AI scams: what they look like and how to protect your household

What AI has changed, and what it has not

The scams on this page are familiar ones: a call from ‘your bank’, a grandchild in trouble, a famous face endorsing a scheme that will double your money. What has changed is how convincing each can be made, and how many can be sent.

The Home Office’s Fraud Strategy 2026–2029 (March 2026) names the tools: criminals are adopting generative AI such as deepfakes, large language models and voice cloning to make attacks more sophisticated, credible and numerous. UK Finance, publishing its Annual Fraud Report 2026, said criminals are exploiting advances like AI to “industrialise operations”. Neither gives a figure for how much fraud now involves AI, and no UK authority publishes one.

Few people feel able to tell the difference: in Ofcom research published in July 2024, fewer than one in ten people aged 16 and over (9%) said they were confident they could identify a deepfake. That is 2024 data, and the Advertising Standards Authority expects AI video and images to get harder to tell from the real thing. So the defence cannot rest on spotting the fake. It has to rest on what you do next.

The main types, and where we cover each

Cloned voices. A call that sounds like your child, your parent or your bank’s fraud team. The number on your screen may look right too: fraudsters can spoof numbers, and Stop! Think Fraud warns that caller ID is not proof of who is calling. Our voice cloning guide covers how these calls run and how to check one.

Deepfake adverts. A video of a well-known face recommending an investment, often on social media. Age UK’s rule is the one to keep: if a famous face is selling you an investment online, it is fake. Our deepfake adverts guide explains how to check an advert and where to report it.

The family emergency. ‘Hi Mum, new number’ by text or WhatsApp, or a call in a cloned voice asking for money now. Stop! Think Fraud and Age UK both say to check on a number you already have for the person, and both recommend a family safe word, which costs nothing.

Polished messages. Texts and emails without the clumsy phrasing people were once told to look for; large language models are one of the three tools the Fraud Strategy names. Do not use a link or number a message gives you; go to the organisation by a route you already know.

The honest scale

The national numbers come from UK Finance and the ONS Crime Survey. UK Finance gives no figure for AI, and its report has no ‘family emergency’ or voice-cloning category, so there is no official UK figure for losses to a cloned voice; figures you may see come from individual banks or surveys, not official statistics. What exists is partial: more than £10 million lost in 2024 to deepfakes of influential people advertising fake investment schemes, and a highest single loss to AI-enabled fraud of about £500,000 in the 2025/26 financial year up to November 2025, both police figures cited by Surrey’s Police and Crime Commissioner.

UK Finance’s Annual Fraud Report 2026, published in June, says criminals stole £1.28 billion through payment fraud in 2025, up 4%. Within that, authorised push payment scams, where you are tricked into sending the money yourself, rose 19% to £576.4 million across 248,070 cases, and investment scams, the category deepfake adverts feed, rose 40% to £221.5 million.

The picture is mixed rather than a runaway: unauthorised fraud, where a criminal uses your card or account without you, fell 5% to £703.4 million, and impersonation scams, where criminals pose as a bank, the police or another organisation, fell 12% by value. Two-thirds of authorised scam cases began online, carrying 32% of the losses; the 17% that began through telecoms, such as a phone call, carried 28%, because those scams are typically higher value.

The ONS Crime Survey counted 4.5 million fraud incidents in England and Wales in the year to March 2026, no statistically significant change, and 3.8 million fraud victims, up 10%. Those 4.5 million incidents are about 47% of the survey’s headline crime estimate of 9.6 million, by our own calculation. The ONS left police-recorded fraud out of that July 2026 bulletin during the move from Action Fraud to Report Fraud, so it has no newer totals of fraud reported to the police.

The three habits that work against all of them

Because you cannot reliably spot the fake, these habits work on what the scams on this page need from you: speed, secrecy and a payment. It comes down to three moves.

Stop. Genuine callers will not pressure you to act immediately, and it is always safe to hang up. No bank or police officer will ask you to move money to a ‘safe account’; in Age UK’s words, safe accounts don’t exist. Urgency is the tell, not the voice.

Check on a number you already know. Hang up and ring back on the number on your bank card, or a number you already have for the person; never one the caller gives you. For your bank, dial 159: it connects you directly to your own bank, cannot be spoofed and will never call you. It covers more than 99% of UK retail bank current accounts; the cost depends on your phone provider, often the national rate. 159 is for your bank only; to check a relative, call the relative back.

Use a safe word. Agree a word or phrase with close family and friends, never share it by text or online, and if a caller who claims to be family or a friend cannot give it, hang up. That is Stop! Think Fraud’s advice and Age UK’s. It works against a cloned voice because the criminal behind it does not know the word. Our family safe word guide covers choosing one, agreeing it in person, and getting a reluctant relative to use it.

If it has already happened, and where to report

Contact your bank first, on the number on your card or by dialling 159, and tell them exactly what you sent and where. Then report it. The full first-hour list is in what to do if you have been scammed.

If you were tricked into sending a bank transfer from one UK account to another (Faster Payments or CHAPS) on or after 7 October 2024, the mandatory reimbursement rules, currently run by the Payment Systems Regulator, apply: tell your bank as soon as possible and within 13 months, and eligible losses up to £85,000 are normally reimbursed within five business days. A bank may take an excess of up to £100, never from a vulnerable customer, and can refuse if you were complicit or grossly negligent, which the regulator calls a high bar. International payments are outside the scheme, and card, cash and cheque payments have separate protections.

England, Wales and Northern Ireland. Report to Report Fraud at reportfraud.police.uk or on 0300 123 2040, Monday to Friday, 8am to 8pm. It replaced Action Fraud on 4 December 2025. It is not an emergency service: if a crime is happening now, call 999, or 101 if it is not an emergency. In Northern Ireland, Report Fraud gives you the crime reference number; phone the PSNI on 101 (999 in an emergency) for a ‘call for service’ if the fraud is happening now or happened within 24 hours, you know the suspect and they live in Northern Ireland, the victim is vulnerable, or evidence needs securing or a loss preventing.

Scotland. Report Fraud does not cover Scotland. All fraud and other financial crime in Scotland is reported to Police Scotland on 101, through its online form or in person, and on 999 in an emergency.

Wherever you are: forward scam texts free to 7726, and send a scam caller’s number in a text to 7726 too; forward phishing emails to report@phishing.gov.uk; and report fake online adverts to the Advertising Standards Authority. Stop! Think Fraud lists all three routes.

What the law is doing

Two strands of work are under way, and neither is finished. Under the Online Safety Act 2023, Ofcom published draft Fraudulent Advertising Codes of Practice on 10 July 2026: nearly 40 measures for the largest platforms and search services, covering paid-for adverts only, not ordinary posts. Our deepfake adverts guide sets out what the draft would require of platforms. The consultation closes on 2 October 2026; final decisions come in 2027, and the codes take effect only once Parliament approves them. The Act’s separate illegal-content duties, which cover fraud offences, are already in force.

The March 2026 Fraud Strategy also commits the Home Office, with DSIT and the Alan Turing Institute, to a framework for detecting deepfake media including synthetic audio, and committed £31 million to an Online Crime Centre, which the strategy said was set to begin operations in April 2026. This page will record each as it lands.

Helping an older relative

Scams that start through telecoms, such as a phone call, tend to be higher value, as the figures above show. If you look after a parent or an older neighbour, three practical steps help.

First, agree the safe word with them in person and use it once for practice, so it is not awkward when it matters. Second, put the numbers by the phone: 159 for the bank, 101 for the police, and the rule beside them, ‘hang up and ring back’, which is Age UK’s advice for any call claiming to be either.

Third, make it normal to check with you before any payment, however small the first one is; Ofcom suggests encouraging a relative to check with you or another trusted person before sending money. The reimbursement rules treat vulnerable customers more generously, with no excess and no refusal for gross negligence, but the better outcome is the payment that never leaves.

If you keep a household file, write these steps and who knows the safe word into it, but keep the word itself out. The Family File is gaining a page for exactly this, ‘Scams and our safe word’.