AI phishing and scams: how criminals use AI and how to check

AI scams use artificial intelligence to make old tricks look new. Scamwatch says scammers use technology and AI to make scams “more convincing, personalised and difficult to detect”. This guide explains how AI is used in phishing and scams (better-written messages, copied websites, chatbots, fake profiles and voice or video fakes), what Scamwatch and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) say about them, and the checks those agencies describe.

The underlying scams haven’t changed much. They still want money, passwords, codes or personal details. What AI changes is how polished and personal the approach can look.

How AI is used in phishing and scams

Scamwatch’s page on technology and AI describes several patterns.

Better-written, personalised messages

Phishing used to be easier to spot because of clumsy wording and generic greetings. Scamwatch explains that AI lets scammers create “thousands of personalised emails, texts, and social media messages” using personal details found online. A message might use your name, mention your suburb or employer, or refer to something you posted.

Scamwatch’s point is simple: “A personalised message doesn’t make it legitimate.” Correct spelling, a friendly tone and accurate personal details aren’t proof that a message is genuine. For the wider family of message, text and call scams, see phishing, smishing and vishing explained.

Copies of real websites

Scamwatch describes “mirror websites”: “perfect copies of real websites, with working contact forms and customer service features”, often using the real brand’s logo. It says these can go live “within hours of a real company launching a new service”. A link in an AI-written message may lead to one of these pages, where any login or card details typed in go to the scammer.

Fake documents

According to Scamwatch, “professional-looking certificates, licences, and official documents can be created in minutes”. It gives investment scammers faking regulatory paperwork, and romance scammers faking passports and work permits, as examples. A document that looks official isn’t proof on its own.

Chatbots that keep a conversation going

Scamwatch says “AI chatbots can have conversations with multiple people at the same time”. It explains that they can remember personal details and keep a fake persona going for months. Scamwatch also says scammers use AI to adapt their approach based on your responses: if you question the story, they may change tactics or produce “evidence” to answer your concerns.

This matters for long-running scams such as romance scams and fake investment “advisers”, where trust is built over weeks.

Fake profiles and fake trading platforms

Scamwatch describes AI being used to generate photos and videos for fake social media and dating profiles, including the ability to “create photo albums of someone who doesn’t exist”. It also describes fake investment apps that “look and function like real trading apps”, showing false market data and growing “profits”. See investment scams for how these usually unfold.

Voice clones and deepfake videos

Scamwatch says “scammers can use a few seconds of a voice recording to create AI clones”, and may then call pretending to be a friend or relative in trouble. It also describes fake videos and audio that appear to show celebrities, politicians or family members endorsing investments or asking for money. Our guide to deepfake and voice-cloning scams covers these in more detail.

A fictional example

Priya runs a small bookkeeping business. She gets an email that appears to come from her accounting software provider, addressed to her by name and mentioning a feature launched that week. It’s well written, with no typos. It says her subscription payment failed and links to “billing.accounts-portal.example”.

The page looks exactly like the real login screen, with a working help chat. When Priya asks the chat why the payment failed, it replies instantly with a plausible explanation and urges her to update her card within the hour.

Every element matches what Scamwatch describes: a personalised message, a mirror website, a chatbot that answers questions and a sense of urgency. The check Scamwatch describes is to leave the message and type the provider’s real web address directly into the browser, or use its official app, to see whether there’s really a billing problem.

Warning signs that still apply

The request, rather than the writing, is usually the giveaway. Official guidance focuses on checking the request through a channel you already trust, rather than judging how the message looks. Based on Scamwatch and ASD’s ACSC guidance, common signs include:

• Unexpected contact. Scamwatch says to “be suspicious of anyone who unexpectedly contacts you on social media”, and the same caution applies to email, text and calls.
• A link or attachment that leads to a login, payment or “verification” page.
• A request for passwords, card details, or multi-factor authentication or verification codes. ASD’s ACSC says: “Never share your log-in details, multi-factor authentication or verification codes with anyone.”
• A call or message from a “new number” claiming to be someone you know.
• Pressure to act quickly, keep it secret, or move money.
• Investment returns that seem too good, backed by videos of well-known people or official-looking documents.
• Someone you’ve only met online asking for money. Scamwatch’s social media scams page says: “Never send money to a person you have only met online”.

For a general set of checks, see how to tell if a message or call is a scam, or practise with the phishing awareness quiz.

How to check: what Scamwatch and ASD’s ACSC describe

These steps are drawn from Scamwatch’s AI page and ASD’s ACSC scams page (checked October 2026). The agencies’ pages have the latest wording.

1. Stop before you click or reply. Don’t use the links, phone numbers or contact details in the message. ASD’s ACSC says “do not use the links or contact details given to you in the message”.
2. Go to the organisation yourself. Scamwatch says to “always type web addresses directly into your browser”, or use the organisation’s official app.
3. Call back on a number you find yourself. Scamwatch describes calling back on a number from the organisation’s official website or app. For large payments, ASD’s ACSC describes confirming bank details by phone using a number you already know.
4. Check a “friend” or relative separately. Scamwatch’s guidance is to call them back on their real number, and not to reply to a new number claiming to be them.
5. Check investments independently. Scamwatch describes searching online for scam warnings and checking the ASIC website to see whether the person is licensed.
6. Keep accounts protected. ASD’s ACSC describes using multi-factor authentication and strong, unique passphrases, and its MFA guide lists email, banking, shopping and social media accounts as important places to start.

If you’ve been scammed

Scamwatch’s AI page lists these steps:

1. Contact your bank or card provider immediately, ask them to stop transactions, and change passwords on banking, email, government and shopping accounts.
2. Contact IDCARE (free) on 1800 595 160 for help making a recovery plan.
3. Report the scam to Scamwatch at scamwatch.gov.au/report-a-scam.

If an account has been taken over or a device compromised, ASD’s ACSC runs ReportCyber and a 24/7 hotline on 1300 CYBER1 (1300 292 371). See first steps after a scam for a fuller walk-through.

Things to watch for

• Polish isn’t proof. A well-written, personalised message can still be a scam.
• Chat windows can be fake too. A “support” chat on a copied website is part of the copy.
• “Evidence” can be generated. Scamwatch describes scammers producing documents, screenshots or photos on demand when questioned.
• Using AI tools yourself. Pasting a suspicious message into an AI chatbot isn’t an official check. Our guide to using AI chatbots safely explains what to keep in mind when sharing information with them.

Common questions

How can I spot an AI scam?

There’s no reliable visual test, because Scamwatch says AI makes scams “more convincing, personalised and difficult to detect”. The request is usually the giveaway: a link to a login or payment page, a request for passwords or codes, or pressure to move money. Scamwatch and ASD’s ACSC describe checking the request through a channel you already trust. See how to check.

How are scammers using AI in Australia?

Scamwatch describes AI being used to write personalised messages at scale, build copies of real websites, create fake documents and profiles, and run chatbots that hold conversations with many people at once. It also describes deepfake videos and voice clones. The underlying scams still want money, passwords, codes or personal details. See how AI is used in phishing and scams.

Can AI make a scam message look real?

Yes. Scamwatch says AI lets scammers create “thousands of personalised emails, texts, and social media messages” using personal details found online, and that “a personalised message doesn’t make it legitimate”. Correct spelling, a friendly tone and accurate details aren’t proof a message is genuine, which is why official guidance focuses on the request rather than the writing. See warning signs that still apply.

Can a fake website have a working help chat?

Yes. Scamwatch describes “mirror websites”: “perfect copies of real websites, with working contact forms and customer service features”, often using the real brand’s logo. A “support” chat on a copied website is part of the copy. Scamwatch says to “always type web addresses directly into your browser”, or use the organisation’s official app. See copies of real websites.

Can I ask an AI chatbot if a message is a scam?

Pasting a suspicious message into an AI chatbot isn’t an official check. Scamwatch and ASD’s ACSC describe checking the request through a channel you already trust instead, such as the organisation’s official website or app, or a phone number you found yourself. Our guide to using AI chatbots safely explains what to keep in mind when sharing information with chatbots.

What do I do if I’ve been scammed?

Scamwatch’s AI page lists contacting your bank or card provider immediately to ask them to stop transactions, and changing passwords on banking, email, government and shopping accounts. It also lists contacting IDCARE (free) on 1800 595 160 for help making a recovery plan, and reporting the scam to Scamwatch. See if you’ve been scammed for the full steps.

Where to get official help

• Scamwatch for reporting scams and current warnings: scamwatch.gov.au/report-a-scam
• IDCARE for free identity and cyber support: 1800 595 160
• ASD’s ACSC for ReportCyber and the 24/7 hotline: 1300 CYBER1 (1300 292 371)
• Your bank or card provider, using the number on the back of your card or in its official app
• In an emergency, call 000