Social engineering
Deepfake and voice-cloning scams explained
How deepfake scams use AI-made video and cloned voices to impersonate relatives, managers and public figures, and the checks Scamwatch and ASD describe.
How to protect against deepfake scams: what official guidance lists
A fake voice or video can be convincing, so official guidance focuses on checking the request through a channel you trust.
- Call the person back on their real numberScamwatch says to "always take the time to call your friend or family member back on their real number to check".How to check a request
- Don't reply to a new number claiming to be someone you knowThis is in Scamwatch's guidance on how scammers use technology and AI.What Scamwatch describes
- Contact organisations using the number on their own website or appScamwatch describes using the official number, not one given during the contact, and typing web addresses directly into the browser.How to tell if it's a scam
- Check ASIC's registers before acting on an investment videoMoneysmart lists celebrity endorsements as a reason to stop and check, and explains how to search ASIC's Professional Registers and Investor Alert List.Investment scams explained
- At work, verify payment requests through a set processASD's BEC guide describes a process to "verify and validate requests for payment and sensitive information".Workplace checks
- If you've sent money, contact your bank right awayScamwatch lists contacting your bank or card provider and asking them to stop transactions, then contacting IDCARE and reporting the scam.What to do if you've paid
Based on Scamwatch's guidance on technology and AI and on what to do if you've been scammed, Moneysmart, ID Support NSW and ASD's BEC guide, checked October 2026.
Key points
- Scamwatch explains that scammers use AI to create fake videos and audio that look and sound real, and that "a few seconds of a voice recording" can be used to create a voice clone.
- Scamwatch and ID Support NSW describe deepfakes being used in fake investment endorsements and in calls pretending to be someone the person knows who is in trouble.
- Visual and audio glitches aren't a reliable test. That's why official guidance focuses on checking the request through another channel.
A deepfake is video, audio or an image created or altered with artificial intelligence to imitate a real person. Scamwatch explains that scammers “use AI to create fake videos and audio recordings that look and sound real”. This guide explains how deepfake scams and AI voice cloning work, the signs official sources describe, and what they say about checking a request.
How deepfake scams work
Official sources describe several patterns:
- Fake endorsements. Scamwatch says fakes may show celebrities, politicians or relatives endorsing investments or asking for money. ID Support NSW describes AI-generated “convincing videos or audio clips” of well-known media or finance figures promoting fake investments. See investment scams.
- Voice cloning. Scamwatch says scammers “can use a few seconds of a voice recording to create AI clones”, then may phone pretending to be a friend or relative in trouble, which makes an emergency story seem genuine.
- Personalised messages at scale. Scamwatch explains that AI helps scammers create thousands of personalised messages using details found online, and that personalisation alone doesn’t show a message is legitimate.
In workplaces, impersonating a manager or supplier to request an urgent payment is a known pattern. ASD’s business email compromise guide lists “unexpected payment requests from someone in a position of authority” as a warning sign. See business email compromise and impersonation scams.
A fictional example
Alex gets a call from an unknown number. The voice sounds like his brother: “I’ve lost my phone and wallet, can you transfer money to this account?” This matches the pattern Scamwatch describes: a cloned voice, a claimed emergency and a new number. For a wider set of checks, see how to tell if a message or call is a scam.
Can a deepfake be spotted?
Sometimes. ID Support NSW lists signs such as strange facial expressions or movements, and audio and mouth movements that are out of sync. It also lists urgency (“one time offer”, “invest now”) and claims of “low risk and high reward” as warning signs in investment videos.
These signs aren’t reliable on their own, which is why official guidance focuses on checking the request through another channel.
How to check a call, message or video
Scamwatch’s page on technology and AI includes:
- “Always take the time to call your friend or family member back on their real number to check.”
- “Don’t reply to a message from a new number claiming it’s your friend or family member.”
- Contacting organisations using the official phone number on their website or app, not one given during the contact, and typing web addresses directly into the browser.
- “Check the ASIC website to confirm if the person offering the investment is licenced”, and searching online for scam warnings about an investment.
ID Support NSW also describes checking ASIC’s investor alert list and professional register before investing. Moneysmart’s “check before you invest” guide lists relying on “testimonials, celebrity endorsements, social media posts or online reviews” as a reason to stop and check, and explains how to search ASIC’s Professional Registers and Investor Alert List.
How workplaces check payment requests
- ASD’s BEC guide describes establishing a process to “verify and validate requests for payment and sensitive information”, and giving workers guidance to verify account details before acting on unusual requests.
- Its warning signs include “an urgent payment request or threats of serious consequences if payment isn’t made” and “pressure for secrecy or requests to circumvent protective business processes”.
See payment redirection controls for checking invoices.
If you’ve already sent money
Scamwatch’s guidance on what to do if you’ve been scammed lists contacting your bank or card provider right away and asking them to stop transactions, contacting IDCARE (1800 595 160) for a free plan to limit the damage, and reporting the scam to Scamwatch. Scamwatch lists Lifeline (13 11 14) and Beyond Blue (1300 22 4636) for support. First steps after a scam sets out what to do by situation.
Where to report
- Scamwatch: report the scam at scamwatch.gov.au.
- The platform: ID Support NSW says to “always report scam posts or comments to the social media platform”.
- IDCARE: 1800 595 160, for a free plan to limit the damage.
Where to report scams and cybercrime in Australia lists each service.
Common questions
How can I tell if a video or call is a deepfake?
There’s no reliable way to tell from the video or voice alone. ID Support NSW lists signs such as strange facial expressions or movements, and audio that’s out of sync with mouth movements, but these signs aren’t reliable on their own. That’s why Scamwatch and ID Support NSW focus on checking the request through another channel. See can a deepfake be spotted?
Can scammers clone my voice from a short recording?
Yes. Scamwatch says: “Scammers can use a few seconds of a voice recording to create AI clones.” It says they may then phone pretending to be a friend or relative in trouble, which makes an emergency story seem genuine. A claimed emergency from a new number matches the pattern Scamwatch describes. See how deepfake scams work.
What do I do if a call sounds like a family member asking for money?
Scamwatch’s guidance is: “Always take the time to call your friend or family member back on their real number to check.” It also says not to reply to a message from a new number claiming to be your friend or family member. Calling back on a number you already have is a check that doesn’t depend on how real the voice sounds. See how to check a call, message or video.
Can a celebrity investment video be a deepfake?
Yes. Scamwatch says fakes may show celebrities or politicians endorsing investments, and ID Support NSW describes AI-generated videos of well-known figures promoting fake investments. Moneysmart lists relying on celebrity endorsements as a reason to stop and check, and explains how to search ASIC’s Professional Registers and Investor Alert List. See investment scams.
How do businesses check a payment request from a manager?
ASD’s BEC guide describes establishing a process to “verify and validate requests for payment and sensitive information”, and giving workers guidance to verify account details before acting on unusual requests. Its warning signs include unexpected payment requests from someone in a position of authority and pressure for secrecy. See how workplaces check payment requests.
What do I do if I’ve sent money to a deepfake scammer?
Scamwatch lists contacting your bank or card provider right away and asking them to stop transactions. Its other steps are contacting IDCARE (1800 595 160) for a free plan to limit the damage, and reporting the scam to Scamwatch. Scamwatch also lists Lifeline (13 11 14) and Beyond Blue (1300 22 4636) for support. See if you’ve already sent money.