��������

The rapid increase in the abilities of AI models has led to the creation of deepfakes. Deepfakes are video or audio messages generated by artificial intelligence, which can be used to impersonate an individual by mimicking their voice and/or appearance. Advanced AI models can generate deepfakes by using videos, audio clips, and images of their targets.  
 
For those who have a public social media presence, it is very easy for a scammer to obtain sample videos, audio, and images, which could be used to generate a deepfake. It is typically much simpler to generate a deepfake that only uses audio, as videos require advanced AI models and need more resources to produce a convincing result. 
 

From the scammer's perspective, the most important component of any social engineering attack is to make themselves seem convincing. While an email or text message may be quickly identified as fraudulent, identifying a copy of a friend, family member, or colleague's voice or face can be much more difficult. This is what makes deepfakes such a useful tool for scammers. 
 

While these deepfakes can be very convincing, there are still techniques that you can use to see through the scammer's ruse. If you receive a suspicious message, you can look for… 

• Messages claiming to originate from a trusted source that were not expected

• Pressure to act quickly or with urgency

• Requests for money via methods that make reimbursement difficult (such as cryptocurrency or gift cards)

• Requests to keep the conversation secret

Some security organizations, such as the , recommend creating a safe word between you, your family, and your friends. If you find yourself contacted by someone claiming to be a friend or family member, but you notice any of the red flags discussed above, ask them for the safe word. If they do not know it or respond incorrectly, do not interact with them further.  

If you receive an email you suspect to be a deepfake and you do not recognize the sender’s email address, report the message to us at phish@kent.edu. To report deepfakes such as voice-cloning phone calls, file a report with the Federal Trade Commission at . Reports can also be made to the Internet Crime Complain Center at . 

Many AI models have fewer safety features than models like Google’s Gemini and OpenAI’s ChatGPT, and may offer free services. Scammers use models with fewer guardrails to produce malicious code, emails, files, and reports about potential targets. 

With AI, crafting emails has become easy for scammers. Grammar errors that made it easy to spot phishing emails are less common. All a scammer needs to do now is select a prompt and tell AI how many emails to send. The results are astounding; AI knows how to make emails appear “human” and relatable. 

Scammers can use spear phishing tactics in AI-generated emails. Once prompted, AI will scour the internet and use the information it found to craft a personalized email. Often, this AI-generated email looks like one that you would receive from someone you know. 

AI can even be used to create material such as images, videos, audio, and websites. This means that scammers can use AI to generate a phish that asks you to call a phone number, which uses an AI-generated voice to tell you to visit an AI-generated website to enter sensitive information. 

While AI-generated phishing may seem difficult to detect, there are still ways to spot it. A great place to learn some of these techniques is our page discussing phishing red flags. Some of the most important red flags to look for are a sense of urgency, an unexpected request, or an unfamiliar sender.