When you can't trust your eyes or ears: how to protect yourself from fraud in the age of AI
Not long ago we relied on simple signals. Mum's voice on the phone meant Mum was calling. A video with the CEO meant it was the CEO. A book with an author's name on the cover meant that author wrote it. A thesis with a student's signature meant the student wrote it.
Generative AI has broken these habits. A voice can be cloned from a short recording, a face can be "worn" by someone else on a video call, a book or a dissertation can be generated in an evening, and a photo "from the scene" can be drawn from scratch. Fraud has become cheaper, faster and more convincing.
This article covers the whole range: from school and university work that students did not do themselves, through fake books, dissertations and artworks, to cyber fraud with fake voices, videos and call forwarding. For each situation you will find warning signs, simple rules and tools that help you check. The main idea is simple: when you can't trust your eyes and ears, trust a verification routine.
Part 1. School and university: when the work isn't the student's
The most everyday kind of "fake" is work handed in under one's own name but done by someone else: an older sibling, a paid "writer", and increasingly a chatbot. The teacher receives a neat text, but the student hasn't gained the skills the assignment was meant to build.
Why "just run it through a detector" is a bad idea
AI text detectors estimate probability; they do not establish facts. They are more often wrong on short texts, on texts by people writing in a second language and on very formulaic genres such as instructions or school essays. Accusing a student based on a percentage alone is unfair and risky.
It is more useful to design learning so that faking is hard and pointless:
- Assess the process, not only the result. Drafts, an outline, notes, document version history, a short oral explanation of "how you got there".
- Set tasks tied to experience. What was discussed in class, personal observation, local context: these are harder to hand off to a bot.
- Do part of the work in class. By hand or on a computer without internet access.
- Agree on rules. Where AI may be used (brainstorming, grammar checks), where it may not, and how to disclose its use.
- Talk instead of accusing. If a detector shows a high score, ask the student to explain the text, retell the arguments in their own words and show drafts.
Tools for teachers and lecturers
If you do need checks, use several signals at once:
- Plagiarism and AI text in institutions. Turnitin is the standard at many universities worldwide; StrikePlagiarism.com works with many European institutions, checks texts in 30+ languages and integrates with Moodle; Compilatio and PlagiarismCheck.org are two more options for schools and universities.
- AI text detectors. GPTZero, Copyleaks, Originality.ai, Pangram, Winston AI and ZeroGPT estimate the likelihood that a text was generated. Compare several services and never draw conclusions from one.
- For students and writers. Quetext has a free plan for checking your own text for accidental matches and correct citations before submission.
What parents can do: ask about what the child understood rather than the grade; ask them to tell you what the essay is about; explain that AI is a learning assistant, not a substitute for learning. A child who uses AI honestly will always be ahead of one who can only copy with it.
Part 2. Fake books, dissertations and research papers
Generated books
Large online marketplaces now carry books written entirely or almost entirely by AI: travel guides, cookbooks, "biographies", mushroom-foraging guides, knock-offs of popular releases with similar titles and covers. Sometimes they carry the name of a real author who was never asked.
How to avoid buying a fake:
- Check the author. Do they have a website, interviews, other books, a page at a publisher? Have dozens of books appeared under this name within a few months?
- Use "look inside". Generic phrases without specifics, repetition and odd advice are warning signs.
- Read reviews with details, not identical five-star ones.
- Buy from the publisher's site or trusted bookshops, especially reference books about health, money and safety.
Publishers and editors can use the same AI text detectors, such as Originality.ai, Pangram and GPTZero, but again as a signal for manual review rather than an automatic decision.
Dissertations and research papers
In science, fakes are even more dangerous: other researchers cite fabricated results and decisions are made on them. Besides classic plagiarism, today you find:
- Paper mills: companies selling ready-made papers and authorship slots.
- Tortured phrases. Paraphrasing tools replace established terms with odd synonyms to slip past plagiarism checks, so "artificial intelligence" becomes "counterfeit consciousness" and "deep learning" becomes "profound learning".
- Image manipulation. The same figure, rotated or flipped, shown for different experiments; spliced fragments; AI-generated "microscopy" images.
Tools used by editors, universities and researchers themselves:
- iThenticate by Turnitin checks manuscripts and dissertations for similarity before publication; researchers can buy credits for a single manuscript.
- StrikePlagiarism.com cross-checks submissions against each other and against scientific databases.
- Proofig AI and Imagetwin find duplicated, edited and AI-generated images in a paper's figures and matches with millions of published figures.
- Problematic Paper Screener is a free research tool that flags published papers with tortured phrases, generator output and citations of retracted work.
Tip for PhD students and researchers: keep raw data, lab notebooks and version history. That is your best defence if your work is ever questioned.
Artworks, illustrations and music
Faking in art has two sides. One is passing off generated work as your own handmade work (in competitions, commissions, marketplaces). The other is generating work "in the style of" a specific artist without consent and selling it as "almost theirs".
There are detectors for images: Hive Moderation, AI or Not, Illuminarty, Sightengine. They give a probability, not a verdict, and are more often wrong on edited or compressed images.
It is more reliable to look at where a file came from. The Content Credentials (C2PA) standard, backed by Adobe, Microsoft, Google, OpenAI, Meta and hundreds of other companies, lets a camera, editor or generator attach a signed record: who created or changed the image, when and with what. Google embeds an invisible SynthID watermark into content from its models and lets you check a file through Gemini. The limitation of both: if there is no label, that does not prove the image is genuine.
Artists who don't want their work copied can use free tools from the University of Chicago: Glaze makes it harder for models to copy a style, and Nightshade makes images "poisonous" for unauthorised training. They don't guarantee full protection, but they raise the cost of theft.
Part 3. Cyber fraud: voice, video, calls
A relative's cloned voice
The scheme is old, the tools are new. A scammer used to call and say "Mum, I've had a car accident, I need money", hoping that in a panic you wouldn't notice a stranger's voice. Today a short recording, for example a video from social media, is enough to clone a voice. The US Federal Trade Commission warns plainly: don't trust the voice, even if it sounds exactly like someone you love.
Warning signs:
- Urgency and emotion. "No time to explain", "don't tell anyone", crying, shouting, a "police officer" or "doctor" on the line.
- Unusual payment methods. Transfer to someone else's card, cryptocurrency, gift cards, "a courier who's on the way".
- An unfamiliar number or "my phone died, I'm texting from a friend's".
What to do:
- Hang up and call back on a number you know yourself, not the one that called. Caller ID can be spoofed.
- Agree on a family code word or a question only your people know the answer to, and which isn't on social media.
- Contact other relatives if the person doesn't answer.
- Don't rush. A real emergency won't vanish in the five minutes you spend checking.
Tools can help but don't replace these rules. Hiya and Truecaller show who's calling and flag spam and scam numbers; Hiya is also developing real-time AI voice detection. ElevenLabs offers a free classifier that shows the probability a recording was made with ElevenLabs technology (it doesn't recognise other providers' voices). AI Voice Detector analyses uploaded audio. For businesses such as call centres and banks there are specialised systems: Pindrop, Resemble AI (Resemble Detect), Reality Defender.
Deepfake videos and video calls
The best-known case happened in early 2024 in Hong Kong. A finance worker at the engineering firm Arup received an email from the "CFO", had doubts, but then joined a video call where he saw and heard the "CFO" and "colleagues". All of them were deepfakes. After the call he made 15 transfers totalling about 25 million US dollars. Arup confirmed that fake voices and images were used in the fraud.
How to protect yourself:
- Confirm payments and changes of bank details through another channel. A call to a known number, an in-person meeting, an internal ticketing system. A "two keys" rule for large sums.
- Ask for something unpredictable. Turn your head to profile, pass a hand in front of your face, mention a detail from a past conversation. Deepfakes keep improving, so this is no guarantee, but it's a reason to pause.
- Be wary of celebrity "video messages" promoting investments, "payouts" or giveaways. This is one of the most common schemes.
- Find the original source. Is the video on the person's or organisation's official channel?
For checking videos and photos:
- InVID Verification Plugin: a free browser extension used by journalists for video keyframes, reverse search and metadata.
- Google Lens and TinEye: reverse image search to see whether a photo of a "seller", "soldier" or "bride" was taken from someone else's profile and where it first appeared.
- Forensically and FotoForensics: free technical analysis of photos for signs of editing. FotoForensics is a public service, so don't upload personal photos there.
- McAfee Deepfake Detector: alerts you if a video in your browser contains AI-generated audio (on compatible computers).
- Business solutions for media verification: Reality Defender, Sensity AI, Attestiv, DuckDuckGoose, and for insurers and inspections Truepic, which records the time, place and device of capture.
Call forwarding and "codes from SMS"
Many banks and messengers confirm sign-in with an SMS code or a call. Scammers don't need to steal your phone, only to make those calls and messages reach them.
How it looks in practice:
- "Dial this code to confirm the delivery / request / line check". Posing as a delivery service, a mobile operator or a bank's "security team", they ask you to dial a combination like
**21*number#. In fact this is a standard GSM command for unconditional call forwarding: all your incoming calls go to the scammer's number, including calls with confirmation codes. - "Read me the code from the SMS". No bank, operator or police will ask for SMS codes, a PIN, CVV or password. An SMS code is the key to your account.
- SIM swap. Using forged documents or a bribed employee, an attacker obtains a duplicate of your SIM. Your phone suddenly loses signal for no reason.
What to do:
- Never dial codes dictated over the phone or sent in a message unless you understand what they do.
- Check call forwarding. The standard GSM codes
*#21#(show unconditional forwarding) and##002#(cancel all forwarding) work on most networks; exact instructions are in your operator's app or help pages. - If your phone suddenly loses signal for no visible reason, contact your operator and bank immediately.
- Move important accounts from SMS to an authenticator app or a security key. Google Authenticator and Microsoft Authenticator generate codes on the phone itself, without SMS and even offline, so forwarding can't intercept them. A YubiKey hardware key is stronger still: it checks the site address and won't hand a sign-in to a phishing copy.
- Turn on a two-step verification password in messengers (in Telegram, "Cloud password"; in WhatsApp, the two-step verification PIN). Then an SMS code alone isn't enough to hijack your account.
Phishing messages, sites and "great deals"
AI writes phishing emails without mistakes and in any language, so "an email full of grammar errors is a fake" no longer works. Check the substance, not the language:
- Links. Before opening one, check it in VirusTotal or ScamAdviser (the latter shows how far a website or online shop can be trusted).
- A suspicious message or QR code. Forward it to the free Bitdefender Scamio chatbot on WhatsApp, Messenger or the web app; it will tell you whether it looks like a scam.
- All-round device protection. Norton 360, Bitdefender and Malwarebytes have features against scam sites, messages and calls.
- Data breaches. Have I Been Pwned shows whether your email has appeared in leaked databases. The less is known about you, the harder it is for a scammer to be convincing, so services like Incogni, DeleteMe or Aura help remove your data from data brokers (mainly in the US and EU).
- Unique passwords. A password manager such as Bitwarden, 1Password or Proton Pass stops one breach from opening all your accounts and won't autofill a password on a phishing site with a different address.
Checklist: rules that work even when technology deceives
1. Urgency is a red flag. The harder someone rushes you, the more time you should take to check.
2. Verify through another channel. A call: call back on a known number. An email: phone. A video: message the person in your usual messenger.
3. A family code word and a "two keys" rule at work.
4. No SMS codes, PINs, CVVs or passwords to anyone. Not to the "bank", the "police" or the "operator".
5. Don't dial dictated combinations of stars and hashes. Check forwarding with *#21#.
6. Two-factor protection via an app or key, not SMS.
7. Photos and videos: look for the original source. Reverse search, official channel, metadata.
8. A detector is a hint, not a verdict. Especially when accusing a real person.
9. Less public data means less material for fakes. Limit access to videos with your voice, your date of birth, your children's names.
10. Talk about this with your family, especially older parents and children. The best defence against fraud is someone who knows the scheme in advance.
What to do if you've already been scammed
- Call your bank immediately on the number on the back of your card or in the official app, and block the card and suspicious transfers. The first minutes and hours matter.
- Change passwords for email, banking and messengers, end all unknown sessions and turn on two-factor authentication.
- Contact your mobile operator if you suspect forwarding or a SIM swap.
- Keep evidence: screenshots, numbers, links, call recordings, receipts.
- Report it to the police. In Ukraine, call 102 or use the cyber police website; elsewhere, use your national police or fraud reporting service.
- Warn friends and family if scammers got into your messenger account: they may ask for money in your name.
FAQ
Can you tell for sure that AI wrote a text?
No. Detectors give a probability estimate and make mistakes both ways. It's more reliable to look at the process: drafts, version history, the author's ability to explain their text.
How much audio is needed to clone a voice?
Modern services need only a short clip, and such clips are often taken from social media videos. So don't trust a voice alone, and agree on a code word.
Does asking someone to turn their head during a video call help?
It may expose a simpler deepfake, but it's no guarantee. The most reliable step is to confirm the request through another channel.
What does the **21*number# code I'm asked to dial do?
It turns on unconditional forwarding of all calls to that number. Don't dial it at someone else's request. You can check forwarding with *#21# and cancel all forwarding with ##002#.
Is it safe to upload photos to online checkers?
Not always. Some services are public or share files with partners (FotoForensics, VirusTotal). Don't upload personal photos or documents.
If an image has no AI watermark, is it genuine?
No. Content Credentials and SynthID label only part of the content, and metadata can be stripped. A missing label is not proof.
How can I protect my drawings from style copying?
Glaze and Nightshade make it harder for models to train on your work. Posting images at lower resolution and with a watermark also helps.
Summary
AI didn't invent fraud; it made it cheap and convincing. So protection today depends less on sharp eyes and ears and more on habits: call back on a known number, don't rush, never read out codes, confirm money requests through another channel, find the original source of photos and videos, and judge learning by the process rather than only the result. The tools in this article help, but the strongest protection is agreements between people who trust each other.
Facts checked: 27 October 2026. This article is for information only and is not legal advice. Service terms may change, so check them on the official websites.
Call Assistant