How scammers use AI now

For twenty years, the easiest way to spot a scam was the writing. Broken grammar, strange spacing, a greeting that used your email address instead of your name. The mistakes were the tell. We trained a whole generation to look for them.

That tell is gone.

A scammer with a free chatbot now writes in flawless English, in any language, in the exact tone of your bank, your exchange, or your boss. The cost of producing a convincing lie fell to almost nothing. That single change is what makes this moment different, and it is worth understanding clearly, because the panic around it is mostly aimed at the wrong things.

What actually changed

Three things got cheaper, all at once.

1. Writing got cheaper. A persuasive, personalized message used to take a skilled human a few minutes. Now it takes a few seconds, and the quality is higher. One scammer can run thousands of conversations at the same time.
2. Voices and faces got cheaper. A short clip of someone speaking is enough to clone their voice well enough to fool a family member on a stressful phone call. We cover this in depth in the deepfakes lesson.
3. Targeting got cheaper. AI tools can scrape your public posts and assemble a profile: where you work, who your relatives are, what you care about, what you recently bought. The scam that mentions your actual dog by name lands very differently from the generic one.

Notice what is on that list and what is not. The delivery got better. The underlying trick did not change at all.

The trick underneath is always the same

Strip away the polish and almost every scam is one of these:

• Urgency. Something must happen right now, or you lose access, money, or safety. Urgency exists to stop you from thinking. A real institution can wait twenty minutes for you to call them back on a number you looked up yourself.
• Authority. The message claims to be someone you defer to: support, a regulator, your employer, the platform itself. AI is very good at sounding like authority. Authority is a costume, not a fact.
• A leak in your control. At some point you are asked to do the one thing that actually transfers value: reveal a seed phrase, approve a transaction, send a payment, install something, or log in through a link they provided.

If you learn to feel for those three shapes, the quality of the writing stops mattering. A perfect email asking you to confirm your seed phrase is exactly as fake as a typo-ridden one. No real support team has ever needed your seed phrase, and AI does not change that.

A few concrete examples

The pig-butchering chat. A friendly stranger messages you, builds rapport over days or weeks, then introduces a "great" investment platform. AI lets one operator run hundreds of these warm, patient conversations at once. The investment site shows fake gains to encourage bigger deposits. The tell is not the chat, which is pleasant and human. The tell is the destination: an unsolicited relationship that steers, eventually, toward you depositing funds somewhere you did not seek out.

The cloned-executive request. You get a message, or even a voice note, from someone senior asking you to move money or buy gift cards quickly and quietly. The voice may genuinely sound like them. The defense is procedural, not perceptual: payments get verified through a second channel you initiate, every time, no exceptions for urgency.

The fake support agent. You post publicly that you are having a wallet problem. Within minutes, "support" replies. It is not support. It is someone watching the keyword, armed with an AI that writes calm, competent help-desk English. We give this its own lesson because it is now the single most common way self-custody users get drained.

What still protects you

The good news is that the defenses did not change either, because they were never about catching bad writing.

• Slow down on anything urgent. Urgency is the scammer's only real weapon against a careful person. Removing it removes most of their power.
• Verify on a channel you choose. Hang up and call the number on the back of your card. Open the app yourself instead of tapping the link. Message your boss on the tool you normally use. You initiating the second contact is what breaks the trick.
• Never reveal or type your seed phrase anywhere, for anyone, for any reason. This is absolute. There is no legitimate exception, and AI has not invented one.
• Treat unsolicited contact as unverified by default. Whoever reached out first has to earn trust, not the other way around.

None of these require you to detect that something was AI-generated. That is the point. Trying to "spot the AI" is a losing game, because the tools improve every month. Refusing to act on urgency, and verifying through your own channels, works no matter how good the fake gets.

Try it

Reading about the defense is one thing. Reaching for it under pressure is another. Run the drill below: six situations from the AI era, and for each one you pick the action you would actually take. We grade it and explain the move behind every right answer.