Suppose a school director calls the office with an urgent request: a supplier needs to be paid today, and the bank details have changed. The voice sounds right. The caller knows the program name. There is even a short video message confirming the request.
Would that be enough to authorize the payment?
This is a hypothetical example, but the underlying risk is real. AI can generate convincing voices, faces, and video. Recognizing the person on a screen no longer settles whether the request came from them.
A deepfake is AI-generated or AI-altered audio, imagery, or video that can make a person appear to say or do something they did not. A deepfake scam uses that apparent authenticity to obtain money, information, access, or another action.
For training schools, businesses, and families, the most useful response is a verification habit that works even when the fake looks convincing.
What deepfake scams actually ask you to do
The technology gets attention, but the requested action is what puts you at risk.
Someone impersonating a school employee might request a student list. A fake supplier might provide replacement payment instructions. A caller sounding like a relative might demand money for an emergency. A fabricated endorsement might direct viewers to a fraudulent enrollment or investment page.
The FBI’s public warning about generative AI fraud describes criminals using synthetic voices, images, and video to strengthen impersonation schemes. It also warns that AI can improve fraudulent writing, reducing the spelling mistakes people once relied on as warning signs.
For a school, that means a message can be well written, personally relevant, and still unauthorized. A professional-looking request deserves the same verification as an awkward one.
Can you spot a deepfake just by looking or listening?
Sometimes there are clues: unusual movements, inconsistent lighting, audio that does not match the speaker’s mouth, or speech that sounds out of character. Those clues justify a closer look. Their absence does not establish authenticity.
Research helps explain why confidence can be misleading. In a 2022 study published in PNAS, researchers Sophie J. Nightingale and Hany Farid found that participants had difficulty distinguishing the study’s AI-generated faces from real ones. Synthetic faces also received higher trustworthiness ratings on average.
That study examined still images under specific experimental conditions. It does not give a detection rate for today’s phone calls or video meetings. Its practical lesson is narrower and useful: an appearance that feels trustworthy can be manufactured.
Avoid turning a single visual trick into your security process. Asking someone to blink, turn sideways, or move a hand is not a dependable substitute for verifying the request independently. Poor connections can also make genuine calls look strange.
Separate the identity question from the action question
There are two things to establish:
- Is this really the person or organization they claim to be?
- Is this particular request authorized and appropriate?
Even a real employee’s account can be compromised. A genuine-looking message from a known address still needs extra attention if it changes payment details, requests private records, or asks you to bypass normal approval.
For example, your school could require any supplier bank change to be confirmed using contact information already held in its records. The person processing the change should not rely on the telephone number supplied in the change request itself.
That is an operational choice your team can implement without deciding whether a recording contains AI.
A verification routine for an unexpected request
When a request involves money, account access, or sensitive information, use a short routine your staff can remember.
Pause the action. You can respond calmly: “I need to confirm this through our usual process before I make the change.” A request for urgency does not need to become an immediate payment or disclosure.
Use a contact method you already trust. End the call and contact the person through an established number or an independently located official channel. Do not simply redial the number supplied by the caller.
Confirm the substance. Ask whether they requested the specific action, including the recipient, amount, record, or account change involved. A general “Did you call?” can leave important details unresolved.
Apply your normal approval rules. If a change requires a second reviewer, keep that step. A convincing voice should not replace a documented approval.
The Federal Trade Commission’s guidance on voice-cloning scams recommends calling a supposed family member through a number you know is theirs. If you cannot reach them, contact another relative or friend who can help verify the situation.
For families, a privately agreed word or phrase can provide an additional check, as the FBI suggests. Keep it out of public posts and combine it with independent contact. No single shared phrase should become permission to ignore every other warning sign.
Check a video before you pass it on
Not every deepfake asks you to transfer money. Some aim to damage a reputation or make a false claim spread.
Before sharing a disturbing clip of an instructor, public figure, or business owner, ask where the recording originated. Look for the original upload and any fuller version. Check whether the person or organization has addressed it through an established channel. Look for corroboration from reliable reporting that has independently investigated the material.
A cropped clip, a screenshot of a post, and several accounts repeating the same video are not three independent sources.
If your school is the subject of a questionable recording, designate one person to coordinate verification and communication. Staff should know where to route questions rather than improvising explanations in public comments. Preserve relevant links and timestamps; avoid spreading a harmful clip further while trying to debunk it.
You can say, “We are checking the source and will update this page when we have verified information.” That is more responsible than announcing a technical conclusion you cannot yet support.
What to do if you already responded
Act on what was exposed. If you sent money, contact the bank or payment provider promptly and ask what recovery or fraud-response options are available. Recovery is not guaranteed. If you shared credentials, use the service’s official recovery process and alert your organization’s account administrator. If student or customer information was disclosed, notify the person responsible for your organization’s incident response.
Keep relevant messages, transaction details, account names, and timestamps for the report. In the United States, use ReportFraud.ftc.gov for scams and the FBI’s Internet Crime Complaint Center for internet-enabled crime. For an immediate threat to someone’s physical safety, contact emergency services.
Treat reporting as a request for help. Blaming the person who received a convincing scam makes it harder for others to report the next one quickly.
Practice the decision, not just the warning signs
At your next staff meeting, give the team this fictional request:
“I’m in a meeting and cannot talk. Please send the current student contact list to this new email address before noon.”
Ask three questions: Who is allowed to approve that disclosure? Which trusted contact method will you use to confirm it? Where will you record the decision?
Then run the same exercise with a changed bank account or an urgent password-reset request. You are testing whether the team can protect the information while still helping a legitimate person.
For the learning communities served by Steams Online, digital literacy includes knowing when to slow down. A familiar voice may get your attention. A verified request is what should determine your next action.
Sources and further reading
- Federal Trade Commission: Scammers use AI to enhance their family emergency schemes.
- FBI: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud.
- Sophie J. Nightingale and Hany Farid: AI-synthesized faces are indistinguishable from real faces and more trustworthy, PNAS, 2022.
- FTC: Fighting back against harmful voice cloning.
