AI scams that steal money in 2026: the catalog, with what to do

AI scams that steal money in 2026 are mostly old cons with better props: a cloned voice, a deepfake video call, a polished investment pitch or a fake job offer, all built to make you pay fast. The single check that defeats most of them is to stop, hang up and contact the person or institution yourself on a number you already trust, before any money moves.

How we checked this

This catalog draws on the FBI Internet Crime Complaint Center’s 2025 annual report and its September 2026 alert on impersonation scams, two FTC consumer guides, a finance professor’s summary of the AI figures in The Conversation, Mastercard’s 2026 trends post, and official UK, EU and Spanish pages: Report Fraud, the National Cyber Security Centre, the FCA, UK Finance’s Take Five, Stop Scams UK’s 159 service, Barclays, the European supervisory authorities’ December 2025 factsheet on AI-powered fraud, Europol, the Policía Nacional, INCIBE and the Banco de España. Every figure is linked where it appears, and facts were checked on September 24, 2026. The numbers here are US numbers. This is a catalog of patterns and defenses, not legal or financial advice, and it does not promise that any money can be recovered.

Which AI scams are actually common right now

The best public data on this comes from the FBI. In its 2025 annual report, the Internet Crime Complaint Center (IC3) counted complaints with an AI connection as a separate category for the first time. According to The Conversation’s summary of that report, Americans filed more than 22,000 such complaints and reported roughly $893 million in losses. Investment fraud made up $632 million of that, and people over 60 lost $352 million.

The IC3 report itself breaks down which crime types mention AI most often. Investment complaints lead by a wide margin (4,356), followed by extortion (1,764), personal data breach (1,204), phishing and spoofing (803), employment scams (691), romance and confidence scams (626), non-payment or non-delivery (609) and tech or customer support scams (574). Government impersonation (260) and business email compromise (135) appear further down the list.

Treat these as a floor, not a full count. The FBI itself notes that overall losses to investment scams exceeded $8 billion, far above the AI-tagged share, which “demonstrat[es] that many victims do not realize the extent AI may be involved in scams.” A complaint only gets an AI tag when someone spots and reports the AI part. A cloned voice that sounded real won’t be counted as AI.

The global picture is harder to pin down. Mastercard’s 2026 payment trends post says that “80% of consumers around the world were the target of a scam in the last year.” Treat that as Mastercard’s claim, not a measured fact.

The one check that defeats most of them

Almost every scheme in this catalog needs the same three things from you: you believe who you’re talking to, you feel you have no time, and you pay through a channel that is hard to reverse. AI makes the first one cheaper. It does not change the other two, and that’s where you can stop it.

The FTC’s advice on fake emergency scams sums up the core move: don’t trust the voice on the line, even if it sounds exactly like someone you know. Resist the pressure to act right away. Hang up, or say you’ll call back, and then reach the person on a phone number you know is right. If you can’t reach them, call another family member or friend, even if the caller told you to keep it secret. The FBI gives the same advice for callers who claim to be officials: stop all contact and go to your bank and local police directly.

We call this the callback rule. It works because it ignores how convincing the fake is. You don’t have to spot a deepfake or judge whether a voice sounds slightly off. That matters, because The Conversation reports that in one study listeners identified an AI-generated voice only about 60% of the time, not much better than a coin toss. All you have to do is end the conversation the other side controls and start one you control.

Two more habits help. First, agree on a family code word or a question only the real person can answer; the FTC suggests things like “What kind of dog do you have?” Second, be suspicious of the payment method. The FTC notes that fake-emergency scammers ask for wire transfers through companies like Western Union or MoneyGram, cryptocurrency, payment apps or gift card numbers. A real bank, court or relative almost never needs gift card numbers today.

The catalog

Each entry has the same four parts: how the scheme works, the tell, a 60-second check and what to do. We describe each scheme only in enough detail for you to recognize it.

1. The cloned-voice “family emergency” call

How it works. Someone calls or messages sounding exactly like your child, grandchild or friend, says they’re in trouble and needs money now. The FTC explains that with a short audio clip, perhaps from content posted online, and a voice-cloning program, a scammer can sound just like your family member. Sometimes a second voice joins as a “lawyer,” “police officer” or “doctor” to add authority.

The tell. Urgency plus secrecy plus an unusual payment method: wire, crypto, payment app or gift card.

The 60-second check. Hang up. Call your relative on the number you already have saved. If they don’t answer, call someone else who would know where they are. Or ask the caller your family code word. The European supervisory authorities give the same advice in their factsheet on AI-powered fraud: call back on a known number through a trusted channel, and agree a “safe word” with your family. The factsheet also warns that a cloned voice can sound robotic or overly smooth, but that AI speech may also sound very natural, so don’t rely on your ear.

What to do. If you already paid, go straight to the first-hour steps below. Our guide to the deepfake “family emergency” call covers the script in more detail.

2. The deepfake video call from an “official”

How it works. The FBI warned in September 2026 that scammers use AI to appear as law enforcement and government officials on video calls with victims, adding the appearance of legitimacy. Most of these complaints involve an accusation that you are connected to a crime, with threats of arrest unless you pay or “help the investigation.” Variants include a missed jury duty or court date. Between January 2025 and July 2026 the IC3 logged 6,833 complaints of that kind, with losses of nearly $36 million. Another variant claims your passport or license is expiring and demands a renewal payment (496 complaints, more than $348,000 lost).

The pattern is not only American. The EU factsheet describes callers who claim to be your bank or a public authority such as the police or tax office, sometimes with a deepfake voice or video and a spoofed number that matches the real one. Barclays lists pressure, threats that you could get in trouble or be arrested, and “authority” such as claiming to be from HMRC among the things scammers often do.

The same technique works on businesses. In 2024, a finance employee at the architecture and design firm Arup wired about $25 million after a video meeting “staffed” by deepfakes of the chief financial officer and colleagues.

The tell. An official who threatens arrest over video and wants payment now. A senior colleague who asks for an urgent, unusual transfer and wants it kept quiet.

The 60-second check. End the call. Look up the agency or the colleague yourself, using a number from an official website or your company directory rather than anything in the message, and ask whether the request is real.

What to do. The FBI advises you to cut off contact, notify your financial institutions, report to local police and file at ic3.gov.

3. The AI-powered investment pitch or “trading bot”

How it works. Investment is the category where the IC3 sees AI most often: 4,356 complaints mentioning AI, and $632 million of the AI-linked losses in The Conversation’s summary. The pitch can be a deepfake video of a well-known figure recommending a platform, a chatbot “advisor,” or an app that claims an AI model trades for you.

The tell. Returns that sound guaranteed, a push to move money onto an unfamiliar platform or into crypto, and trouble when you try to withdraw.

The 60-second check. Search for the company and the person yourself instead of following their links, and check with your country’s securities regulator whether they are registered. Don’t let the offer’s own website be your only source. In the UK, the FCA says almost all financial firms must be authorized or registered with it, and asks you to check the firm on its Firm Checker and use only the contact details listed there. In the EU, the supervisory authorities point to warnings from your national financial authority, the IOSCO I-SCAN list and, for crypto providers, the ESMA register. Europol’s leaflet adds a simple rule: reject cold calls about investment opportunities.

What to do. Stop depositing. Don’t pay a “tax” or “fee” to unlock a withdrawal. Contact your bank and file a report. In the UK, you can call the FCA on 0800 111 6768 about a suspicious firm; if you have lost money, the FCA sends you to Report Fraud.

4. Romance and “friendship” scams that end in a transfer

How it works. AI helps scammers run many conversations at once, write fluent messages in any language and produce convincing photos. The IC3 counted 626 romance and confidence complaints with an AI reference in 2025. These relationships often turn into an “investment opportunity” or an emergency that only you can pay for. The EU factsheet describes the same arc and notes that fraudsters use AI to generate fake profiles and chatbots to write messages, then steer victims toward crypto “investments.”

The tell. Someone you have never met in person, who can never quite join a live, unscripted video call, and whose story eventually ends with a request for money or crypto.

The 60-second check. Tell a friend or relative the whole story out loud. Ask the person for a live video call at a time you choose. Search their photos.

What to do. Don’t send more money, even to “recover” what you have already sent. Report the account to the platform and file a complaint.

5. Fake jobs and “task” scams

How it works. Employment complaints mentioning AI numbered 691 in the IC3’s 2025 data. A recruiter messages you with a remote job, an AI-polished website and paperwork, and a quick “hire.” At some point, you are asked to pay: for equipment, for training, or to unlock earnings from a simple online task.

The tell. A job you didn’t apply for, and any request that you pay your employer.

The 60-second check. Find the company’s careers page yourself and contact its HR team through that page. Legitimate employers pay you. They don’t ask you to deposit money first.

What to do. Stop paying, keep the messages, and report the scam. If you shared ID documents, watch for identity theft.

6. AI-polished phishing and fake checkout pages

How it works. Phishing and spoofing complaints with an AI reference reached 803 in the IC3’s count. AI removes the spelling mistakes and awkward phrasing people used to rely on as warning signs. Messages copy your bank, a delivery company or, more and more, an AI shopping service. A “confirm your agent purchase” or “re-authorize your card” link leads to a lookalike page that collects your login or card details.

The tell. A message you didn’t expect that asks you to log in, confirm a payment or re-enter card details through a link.

The 60-second check. Don’t use the link. Open the app or type the site’s address yourself and check whether the alert shows up there.

What to do. If you entered details, change the password, turn on two-factor authentication and call your card issuer to block the card. Our 12-point account protection checklist walks through each setting. In the UK, forward suspicious emails to report@phishing.gov.uk; the NCSC says it had removed 448,000 scam URLs as of June 2026. Barclays also suggests forwarding scam texts to 7726, a free number run by mobile providers.

7. Fake shops and fake AI shopping agents

How it works. Non-payment and non-delivery complaints mentioning AI came to 609. AI makes it cheap to set up a professional-looking store, write fake reviews or market a “shopping agent” that promises to find deals and pay for you. The goods never arrive, or the “agent” is just a way to collect your card.

The tell. Prices well below everyone else’s, a store or agent with no history, and a request to pay by bank transfer, crypto or gift card instead of a card with dispute rights.

The 60-second check. Look the seller up outside its own site. For an agent, check that it comes from a company you already know and that you set it up yourself.

What to do. Dispute the charge with your card issuer quickly. Europol’s advice is the same: pay by credit card where you can, and if the goods don’t arrive and the seller doesn’t answer, contact your bank. We explain how to judge agents in Fake AI shopping agents: how to tell a real one from a scam.

8. Fake tech support and “your account is compromised” calls

How it works. The IC3 logged 574 tech and customer support complaints with an AI reference. A caller or pop-up claims to be from your bank, a software company or a platform’s security team, says your account is under attack and offers to “protect” your money, often by moving it somewhere or by asking for remote access to your device.

The tell. Someone contacts you first about a security problem and wants you to move money, install software or read out a code.

The 60-second check. Hang up and call the number on the back of your card or in the official app. In the UK, you can dial 159, which Stop Scams UK says connects you with banks covering more than 99% of UK retail current accounts and cannot be spoofed. Barclays says it will never tell you to move money to keep it safe, ask you to help with an internal investigation, or ask for remote access to your device. The Banco de España makes the same point for Spain: scammers can fake a bank’s caller ID or make texts appear in the same thread as the bank’s real messages, and your bank does not need a code from you to cancel a “fraudulent” payment. Spain has also required operators to block calls and texts from unassigned numbers and calls from abroad that display a Spanish number, and reserved 800 and 900 numbers for customer-service and sales calls.

What to do. If you gave remote access, disconnect the device from the internet, then contact your bank from a different device.

9. The recovery scam that follows a scam

How it works. People who have already lost money are targeted again. The FTC describes refund and recovery scams as schemes that promise to get your money back and then charge you for it. The IC3’s 2025 report notes an increase in complaints about impersonation of government officials and recovery firms, including fake law firms targeting crypto scam victims and scammers pretending to be the IC3 itself. The FCA calls these “recovery room” scams, and the EU factsheet warns that the caller may pose as the police, the tax office or a financial authority.

The tell. Anyone who contacts you out of the blue offering to recover lost funds for an upfront fee, including someone who claims to be a government agency.

The 60-second check. Government agencies don’t charge a fee to return money. Contact the agency yourself through its official website.

What to do. Don’t pay. Report the contact where you filed your original complaint (the routes are listed below), along with the original details.

What to do in the first hour after a transfer

Speed matters more than anything else here. The FTC says the sooner you act, the better, because scammers pick payment methods that move money quickly and are hard to reverse. Our first-hour guide has the full checklist. In short:

1. Stop contact. Don’t reply, don’t send “one last” payment, and don’t let the scammer keep you on the phone. The FBI’s first instruction is to stop all contact.
2. Call your bank or payment provider. Use the number on your card or in the official app. Tell them it was fraud and ask them to try to stop or recall the payment. The Conversation gives the same order: call your bank immediately, ask it to attempt a recovery, then report.
3. Secure your accounts. Change passwords you may have shared, turn on two-factor authentication and switch on transaction alerts.
4. Report it. The routes for the US, the UK and Spain are in the next section. In the US, file with the FBI at ic3.gov and with the FTC. The FBI asks you to include any available information, such as phone numbers, account details, transaction records and the messages you received. Also file with your local police.
5. Expect a second wave. Treat any later offer to “get your money back” as a likely recovery scam.

Getting money back is never guaranteed, and it depends on how you paid and how fast you reported it. If a large sum is involved or a bank refuses to act, a consumer-protection lawyer or your local consumer agency can advise on your options.

How to report: US, UK and EU/Spain

Report even if you didn’t lose money. Europol asks people to report any suspected fraud attempt to the police, even if you did not fall victim. Tell your bank first if money has moved; the report comes second.

United States. Use the FBI and FTC routes from the first-hour steps above.

United Kingdom. Report Fraud (formerly Action Fraud) takes reports from England, Wales and Northern Ireland and says it serves the 4.6 million people affected by cyber crime and fraud each year. UK Finance’s Take Five campaign gives the order: contact your bank immediately, then tell the police. The NCSC’s phishing inbox is for scam emails, not for reporting a crime.

European Union. The joint factsheet from the EBA, EIOPA and ESMA, published on December 15, 2025 in all official EU languages, sets out five steps: stop transactions and contact with the scammer, call your bank through official channels, change all your passwords, report to the police or your national financial authority, and watch for recovery scams.

Spain. You can report to the Policía Nacional by phone on 091 or 112, online, or in person at any police station, which are open around the clock; foreign visitors can use the SATE tourist assistance offices. For online fraud, the police say you need a certificate from your bank or another document showing the fraudulent charges; if you file without it, you may be asked to come back with it. For advice before or after a scam, INCIBE’s 017 line is free and confidential, open 8:00 to 23:00 every day of the year, and also reachable on WhatsApp at 900 116 117, on Telegram at @INCIBE017 or through a web form.

If you live elsewhere, your national police and financial regulator are the starting point. Our first-hour guide covers the steps that apply everywhere.

How to protect an older relative

The numbers explain why this deserves its own section. People over 60 accounted for $352 million of the AI-related losses reported to the FBI in 2025. That isn’t because older people are careless. Many of these schemes, especially the cloned-voice “grandchild in trouble” call, are designed specifically for them.

Start with one calm conversation, not a lecture. Explain that voices and faces can now be faked, and practice the callback rule together: if anyone calls asking for money, hang up and call back on a saved number, even if the caller begs you not to. Agree on a family code word. Write down the numbers that matter (family members, their bank’s fraud line) somewhere near the phone.

Then add protections that don’t depend on anyone’s judgment in a stressful moment. The Conversation suggests asking their bank or brokerage about adding a trusted contact the institution can call if something looks wrong. It costs nothing, and it gives the bank a way to raise the alarm before money leaves. The same source recommends turning on transaction alerts and considering a credit freeze, which is free in the US and stops new accounts being opened in someone’s name.

Finally, make it easy to tell you. People who have been targeted often stay quiet out of embarrassment, and scammers count on that. Say plainly that you’d rather get ten false alarms than miss one real scam, and that nobody who gets fooled by a well-made fake is to blame.

What to watch out for

• Counts that undercount. The IC3 figures only include people who reported and cases where the AI part was noticed. Some sources also use projections from consulting firms; we left those out because they aren’t measured losses.
• “Detect the deepfake” advice. Tips about odd blinking or lip movement go out of date fast. Even the EU factsheet, which lists such signs, says AI speech may sound very natural. Contacting the person yourself works however good the fake is.
• Claims without sources. Figures like Mastercard’s 80% are widely repeated. Treat a number as a claim until you can see the study behind it.
• Pressure to keep it secret. Any request to hide a payment from family, your bank or your employer is a red flag in every entry above.
• Crypto and gift cards as payment. These show up as warning signs because they are hard to reverse, not because we are commenting on them as investments.

Go deeper

This catalog is part of our Scams and safety guides.

• Protecting your accounts from AI-powered attacks: the 12-point checklist
• Fake AI shopping agents: how to tell a real one from a scam
• Your money was stolen: what to do in the first hour
• The deepfake “family emergency” call: how it works and a 60-second check