AI is making scams more convincing. Here's how to protect your accounts

For years the standard advice on scam emails was to look for the spelling mistakes. That stopped working a while ago. In January 2024 the National Cyber Security Centre warned that generative AI can already write convincing messages "without the translation, spelling and grammatical mistakes that often reveal phishing", and said this would highly likely increase.

Here's what hasn't changed. AI makes the bait better, but every scam still ends with a request: send money, read out a code, log in through a link, or let someone onto your computer. Four free habits deal with most of it. Use passkeys where you can, a password manager and two-step verification everywhere else (email first), agree a family safe phrase, and always call back on a number you already have.

• PasskeysWherever they're offered
• Password managerPlus 2-step verification, email first
• Safe phraseAgree one with family
• Call backOn a number you already have

What AI actually changes

First, the writing got better. A scam email or text no longer has to come from someone who writes fluent English. The NCSC's view is that AI helps criminals most with social engineering, the bit where they talk you into something, making it "more effective, efficient, and harder to detect". So a polished email from your "bank" tells you nothing either way.

Second, voices can be copied. Police forces have warned about criminals using AI to imitate a voice lifted from videos posted online, then ringing a relative with a fake emergency and a request for money. The government's Stop! Think Fraud campaign also warns that the caller ID on your phone doesn't prove who's calling.

Third, it works at scale. The NCSC's 2025 assessment says AI will almost certainly keep making cyber attacks more effective and efficient, and will highly likely increase their volume and impact to 2027. It does that by improving the tricks criminals already use, though, not by inventing new ones. I find that oddly reassuring: the defences that worked before still work. They just matter more now.

What AI doesn't change: the ask

Stop! Think Fraud is blunt about this. Genuine service providers, banks and the police will never call asking you to transfer money, share personal financial details or hand over remote control of your computer. The warning signs it lists don't care whether a person or a machine wrote the script: being asked for a one-time passcode or PIN, being pushed to move money, and being rushed or panicked when you start asking questions.

The numbers tell the same story. UK Finance's 2026 fraud report found that losses to authorised push payment (APP) fraud, where you're tricked into sending the money yourself, rose 19 per cent to £576.4 million in 2025. Investment scams cost the most, at £221.5 million. Impersonation scams, where someone pretends to be your bank or the police and asks you to move money to a "safe account", fell for another year, with losses down 12 per cent. Once enough people know what the ask sounds like, it stops working.

Defence 1: use passkeys wherever they're offered

This is the newest piece of advice, and probably the one that helps most. On 23 April 2026 the NCSC announced that passkeys should now be people's first choice of login, and that it no longer recommends passwords where passkeys are available.

A passkey lets you sign in with whatever you already use to unlock your phone or laptop (your face, fingerprint or PIN) instead of typing a password. For scams, that's the clever part: there's nothing to type into a fake website, so there's nothing to steal. The NCSC says passkeys are highly resistant to phishing and at least as secure as, and generally more secure than, the strongest password combined with two-step verification.

Google, eBay and PayPal already support them. To get started, look in the security or sign-in settings of your most important accounts for a "passkey" option and follow the steps.

Defence 2: everywhere else, a password manager and 2-step verification, email first

Where a service doesn't offer passkeys yet, the NCSC's advice is a password manager to create strong, different passwords, plus two-step verification (2SV), which is the extra code or prompt you get when you log in.

Do your email first. The NCSC picks it out for good reason: whoever gets into your email account can reset the passwords on almost everything else, read your private messages and send emails pretending to be you. Give it a strong password you don't use anywhere else and turn on 2SV. According to the NCSC's 2SV guidance, text-message codes aren't the most secure type of 2SV but are far better than none; authenticator apps are the main alternative.

A password manager is less of a faff than it sounds. Your phone and browser very likely have one built in, and there are standalone ones too. It creates and remembers the passwords for you, and because it only fills them in on the real website, it won't hand your password to a lookalike one.

While you're in the settings, save your backup codes (the NCSC notes they work even if you lose your phone) and check your recovery phone number and email are up to date. They're what get you back in if your phone goes missing, and that's exactly when you'll be glad you did it.

Defence 3: agree a family safe phrase

This is the answer to voice cloning, and it's free. Stop! Think Fraud suggests agreeing a safe phrase with close friends and family, so you can check you're really talking to them. Keep it inside that circle. If someone rings claiming to be family and can't give the phrase, hang up.

Pick something that isn't anywhere on social media, so not a pet's name or the street you grew up on. Make a point of telling older relatives. A panicked call from a "grandchild" is one of the oldest scripts going, and a cloned voice makes it far more convincing.

Defence 4: hang up, and call back on a number you already have

Nearly every scam depends on keeping you on the line they chose, so get off it. If a call, text or email about money feels off, end it and contact the organisation yourself on a number you know is genuine: the back of your card, a bill, or the organisation's own website.

For your bank there's a shortcut, 159. Stop Scams UK says it puts customers of more than 99 per cent of UK retail bank current accounts straight through to their bank, and unlike ordinary numbers it can't be spoofed or impersonated. Save it in your phone now, while you're thinking about it.

If it happens anyway

Anyone can be caught out. These scams are built by people who do nothing else all day. What matters is moving fast.

1. If you've sent money, call your bank straight away, on 159 or the number on your card. Since 7 October 2024, the Payment Systems Regulator's rules mean most victims of bank-transfer scams in the UK should be reimbursed, up to £85,000, for Faster Payments and CHAPS transfers between UK accounts. Report it within 13 months of the payment. You can expect a refund within 5 business days of claiming unless the bank needs more information, and it has to decide within 35 business days. Banks can apply an excess of up to £100, but not to vulnerable customers.
2. Report the fraud. Report Fraud replaced Action Fraud in December 2025. Report at reportfraud.police.uk or call 0300 123 2040. In Scotland, report it to Police Scotland on 101.
3. Report the message. Forward scam texts to 7726 (it's free) and scam emails to report@phishing.gov.uk, as GOV.UK advises. For a scam call, text 7726 with the word "Call" followed by the number.
4. If an account has been taken over, change your email password first, from a device you trust, then the others, turning on 2SV or passkeys as you go.

The two-futures view

The question this site keeps coming back to is what you can do today that helps whichever way things go. If AI keeps getting better and more useful, it gets better for scammers too, so these habits matter more each year. If something goes wrong instead (a lost phone, a locked account, a week offline), the same steps get you back in: passkeys that sync to a new device, recovery codes somewhere safe, and important numbers written on paper. Our guide to what happens if the internet goes down covers that side. None of it costs anything, and it all helps either way.

Frequently asked questions

Where to go next

• What if the internet went down for seven days?: the companion piece: what a household actually loses offline.
• The AI toolkit worth paying for: including what to check about data before you use an AI tool.
• What not to paste into an AI chatbot: the companion piece: what you hand to the AI yourself, and what the providers do with it.
• AI side hustles that actually work: the useful side of the same technology.
• Automate the boring half of your small business: automation tools hold the keys to your other accounts, so protect them too.