AI-Powered Scams (2026)

You do not need the attacker's toolchain. You need the implication. Public or leftover audio — a birthday story on social, a podcast guest slot, a company all-hands recording — can be enough for a call that would have fooled last decade's "I know that voice" heuristic. The content of the call is rarely creative. Family emergency: bail, hospital, "don't tell Dad." Work: vendor payment, gift cards for a "secret reward," payroll exception, "don't loop in finance, we already approved it." The tell is the combination: identity-sounding audio plus a request that violates your normal money path, plus pressure to stay on the line so you cannot check. The family-emergency money test is the drill you run when you are calm, not when you are crying. Agree a challenge phrase in person (or on a call you initiated to a number already in your contacts). When a panicked voice asks for cash, gift cards, or crypto: hang up. Call the known number — the one already saved as Mom, not the caller-ID that just rang. Ask the phrase. Real family will survive the thirty seconds. A clone plus a callback to the real phone fails the test because the real person is not in a jail in another state. Do not stay on the first call "to keep them safe." That is how the timer wins.

Work is the same pattern with a org chart. Callback on a known number: the switchboard on the company site you type, the boss's number already in the directory, the chat thread you already use for approvals — not a number dictated on the suspicious call, not a new Slack account that "is the CEO on travel." Unusual wires skip procedure "just this once" because procedure is the control. If your policy needs two approvers, a voice cannot fire you through a handset. Deepfake video meetings exist as a scare story; the defense is still out-of-band: a second channel you already had, an amount threshold, an in-person or known-number confirm. You do not "test" a clone by recording coworkers. You harden the approval path so audio is never sufficient.

Typos were a gift. They are no longer a reliable filter. Models write polite, local, logo-adjacent copy with the right product names. Some bait is personalized from public posts — travel, a new job, a family event — the same footprint Topic 4 asked you to shrink. The inspection surface did not move to style. It stayed on: unexpectedness, domain you did not type, urgency that forbids official apps, asks for OTP or a wire. A flawless paragraph from "IT" with a lookalike link is still Module 1. Perfect English is not a signature of your employer. Out-of-band verify is the unified control across voice, video, and mail. Mail: open the app or URL you already use; do not use the message's button. Voice: hang up, call the known number, phrase test. Chat: confirm in a channel you already had, not a new DM that arrived with the scare. If the request is money, the second channel is mandatory even when the first channel "could not be more them." Recognition is cheap now. Possession of the real person's phone, or of the real approval workflow, is still expensive for the attacker.

What you will not do: install voice-clone apps "to see how easy it is," scrape a sibling's TikTok for a demo, or generate a boss deepfake for security awareness without written authorization and a scope that is not this homework. Awareness here is the callback card and the grammar warning — not a lab in synthetic media. If your workplace runs an official simulation, that is their program. This lesson's artifact is yours: numbers you already have, a phrase you chose, a rule that money never moves on the first unexpected call.

Fill numbers you already have. Do not publish them. chmod 600. Agree the phrase in person when you can — not during a suspicious call. If you live alone, the "family" row can be a trusted friend whose number you already know. Work row can be a directory number, not a cell the last caller recited. Never put OTPs or bank passwords in this file.

# Out-of-band verify. NEVER clone voices or scrape family/boss audio.

mkdir -p "$HOME/cyberlium-lab"

{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "=== family / trusted person (number already in MY contacts) ==="
  echo "label: (Mom / partner / friend — no public post of this file)"
  echo "known_number_already_saved: (write privately; this file stays mode 600)"
  echo "challenge_phrase_agreed_in_person: (not spoken on a suspicious call)"
  echo "=== work (optional) ==="
  echo "boss_or_switchboard_already_on_file: "
  echo "normal_approval_channel: email_thread / chat_we_already_use / two_approvers"
  echo "=== rules ==="
  echo "on_unexpected_money_call: hang_up_then_call_known_number"
  echo "stay_on_first_line: never"
  echo "gift_cards_crypto_wire_on_first_call: never"
  echo "fluent_email_is_proof: no — domain_and_official_app_still_required"
  echo "=== grammar tell (retired) ==="
  echo "perfect_english_means_safe: false"
  echo "=== ethics ==="
  echo "did_not_run_voice_clone_tools: yes"
  echo "did_not_scrape_or_synthesize_anyone: yes"
} > "$HOME/cyberlium-lab/callback-card.txt"
chmod 600 "$HOME/cyberlium-lab/callback-card.txt"

# NEVER: clone voices, train on short clips, or deepfake a boss/family member
# NEVER: stay on the first call while buying cards or sending crypto
# NEVER: use a callback number the suspicious caller dictates
# NEVER: skip finance/family process because the voice "could not be faked"
# NEVER: treat perfect grammar as a phishing all-clear

You now treat voice as cloneable from short public clips, family-emergency money as a test you pass by hanging up, and fluent mail as still phishing-shaped until a domain you type agrees. Callback on a known number is the control. Next — Lab — Scam Simulator — you walk four fictional scenarios (job, crypto, QR, voice) and write the safe action plus flags into scam-sim.txt.