How to spot AI-powered scams in 2026: an Australian guide

AI scams cost Australians more than $390 million in 2024 and are growing fast. Here are the eight new attack patterns to watch for, and the simple verification steps that defeat most of them.

By ECTD Editorial · Published 2026-05-02 · Updated 2026-05-02

In 2024, the Australian Competition and Consumer Commission reported $2.74 billion in losses to scams nationwide — and AI-generated attacks now account for the fastest-growing share. Voice clones, deepfake video calls, and AI-written phishing emails have made traditional advice ("look for spelling mistakes") almost useless. This guide is what every Australian — especially older Australians and small business owners — needs to know in 2026.

Why AI changed scams forever

For decades, the standard advice was the same: scammers slip up. They misspell, they use awkward grammar, they have foreign accents, they make implausible offers. If you spotted one of these "tells", you knew it was a scam.

AI removed every one of those tells. Modern large language models write fluent, grammatical English on demand. Voice cloning tools need only 3-5 seconds of audio to replicate a relative's voice. Real-time deepfake video can put any face on any video call. The 2024-2025 wave of consumer AI tools made these capabilities free or near-free for criminals worldwide.

The good news: while the surface look of scams has changed, the underlying mechanics haven't. Almost every AI scam still relies on creating urgency, isolating you from verification channels, and pushing you to act before thinking. Once you understand the pattern, the AI window-dressing matters much less.

The eight AI scam patterns hitting Australians in 2026

1. Voice clone "family emergency" calls

You receive a phone call. Your daughter, son, grandchild, or close friend is on the line in tears, saying they've been in an accident or arrested overseas, and they need money urgently — usually via gift cards or wire transfer to avoid "police involvement". Their voice sounds exactly right.

The scammers scraped 5 seconds of their voice from a TikTok, Instagram reel, or voicemail greeting and cloned it. The "calling from a strange number" is explained away ("I lost my phone") and the urgency stops you from hanging up to verify.

Family safe word: Pick a single word with your closest family members that no scammer would know — a childhood pet's name, a private joke. If anyone calls in distress asking for money, ask for the safe word. Real family members will know it. Voice clones never will.

2. Deepfake video calls from "your CEO" or "the bank"

Small business owners and finance staff are being targeted by video calls where their CEO, CFO, or accountant appears on screen and authorises an urgent transfer. The face and voice are AI-generated; the call originates from a stolen calendar invite or a spoofed email.

Hong Kong police reported a single such scam in 2024 that extracted US$25 million from a multinational firm. Smaller Australian businesses are now the volume target — losses typically $50,000–$500,000 per incident.

3. AI-written phishing that passes every filter

Phishing emails used to be easy to spot — broken English, weird phrasing, generic greetings. AI-generated phishing reads like a real email from a real colleague or a real institution. It addresses you by name, references actual recent events ("about that project last week"), and uses the writing style of the person being impersonated.

Banks, the ATO, MyGov, telcos, and Australia Post are all impersonated regularly. The link in the email goes to a perfectly cloned login page that captures your credentials.

4. Investment scams with AI-generated celebrities

Facebook and Instagram ads featuring deepfake videos of Gina Rinehart, David Koch, Andrew Forrest, or Australian financial commentators have flooded social media. The "celebrity" personally endorses a too-good-to-be-true crypto or stock platform. Victims who click are funnelled into a slick onboarding flow that takes deposits and never returns them.

No legitimate Australian financial figure — politician, businessperson, broadcaster — endorses investment platforms via Facebook ads. None. If you see one, it's a scam, full stop.

5. Romance scams using AI-generated personas

Match-based dating apps and Facebook groups are full of profiles built entirely from AI-generated photos. The "person" can hold months of natural conversation (powered by an LLM running in the background) and never video calls (or video calls briefly with a deepfake). Eventually, a crisis emerges — medical emergency, business deal gone wrong, customs problem — and they need money.

AI-generated profile photos can now be detected by Google Image Search returning "no results" — a real person's photos appear elsewhere online; AI-generated faces don't.

6. Tax-time MyGov clones

Every July-October, scammers send AI-personalised emails impersonating MyGov or the ATO, claiming you're due a refund or that you owe an immediate payment. The links go to perfect clones of the MyGov login page — pixel-identical, with working SSL certificates.

The ATO's policy: they will never email or text you with a clickable link to log in. They will only ever ask you to log into MyGov yourself. Any email or SMS with a "click here to view your refund" link is a scam.

7. Fake invoice scams against small businesses

Scammers intercept or guess email threads between you and a legitimate supplier, then send a "new bank details for our payment" follow-up using AI to perfectly mimic the supplier's writing style. You pay the new account; the real supplier never sees the money.

Always verify bank detail changes by calling the supplier on a number you have on file (not the number in the email). This single step defeats almost every variant of the scam.

8. AI customer support impersonation

You search Google for "Westpac customer support" and click the top result. It's a sponsored ad pointing to a scam site. An AI chatbot greets you, asks for your account details "to verify your identity", and harvests them. Or you receive a call from "Telstra technical support" claiming your internet has a security issue and they need remote access.

No real bank or telco will ever cold-call asking for your password, OTP code, or remote access. Never click on a sponsored "customer support" ad — type the URL directly or use a bookmark.

The five-step verification system that defeats most AI scams

You don't need to spot the AI to defeat the scam. You need to break the urgency loop. Every AI scam needs you to act now; every defence boils down to slowing down and verifying.

Pause for 60 seconds. If something is genuinely urgent at 9pm on a Tuesday, it can wait 60 seconds while you breathe and think. Scammers rely on the panic response.
Hang up. Call back on a known number. Don't use the number that called you. Don't click the link in the message. Look up the official number yourself — from the back of your bank card, from a previous statement, from your own contacts.
Verify with a second person. Talk to a partner, family member, friend, or colleague before sending any money or providing any credentials. Scammers isolate; loved ones are the firewall.
Check the URL letter-by-letter. mygov.au.support-2024.com is not MyGov. Real Australian government domains end in .gov.au. Real banks use exact domains like westpac.com.au, not westpac-au.com.
If money is requested in gift cards, crypto, wire transfer, or to a "new" bank account: stop. No legitimate Australian institution accepts these for genuine debts. None.

For older Australians and family members: Help the people in your life who are most at risk. Sit down with parents, grandparents, and older friends. Set up a family safe word. Add their numbers to "verified contacts" on their phones. Show them how to spot a sponsored search ad versus a real one. The 30-minute conversation prevents most of these scams from ever working.

What to do if you've been scammed

Acting fast in the first 24 hours can sometimes recover funds. Acting at all helps protect others.

Stop sending more money. If you're mid-scam, stop now. Don't send "one more transfer to release the original".
Contact your bank immediately. Call them, don't use chat. They may be able to recall a transfer if reported within hours. Most major Aussie banks now have dedicated scam recovery teams.
Report to Scamwatch (scamwatch.gov.au). This feeds national data and helps protect others.
Report to ReportCyber (cyber.gov.au) if there's any form of unauthorised access to accounts.
Report identity theft to IDCARE (1800 595 160), Australia's national identity-theft support service. They walk you through the recovery steps for free.
Change all passwords for any accounts the scammer touched, plus your email account (which is the master key to everything else).

The bigger picture

AI scams are going to get more sophisticated, not less. Voice cloning quality keeps improving. Deepfake video gets cheaper and easier. The volume of attacks scales with how cheap they are to launch.

But the human verification fundamentals — slow down, call back on a known number, check with a second person, never use unusual payment methods — remain the same defences that have worked for decades. The technology of the attack has changed; the technology of the defence is still trust, verification, and time. Use them.

Talk to someone you trust: If anything online or on the phone is making you feel rushed, scared, or pressured to send money or provide details, talk to someone before acting. A 5-minute conversation has saved more Australians from scams than any technology ever has.

General information only — not personal financial, tax, legal or medical advice. Consider your own situation and consult a licensed professional before acting. Figures are current as at the date shown above.