AI has removed the old giveaways of a scam (bad grammar, odd phrasing, an unfamiliar voice), so this course teaches the one habit that still works: verify every unexpected request through a channel you already trust.
This course is written for everyone, with no technical background needed. It takes about 45 minutes to read start to finish, or you can take one module a day.
Each module is built from the same parts:
If you only remember one sentence from this whole course, make it this one: when a message asks for money, passwords, codes or secrecy, stop and check it another way before you act.
why the old advice ("look for spelling mistakes") no longer protects you, and what has replaced it.
Maria works in accounts at a small construction company. On a Tuesday morning she gets an email from a supplier she has worked with for years. It uses her first name, mentions last month's concrete delivery, and says the supplier has moved banks. Please send this week's payment to the new account. The email is friendly, perfectly written, and signed by the same person as always.
Nothing about it feels wrong. But the supplier never sent it. A scammer read the company's website, the supplier's LinkedIn page and a few public posts, then asked an AI tool to write the email in the supplier's style. It took minutes.
Phishing is when a criminal pretends to be someone you trust (a bank, a boss, a delivery company, a relative) to trick you into doing something that helps them. Usually that means one of four things:
The word started with email, but the same trick now arrives by text message (sometimes called smishing), phone call (vishing), video call, social media and even job ads.
For years, scams were easy to spot: clumsy English, generic greetings like "Dear Customer," and offers too good to be true. Artificial intelligence (AI) tools, the same kind of chatbots and voice apps many people now use every day, have taken those clues away. Criminals use them to:
| What the data shows | Figure | Source |
|---|---|---|
| Share of phishing emails containing AI-written content | 82.6% | KnowBe4 / VIPRE via StationX |
| AI-generated share of reported phishing, Nov → Dec 2025 | 4% → 56% (a 14-fold jump in one month) | Hoxhunt 2026 Phishing Trends |
| Time to write a convincing phishing email | About 16 hours by hand → 5 minutes with AI | IBM, via VoxBooster roundup |
| Typical time for a victim to click a phishing link | 21 seconds | Verizon DBIR 2025 |
| AI-related fraud complaints to the FBI in 2025 | 22,000+ complaints, $893M+ lost | FBI IC3 via CybelAngel |
| How often people correctly spot fake AI audio, video or images | About 54%, barely better than a coin flip | ZeroThreat |
Notice the 21-second figure. Most people who fall for a scam do it quickly, on autopilot. That is the moment this course is designed to interrupt.
If you can't reliably tell a real message from a fake one by looking at it, what can you do? You change the question. Instead of asking "Does this look real?", ask:
"What is this asking me to do, and can I confirm it another way?"
In Maria's case, a 30-second phone call to the supplier (on the number already saved in her contacts, not one from the email) would have stopped the scam completely. The rest of this course builds on that habit.
Think of the last three times someone asked you, by message, to pay something, log in somewhere or share information. For each one, ask yourself: if this had been fake, how would I have known? If the honest answer is "I wouldn't have," that's normal, and it's exactly why the checking habit matters.
You can no longer spot a scam by its spelling, its tone, or even the voice on the phone. Judge the request, not the polish, and check it through a channel you already trust.
the seven most common AI-assisted scams, what each one looks like from your side, and the single move that defeats it.
Before any of these attacks, scammers usually do homework. They look at what you and your workplace share publicly: job titles on LinkedIn, staff pages, holiday photos, voice and video clips, even out-of-office replies. AI tools help them sort that information quickly and turn it into a believable story. The scams below are the different ways that story gets delivered.
What it looks like: an email from your bank, your IT department, Microsoft, a delivery company or a supplier. It uses your name, refers to something real (a recent order, a colleague, a project), and asks you to click a link, open a document or update payment details.
Why it works now: AI writes in the exact tone of the real sender, with no mistakes, and can produce thousands of slightly different versions so spam filters struggle to catch them.
Your move: don't use the link. Go to the website or app yourself, the way you normally would, and check there.
What it looks like: a phone call or voicemail from someone you know: your manager, your bank, your son or granddaughter. The voice is unmistakably theirs. They are in trouble or in a hurry and need you to send money, share a code, or approve something now.
Why it works now: AI can copy a person's voice from a short recording, such as a social media video, a podcast, a conference talk, even a voicemail greeting. Some tools can do it live, during the call.
Your move: hang up and call the person back on the number you already have for them. Or ask for your family or team safe word (see Part 4).
What it looks like: a video meeting with your boss, a senior executive, or several colleagues at once. Everyone looks and sounds right. They ask you to make an urgent, confidential payment.
Why it works now: "deepfake" tools can swap faces and voices in real time. In one well-known 2024 case, an employee at the engineering firm Arup joined a video call with what looked like the company's finance chief and several colleagues (all fakes) and transferred about $25 million.
Your move: seeing a face is not proof. Confirm any money request through a separate channel and your organization's normal approval process.
What it looks like: a text, voicemail or video from a government official, the police, the FBI, the IRS or a court. It may warn of a legal problem or ask you to move to a private chat app to discuss something sensitive.
Why it works now: the FBI has warned that criminals send AI-generated voice messages pretending to be senior U.S. officials, and in July 2026 that scammers were circulating deepfake videos of FBI leaders pointing people to a fake version of the FBI's crime-reporting website.
Your move: look up the agency's official contact details yourself and contact them directly. Real agencies don't demand payment by gift card, cryptocurrency or wire.
What it looks like: after you've lost money to a scam, someone contacts you claiming to be from law enforcement, a law firm or a recovery service. They can get your money back, for a fee.
Why it works now: victims are often listed and resold. Scammers now use deepfaked "agents" to seem more official. People over 60 are hit hardest.
Your move: ignore it. The FBI's crime-reporting center (IC3) has no social media presence and never charges to recover money.
What it looks like: a great job offer arrives out of nowhere. The "recruiter" moves you to WhatsApp or Telegram, rushes the process, and asks for a copy of your ID, your bank details or an upfront fee for equipment or training. On the other side, employers now see job candidates who use AI-generated identities or face-swaps during video interviews to get hired and gain access to company systems.
Your move: find the job on the company's official careers page and contact them through it. Never pay to get a job.
What it looks like: a QR code on a letter, poster or parking meter; a meeting invitation you didn't expect; or a notice that someone has "shared a secure document" with you. Each leads to a page asking you to log in.
Why it works now: these formats often slip past email security filters, and phones make it hard to see where a link really goes.
Your move: if you didn't expect it, don't scan or click. Open the service you normally use and look for the document or meeting there.
The technology changes, but the scam underneath doesn't. Every one of these ends with a request for one of the same few things: money, a password or code, access, personal information, and often secrecy. AI makes the packaging more convincing. Your job is to notice what's inside the package.
Search your own name online and look at your public social media profiles as a stranger would. Ask: could someone use this to pretend to be me, or to convince my family or colleagues that they're talking to me? Note one thing you could make private this week.
Every scam ends with a request. Learn to spot the request, and the disguise stops mattering.
the warning signs AI can't hide, and a simple three-question test you can run on any message in under ten seconds.
David, a retired teacher, gets a call at 7 a.m. It's his granddaughter Emma: her voice, her way of saying "Grandpa." She's crying. She was in a car accident while visiting friends out of state, she's been arrested, and a lawyer will call him about bail. "Please don't tell Mom and Dad, they'll kill me." Minutes later the "lawyer" calls and explains the bail can be paid with gift cards from the supermarket.
The voice was a fake made from Emma's social media videos. But look at what the call contained: an emergency, a demand for secrecy, pressure to act right now, and an unusual way to pay. Those four things are the real alarm bells, and no amount of AI can remove them, because the scam doesn't work without them.
Scammers need you to act before you think. That need shows up in the same ways, again and again.
1. Urgency. "Within the hour." "Before the end of the day." "Your account will be closed." Real organizations and real people almost always give you time to check. Pressure is designed to stop you thinking.
2. Secrecy. "Don't tell anyone." "This is confidential." "I'm in a meeting, just text me." Scammers want to cut you off from the people who would spot the scam.
3. Strong emotion. Fear (you're in trouble), panic (someone you love is hurt), excitement (you've won, you've got the job) or the wish to please someone important (your boss needs a favor). Strong emotion makes all of us less careful.
4. A change to the usual way things are done. New bank details for a regular supplier. A request to buy gift cards. Payment in cryptocurrency. Being asked to read out a code that was texted to you. If the process is unusual, treat the whole request as suspicious.
5. A switch of channel. "Let's move this to WhatsApp / Signal / Telegram / my personal number." Scammers prefer places where your workplace or bank can't see the conversation.
6. Links, attachments and QR codes you weren't expecting, especially ones that lead to a page asking you to sign in.
7. Authority you can't check in the moment. A boss, a police officer, a government official, a bank fraud team. The more important the person claims to be, the more reason to confirm it through a separate channel.
The FBI points to clues such as lips slightly out of sync with the voice, strange-looking hands or jewelry, shadows that don't match, and lag on the line. You can also ask the person to do something unscripted: turn their head to the side, wave a hand in front of their face, or answer a question only they would know.
These clues are worth knowing, but don't rely on them. The technology improves every month, and a clean, smooth video is not proof that it's real. Use the clues as a reason to check, never as a reason to trust.
Before you act on any message, call or video that asks you to do something, ask yourself three questions:
If the answer to any of these is yes, stop and verify using the steps in Part 4. It doesn't mean the message is a scam. It means it's worth 60 seconds to make sure.
Open your email or text messages and find one message that asks you to do something (click, pay, log in, reply with details). Run the three-question pause test on it. Do this once a day for a week and it becomes automatic.
Urgency, secrecy, emotion and an unusual request are the fingerprints of a scam. The harder a message pushes you to skip a normal step, the more likely it is to be fake.
a five-step routine for checking any suspicious request, polite words to use while you check, and six simple settings that protect you even on a bad day.
A familiar voice, a familiar face, or an email from a familiar address used to be good enough. Now they can all be faked. So treat them as a claim ("this is your boss") rather than proof. The proof comes from checking through a route the scammer doesn't control: a phone number you already had, an app you open yourself, a person you can walk over to.
Many people feel rude hanging up on a boss or a crying relative. You don't have to be rude. Try:
A real person will understand. A scammer will push harder, which tells you everything.
These take an afternoon and protect you from then on, even on days when you're tired, distracted or caught off guard.
1. A family safe word. Pick a word or short phrase that everyone in your close family knows but that never appears online. Avoid pets' names, birthdays and street names. Agree that anyone calling with an emergency and asking for money must say it. Share it in person, not by text or email.
2. Two-step sign-in, ideally with a passkey. Two-step sign-in (often called multi-factor authentication or MFA) means logging in needs something more than your password: a code from an app, a fingerprint, or your face. A passkey is the newest and safest kind: it's built into your phone or computer and only works on the real website, so a fake login page can't steal it. Turn it on for your email first, then banking and social media. Your provider's security settings page will walk you through it.
3. A password manager. This is an app that creates and remembers a different strong password for every site. It has a hidden bonus: it only fills in your password on the real website. If you click a link and your password manager doesn't offer to fill in your details, treat that as a warning that the site may be fake.
4. Bank alerts. Most banks can text or notify you whenever money leaves your account, a new payee is added, or a large purchase is made. Turn these on so you hear about problems in minutes, not weeks.
5. Tighter social media settings. Set personal profiles to friends-only where you can. Think twice before posting long videos of yourself or your children talking, travel plans while you're away, or details like your employer, pets' names and family members' names together.
6. A sticky note of real numbers. Write down (or save in your contacts) the real phone numbers for your bank, your workplace IT help desk and your closest family members. When something feels wrong, you won't need to search.
The police, the FBI, the IRS, your bank, Microsoft, Apple and Amazon will never ask you to:
If someone asks you to do any of these, it's a scam. No checking needed.
This week, do two things from the setup list: choose a family safe word with the people closest to you, and turn on two-step sign-in for your main email account. Tick them off below.
Stop, close, call back on a number you already know. Thirty seconds of checking beats any amount of guessing.
why workplaces are a favorite target, the safety rules good organizations put in place, and why following them, even when it feels slow or awkward, protects you personally.
Priya has been a payroll assistant for three months. Late on a Friday she gets a Teams message from the company's finance director: an acquisition is about to close, it's confidential, and a payment must go out before the weekend. A few minutes later he calls her. It's his voice. He's polite but firm, and he thanks her for helping.
Priya's company has a rule: any new payment over $10,000 needs a second approver and a call-back to a known number. She feels awkward, but she follows it and calls the finance director's desk line. He's at his daughter's soccer game and has no idea what she's talking about.
The rule did what Priya's instincts alone couldn't. That's the point of it.
Businesses move large sums of money, hold valuable data, and have lots of staff who receive messages from people they don't know well. A scammer only needs one person, on one busy afternoon, to make one mistake. Business email scams cost organizations billions of dollars every year, and AI voice and video fakes have made them more convincing.
The good news: at work, you're not on your own. Organizations can put safety rules in place so that no single message, call or video can cause a disaster, even a perfect fake.
| Safety rule | What it means for you | What it stops |
|---|---|---|
| Call-back check | Before changing bank details or sending a new payment, you phone the person or supplier on a number already on file, never one given in the request. | Fake supplier emails, voice-cloned bosses, deepfake video calls |
| Two-person approval | Payments over a set amount need a second person to approve them, through a separate system. | One fooled employee sending money alone |
| Two-step sign-in (MFA) and passkeys | Logging in needs more than your password: your phone, a fingerprint or a small security key. | Stolen passwords being used by criminals |
| Code words for leaders | Executives and finance staff agree a code word or question for urgent requests. | Fake calls "from the CEO" |
| Help desk identity checks | IT won't reset your password or sign-in just because someone calls claiming to be you. | Criminals tricking IT into handing over your account |
| "External sender" warnings | A banner on emails that come from outside the company. | Fakes pretending to be colleagues |
| Practice phishing tests | The security team sends realistic fake scams so you can practice spotting them. | Being caught off guard by the real thing |
| A "Report phishing" button | One click sends a suspicious message to the security team. | Scams spreading to other colleagues |
If your workplace doesn't have some of these, it's worth asking your manager or IT team about them.
People follow safety rules when leaders do. Say out loud, in meetings and in writing: "I will never ask you to skip the call-back check, and I'll thank you for doing it to me." That one sentence removes the awkwardness that scammers rely on.
Find out your workplace's answers to these three questions, and write them down:
At work, the process protects you. Follow it every time, and the more someone pressures you to skip it, the more important it is.
exactly what to do in the first hour after clicking a bad link, sharing a password or sending money, and why acting fast matters more than feeling embarrassed.
Scams are designed by professionals and now powered by AI. Doctors, lawyers, bankers and security experts all fall for them. Being caught says nothing about your intelligence. What matters is what you do next, and the faster you act, the more you can usually save.
People who've just been scammed are often targeted again. Expect messages offering to "recover" your money for a fee, or claiming to be from the police or a bank investigating your case. Treat every one with the same suspicion: hang up and contact the organization directly.
Losing money or feeling tricked is upsetting. Talk to someone you trust. Many people stay silent out of embarrassment, which helps no one except the scammer, and sharing your story may stop it happening to a friend.
Save your bank's fraud phone number in your contacts now, under a name you'll find quickly in a panic, like "BANK FRAUD."
Speed beats embarrassment. Call your bank, change your passwords, tell IT, and report it, in that order, within the hour.
Read each scenario and decide what you'd do before reading the answer. There's no score. The goal is to practice the pause.
The boss on the phone.
Your manager calls from an unknown number. It's definitely her voice. She says she's at the airport, her phone died, and she needs you to buy $500 in gift cards for a client and text her the codes.
Hang up and call her normal number, or message her through your usual work chat. Gift cards plus urgency plus a new phone number is a classic scam, and a familiar voice is no longer proof.
The perfect email.
A well-written email from "Microsoft 365" says your mailbox is almost full and you'll stop receiving messages unless you sign in using the link.
Don't click. If you're worried, open Outlook or your email app the way you normally do and check there. Report the email using your "Report phishing" button.
The grandchild in trouble.
Your grandson calls in tears: he's been arrested and needs bail money. He begs you not to tell his parents.
Ask for your family safe word. If he can't give it (or you don't have one yet), hang up and call him, or his parents, on the numbers you already have. The request for secrecy is a giveaway.
The video meeting.
You're pulled into a video call with your finance director and two colleagues. They need an urgent, confidential transfer approved before markets close.
Follow your normal approval process and confirm through a separate channel, such as calling the director's desk phone. Fake multi-person video calls have cost companies millions.
The FBI wants to help.
You lost money to an online scam last year. Now an "FBI agent" contacts you on social media, sends a short video message, and says they can recover your funds for a small processing fee.
Ignore it. The FBI's crime-reporting center has no social media presence and never charges a fee. This is a recovery scam.
The dream job.
A recruiter messages you on LinkedIn with a well-paid remote job. After a quick chat on Telegram, they offer you the role and ask for a copy of your passport and your bank details for payroll.
Find the job on the company's official careers page and contact them directly. Real employers don't hire over chat apps in a day, and never ask for a fee.
The parking QR code.
A sticker on a parking meter says "Pay by QR code." The page it opens asks for your card details.
Use the parking company's official app or the meter itself. Fake QR stickers placed over real ones are a common trick.
Your ticks are saved only in this browser. Nothing is sent anywhere.
Print this, stick it by your desk, or share it with family.
The new reality: AI lets scammers write perfect messages, copy voices and fake faces. You can't reliably spot a fake by looking or listening.
The warning signs: urgency, secrecy, strong emotion, a change to the usual process, a switch to another app, and unexpected links or QR codes.
The routine: Stop. Close the message. Call back on a number you already know. Confirm with a safe word or personal question. Report it.
Set up once: a family safe word, two-step sign-in or passkeys on your email and bank, a password manager, bank alerts, and real phone numbers saved.
Never: pay with gift cards or crypto, read out a code you were texted, move money to a "safe account," or pay to recover lost money.
If it happens: call your bank, change passwords, tell IT, report to ic3.gov and reportfraud.ftc.gov, all within the hour.
This module is general educational information, not professional or legal advice, and following it cannot guarantee you will not be scammed. Statistics are reported by the sources linked and may change. Organisations and products are named as examples only; Rondel Group is not affiliated with them. If you are in immediate danger, call 911.