The FBI's December 2024 warning on AI-enabled fraud: AI text, fake IDs, cloned voices and deepfake video, and what the FBI says to do about each.
Social Engineering Examples·4 sources
On 3 December 2024 the FBI's Internet Crime Complaint Center published PSA241203, a public warning titled "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud". It isn't about one incident. It pulls together what the FBI was seeing across thousands of victim complaints: scammers using AI-written text, AI-made photos and ID cards, cloned voices and deepfake video to run the same old frauds faster and more convincingly. The advisory gives no loss figure. A year later, the 2025 IC3 annual report counted 22,364 complaints tagged as AI-related, with $893 million in adjusted losses. Status: an advisory, so no named victims and nobody charged.
| Modality | Examples the FBI lists |
|---|---|
| Text | Phishing scripts, fake social media profiles, scam messages translated into fluent English, content for bogus investment sites, chatbots that keep victims talking |
| Images | Profile photos for fake identities, forged IDs and law-enforcement or bank credentials, fake celebrity endorsements, invented disaster photos for charity scams, sextortion images |
| Audio | Short cloned clips of a relative's voice used in staged crisis calls, and cloned voices used to impersonate account holders to their bank |
| Video | Real-time deepfake calls posing as executives, police or other authority figures; video "proof" that an online contact is real; deepfakes in investment promos |
None of this is a new crime. Romance scams, grandparent scams, CEO fraud, dodgy investments: all older than ChatGPT. What's changed is the friction. Less work per victim. More victims per scammer. And far fewer slip-ups for a target to spot.
Tip: if a message, photo or call feels unusually polished for the person it claims to come from, treat that polish as a warning, not reassurance.
Two of the FBI's examples deserve a closer look because they turn up again and again in the cases on this site. The first is the crisis call. A scammer clones a loved one's voice from a few seconds of public audio and rings a relative claiming to be in trouble and needing money now. See the Quebec grandparent case for what that looks like in practice.
The second is the bank impersonation, in reverse: a cloned voice used to pose as the customer when calling the bank, to get into the account. The PSA doesn't name a product or describe how a voice-authentication system might be beaten, and this page doesn't either.
On video, the advisory points to live deepfake calls impersonating executives. The Arup case earlier in 2024 is the obvious reference point.
| Figure (2025 IC3 annual report) | Amount |
|---|---|
| Complaints tagged "AI related" | 22,364 |
| Adjusted losses, all AI-related | $893,346,472 |
| Of which: investment fraud | $632,041,188 |
| Of which: business email compromise | $30,256,592 |
| Of which: confidence/romance fraud | $19,041,653 |
| Of which: employment fraud | $12,550,185 |
Three caveats. These come from the 2025 annual report, a year after the PSA, which itself gives no numbers. "AI related" is a descriptor attached to a complaint that already has a crime type, so these dollars sit inside the annual total rather than on top of it. And complaint data isn't measured loss. It's what victims reported. For the full breakdown, see the IC3 2025 AI fraud page.
See also voice cloning, deepfake examples and pig butchering.
A public service announcement from the FBI's IC3, published 3 December 2024, describing how criminals use generative AI text, images, voice cloning and deepfake video to make financial fraud more scalable and believable.
The PSA gives no figure. The FBI's 2025 annual report later recorded 22,364 AI-related complaints and $893 million in adjusted losses, most of it investment fraud.
A family secret word, calling back on known numbers, listening for inconsistencies, checking images for artefacts, limiting public exposure of your voice and face, and reporting to IC3.
No. It synthesises patterns across many complaints rather than describing a single case.
Social Engineering Examples. “FBI PSA241203: how criminals use generative AI in financial fraud (2024)”. Accessed 3 November 2026. https://socialengineeringexamples.com/fbi-ic3-psa241203-generative-ai-financial-fraud-2024
the PSA describes criminals using synthetic profiles, images, identification documents, audio and video; it does not reconstruct one target-selection process.
Public voice and image exposure (such as social media content) is very hard to eliminate at the scale the PSA describes; the FBI's own realistic recommendation is to limit how much voice and image content of yourself or your family is posted publicly and to restrict social accounts and followers, shrinking the raw material available to clone rather than assuming it can be hidden entirely.
generative AI can create believable text, images, audio and video and reduce the effort needed to deceive targets, according to the PSA.
Generation of the synthetic audio or video happens outside the victim's or institution's view, so there is no direct control at this stage; the realistic defense is the human verification built into Stage 4, training people and call-handling staff to treat any single piece of audio or video as unverified by default.
the PSA lists separate examples such as fictitious social profiles, forged credentials and loved-one crisis calls. It does not establish that every scheme combined all modalities.
use independent identity checks before relying on a synthetic-looking credential or an unexpected audio/video request. This is general advice, not a named bank control documented as defeated by the PSA.
examples include short audio clips impersonating a loved one in crisis and real-time video chats purporting to show executives or authority figures.
the FBI recommends a family secret word or phrase and independently verifying a caller by contacting the purported bank or organization directly. These checks reduce reliance on the incoming voice; they are not a guarantee against every fraud.
the PSA describes demands for immediate financial assistance or ransom and fraudulent bank-account access through AI-generated audio impersonation. It does not identify a specific bank authentication control being defeated.
the PSA advises against sending money, gift cards, cryptocurrency or other assets to people known only online or by phone, and against sharing sensitive information with them.
the PSA asks victims of financial fraud to submit an IC3 report with relevant transaction and interaction details; it provides no measured cash-out or recovery result.
report suspected financial fraud to IC3 with available transaction and interaction details. The PSA does not promise recovery.
Browse by what this case has in common with others in the library.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a…
Fake Anti-Scam Centre and police officers convinced a Singapore finance worker she was a suspect, then took S$1.2M through transfers…
A 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a…
GootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that…
Prosecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took…
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a…
A Mattel finance executive wired $3M to China on a forged email from her brand-new CEO, and the company clawed…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
An attacker sent a LastPass employee WhatsApp calls and a voicemail using an AI copy of the CEO's voice. The…
Argan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss,…
Air Canada admitted in a sworn Ontario Superior Court affidavit that it hired private investigators who twice took trash from…
A spoofed email impersonating a company executive tricked a Main Line Health employee into emailing the W-2 and personal data…
A spoofed email impersonating a company executive tricked a Main Line Health employee into emailing the W-2 and personal data…
Orion S.A. lost about $60M in 2024 when an employee was tricked into wiring money to criminals. What Orion confirmed,…
A scammer spoofed a New Zealand bank's number and obtained authentication codes by claiming they would suspend banking and cancel…
Attackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread, then posed as the…
A deepfaked Martin Lewis Facebook ad led to a fake adviser, a Revolut account, £5,000 of savings and £70,000 in…
Orlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white…