Think you can spot scam red flags? The warning signs are changing

IN BRIEFANZ has warned businesses about sophisticated scams in upcoming busy commerce periods.Cybersecurity experts say AI improves every stage of a scam.

Australians are being warned that some of the most common advice for spotting scams is becoming less effective, as criminals use artificial intelligence to create convincing emails, phone calls and video deepfakes.

Banks and cybersecurity experts say artificial intelligence (AI) is helping fraudsters impersonate trusted colleagues, businesses and even family members with a level of sophistication that can be almost impossible to detect.

The warning comes ahead of the Black Friday sales period and summer holidays, when scammers typically exploit heightened spending and pressure to target victims.

More than 84,000 cybercrime reports were made in 2025, while the average self-reported cost of cybercrime to businesses rose sharply, according to the Australian Signals Directorate.

How AI is changing the scam landscape

Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.

AI is transforming every stage of a scam, from impersonation to execution, according to Sanjay Jha, a professor at UNSW’s School of Computer Science and Engineering.

“What’s genuinely new is three things: the impersonation of real, trusted people, real-time deepfakes, and the scale and personalisation that the technology brings to financial crime,” he said.

AI technology allows criminals to produce deepfake videos of trusted people, including doctors, celebrities and business leaders, to promote fake products or investments. It can clone voices of family members, colleagues or executives asking for money.

READ MORE

The volume and quality of scam techniques are a concern, as large language models can write fluent, personalised messages in any language, with fewer spelling mistakes, and can run thousands of conversations at once.

“We used to tell people to look for spelling mistakes,” Jha said, adding that advances in AI mean scammers can produce fluent, convincing messages with few obvious errors.

Scammers can appear on a live call impersonating someone else, Jha said, pointing to a 2024 case in Hong Kong, when United Kingdom engineering firm Arup transferred about HK$200m ($36.5 million) to criminals after a deepfaked multi-person conference.

“AI has turned scamming from a craft into a factory. A  few seconds of your voice is now enough for a criminal to become you,” he said.

Professor in CyberCrime and Cyberwar at UNSW, Richard Buckland, said any information available on the internet is accessible to criminals using AI, and that experts were “just scratching the surface” of its abilities.

“If I wanted to scam you, you might have published all sorts of stuff in your youth, your dad might have said things, your friends may have, but it’s in a thousand locations, and before AI, no one would ever find it,” he said

“But that’s actually all inside the AI now. So AIs can access a vast amount of information about us and know about us.”

AI lets criminals enact existing scams faster, at scale and more convincingly, he said, and the technology was easily accessible.

“It’s really a world of outsourcing now; you could pay someone to do it, you could buy a model that does it.”

The most common scams targeting businesses

The most common scams affecting businesses include the impersonation of legitimate business email accounts, known as Business Email Compromise (BEC), payment redirection scams, impersonation scams, mule accounts, identity fraud, investment scams and goods and services scams.

BEC and payment redirection scams involve criminals gaining access to or impersonating legitimate business email accounts. Victims often believe they are paying a genuine supplier or business partner, when the funds are being transferred to a fraudulent account.

Jha said scammers use AI to study a company’s public information, past emails where accounts have been compromised, and the writing style of its executives and suppliers. They then send a “perfectly worded email, in the right tone, at the right moment in a real transaction”, asking to update banking details.

AI can also generate realistic fake invoices and receipts that match a supplier’s branding. “Instead of just an email, the ‘CEO’ now follows up with a phone call in their cloned voice, or joins a video call.”

READ MORE

Similarly, scammers can pretend to be trusted organisations or individuals, including banks, suppliers or government agencies.

Impersonation scams generally rely on urgency and social conditioning to pressure victims to share information, click malicious links or approve payments or transfer funds.

One of the most significant emerging threats identified by ANZ is the use of stolen or falsified identities to open accounts that can receive scam proceeds. Known as “mule” accounts, these are used to facilitate financial crime, including money laundering.

Identity fraud was the most common scam reported in 2025, and ANZ said it has identified a “growing misuse” of mule accounts across the financial system.

Investment scams trick individuals and businesses into investing in fake or non-existent opportunities by promising attractive returns or exclusive offers. They rank consistently among the highest-loss scam categories reported to ANZ.

“AI easily produces deepfake videos of well-known business figures, journalists or politicians endorsing a trading platform, fake news articles, fake dashboards showing ‘profits’, and chatbots that keep victims engaged for weeks,” Jha said.

“In short, AI removes the tell-tale signs we taught people to look for: bad grammar, a stranger’s voice, a generic greeting. The scam now looks and sounds like business as usual.”

Individuals and businesses are also urged to look out for goods and services scams — advertised goods and services that are fake, misrepresented or never delivered after payment is made, commonly occurring through online marketplaces, social media platforms and fraudulent websites. While often lower in value, goods and services scams remain among the highest-volume scam types reported by ANZ.

ANZ general manager specialist sales, Cosi De Angelis, said that as AI evolved, financial crime was becoming harder to detect because it is “often hidden within legitimate businesses, trusted relationships, and everyday transactions”.

“In many cases, criminals are exploiting trust as effectively as they are technology,” De Angelis said.

How to defend against ‘routine’ scams

Jha said that scams would only become more sophisticated.

“We’ll see real-time deepfake video calls become routine, AI agents that run entire scam conversations end to end, and scams that combine stolen data, cloned voices and fake documents in one coordinated attack,” he said.

“It is an arms race, and criminals adapt quickly to every new defence.”

Between October 2025 and June 2026, ANZ customer scam losses fell by 24 per cent compared with the same period the previous year. During that time, the bank said it also prevented and recovered more than $100 million in scam and fraud-related funds.

ANZ said it is encouraging businesses to review their cyber security practices and ensure staff understand the warning signs of cyber-enabled scams and fraud.

“Technology will continue to evolve, but human judgement remains one of the strongest defences,” De Angelis said.

READ MORE

Jha said there was real progress being made by banks, telcos and digital platforms using AI to detect and prevent cybercrime.

“Reported losses have come down from their peak in recent years. Banks are also intercepting and recovering more stolen money than before. That shows coordinated action works,” he said.

But Buckland said in the meantime, large financial institutions needed to stop contacting customers by phone and email.

“If you get an email, there’s actually no way you can absolutely be sure it’s the right email. And if we get a call, there’s no way we can be sure we’re speaking to who we think we are, even if the correct number shows on the screen.

“So companies have to stop doing it,” he said.

While banks were “lucky” to have physical branches, Buxton anticipated acting against these threats would be a problem for many organisations, in a future where the only trustworthy communications would be “in-person”.

“If you can only contact your customers electronically, you can no longer be distinguished from a scammer,” he said.

“So how’s it going to work?”

For the latest from SBS News, download our app and subscribe to our newsletter.