Module 7 of StartCloud's AI at Work: Foundations learning pathway, in five short units with a knowledge check: why spelling and grammar no longer reveal a scam, how voice cloning and video deepfakes work in practice, why 'it sounded exactly like him' is no longer evidence, the callback habit that defeats all of them, and what to do the moment one lands at work.
Spotting AI-Generated Scams and Deepfakes
The typo era is over
For twenty years we taught people to spot a scam by its spelling. Dodgy grammar, strange punctuation, a greeting that got your name wrong. It worked, but it was never the scam we were spotting. It was just the part scammers happened to be bad at.
AI has fixed all of it, cheaply and instantly, in fluent Australian English. Scamwatch notes that scammers now use AI to produce thousands of personalised emails, texts and messages built from details found online. So the message that mentions your manager by name, refers to the tender you posted about last week and reads like it came from a real person may well have been written by a machine that has never set foot in Perth.
The old signals are gone. The new signals are about behaviour, not spelling, and they have not changed in decades.
- Spelling mistakes and clumsy grammar. The writing is clean now, and often better than ours
- Obvious translation errors and odd word choices
- "Dear Valued Customer". It has your name, your job title and your last team announcement
- "It looked professional, so it must be real". Looking professional is free
- The ask itself: money, bank details, a password, a code, a gift card, an urgent approval
- Pressure and secrecy: right now, before close of business, do not mention it to anyone yet
- An odd channel: the boss texting from a new number, a supplier suddenly on WhatsApp
- Anything that quietly skips a step your business normally insists on
The most convincing part of a modern scam is usually the detail. They know your manager's name, your accounts email address, the software you use, the conference you went to. All of that sits on your website, your LinkedIn and the ABN register, and AI can assemble it in seconds. Familiarity is now the cheapest thing to fake, so stop treating it as a reason to relax.
Text was the easy bit. The part that catches careful people is audio and video, because those are the senses we have always trusted without thinking. If you heard his voice, it was him. If you saw her face on the call, it was her. That was a perfectly good rule for the whole of human history, and it stopped being reliable about two years ago.
Here is the sentence worth carrying out of this module: "it sounded exactly like him" is no longer evidence of anything. Nor is "I saw her face". Sounding right is now cheap. Being right is a separate question, and it has a separate answer, which is the next unit.
The boss rings about an urgent payment
Same voice, same turn of phrase, same slight impatience. They are stuck in a meeting, a supplier needs paying today, the details are in the email that just landed. Everything about the call feels normal except the one thing that should stop you: it is a payment request arriving through a shortcut.
A family member in trouble
A crackly call, real distress, an accident or an arrest, and money needed straight away. Scamwatch warns that only a few seconds of recorded voice can be enough to build a convincing clone. This one is designed to hit you in the stomach so hard that you never get as far as thinking.
A face on a video call
A senior person joins a call, camera on, and approves a transfer that skips the usual process. There are sometimes tells: lag between the mouth and the audio, odd edges around hair and glasses, a reluctance to turn side-on. Do not build your defence on spotting them. They get better every month, and you get one look.
Your voice is more public than you think
A voicemail greeting. A webinar recording. A podcast interview, a conference video, a reel on the company socials, or simply a phone call from a stranger who kept you talking for a minute. None of that is a mistake on your part. It is just the world we work in now.
Plenty of advice tells you to listen for flat delivery or watch for strange blinking. Fine as a bonus, useless as a plan. You are being asked to spot a fake in real time, under pressure, while someone senior-sounding is waiting on the line. Nobody wins that game reliably, and the ones who think they can are exactly who these scams are built for. Move your trust off your ears and onto your process.
Every scam in this module, the perfect email, the cloned voice, the face on the video call, dies to the same simple move. End the conversation and make contact yourself, on a number you already had.
That is it. It works because the fake only exists inside the channel the scammer controls. Step outside it and there is nothing left. You do not need to detect anything, judge anything or be clever under pressure. You just need to hang up and dial.
Not the number in the email signature, not the number the caller reads out, not the link in the text, and definitely not the helpful fraud line the caller offers so you can check. Scamwatch is blunt about this one: never use contact details given by a caller or written in an email or SMS.
Your own contacts list. The staff directory. The number on the back of your bank card. The organisation's official website, typed into the browser by you. Any of those breaks the scammer's control of the conversation, which is the entire trick.
The Australian Signals Directorate recommends an approval process for any request to change payment details or make a large transfer, verified by phone on a known and verified number, not one from the email. In a small business that is one phone call. It is also the single cheapest control you will ever put in.
A word or a question that only the real person would know, kept out of email and off social media. It sounds a bit spy novel until the day a voice that sounds exactly like your daughter rings in tears, and you have something to fall back on other than your own judgement.
The whole scam runs on you feeling awkward about checking. That is why there is always a reason not to wait. Here is the truth: no real manager, no real supplier and no real bank has ever been annoyed by "no worries, I will ring you back on the number in the directory". Real people wait two minutes. Only a scam cannot survive a callback.
Say the callback habit slips one day, because you were flat out and it looked completely normal. That is a bad hour, not a disaster, as long as the next few minutes go the right way.
Before the boss, before IT, before working out how it happened. Recalling a payment gets harder by the minute, so the fraud line is the first call. Then tell your manager and whoever looks after your IT, and keep the email, the message and the call details, because they are evidence now.
ReportCyber at cyber.gov.au is the official channel for cybercrime, and Scamwatch collects scam reports at scamwatch.gov.au. A near miss is worth reporting too. Your report helps build the picture that warns the next business, which one day will be somebody you know.
Scams arrive in waves. If the fake voice rang you this morning, it is ringing your colleague this afternoon. A two-line message in the team chat saying what happened and what to watch for is worth more than any policy document, and it costs nothing.
These things are properly convincing, built by people who do it full time. Getting caught is not a comment on how careful or clever you are. The only real mistake available here is staying quiet about it, and that one is entirely avoidable.
You are not going to win by getting better at spotting fakes, because the fakes improve faster than any of us do. You win by moving your trust from what you saw and heard to how you confirmed it. Hang up. Ring back on a number you already had. Nothing survives that.
- Scamwatch, National Anti-Scam Centre: How scammers use technology and AI
- Australian Signals Directorate, cyber.gov.au: Business email compromise
- Australian Signals Directorate, cyber.gov.au: Report a cybercrime, incident or vulnerability (ReportCyber)
Australia's official scam and cybercrime guidance, current at the time of writing (August 2026). Scam tactics move quickly, so the links above are the place to check for what is going around this month.
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. A beautifully written email from your manager asks you to update a supplier's bank details before close of business. What do you do?
2. What is closest to the truth about voice cloning?
3. Someone says "but it sounded exactly like him". How much does that prove?
4. You have decided to call back and check. Which number do you use?
5. On a video call, a senior colleague's face asks you to push through an urgent transfer outside the normal process. What is the right move?