Not sure whether that message is real? There’s one move that works.

Don’t use any number, link, or address they gave you. Look the organisation up yourself and contact them that way.

A scammer can fake a name, a voice, a logo, and a caller ID. What they cannot fake is being reachable at the real number you found independently.

You do not have to prove it’s a scam. You only have to decline to act on “it looks real” as if it were proof.

Three things that show up in nearly every scam, whatever the story:

Urgency — it must happen now, before you can check. Secrecy — don’t tell your family, don’t tell the bank. An unusual payment — gift cards, wire, cryptocurrency, or reading a code aloud.

The FTC is blunt about that last one: “No real business or government agency will ever tell you to buy a gift card to pay them.”

Things that are no longer reliable signals

Bad spelling and clumsy grammar used to give scams away. AI writes clean English now, so a well-written message means nothing either way. A familiar voice on the phone means nothing — voices can be cloned from a short clip. A number you recognise means nothing — caller ID is trivially faked.

What still works is the channel switch: leave the conversation they started, and reach them through a route you found yourself.

How to spot an AI scam or deepfake What’s changed, what hasn’t, and the habit that protects you “Is this real?” — checking what you see Three questions before you believe, share, or act on something

AI Literacy Foundation is a 501(c)(3) charitable nonprofit (EIN 41-5009995), a California nonprofit public benefit corporation founded in 2026 and run by an unpaid volunteer board whose directors serve without pay. Everything we publish is free to read. We run no advertising, we accept no payment from the makers of the tools we write about, and we will never call, text, or email you asking for money, gift cards, cryptocurrency, or access to your computer.

All our guides · Verify us · Look us up at the IRS

General public educational information — not legal, financial, medical, or cybersecurity advice.