Digital scams have become harder to detect because artificial intelligence has resolved the flaws that once gave away the criminal. Today, it is possible to mimic a relative's voice, create a video with the face of a famous person, and write messages without any Portuguese errors. The good news is that the defense remains simple: be suspicious of urgency, confirm through another channel, and protect your accounts.
What has changed with AI
The script for scams is old. Someone creates an urgent story, plays with your emotions, and asks for money or data. The difference is the quality of the performance. In an alert from December 2024, the FBI, through its Internet Crime Complaint Center (IC3), described how criminals use generative AI to produce text, images, audio, and video at scale, with more convincing content reaching more people.
CERT.br, which maintains the Internet Security Handbook, follows the same line in the pamphlet about scams published in March 2026: scammers create imitations of voices and faces with AI, including those of family members and celebrities, to ask for money or promote fake investments.
Voice cloning
From recordings of someone's voice, the criminal generates short audios with speeches that the person never said. The most common use, according to the FBI, is to simulate an emergency: the "daughter" who suffered an accident, the "brother" in jail who needs money urgently.
Warning signs: strange intonation, choice of words that the person doesn't usually use, request for confidentiality ("don't tell anyone"), and urgency to transfer.
Deepfakes in video
The fake video appears in two forms. The first is an advertisement with a celebrity "recommending" an investment or product. The second is bolder: real-time video calls with supposed executives, police officers, or other authorities, which the FBI also lists among the uses already observed.
It's worth looking closely at the details. The FBI suggests looking for distorted hands or feet, unrealistic teeth and eyes, irregular faces, inconsistent shadows, watermarks, delays between audio and video, and unnatural movements. No sign is a guarantee, so checking through another channel carries more weight than visual analysis.
More convincing phishing
Poor Portuguese used to be a classic clue for fake emails or SMS. Translation and text generation tools eliminate this signal, as pointed out in the FBI alert. There are even chatbots on fake sites leading victims to a malicious link.
CERT.br lists the most frequent bait themes: canceled CPF, consignment held, job offer, pending payment, token re-registration, points that will expire, and fake app update.
Fake profiles
Realistic photos of non-existent people are no longer difficult to produce. The FBI reports the mass creation of fake profiles on social media, with photos generated by AI, for romance, investment, and trust scams. There are also images of invented disasters to solicit donations to non-existent institutions.
A practical caution from CERT.br: limit what you publish, think about who can see your posts, and don't accept unknown contacts. The fewer photos and audios of yours are public, the less material there is for cloning.
WhatsApp scams and fake call centers
Here, AI combines with known tricks, such as someone claiming to have changed their number and soon asking for a Pix, or a contact presenting themselves as the bank.
In October 2026, Febraban warned that criminals set up a WhatsApp profile with the entity's logo to discuss a "suspicious transaction" and collect personal data. The federation also stated that it does not contact via SMS, phone, letter, email, WhatsApp, or social media for security procedures or financial operations, and does not offer loans. If someone asks for an upfront fee to release credit, treat it as a scam.
In the fake call center, the person on the other end usually asks for a password, code, or the installation of an app. Febraban advises terminating the contact and never sharing passwords, codes, or personal information. If you have installed an app suggested by a fake bank employee, CERT.br recommends restoring your phone to factory settings and recovering data from a trusted backup.
How to protect yourself in practice
- Set a code word with your family. A password that only you know how to answer breaks the cloned voice and the fake video. This tip appears in both the FBI alert and the CERT.br handbook.
- Verify through another channel. Hang up and dial the known number or the one on the official site yourself. Never use the contact from the suspicious message.
- Enable two-factor authentication. Even if someone discovers your password, they still need the second factor. And if a notification for approval arrives that you didn't request, deny it.
- Be suspicious of urgency. Threats, emotional appeals, requests for secrecy, and offers that are too good to be true are the signs that CERT.br points out in almost every scam.
- Do not send money to people you only know online or by phone. Neither Pix nor crypto.
Fell for a scam? Where to report in Brazil
The pamphlet "Scams: Fell for It? See What to Do," from CERT.br, published in May 2026, organizes the reaction. Cut contact with the scammer and block the number. Change the passwords of the affected accounts and end open sessions on other devices. If you paid via Pix, dispute the transaction through your bank's app or official channel to activate the MED, the Special Refund Mechanism. The sooner you act, the greater the chance of recovering the amount.
Then, keep prints, links, numbers, receipts, and protocols. File a police report, which can often be done online. Report the profile or advertisement on the social network itself and inform your contacts if someone is using your name. If the issue isn’t resolved with the bank, you can file a complaint with the Central Bank or contact the Procon in your state.
Frequently asked questions
Is it possible to know for sure if a voice was cloned?
Not always. Strange tone and phrases that are out of character for the person help, but the most reliable way is to hang up, call the known number, or ask for the agreed-upon code word.
Can the bank call me asking for a password or code?
Be suspicious of any call or message requesting a password, code, or app installation. End the contact and call the official bank number yourself.
I made a Pix payment to a scammer. Do I still have a chance?
There may be a chance, and it is greater the faster you act. Dispute the transaction through the bank's app or official channel to activate the MED and file a police report with the evidence.
Does making my profile private help?
It helps. Fewer public photos, videos, and audios mean less material to create imitations, and accepting only known individuals reduces the approach of fake profiles.
Next steps
Today, set a code word with your closest people and activate two-factor authentication on your email, WhatsApp, and bank app. If you want to better understand how information security and the technology behind these attacks work, explore the Hcode course platform.
Sources
Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, FBI / Internet Crime Complaint Center (IC3), December 3, 2024.
Scams: Don't Be Fooled, CERT.br / NIC.br (Internet Security Handbook), March 2026.
Scams: Fell for It? See What to Do, CERT.br / NIC.br (Internet Security Handbook), May 2026.
Febraban warns that criminals have used the entity's name to commit scams, Mercado & Consumo, October 9, 2026.