Something changed last year that most people don’t know about.

Scammers used to need skills. Writing convincing phishing emails required good English. Calling people and pretending to be their bank required quick thinking and social engineering experience. Creating fake ID documents required access to special software and some technical know-how.

AI changed all of that — overnight.

Deepfake fraud targeting bank accounts jumped 700% in a single year. That’s not a typo. Seven hundred percent. And it’s not slowing down. Researchers project that AI-powered fraud losses will hit $40 billion in the United States alone by 2027 — up from $12.3 billion in 2023.

A major report released today by the American Bankers Association, the Better Identity Coalition, and financial industry security experts laid out just how bad things have gotten — and where they’re heading. The findings should be on every bank customer’s radar.

Let’s break down exactly what’s happening, what these scams look like, and what you can do right now to protect your accounts.

Why AI Made Bank Fraud So Much Worse

The old fraud problem was about scale. Scammers existed, but they were limited by what human beings could do. There were only so many skilled criminals who could write convincing phishing emails in good English. Only so many who could pull off a convincing phone call impersonating a bank. Only so many who could forge a realistic bank statement.

AI didn’t just make scammers better at what they already did. It eliminated the skill requirements entirely.

What used to cost a professional criminal a week of work now takes an AI tool about 30 seconds.

Here’s what that means concretely:

  • Phishing emails that used to have obvious spelling mistakes and awkward phrasing now read like they were written by a professional. An AI tool cut the cost of running a phishing campaign by over 95% while making the emails more convincing than most human-written ones.

  • Phone calls from “your bank” now sometimes use AI-generated voices that clone real bank employees — or even clone a family member’s voice. If you get a frantic call from someone who sounds exactly like your daughter saying she’s in trouble and needs you to wire money, it might be a machine.

  • Fake ID documents that used to look obviously forged now look virtually identical to the real thing. AI can generate a photorealistic driver’s license for a made-up person in seconds.

  • Deepfake video calls — yes, real-time video deepfakes where you see a “person” talking to you on screen — are now possible. A finance worker in Hong Kong transferred $25 million to criminals after being on a video call with people who looked and sounded like his company’s CFO and other executives. They were all AI-generated.

Every one of these tools is available for cheap — sometimes free — to anyone who looks for them.

The 6 Scams Hitting Bank Customers Right Now

1. The “Your Account Has Been Compromised” Call

How it works: Your phone rings. The caller ID shows your bank’s actual phone number (scammers can spoof this easily). A friendly, professional voice — sometimes AI-generated — tells you that suspicious activity has been detected on your account. They need to verify your identity. They ask for your account number, password, or the code that was just texted to you.

That last part — the text code — is the real target. When you give them that code, they’re using it in real time to log into your actual account.

Red flags:

  • Any incoming call asking for your password, PIN, or a one-time code you just received
  • Urgency and pressure to act immediately before you can think
  • Caller ID showing your bank’s number (this can be faked)

What to do: Hang up. Call your bank directly using the number on the back of your debit card. Never give out a code you just received — your bank will never ask for this.

2. The Fake Bank Login Page

How it works: You receive an email or text that looks exactly like your bank — same logo, same colors, same wording. It says there’s a problem with your account and you need to log in immediately. The link takes you to a page that looks identical to your bank’s website. You enter your username and password. The fake site captures your credentials and immediately passes them to the real site on your behalf, logging in as you while you watch.

This is called a man-in-the-middle attack. AI now writes these phishing emails with no grammar errors, correct bank terminology, and personalized details scraped from data breaches.

Red flags:

  • Any email or text with a link asking you to log in “immediately”
  • Link that goes to a URL that isn’t exactly your bank’s real domain (check carefully — bankofamerica-secure.com is NOT Bank of America)
  • Sense of urgency, threat of account suspension

What to do: Never click bank links in emails or texts. Type your bank’s URL directly into your browser. Bookmark it and use the bookmark.

3. The Deepfake Family Emergency Scam

How it works: You get a call from what sounds exactly like your son, daughter, or spouse. They’re in trouble — an accident, arrested, stranded somewhere. They need money transferred immediately. Don’t tell anyone else, they say. Just do it quickly.

This is the old “grandparent scam” upgraded with AI voice cloning. Scammers capture a few seconds of someone’s voice from social media videos, TikToks, or YouTube, then use AI to clone it and generate any message they want in that voice.

Red flags:

  • Request for unusual money transfer methods (wire, Zelle, Venmo, gift cards)
  • “Don’t tell anyone else” — this is a critical manipulation tactic
  • Urgency that prevents you from thinking or making other calls

What to do: Hang up immediately and call your family member directly using a number you already have. Establish a family safe word in advance — a random word only your family knows. If someone calls claiming to be family and can’t say the safe word, it’s a scam.

4. The AI-Powered Account Opening Fraud (Synthetic Identities)

How it works: This one doesn’t target you directly — it’s about criminals opening fake accounts using AI-generated identities. Scammers combine real Social Security numbers (often from children or elderly people) with fake names and addresses, then use AI to generate realistic supporting documents (pay stubs, utility bills, bank statements).

They open accounts, build up a credit history over months, then drain every penny of credit simultaneously and disappear. The “person” they invented never existed.

Why you should care: This fraud costs financial institutions billions — and those costs ultimately show up in higher fees, tighter credit policies, and stricter ID requirements that affect real customers like you.

Red flags for yourself: Check your credit report regularly at annualcreditreport.com. If you see accounts you don’t recognize, especially old ones associated with your Social Security number, it may indicate SSN misuse.

5. The AI Business Email Compromise (If You Run a Small Business)

How it works: You receive an email that appears to be from your business partner, boss, or a vendor you regularly pay. The email looks exactly right — correct email address, writing style, typical requests. It asks you to update payment details, process an urgent invoice, or transfer funds to a new account.

AI now writes these emails based on scraped information about your business relationships, making them nearly impossible to distinguish from real communications. Small business owners are prime targets.

Red flags:

  • Any request to change payment details or bank account numbers
  • Urgent payment requests outside normal business processes
  • Request to keep the transfer confidential

What to do: Establish a verbal verification rule — any request to change payment information or process unusual transfers requires a voice call to confirm, using a number you already have on file (not one provided in the suspicious email).

6. The “Bank Security Team” Deepfake Video Call

How it works: You get a video call — increasingly via WhatsApp or Signal — from someone who looks and sounds like a bank official, a law enforcement officer, or in some cases someone you know professionally. They tell you your account is involved in fraud and you need to transfer funds to a “safe” account immediately.

Real-time video deepfakes are now available as consumer-grade tools. A criminal can put another person’s face and voice on their video stream live.

Red flags:

  • Any request to transfer money to a “safe account” — banks don’t do this, ever
  • Video quality issues, unnatural blinking or lip sync problems (though quality is improving fast)
  • The person seems slightly “off” — emotions don’t quite match their words, lighting looks odd

What to do: End any video call making financial requests immediately. Call your bank directly. No legitimate organization will ever ask you to move money to a different account “for safety.”

The One Rule That Stops Most Scams

Before we get to more specific advice, here’s the single rule that neutralizes the vast majority of these attacks:

If you didn’t initiate the contact, don’t trust it.

  • Phone call from “your bank”? You didn’t call them. Hang up.
  • Email with a link? You didn’t ask for it. Don’t click it.
  • Text with a verification code? You didn’t request it. Don’t share it.
  • Urgent message from “family”? Call them back directly.

Scams work through urgency, fear, and breaking your normal verification habits. The antidote is simple: slow down, break contact, re-initiate contact yourself through channels you control.

Protecting Your Accounts: Practical Steps

Step 1: Enable Strong Authentication on Everything

  • Turn on biometric login (fingerprint or Face ID) for your banking apps — this prevents someone with your password alone from logging in
  • Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) instead of SMS codes wherever available — SMS codes can be intercepted, authenticator apps are harder to steal
  • If your bank offers a passkey or security key option, use it — these are the most secure and can’t be phished

Step 2: Set Up Account Alerts

  • Enable real-time text or email alerts for every transaction over $1
  • Set alerts for login attempts, especially from new devices
  • Enable alerts for wire transfers and Zelle/Venmo payments
  • Set a daily transfer limit that requires additional verification to override

Step 3: Create a Family Emergency Verification Process

Sit down with your family and do two things:

  1. Create a safe word — a random phrase only your family knows that you’ll demand from anyone claiming to be family in an emergency
  2. Agree on verification steps — if you get an “emergency” call, you’ll call back on the number you already have before doing anything

Step 4: Freeze Your Credit

Credit freezes are free and prevent anyone — including AI-powered synthetic identity fraudsters — from opening new credit accounts in your name:

  • Equifax: equifax.com/personal/credit-report-services
  • Experian: experian.com/freeze/center.html
  • TransUnion: transunion.com/credit-freeze
  • ChexSystems (for bank accounts): chexsystems.com

You can temporarily thaw a freeze when you need to apply for credit yourself. Leave them frozen otherwise.

Step 5: Monitor Your Financial Accounts Weekly

Set a recurring 5-minute habit: scan all your bank and credit card transactions once a week. Most fraud is caught fastest by the account owner. Anything unfamiliar — report it immediately. You generally have 60 days to dispute fraudulent credit card charges and limited protection windows for bank transfers.

Step 6: Use Unique Passwords and a Password Manager

If you use the same password for multiple accounts and one gets breached, all your accounts are vulnerable. A password manager (Bitwarden, 1Password, or Apple/Google’s built-in options) generates and stores unique random passwords for every site, so a breach of one site doesn’t cascade.

If You Think You’ve Been Scammed

Act immediately — every minute matters:

  1. Call your bank directly using the number on the back of your card. Report any unauthorized transactions and ask to freeze your account while they investigate.

  2. Report to the FTC at reportfraud.ftc.gov — this helps track scam patterns and can help you recover funds in some cases

  3. File a police report — required for many fraud recovery processes and insurance claims

  4. Report to the FBI’s IC3 at ic3.gov — especially for any wire transfer fraud; they have recovery programs that can sometimes claw back funds within 72 hours if reported fast enough

  5. Contact your state attorney general — many states have active consumer protection fraud divisions

  6. Notify the credit bureaus if your identity or SSN was involved — place a fraud alert (free, easier than a full freeze) immediately

  7. Change passwords on all financial accounts from a clean device

The Bottom Line

Here’s the hard truth: the scams targeting your bank account in 2026 are better than the scams of 2020. The AI tools criminals use are better at writing convincing messages, faking voices, and generating fake documents than most of us can detect.

But the defenses are also better — and most importantly, you are the strongest defense.

No AI scam can get past someone who:

  • Never acts on urgency without pausing to verify
  • Calls back using numbers they already have
  • Has alerts set on all their accounts
  • Has their credit frozen
  • Knows what family emergency verification looks like

The goal isn’t to be paranoid. It’s to make one habit automatic: when something financial happens unexpectedly, slow down and verify through a channel you control before you do anything.

That one habit defeats most of the $40 billion fraud problem.

📊 For compliance officers and risk managers: For an in-depth analysis of the ABA/FSSCC policy recommendations, the 10 AI attack categories, and what financial institutions need to do to comply, see: The $40 Billion AI Fraud Crisis: What Financial Compliance Teams Must Do Now — ComplianceHub.wiki

Quick Reference: The Scam Red Flags

Scam TypeBiggest Red FlagYour Move
Bank impersonation callAsking for code you just receivedHang up, call bank directly
Phishing email/textLink to “urgent” login pageDon’t click, go directly to bank site
Family emergency callAsks for money, says don’t tell anyoneCall family back directly
Synthetic identityUnrecognized account on credit reportReport to credit bureaus, freeze credit
Business email fraudChange in payment details via emailVerify by phone before paying
Video call fraudAsks you to move money for “safety”End call immediately

ScamWatch HQ covers fraud, scams, and consumer protection — in plain English, with no jargon. Stay safe.