AI Literacy & Prompting Module 5 – Privacy, safety and security
Deepfakes, voice clones and AI scams
Recognise cloned voices, deepfake video calls, fake messages and fake images, check a call with a call-back and a code word, and report fraud in India.
What you will learn
- Recognise the common AI-enabled scams, from cloned voices and deepfake video calls to AI-written messages and fake images
- Verify a suspicious call or message with a call-back on a number you saved, a family code word and official channels
- Check images and videos for provenance data such as Content Credentials, and explain why a missing label proves nothing
- Report fraud and non-consensual images in India through 1930, cybercrime.gov.in and a platform's grievance officer
Before you start
What you’ll learn · Before you start
What you will learn
- Recognise the common AI-enabled scams, from cloned voices and deepfake video calls to AI-written messages and fake images
- Verify a suspicious call or message with a call-back on a number you saved, a family code word and official channels
- Check images and videos for provenance data such as Content Credentials, and explain why a missing label proves nothing
- Report fraud and non-consensual images in India through 1930, cybercrime.gov.in and a platform's grievance officer
Before you start
On this page
In 2024, an employee in Hong Kong joined a video conference with what looked and sounded like the company’s chief financial officer, and authorised transfers of about HK$200 million to five bank accounts. The police later found that the meeting had been pre-recorded from public video clips and voices: nobody on the call was real (Hong Kong government).
AI makes a scammer’s voice, face and writing convincing, so the old warning signs (a strange accent, a blurry photo, a message full of mistakes) no longer protect you. This lesson shows what the scams look like, the pattern they all share, the checks that end them, what provenance labels can and cannot prove, and where to report in India, fast.
Scams use AI to copy a voice, a face or a writing style
The FBI’s announcement on generative AI fraud describes the same scams in every medium. AI-written text lets criminals write believable messages faster and removes the “human errors” that used to give scams away. AI images make profile photos and fake identity documents. voice clone: An AI copy of a person's voice, made from recordings of them speaking, that can say any words in that voice. A few seconds of audio can be enough. need only “short audio clips containing a loved one’s voice” to stage a crisis call. And AI video puts fake executives, police officers and officials into “real time video chats” (FBI). A research system has even copied a voice from a recording of only three seconds (Wang and others). The same tools serve every kind of con:
| Scam | What AI adds | What stays the same |
|---|---|---|
| A relative in trouble | A cloned voice from a short clip | Urgency, secrecy, money now |
| The boss on a video call | A generated face and voice | A secret, urgent transfer |
| Fake police or officials | A staged video call | Threats, and payment to settle |
| A phishing message | Fluent text with no mistakes | A link, a code or a payment |
| A fake profile or product | Realistic photos and posts | Money sent to a stranger |
deepfake: A video, image or audio recording made or altered with AI so that a real person seems to say or do something they never said or did. are also used to get past identity checks. India’s cybercrime coordination centre warns that criminals ask people on video calls or in fake job interviews to look at the screen, turn their head or blink, record it, and build a replica that can fool facial checks and video-based identity verification (I4C).
'Digital arrest' calls
The I4C reports scammers who pose as the police, the CBI, the RBI or other agencies, accuse the victim of a crime and keep them on a video call, sometimes in a fake police station, until they pay. Its advisory is plain: “There is no concept of Digital Arrest under any Indian Laws.” Hang up, and check with your nearest police station directly (I4C).
Checkpoint
Check: What AI adds to scams
Urgency, secrecy and a request for money are the pattern to stop at
A cloned voice changes how a scam sounds, not how it works. Every scam in the table needs three things from you, in a hurry: to act at once, to tell nobody, and to send money, a one-time code or access to a device. Urgency stops you thinking, secrecy stops you checking with someone who would see through it, and the request is the point of the call. Step through a call that uses all three:
The drawing shows the whole scene; its 6 steps are listed below.
Every step as text
- The voice. Your phone rings from an unknown number. It is your cousin's voice, crying: he has had an accident on his bike and is at a police station. A few seconds of his voice from a video were enough to copy it.
- Urgency. A second voice says it is a police officer: 40,000 rupees now, or your cousin stays in a cell overnight. The deadline is minutes, so that you do not stop to think.
- Secrecy. Your cousin begs you not to tell his parents. Secrecy cuts you off from the people who would tell you he is safe at home.
- The code word. You ask for the family code word, agreed in person months ago. The caller cries harder and says there is no time. A real cousin would know it; a cloned voice does not.
- Hang up, call back. You hang up and call your cousin on the number saved in your own phone, not one the caller gave you.
- The truth. Your cousin answers from his office. He is fine and has not been on a bike all week. You report the call, and no money moved.
Two things ended that call, and neither was spotting a fake voice. The caller could not give the family’s code word, and a call-back on the number in your own phone reached the real cousin. Notice where the pressure peaked: at the moment the caller asked for secrecy, the step a genuine emergency has least reason to ask for. A relative in real trouble wants the family to know.
Key idea
Urgency plus secrecy plus a request for money, a code or access is the pattern of a scam, whatever voice or face it wears. Stop at the pattern; do not try to judge the voice.
Checkpoint
Check: The pattern of urgency, secrecy and a request
Verify by leaving the call: call back, code word, official channels
Checks that work do not depend on hearing a fake. The FBI’s advice starts with two: agree “a secret word or phrase” with your family, and check a caller by hanging up, finding the organisation’s contact yourself and calling that number directly. India’s cybercrime centre adds that you should speak to relatives and friends before any transfer of money. Put together, they make one routine:
The drawing shows the whole scene; its 6 steps are listed below.
Every step as text
- Pause. The call wants money, a one-time code or remote access, now and in secret. That combination, not the voice or the face, is the signal to stop.
- The code word. Ask for the word your family agreed in person. A cloned voice can copy how someone sounds, not what only they know. No word, or excuses, ends the call.
- Call back yourself. Hang up and call the person, the bank or the office on a number you saved or found yourself, never one the caller gives you.
- Talk to someone. Before any payment, tell someone you trust. Scammers ask for secrecy because one conversation with a relative or a colleague usually ends the scam.
- Report. Report the call even if you paid nothing, so others are warned. If money moved, report at once: on 1930 or at cybercrime.gov.in in India.
- When the word fails. If the caller cannot give the code word, you need no further checks: hang up and report. The other steps are for calls you cannot settle with the word alone.
A code word works because it is something a clone cannot copy: it was agreed in person and never written in a message or posted online. A call-back works because the scammer controls only the call you received, not the number saved in your phone or printed on your bank card. Neither check needs you to be sure the voice is fake.
Trying to catch the fake by its flaws
Wrong: “I’ll listen for a robotic voice or watch for glitches.” Right: “I’ll ask for the code word and call back on my own number.” Detection fails often even for machines: NIST reports accuracy between 50 % and well above 90 % for synthetic-audio detectors, depending on the method and the data (NIST AI 100-4).
Checkpoint
Check: Verifying outside the call
Labels, watermarks and Content Credentials help, and their absence proves nothing
Three kinds of signal can travel with a picture or a video. A label in its metadata can say how it was made: IPTC’s standard vocabulary has a value for content “Created using Generative AI” (IPTC). An invisible watermark can be woven into the content itself by the tool that made it. And Content Credentials: A signed record, defined by the C2PA standard, that travels with a file and says how it was made and edited, so that a change to it shows when it is checked. It does not say whether the content is true., the C2PA standard, bind a signed record of how a file was made and edited to the file, so that a change shows. The program below writes a generated picture with a label, then makes two copies:
"""A provenance label in an image file: present, lost in a copy, or forged.
The program writes a small picture as a PNG file with a label in its XMP
metadata, as image generators can: the IPTC digital source type
"trainedAlgorithmicMedia", which IPTC names "Created using Generative AI".
Then it makes two copies. The first keeps only the pixels, as a screenshot or
a re-save in many apps would. The second has its label rewritten by hand to
say the picture was captured by a camera. Nothing here is signed, which is
the point: a plain label is a claim that anyone can add, remove or change.
"""
import struct
import zlib
IPTC = "http://cv.iptc.org/newscodes/digitalsourcetype/"
NAMES = {"trainedAlgorithmicMedia": "Created using Generative AI",
"digitalCapture": "Digital capture sampled from real life"}
def chunk(kind, data):
body = kind + data
return struct.pack(">I", len(data)) + body + struct.pack(
">I", zlib.crc32(body))
def png(pixels, width, height, source=None):
rows = b"".join(b"\0" + bytes(pixels[y * width * 3:(y + 1) * width * 3])
for y in range(height))
out = b"\x89PNG\r\n\x1a\n"
out += chunk(b"IHDR", struct.pack(">IIBBBBB", width, height, 8, 2,
0, 0, 0))
if source:
xmp = (f'<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf='
f'"http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:'
f'Description xmlns:Iptc4xmpExt="http://iptc.org/std/'
f'Iptc4xmpExt/2008-02-29/" Iptc4xmpExt:DigitalSourceType='
f'"{IPTC}{source}"/></rdf:RDF></x:xmpmeta>')
out += chunk(b"iTXt", b"XML:com.adobe.xmp\0\0\0\0\0" + xmp.encode())
out += chunk(b"IDAT", zlib.compress(rows, 9))
return out + chunk(b"IEND", b"")
def chunks(data):
at = 8
while at < len(data):
length = struct.unpack(">I", data[at:at + 4])[0]
yield data[at + 4:at + 8], data[at + 8:at + 8 + length]
at += 12 + length
def label(data):
for kind, body in chunks(data):
if kind == b"iTXt" and IPTC.encode() in body:
code = body.split(IPTC.encode())[1].split(b'"')[0].decode()
return f"{code} ({NAMES[code]})"
return None
def pixels_of(data):
raw = zlib.decompress(b"".join(b for k, b in chunks(data)
if k == b"IDAT"))
width = struct.unpack(">I", next(b for k, b in chunks(data)
if k == b"IHDR")[:4])[0]
step = 1 + width * 3
return b"".join(raw[i + 1:i + step] for i in range(0, len(raw), step))
W, H = 4, 4
picture = [(x * 60 + y * 20) % 256 for y in range(H) for x in range(W)
for _ in range(3)]
generated = png(picture, W, H, source="trainedAlgorithmicMedia")
resaved = png(pixels_of(generated), W, H)
relabelled = png(pixels_of(generated), W, H, source="digitalCapture")
for name, data in (("1. As the generator wrote it", generated),
("2. A copy that keeps only the pixels", resaved),
("3. A copy relabelled by hand", relabelled)):
same = pixels_of(data) == pixels_of(generated)
print(name)
print(f" size {len(data)} bytes; same pixels as file 1: "
f"{'yes' if same else 'no'}")
print(f" label: {label(data) or 'none'}")
print(" signed: no")
print("\nFile 2 has no label and file 3 claims a camera, yet all three are")
print("the same generated picture. An unsigned label is a claim, not proof,")
print("and a missing label proves nothing either way.")Output
1. As the generator wrote it size 453 bytes; same pixels as file 1: yes label: trainedAlgorithmicMedia (Created using Generative AI) signed: no 2. A copy that keeps only the pixels size 111 bytes; same pixels as file 1: yes label: none signed: no 3. A copy relabelled by hand size 444 bytes; same pixels as file 1: yes label: digitalCapture (Digital capture sampled from real life) signed: no File 2 has no label and file 3 claims a camera, yet all three are the same generated picture. An unsigned label is a claim, not proof, and a missing label proves nothing either way.
Recorded with Python 3.14.8 on macOS 26 arm64. To run it yourself: mise exec python@3.14.8 -- python3 provenance_label.py
The same pixels came out three ways: labelled as generated, with no label at all, and labelled as a camera photo. Plain metadata can be removed by any copy and rewritten by anyone. NIST notes that metadata is often stripped when files are shared on social media, that detecting a watermark “always comes with some probability of error”, and that a watermark can be forged onto content its tool never made (NIST AI 100-4). Signed Content Credentials go further, but only so far: the C2PA specification says its checks show whether provenance data is “correctly formed, and free from tampering”, and pass no judgement on whether that data is “good” or “bad” (C2PA). Whether the picture tells the truth is still yours to judge.
So read the signals one way. Valid Content Credentials from a signer you trust tell you who made or edited a file and how. A label you cannot verify is a claim. And no label tells you nothing: most files carry none, and copies lose them.
Image Metadata Viewer See the Exif, IPTC and XMP data an image carries, including any provenance label, before you trust or share it.Labels under India's IT Rules
The IT Rules, as amended by G.S.R. 120(E), cover “synthetically generated information”: audio, images and video made or altered to appear real. A platform that offers tools to make it must label such content prominently, embed permanent metadata or another provenance mark where technically feasible, and not let the label be removed; large social media platforms must ask users to declare such content and verify the declaration. Text alone is outside the definition.
Checkpoint
Check: Labels, watermarks and Content Credentials
Report fraud and fake images fast, through the right channel
Speed matters most when money has moved. Banks can sometimes trace and freeze a payment before it leaves the banking system, but only while it is still there, so report within minutes, not days. Report a failed attempt too: it warns others, and the number or account goes on record. The first step depends on what happened:
| What happened | First step |
|---|---|
| Money has left your account | Call your bank on its own number and the fraud line at once |
| A suspicious call or message, nothing lost | Report the number or the message |
| A fake image or video of you is online | Report it to the platform and keep the links |
Give the caller’s number, the links and the times with any report; India’s cybercrime centre asks for the fraudster’s number and the video link in such cases. Outside India, report to your country’s police or national fraud reporting service; in the United States, the FBI takes reports at ic3.gov.
Where to report in India
- Money lost to a cyber fraud: call 1930 at once, or report at cybercrime.gov.in. The helpline’s system connects banks, payment companies and wallets with the police, so that a quick complaint can stop the money on its way to the fraudster (I4C).
- A suspicious call or message, no money lost: report it on the Department of Telecommunications’ Chakshu page within 30 days.
- A deepfake or intimate image of you or someone you help: report it to the platform through its report button or its grievance officer, and on cybercrime.gov.in or 1930; a woman can also get help at a One Stop Centre. Under the IT Rules as amended, a platform must act within two hours on such a complaint about intimate images or impersonation, including morphed images, and you can appeal to the Grievance Appellate Committee at gac.gov.in.
The law reaches the makers too. India’s AI governance guidelines note that deepfake impersonation can be dealt with under the Information Technology Act and the Bharatiya Nyaya Sanhita (guidelines), and in the European Union the AI Act, as amended in 2026, bans AI systems that generate non-consensual sexually explicit content (European Commission).
Checkpoint
Check: Reporting fast, to the right channel
Practise: decide each case and write a family plan
Each card is a call, a message or a video; choose the safest next step. Every answer says why:
Checkpoint
Choose the safest next step
Then write a plan your family could pin on the fridge: how the code word was agreed, whom to call back, what nobody does on a call, whom to tell, and where to report. The sample tests check that each part is there, and that the code word itself is written nowhere.
Exercise · Easy · JavaScript
Write your family's plan against voice-clone calls
Write a short plan that your family could pin on the fridge, so that a call in a loved one's voice asking for money never ends in a payment. plan.mjs holds the plan between two backticks, one line for each part. Fill in each line and keep the backticks:
- Code word: how and where your family agreed it. Do not write the word itself here or anywhere else.
- Call back: at least two people and where their numbers are saved, so you can call them yourself.
- Never on a call: what nobody in the family does during an unexpected call, such as sharing a one-time code or sending money.
- Talk first: whom you tell before any urgent payment.
- Report: where to report fraud. In India that is 1930 and cybercrime.gov.in; elsewhere, your country's police or fraud reporting service.
The sample tests check that every part is there: the code word line says it was agreed in person and contains no word in quotation marks, the call-back line names at least two people, the never-on-a-call line covers one-time codes and money, and the report line names a place to report. They cannot check that your family has agreed the plan, which is the step that makes it work.
Starter code · plan.mjs
// One line for each part of the plan; write after the colon. Edit only the text between the backticks.
// Never write the code word itself here.
export const plan = `Code word:
Call back:
Never on a call:
Talk first:
Report:`;The sample tests · plan.test.mjs
import { test, assert } from 'mysmartcopilot:test';
import { plan } from './plan.mjs';
// The parts of the lesson's family plan. The tests never ask for the code word itself.
const part = (label) => {
const line = String(plan).split('\n').find((l) => l.trim().toLowerCase().startsWith(label.toLowerCase() + ':'));
return line === undefined ? null : line.slice(line.indexOf(':') + 1).trim();
};
test('every part of the plan has its line', () => {
for (const label of ['Code word', 'Call back', 'Never on a call', 'Talk first', 'Report']) {
assert.ok(part(label) !== null, `keep the line that starts with "${label}:"`);
assert.ok(String(part(label)).split(/\s+/).filter(Boolean).length >= 2, `${label}: write at least two words`);
}
});
test('the code word was agreed in person, and is not written down', () => {
const line = String(part('Code word') ?? '');
assert.match(line, /in person|face to face|together/i, 'say that the word was agreed in person, never by message');
assert.ok(!/["“”']\w+["“”']/.test(line), 'do not write the code word itself, in quotation marks or otherwise');
});
test('the call-back line names at least two people', () => {
const people = String(part('Call back') ?? '').split(/,|\band\b|;/).map((s) => s.trim()).filter(Boolean);
assert.ok(people.length >= 2, 'name at least two people you would call back, separated by commas or "and"');
});
test('never on a call: one-time codes and money', () => {
const line = String(part('Never on a call') ?? '');
assert.match(line, /\b(?:otp|one-time code|code|pin)\b/i, 'say that nobody shares a one-time code (OTP) on a call');
assert.match(line, /\b(?:money|pay|payment|transfer|send)\b/i, 'say that nobody sends money because of a call alone');
});
test('the report line names where to report', () => {
assert.match(String(part('Report') ?? ''), /1930|cybercrime\.gov\.in|police|report/i, 'name where you would report fraud, such as 1930 and cybercrime.gov.in in India');
});A hint
A line can be short: Call back: Ma on her saved mobile, and Arjun at work. For the code word, write only how you agreed it, for example Code word: agreed in person at Diwali, written nowhere. The never-on-a-call line needs both the code and the money: Never on a call: share an OTP, send money or install an app.
Results of the sample tests
| Test | Result | Details |
|---|
What your code printed
The sample tests run on this device, in your browser (QuickJS): nothing is sent to mysmartcopilot.com. The first run downloads JavaScript (about 0.6 MB), which is kept for the next runs. A check in your browser is feedback for you, not proof that the code is right for every input.
Last, a self-check on scams, their pattern, the checks, provenance labels and reporting, which begins wherever your answers have been weakest:
Practice that adapts to you
Practise this lesson
13 questions about 5 ideas of this lesson. Each answer is explained at once, and what you get right is kept in this browser.
Interview questions
Warm-up (fresher to mid-level): Why do a call-back and a code word work against voice-clone scams when your ears do not?
A cloned voice copies how a person sounds, sometimes from just a few seconds of a recording, and it can be good enough that neither people nor detection tools can tell reliably. A code word and a call-back do not depend on hearing the difference. A code word is something the real person knows and a clone cannot, as long as it was agreed in person and never written in a message or posted. A call-back on a number you saved yourself reaches the real person, because the scammer controls only the call you received. Both also break the scam’s pattern of urgency and secrecy, since they give you a reason to pause and to involve someone else before any money, code or access is handed over.
Two workplace questions build on this lesson:
Model answers open with any pass: ₹79 for 1 week ($2.99), one payment that never renews.
-
Mid to senior
A finance employee gets a video call from someone who looks and sounds like the finance director, asking for an urgent, confidential transfer to a new supplier. What controls should the company have so that this request fails?
-
Fresher to mid
A video of a colleague, apparently saying offensive things about customers, is spreading in staff messaging groups. The colleague says it is fake. What do you do, and what do you check about the video?
Key takeaways
- AI copies voices, faces and writing well enough to remove the old warning signs: in Hong Kong a pre-recorded deepfake meeting led to transfers of about HK$200 million.
- Every scam needs urgency, secrecy and a request for money, a code or access; stop at that pattern instead of trying to judge the voice.
- Verify outside the call: a code word agreed in person, a call-back on a number you saved, and a word with someone you trust before any payment.
- Provenance helps only as far as it can be verified: a label is a claim, signed Content Credentials show who made a file and how, and no label proves nothing.
- Report fast: in India on 1930 or cybercrime.gov.in when money moved, on Chakshu for suspicious calls, and to the platform’s grievance officer for deepfake and intimate images.
Terms in this lesson
- Content Credentials
- A signed record, defined by the C2PA standard, that travels with a file and says how it was made and edited, so that a change to it shows when it is checked. It does not say whether the content is true.
- deepfake
- A video, image or audio recording made or altered with AI so that a real person seems to say or do something they never said or did.
- voice clone
- An AI copy of a person's voice, made from recordings of them speaking, that can say any words in that voice. A few seconds of audio can be enough.
References
- Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (Alert I-120324-PSA) (Federal Bureau of Investigation, Internet Crime Complaint Center)
- LCQ9: Combating frauds involving deepfake (Government of the Hong Kong Special Administrative Region)
- Advisory TAU/ADV/003: 'Digital Arrest' scam (Indian Cybercrime Coordination Centre, Ministry of Home Affairs)
- Advisory TAU/ADV/016: AI driven authentication bypass (Indian Cybercrime Coordination Centre, Ministry of Home Affairs)
- National Cybercrime Reporting Portal and the 1930 helpline (Indian Cybercrime Coordination Centre, Ministry of Home Affairs)
- The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended by G.S.R. 120(E) (Ministry of Electronics and Information Technology, Government of India)
- Standard Operating Procedure to curtail dissemination of Non-Consensual Intimate Imagery (NCII) content (Ministry of Electronics and Information Technology, Government of India)
- Chakshu: report suspected fraud communication (Department of Telecommunications, Government of India)
- Content Credentials: C2PA Technical Specification 2.4 (Coalition for Content Provenance and Authenticity)
- Reducing Risks Posed by Synthetic Content: An Overview of Technical Approaches to Digital Content Transparency (NIST AI 100-4) (National Institute of Standards and Technology)
- Digital Source Type (IPTC NewsCodes) (IPTC)
- India AI Governance Guidelines (Ministry of Electronics and Information Technology, Government of India)
- AI Omnibus enters into force (European Commission)
- Neural Codec Language Models are Zero-Shot Text to Speech Synthesizers (arXiv (Wang and others))
Related tools
Report a problem with this lesson
Kept only in this browser. Your Learn progress