The voice on the phone was your son's, and it wasn't your son.

Everyone I know has had one this month. The text from "Royal Mail" about an unpaid parcel fee. The call from "the bank's fraud team" that knew the last four digits of your card. The WhatsApp from a child on a new number who has dropped their phone down the loo and needs the rent by five o'clock. Scams are not new, and the sheer volume is not even the story. The story is that the rough edges we were all trained to spot have been sanded off by the same technology that now drafts the emails in your inbox.

This issue is for the people who keep getting these calls. For Maureen Pritchard, 71, in Merthyr, who already screens every call and wants to know whether that is paranoid. For Dean Hollis, 38, on nights in Hull, who wants it straight and readable on a phone. For Fiona MacLeod, running a GP surgery near Inverness, and Sanjay Mistry, running three shops in Leicester, both of whom sign off payments. For Tomasz Wiśniewski and Hannah Clarke, who get the WhatsApp and the Microsoft versions at work. And for Marcus Campbell, who runs security at an insurer and already knows most of this, but needs the version he can forward to his mum.

The tells have gone.

For twenty years the public advice on phishing rested on one observation: criminals were sloppy. The grammar was off, the greeting was "Dear Customer", the English read like it had been through a translation site twice. That was a real signal. It was never a security system, but for most of us it was the only one we had.

Britain's National Cyber Security Centre said the quiet part in January 2024: generative AI can already produce convincing interaction with victims "without the translation, spelling and grammatical mistakes that often reveal phishing". Its follow-up assessment, running to 2027, judges that AI will "almost certainly" make attacks more frequent and more intense, and that criminals will "highly likely" work around the safeguards on commercial models to sell AI-enabled tools as a service.

The academic evidence is blunter. In December 2024 a Harvard team led by Fredrik Heiding, with Bruce Schneier among the authors, ran a trial on 101 real people. A fully automated AI pipeline researched each target from public sources, wrote the lure and sent it. 54% clicked. A generic scam email of the kind we all delete managed 12%. Human experts, given time to research each victim by hand, also scored 54%. The machine matched the professionals, and it did not need paying per email.

Two years earlier, a large industry study had found the opposite: human red-teamers beat the first ChatGPT comfortably. The models improved and the result flipped. If you take one thing from this section, take that. Whatever your instinct says about "how good AI scams are", it is calibrated to a version that no longer exists.

The spelling mistake was never the security system. It was just the only one most of us had.

Three scams, upgraded.

The voice that sounds like family.

Maureen's question is the right one: if it can sound like her grandson, how does she know it is him? The honest answer is that she cannot, not by ear. Starling Bank's chief information security officer put the requirement at three seconds of audio, which is less than one TikTok, one voice note, or one "leave a message after the tone". Starling's survey of more than 3,000 UK adults found 46% did not know this scam existed, 28% thought they might already have been targeted in the previous year, and 8% said they would send the money even if the call felt strange.

The script does not need to be clever. "Mum, it's me, I've lost my phone, this is my new number, I need £400 for the deposit by tonight." What has changed is that the voice on the end of it can now be the right one, and the follow-up messages read like your daughter, because the software has read how your daughter writes. OpenAI's own report on scam networks it shut down describes exactly this: criminals using ChatGPT to translate, to sustain conversations with dozens of victims at once, and to make their messages read less obviously foreign.

The bank that knows your name.

Dean sleeps days. The call comes at two in the afternoon from a UK mobile number, and a calm voice says it is the fraud team, there has been an attempt on his account, and they need to move his money to a safe account while they sort it. They know his name, his bank and his postcode, because all of that leaked years ago in a breach he never heard about.

The number on the screen means nothing. Ofcom found that 42% of us had a suspicious call in a single three-month window, and that we are nearly three times as likely to answer an unknown UK mobile number as an unknown international one. So criminals abroad simply display a UK mobile number. Ofcom says its rules already block around a million calls a day, and on 21 October it fined a telecoms provider £437,500 for letting scammers misuse its numbers. That is the regulator moving. It is also one fine, against a flood.

One honest note. Bank and police impersonation losses actually fell 12% in 2025, according to UK Finance. The warnings your banking app now throws up before a transfer are working. The criminals have noticed, and they have moved to the scams the warnings do not catch: investment, romance, and the fake purchase.

The boss on the video call.

This is the one for Sanjay and Fiona. In January 2024 a finance worker at the British engineering firm Arup, in its Hong Kong office, got an email from the UK chief financial officer about a confidential transaction. He was suspicious. Then he joined a video call with the CFO and several colleagues he recognised, and the doubt went away. Every face on that call was a deepfake. He made 15 transfers totalling HK$200m, roughly £20m ($25.6m) at the time.

That was the expensive proof of concept. The volume version arrived this autumn. Microsoft's Digital Defense Report, published on 1 October, counted more than 46 million attacks in twelve months in which someone impersonated a business contact, and a 502% year-on-year rise in malicious voice-phishing calls made through Teams. It also reports AI being used to change a caller's voice in real time during the call, to mask an accent.

For Sanjay this arrives as a polite email from a supplier he has used for years, saying their bank details have changed, please update before the next invoice. For Fiona it is a caller from "the IT provider" who needs her to approve a remote-access request to fix the clinical system before Monday. UK Finance puts business losses to authorised payment scams at £75.6m last year. The scam is old. The confidence of the delivery is new.

Three more that are in your pocket right now.

The big three above are the ones that make the news. These three are the ones that arrived on your phone this week, and each of them is a small test of the same rule.

The stranger on WhatsApp.

"Hi, is this Sarah?" A number you do not know, a polite apology for the wrong number, and then a second message anyway. Or a contact request from someone who says you met at a wedding. Or you wake up in a group of forty strangers discussing a trading platform. MoneyHelper, the government-backed money service, lists all three as standard openings: the wrong number that becomes a friendship that becomes an investment or a romance, and the group chat where the other members praising the scheme are the scammers too.

This is the scam that AI changed most, because it runs on conversation. One operator with a model can hold a hundred warm, patient, grammatically perfect chats at once, in your language, for weeks, which is exactly what OpenAI described finding when it shut those networks down. Tomasz Wiśniewski, who uses ChatGPT to polish his own English before emailing the boss, will recognise the quality of the prose. That is the point.

Two rules cover it. A real wrong-number sender stops after you tell them; anyone who keeps the chat going wants something. And nobody ever needs your six-digit WhatsApp code. If one arrives that you did not ask for, someone is trying to take your account, and the message that follows asking you to "send it back" is them. Report and block from inside the chat, and turn on two-step verification in WhatsApp's settings tonight.

The Microsoft email about a password you never changed.

"Unusual sign-in activity." "Your password was changed." "Someone requested a reset." These land in work and personal inboxes alike, and they work for a reason the old advice never covered: Microsoft really does send emails like this. Check Point's brand-phishing count for the second quarter of 2026 puts Microsoft at about 23% of all brand impersonation attempts, roughly twice the next name on the list, with LinkedIn, Google, Apple and Amazon behind it and ChatGPT entering the top ten for the first time.

You cannot tell the fake from the real by reading it, and the sender address proves nothing either. So do not try. Never touch the button in the email. Open a browser, type the address of the account yourself (your work sign-in page, or account.microsoft.com), and look at the recent activity there. If it is clean, the email was the attack. If it shows a login you do not recognise, the email was real and someone has your password: change it, on that page, now. Hannah Clarke's version is simpler still: forward it to IT and let them tell her. Marcus should note what this feeds. Cifas logged more than 78,000 account takeovers in 2025, up 6%, with SIM swaps up 38%, and a phished password is where most of them start.

The police station that rang you.

This is the one that should frighten you, and it is the one Maureen is most likely to get. The phone rings, the screen shows the number of a real police station, and an officer with a collar number tells her that her card has been cloned, that staff at her bank are under investigation, and that she can help by withdrawing her savings so they can be checked. A courier will collect them.

The number on the screen is real and the call is not. On 2 October Northumbria Police warned that calls were showing two of its own former numbers, both no longer in use, and said plainly: "do not rely solely on the number displayed on your phone to verify the identity of a caller." In June City of London Police, the national lead on fraud, took more than 260 calls in a matter of hours from members of the public who had been rung from spoofed police numbers, and said other forces across the country were seeing the same. Its disruption team now works to get each spoofed number added to the industry's do-not-originate list, which stops that number being faked again. It does not stop the next one.

Three facts beat this scam, and Maureen can learn them in a minute. The police will never ask you to withdraw money, move money, buy anything or hand over a card or a PIN, not for any investigation. A real officer will not mind you hanging up. And if you want to check, do not ring the number on your screen or the one the caller gives you: use a different phone, or wait a few minutes, then ring 101 or the number on the force's own website. Then text 7726 with the word "Call" and the number that rang you.

The bill, in pounds.

UK Finance's Annual Fraud Report, published in June, says criminals stole £1.28bn through payment fraud in 2025, up 4%, across a record 4.06 million cases. Spread across the UK population that is roughly £18 taken from every man, woman and child, and it only counts what the banks saw.

The part that tracks this article is APP fraud. Those losses rose 19% to £576.4m. Investment fraud, the fake trading platform with the celebrity endorsement, was up 40% to £221.5m. Romance fraud was up 23%. Purchase scams were 71% of all APP cases. Two-thirds of these scams begin online, mostly on social media and marketplaces, but the 17% that begin with a phone call account for 28% of the money lost. The phone is where the big numbers go.

Cifas, which runs the National Fraud Database, logged more than 444,000 cases in 2025, the most it has ever recorded, at over 1,200 a day. Its chief executive described fraud as being "industrialised, with AI accelerating crime". The National Crime Agency, in the same release, puts fraud at 45% of all crime in England and Wales.

Nobody in that list can tell you what share of it was AI-assisted, because no one logs it that way. What every one of them says, in their own words, is that the messages got better and the cases got more numerous in the same two years that the tools became free. Draw your own line through those points.

One thing the UK does better than most countries: since October 2024 the Payment Systems Regulator has required most banks to refund victims of authorised push payment scams, up to £85,000 per claim, with a few exceptions. UK Finance says banks returned £354.3m in 2025, 61% of losses. If you are scammed, report it to your bank at once; you are more likely to get the money back than you think. That is also why the warnings before a transfer keep getting longer. The bank is now the one paying.

Why the old advice stopped working.

We were taught three checks. Look for bad spelling. Ask whether your bank would really contact you this way. Be wary of urgency. The first is dead, for the reasons above. The second is weakened, because the scammer now knows exactly how your bank contacts you and copies it. The third still holds. Urgency remains the one thing every scam needs, because a victim with a day to think is a victim who rings their daughter.

So the rule changes. Stop judging the content. Judge the channel. Anything that arrives at you can be forged: the voice, the face on the video call, the number on the screen, the email address, the logo, the "secure" link. What a criminal cannot forge is a conversation that you start, to a number or an address you already had before today. Marcus would call this out-of-band verification. Maureen can call it hanging up and ringing back.

Hang up, wait a minute, ring back on a number you already had. Any genuine caller will survive that.

The minute matters. Criminals used to keep landlines open after you hung up so that "ringing the bank" put you straight back through to them. That trick is mostly closed off by the networks now, but a pause, or using a different phone, costs nothing.

What to do tonight.

For everyone, starting with Maureen and Dean:

• Agree a safe phrase with your family this week, said out loud, never typed. Anyone ringing for money who cannot give it is not family, whatever they sound like.
• Ring 159 if anyone calls claiming to be your bank. It is a short code that connects you to most major UK banks, including Barclays, HSBC, Lloyds, Nationwide, NatWest, Santander and Starling. Hang up first, then dial it yourself.
• Forward scam texts to 7726 (it spells SPAM on a keypad) and scam emails to [email protected]. Both are free and both get sites taken down.
• If money has gone, ring your bank immediately, then report it to Report Fraud (the service that replaced Action Fraud) at reportfraud.police.uk or on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101.

For Sanjay, Fiona and anyone else who approves payments at work: no change to a supplier's bank details is ever actioned from an email or a call. Someone rings the supplier back on the number you already had on file. Two people sign off anything above a threshold you pick today. And tell the team, plainly, that the voice of the boss on the phone is no longer proof the boss is on the phone. Fiona has an extra rule: nobody grants remote access to an inbound caller, ever, however urgent the clinical system sounds.

For Marcus, the uncomfortable version. Voice and video are now untrusted inputs, which means any control that rests on a human recognising a colleague is a control with a hole in it. Teams and other internal chat tools are the new phone line, and Microsoft's numbers say the attackers got there first. The fixes are the dull ones: payment approval through a second channel the attacker does not hold, passkeys or hardware keys so a phished one-time code is worthless, and a tabletop exercise where the finance team hears a cloned voice before a criminal plays them one.