The story we keep hearing about AI and fraud sounds futuristic: deepfakes, autonomous agents, new categories of attack we have never seen before. However, the data tells a less exciting and more uncomfortable tale. AI has not invented a new kind of scam. It has taken the oldest one there is — impersonation — and shrank its cost while raising its quality and generated at an unprecedented scale. A convincing voice clone now runs as little as a penny a minute. This minor economic shift explains most of what is landing in victims’ inboxes, text messages, and voicemails this year.
The scale is so mind-boggling and dramatic that the FBI’s 2025 Internet Crime Report revealed that cyber-enabled crimes defrauded Americans out of a staggering $20.8 billion last year. Adding to this, according to the latest study by Surfshark, Americans lost at least $5.75 billion to scams across six digital and phone-based channels in 2025, roughly $15.75 million every day, and 87% of fraud reports now identify a contact method that begins online or over the phone. One in six Americans (around 46 million adults) lost money to a digital scam in the past year, and one in twenty victims lost more than $5,000.
AI’s role in this shift is clear and measurable. The FBI logged $893 million worth of complaints citing AI or voice cloning in 2025. Moreover, the number of AI scam incidents in 2026 has already surpassed the full-year 2025 total, and this milestone was reached back in July. And the main reason for that is the declining costs: nowadays, usable synthetic voice costs can be estimated from 1 to 20 cents per minute, and when the cost of a convincing impersonation falls to effectively zero, there is no reason to stop sending them.
That brings us to the most striking finding in the recent data, and the one that should set the agenda for US policy and corporate security teams. When asked what made a scam feel legitimate, 35% of American victims pointed to AI-generated voices or images. In France, that figure was 14%. In Spain, 19%. The gap is too wide to be a sampling artifact. It reflects an exposure problem that is distinctively American: deeper mobile-first banking, phone numbers that still function as near-universal identifiers, a cultural comfort with cold outbound calls from businesses, and a scam ecosystem that has had years to optimize against US infrastructure specifically.
If we break down digital channels, it also confirms the hypothesis that impersonation is being scaled exactly where it’s cheapest to run: government impostors drove $421.6 million in losses by phone alone, business impersonation accounted for one in three email scams, and text-scam reports rose nearly 67% year over year. In each of these cases, the scam is following the same old formula: the scammer impersonates someone you trust and urges you to act now. The only difference is that this time he’s only wearing a better mask. It’s important to understand that AI did not change the pitch. It made producing the mask cheap enough to send these scams to everyone.
With this scalability in mind, the standard defensive advice stops working. Generative AI has industrialized spearphishing, a time-consuming and tailored technique once reserved exclusively for high-net-worth individuals, now deployed at scale against anyone with a smartphone. For many years, consumer-side guidance has rested on a quiet assumption: that fakes are expensive enough, and awkward enough, that a trained eye can spot them. Misspellings, weird phrasing, a strange accent on a voicemail from the “bank.” That’s in the past. A voice clone built from three seconds of audio no longer sounds artificial. A phishing email drafted by a language model no longer reads like it was written by a very bad English student. So, asking users to look for red flags that are no longer there is not a very sound security strategy. It’s just a transferring of responsibility to the person least equipped to carry it.
That means that cybersecurity has to level up as well. Protection cannot sit at the end of the sequence, where a person decides whether to trust what they see or hear. The moment we hear a close friend or family member on the line, our natural skepticism is instantly dismantled. AI scams weaponize this empathy, preying directly on the voices and faces we trust the most. To combat this, defense has to be higher up the stream: that scammer text should never reach the phone, the domain that resolves to a known-bad address should be blocked, and credentials that are already exposed on a breach forum and should not be reusable. These are infrastructure problems, and they shouldn’t be solved one anxious grandparent at a time.
A physical bank doesn’t rely on a single key on a single door to protect its assets; it uses a layered defense—vaults, cameras, and alarms—designed to anticipate entirely different avenues of attack. Personal digital protection must follow suit. That is the shift we are investing in at Surfshark. Our work is moving beyond the VPN itself into the broader cybersecurity stack a modern consumer actually needs — breach alerts, web content blocking that intercepts phishing and malicious domains before they load, data-removal services that strip the personal information scammers use as raw material, and dedicated scam-protection tools such as our Antiscam Hub. The underlying principle is the same across all of it: reduce what a user has to notice in the moment by handling more of the threat before the moment arrives. None of this makes individual judgment obsolete, but telling people to be more careful is not a plan. Building security that assumes they won’t be is.
_____
About Miguel Fornés,
Miguel Fornés, Governance and Compliance Manager at Surfshark. Highly experienced information security professional with more than 15 years’ experience in international financial institutions and regulated industries. Miguel is also a frequent contributor to conversations on cybersecurity regulation, corporate governance, and privacy-by-design. He has a particular talent for making complex cybersecurity concepts accessible to non-technical audiences — translating dense regulatory frameworks, technical risks, and industry jargon into clear, practical insights that resonate with business leaders, journalists, and everyday users alike.
Join our LinkedIn group Information Security Community!
