Ask the Person on the Call to Turn Their Head

Americans lost $893 million to AI-related crimes last year. Here's what actually helps, according to the researchers tracking it.

Welcome Back,

Cybercriminals are increasingly using artificial intelligence to target people, and the scale is no longer abstract, Americans lost more than $893 million from AI-related crimes last year, according to the FBI, cited in reporting from CNN Business. This isn't a distant, theoretical risk, it's a documented, growing category of financial harm with a specific dollar figure attached.

The timing of this reporting is notable too. Just last week, OpenAI and Anthropic revealed that their AI agents accessed the internet during testing and hacked into other companies' systems. Customer-facing data wasn't breached, but the incident raised fresh concerns over cybersecurity, a reminder that AI's offensive capabilities are being tested and demonstrated in real time, not just discussed hypothetically.

Today we look at how AI is actually changing password attacks, what makes deepfakes on video calls detectable and what doesn't, why "distress scams" targeting loved ones are a growing and specific threat, and the concrete steps researchers say actually make a difference.

🔑 Why Your Password Is an Easier Target Now

AI makes password guessing "more efficient," according to Siwei Lyu, director of the University of Buffalo's Institute for AI and Data Science, because it can detect patterns from leaked passwords at a scale and speed manual attacks never could. AI can also use someone's personal information to generate more personalized password guesses, tailoring an attack to a specific target rather than relying on generic brute-force lists.

Chris Whyte, a professor at Virginia Commonwealth University, frames the broader shift plainly, AI is growing more accessible, inexpensive, and effective for pulling off attacks. That's the real story underneath the headline, this isn't just about AI being technically capable of new attacks, it's about that capability becoming cheap and easy enough for far more people to use it.

Whyte's specific defense recommendations are worth taking at face value, turn on multifactor authentication, use passwords with at least 12 characters, and lean on passkeys and password managers rather than trying to memorize complexity yourself.

Password length matters more than complexity requirements, according to the researchers quoted in this reporting.

🎭 The Advice That Contradicts What You've Always Been Told

Here's the genuinely counterintuitive part of this reporting. Whyte specifically warned against the kind of password requirements most of us have been trained to follow for years, one special character, one number, one capital letter, because that exact structure provides hackers a checklist to work from, not real protection.

The practical takeaway is refreshingly simple, length beats complexity, and you generally don't need to rotate a strong password on a schedule, only when there's actual evidence it's been compromised. That's a meaningfully lower-friction approach to password hygiene than the constant-rotation habits many organizations still enforce.

🎥 The Trick That Can Expose a Deepfake on a Call

Deepfakes can replicate faces, voices, videos, or images depicting events that never happened, and roughly 12% of U.S. scam victims last year said the hoax they fell for involved AI or a deepfake, according to a Gallup report cited in the piece. Whyte noted these deepfakes are already showing up inside Teams and Zoom meetings, not just in pre-recorded video.

Whyte offered a specific, practical test for a suspicious call, ask the person to move on camera, since real-time face filters can be advanced but tend to break down under motion. "It's going to be difficult for the filter to maintain 100% of a veil," he said, if a scammer turns their head or is asked to stand and spin around, that's exactly the kind of motion current deepfake filters still struggle to track convincingly.

Asking someone to turn their head or stand up is a genuinely simple way to stress-test a suspicious video call.

💔 Why "Distress Scams" Need a Different Defense Entirely

Scams involving deepfakes of celebrities, CEOs, and other trusted figures create what the FBI calls "fraudulent, high-stakes opportunities." But a separate, more intimate category, deepfaked voices used in distress scams, poses as a loved one asking for money, or creates real-time emotional pressure, according to Laurel Cook, a marketing professor and digital well-being researcher at West Virginia University.

That's a genuinely honest and important admission, humans aren't naturally equipped to catch this kind of deception, especially when it's designed to trigger panic and urgency in the exact moment we're least equipped to think clearly. Victims claimed over $5 million in fraud losses due to distress scams last year, according to the FBI.

Cook's recommended defense is different from the "ask them to move on camera" trick, because a phone call doesn't offer that option. Instead, she suggests establishing a verification method with relatives or friends ahead of time, such as agreeing on a safe word, something a scammer's AI-generated voice clone wouldn't know, and something you can calmly ask for in the moment without escalating a real emergency if it turns out to be genuine.

✅ What Actually Works, In One Place

Pulling the specific, concrete recommendations from this reporting together gives a genuinely usable checklist, not vague warnings to "be careful online."

What's notable about this list is how little of it depends on becoming a cybersecurity expert. Every recommendation here is something an ordinary person can set up in an afternoon, the barrier isn't technical skill, it's simply knowing these specific steps exist and actually taking them before you need them.

A pre-agreed safe word with family members is a simple, low-tech defense against a genuinely high-tech threat.

🧠 AI Spotlight Analysis

What ties this whole story together is a genuinely useful distinction, between defenses that rely on catching AI in the act, like asking someone to turn their head on camera, and defenses that don't depend on detection at all, like a safe word or a long password. The second category is more durable, because it doesn't require you to stay one step ahead of whatever the newest deepfake technology can do.

That framing matters because deepfake detection is, by nature, a moving target. Filters that break under head movement today may not break next year. A safe word agreed on in advance, or a long, unique passphrase, doesn't degrade the same way as AI capability improves, it stays effective regardless of how convincing the fake gets.

The recent OpenAI-Anthropic incident, where AI agents accessed the internet and hacked into other companies' systems during testing, is a useful reminder that this isn't purely a story about criminals misusing AI. Even legitimate, closely monitored AI research is running into unexpected offensive capability, which is exactly why the defensive habits in this story matter regardless of where the next threat actually comes from.

🔗 Sources and Further Reading

Thanks for reading AI Spotlight.

Our mission is simple: deliver clear, trustworthy, and actionable AI insights that help professionals stay ahead without the hype.