Lesson 2 of 6
Lesson 2 — AI-Powered Phishing and Deepfake Fraud
Generated text, cloned voices and video deepfakes have broken the old 'spot the spelling mistake' advice. Learn what still works.
Learn it
Old advice said scams have bad spelling and odd greetings. AI-written scams have neither.
A voice can be cloned from a few seconds of audio, and a face can be faked in a live video call.
The reliable defence is no longer how a message looks — it's verifying through a second, separate channel.
Key terms
- Spear phishing
- A phishing attack tailored to one specific person using researched detail.
- Vishing
- Phishing carried out by voice call, now often with cloned audio.
- Deepfake
- Synthetic audio, image or video generated to impersonate a real person.
- Out-of-band verification
- Confirming a request through a different, known-good channel.
- Business Email Compromise
- Fraud where an attacker impersonates a trusted colleague or supplier to redirect money.
A simple out-of-band verification rule, in code
pythonURGENT = {"urgent", "immediately", "before close of play", "don't tell"}
def needs_callback(msg, amount, sender_known_number):
pressure = any(w in msg.lower() for w in URGENT)
if amount > 500 or pressure or not sender_known_number:
return True # verify by phoning a number you already hold
return False
print(needs_callback("Please pay this invoice urgently", 4800, False))Notice the rule ignores how well written the message is. That's the point — content quality is no longer evidence.
Sandbox lab
Practise the real technique in a fully simulated environment — no live systems, no real data, nothing leaves your browser.
AI phishing simulator
Pick a difficulty. Harder lures are worth more XP per correct call.
Try it
Decide whether each defence still works against AI-generated social engineering.
Checking for spelling and grammar mistakes.
Phoning the sender back on a number you already had.
Requiring two named people to approve any payment over a threshold.
Trusting a live video call because you can see the person's face.
Hovering over links to inspect the real destination domain.
Challenge
Design a 5-step verification policy your school could adopt for any request involving money, passwords or student data.
Pick whichever way suits you — every mode earns the same bonus XP.
Write at least 40 more characters to submit.
Mark your own work
Guided walkthrough — 0/3 clues revealed
- Clue 1 locked — reveal it only if you get stuck.
- Clue 2 locked — reveal it only if you get stuck.
- Clue 3 locked — reveal it only if you get stuck.
Each clue costs 5 XP (never below 25 XP). You'd earn 50 XP right now.