How to spot impersonations, scams and deepfakes

As cyber threats and fraud scams become more sophisticated, it is increasingly difficult for individuals to determine if a request coming via an email, text, phone call or even video call is authentic. Is that caller on the other line who they say they are? Is the request real? Deepfake video content is proliferating across the internet. No matter what form of communication, these well-crafted social engineering scams are designed not only to gain access to personal information, but to reap potential financial gain. 

Cyber threats and fraud scams annually drive record monetary losses due to their sophisticated nature—in 2023, they amounted to over $12.5 billion in losses, a 22% increase over 2022.¹

• Fraudsters are leveraging artificial intelligence (AI) to create audio and video clips, as well as images that appear to be real, usually of a trusted person. These are known as “deepfakes.” In recent news, an individual who believed he was speaking to senior leaders within his organization via a video call was deceived into sending a fraudulent payment, later discovering these were deepfakes that fraudsters constructed to impersonate the employees.
• Impersonations of bank employees or government officials are increasing, and can often sound very convincing. These scammers demand immediate payment or action to avoid further impacts, which can dupe individuals into inadvertently sending money to a fraudulent account.
• Extortion scams, often in the form of phone calls that sound like family members under duress, exploit an individual’s emotional state to get a payment or sensitive information.

As these deepfakes and other impersonation scams may be difficult to detect, it’s important to pause before taking action that involves making payments. Contact a trusted person to talk it through before reacting. Establish a protocol of checking into matters by validating requests and individuals when conducting business, both personally and professionally. Leverage some of the best practices below to help you protect yourself and your accounts:

• Do not assume a phone call, email, text message or video clip is genuine, as phone numbers can be spoofed to appear legitimate, especially if the individual is requesting sensitive information or making high-pressure demands.  
• Validate a caller’s identity. If you receive a call from someone claiming to represent a certain organization and you are unsure, hang up and call an official number, such as on the company’s official website, the back of your credit/debit card or your latest bank statement to confirm the call’s legitimacy.
  • If a caller states they are from J.P. Morgan, it is okay to hang up and contact your J.P. Morgan team member directly. Note: J.P. Morgan will never ask you to provide a one-time passcode. 
  • If someone asserts they are a government official on a call or in an email, avoid being intimidated, and validate via another means of communication, such as calling the phone number on their official website. 
  • Even if it sounds like a family member is in trouble, call a trusted individual before being pressured into making a payment. Consider creating a predetermined family “safe word” to ensure it really is the family member who is in trouble. 
• Avoid clicking on links or opening attachments in emails, texts and social media, particularly if it’s not from a trusted source. If anything appears to be too good to be true, it probably is. Be skeptical about unsolicited messages that promise easy money, great rewards or interesting prospects. 
  • Hover over the link or email sender address to see if the URL is plausible. Refrain from clicking links from unknown senders. Instead, navigate to the website by directly entering the web address in a web browser. Scams, supported by AI or otherwise, attempt to lead you to malicious websites aimed to steal your personal information or infect your devices. This includes social media links and ads.
• Sharing too much information via social media platforms also allows scammers to gather information about you, your friends, family and contacts, and can be used to social engineer you. Be less of a target by limiting the personal information you post.
• Protect your digital identity and accounts by enabling additional controls, such as robust security settings, two-factor authentication, and strong and unique login credentials. 
  • Ensure your devices are protected by keeping anti-virus, operating software and applications up-to-date. 

We can help 

J.P. Morgan takes security very seriously, and continues to invest in the latest technology to help thwart attacks in the ever-evolving threat landscape by using multi-layered approaches to authenticate our clients’ identities, which include, but are not limited to, voice biometrics, mobile device in-app verification and security questions. We will never authenticate a client via one method alone.

To learn more about how you can protect yourself and your accounts, reach out to your J.P. Morgan Banker and team. They can help you become more secure.

¹ https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf