The 2025 FBI Internet Crime Report did something it had never done before: it named AI as a distinct crime category. The number attached to it — $893,346,472 in reported AI-related scam losses across 22,364 complaints — is large, but the number that should actually alarm you is the growth rate. AI-powered scams grew 1,210% in 2025, roughly six times faster than traditional fraud. That is not a trend line. That is a phase change, and it is worth being precise about what actually changed, because the popular framing is wrong in a way that leads to bad defenses.
AI did not invent new attacks. It collapsed the cost of old ones.
Here is the honest, load-bearing observation that most coverage misses: AI has not created novel attack classes. Voice cloning, deepfakes and AI-generated scripts are supercharging classic schemes — romance scams, extortion calls, executive impersonation, government impersonation. The attack taxonomy is unchanged. What changed is the unit economics. As one security researcher put it bluntly this month, AI is not the biggest cybersecurity problem; people are — and AI just made attacking people dramatically cheaper.
Consider the specifics of voice cloning, because they are clarifying. Three seconds of audio is enough to clone a voice at 85% accuracy. The sample is scraped free from a public social-media video. The cloning tool costs as little as $20 on the dark web. So the fully-loaded cost of impersonating a specific human’s voice — your CEO, your daughter, your bank — went from "requires a skilled voice actor and a script" to "twenty dollars and a LinkedIn video." When you drop the cost of an attack by three orders of magnitude, you do not get a slightly worse version of the old threat. You get every marginal, previously-uneconomical target suddenly in scope. That is what a 1,210% curve is made of.
The perimeter is the human now — so architect accordingly
The strategic consequence for anyone responsible for security: the classic defenses were built to protect systems, and the attack has moved to people. You cannot patch an employee. But you can do the thing that actually defeats impersonation, which is the same thing that always defeated it, now mandatory rather than optional: out-of-band verification of anything that moves money or data.
- A verification protocol beats detection. Do not train people to "spot the deepfake" — that is a losing arms race against a technology explicitly optimized to be indistinguishable. Train them to verify through a second channel: a callback to a known number, a shared code word, a confirmation on a different medium. The defense is procedural, not perceptual.
- Treat urgency as the actual signal. Every one of these scams runs on manufactured time pressure, because verification takes time and urgency is how you deny it. "The CEO needs this wire in ten minutes" is not a description of a business emergency; it is the exploit. Make "urgent + irreversible + unverified" a hard stop in policy.
- Reduce the raw material. Voice and face clones need samples. The org’s and executives’ public audio/video footprint is now an attack surface to be managed, not just a marketing asset. This is uncomfortable but real.
The other half: deploying AI expands your attack surface
There is a second, self-inflicted vector that the fraud numbers obscure, and it deserves equal attention. When you rush an AI system into production, you often bolt a powerful, data-rich, externally-facing component onto your stack faster than your security review can keep up. The canonical cautionary tale is McDonald’s McHire recruitment chatbot: an AI hiring assistant used by 90%+ of franchises, which exposed 64 million job-applicant records — names, emails, phones, interview transcripts — because a test admin account was left protected by the password "123456," chained with a basic access-control flaw. No sophisticated AI attack. A default credential and an IDOR bug on a system that happened to be an AI chatbot.
The lesson is not "AI is insecure." It is that AI deployments concentrate sensitive data behind interfaces built at hype-speed, and the boring failures — default creds, missing MFA, broken access control — are where the breaches actually happen. "One in four data breaches were AI-driven" reads like the models are attacking; look closer and a large share is AI systems being breached through utterly conventional negligence. Your AI chatbot is a database with a friendly face, and it deserves the same threat model as any database.
What I would take from this
- Defense is procedural, not perceptual. Invest in verification protocols and out-of-band confirmation, not in teaching staff to detect fakes. The detection race is unwinnable; the verification discipline is achievable.
- Make "urgent + irreversible" a circuit breaker. The single highest-ROI control against impersonation fraud is a mandatory second-channel check on any unexpected, time-pressured, irreversible request. Write it into policy; drill it.
- Threat-model your own AI deployments as data systems. Before shipping a chatbot or agent, ask the unglamorous questions: default credentials, MFA, access control, data exposure. McHire failed all four and it was not exotic.
- Assume symmetric escalation. Attackers went AI-augmented; your detection, verification and monitoring have to as well. The equilibrium is not "AI vs humans" — it is AI-augmented attackers vs AI-augmented defenders, and the side still running purely manual controls loses.
The $893 million headline invites a story about a frightening new kind of threat. The truer, more useful story is that a very old kind of threat — convincing a human to trust the wrong voice — just got industrialized. The attacks are familiar. The scale is not. And because the attacks are familiar, so are the defenses: verify out of band, distrust urgency, and treat every AI system you deploy as the data-rich target it actually is. Boring discipline, applied rigorously, still beats a twenty-dollar voice clone. It just has to be applied every single time now.