AI and Your Security at Home: Voice Cloning, Deepfake Scams and How to Protect Your Family

Imagine your phone rings late at night. It’s your son’s voice, panicked. He’s been in an accident, or arrested, or he’s stuck somewhere and needs money sent right now. Don’t tell anyone, he says, just send it. The voice sounds exactly like him. The way he says “Ammi.” The slight catch in his throat. You’d recognise it anywhere.

Except it isn’t him. Its a recording generated by AI from a few seconds of his voice taken from a video he posted online. And the person on the other end of the line is a scammer.

This isn’t a hypothetical. In its 2025 Internet Crime Report, released in April 2026, the US FBI counted AI-related complaints as a separate category for the first time: over 22,000 complaints with reported losses of around $893 million, including more than $5 million in voice-clone “distress” scams, where criminals impersonate a loved one in a crisis. The FBI described exactly this tactic in public warnings: criminals generating short audio clips of a family member’s voice to fake an emergency. And those are only the cases people reported, in one country.

AI has handed scammers and hackers powerful new tools. Fake voices that sound real. Fake videos of real people. Phishing emails and messages with perfect grammar in any language, personalised to you. Fake websites built in minutes. Malware that adapts. At the same time, AI is also helping defenders, with better spam filters, fraud detection and security tools.

This final article in our series is about protecting yourself, your family and your small business from AI-powered threats at home. We’ll explain the main types of AI scams and attacks, how to spot them, and most importantly, the simple habits and settings that protect you, many of which cost nothing. We’ll also cover securing your PC, phone, router, smart home devices and accounts, with specific notes for life in Pakistan.

You don’t need to be technical to protect yourself. Most of the best defences are simple habits. Let’s go through them.

The short version, if you’re in a hurry

Set a family code word. Agree on a secret word or question with close family. If someone calls in a crisis asking for money, ask for the code word. AI can clone a voice, but it doesn’t know your code word.
Hang up and call back. If you get an urgent call or message asking for money or information, even from someone you know, hang up and call them back on the number you already have saved.
Urgency is the red flag. Scams create panic and pressure to act immediately and secretly. Slow down. Real emergencies can wait five minutes for you to verify.
Never share OTPs or verification codes. No real bank, telecom company, courier or government agency will ask you for a code sent to your phone. Sharing one is how WhatsApp accounts and bank accounts get stolen.
Turn on two-step verification everywhere, especially WhatsApp, email and banking apps.
Use a password manager and unique passwords for every account.
Keep everything updated: Windows, phone, browser, apps and router.
Be careful what you share publicly. Voice and video clips on public social media can be used to clone you.
Talk to your family, especially elderly relatives and teenagers, who are frequent targets.

What’s in this guide

How AI has changed scams and cybercrime
Voice cloning scams
Deepfake video calls and fake videos
AI-powered phishing and messages
WhatsApp and account takeover
Fake websites, shops, apps and investment scams
Sextortion and fake images
Securing your PC
Securing your phone
Your router and smart home devices
Passwords, passkeys and two-step verification
Protecting your family and small business
What to do if it happens to you
Frequently asked questions

Part 1: How AI has changed scams and cybercrime

Scams are nothing new. Fake prize calls, phishing emails, “your account is blocked” messages and fake relatives in trouble have been around for decades. What AI has changed is three things: quality, scale and personalisation.

Quality

Old scams were often easy to spot. Poor spelling and grammar, strange phrasing, obviously fake logos, robotic voices. AI has removed most of those tell-tale signs. AI chatbots write fluent, natural messages in English, Urdu, Roman Urdu and many other languages. Voice cloning tools produce convincing copies of real voices. Image and video generators create realistic fake photos and videos. The advice “look for spelling mistakes” doesn’t work like it used to.

Scale

Before AI, writing convincing, personalised scam messages took time. Now a scammer can generate thousands of tailored messages in minutes. AI can run conversations with many victims at once, keeping each one engaged. What used to need a team of people can be done by one person with the right tools.

Personalisation

AI makes it easy to tailor a scam to a specific person. Scammers can gather information from social media, data leaks and public sources, then use AI to craft a message that references your job, your family members’ names, your recent travel, or your children’s school. Personalised scams are much more convincing than generic ones. Security professionals call targeted phishing “spear phishing,” and AI has made it cheap.

How hard is it to tell real from fake?

Harder than most people think. Studies have found that people are often not much better than a coin flip at spotting AI-generated media. One summary of research found people correctly identified AI voice clones only around 57% of the time. Most of us overestimate our ability to spot a fake, especially when we’re surprised, emotional or rushed, which is exactly the state scammers try to put us in.

That’s the most important lesson in this whole guide: you can’t rely on spotting the fake. Instead, rely on processes, like verification, code words and calling back, that work even when the fake is perfect.

The numbers, and a word of caution

You’ll see lots of alarming statistics about AI fraud online. Some are reliable, many aren’t. The FBI’s figures are among the most credible: around $893 million in reported losses across over 22,000 AI-related complaints in 2025 in the US, with people over 60 accounting for a large share. The FBI itself noted that this is a floor, not a full picture, since many victims never report and AI involvement isn’t always identified. Some vendor estimates put global deepfake-enabled fraud in the tens of billions of dollars per year, but those are estimates, not audited figures. Some widely shared numbers have no traceable source at all.

The precise numbers matter less than the trend: AI-assisted scams are growing, they’re getting more convincing, and they target ordinary people, not just big companies.

The situation in Pakistan

Pakistan has its own wave of cybercrime. Authorities have repeatedly warned about WhatsApp account hijacking, fake courier and delivery messages, fake government notices, and online fraud. In 2024, Pakistan’s interior minister told the Senate that around 1,500 WhatsApp accounts had been compromised in a matter of months, with over 1,400 complaints received by the FIA’s cybercrime wing. TechJuice has reported on large raids in 2026 against organised groups running deepfake, investment fraud and sextortion schemes, including arrests of foreign nationals. Officials have also acknowledged in court that AI tools can be used to clone voices and alter audio.

Cybercrime enforcement in Pakistan is now handled by the National Cyber Crime Investigation Agency (NCCIA), which took over from the FIA’s cybercrime wing. We’ll cover how to report in Part 13.

What these scams look like in real life

To show how these threats come together, here are three scenarios based on the kinds of stories we hear from customers and that have been widely reported. Names and details are illustrative.

The midnight call. A retired teacher in Lahore gets a call from an unknown number. It’s her grandson’s voice, crying, saying he’s been in a road accident in Islamabad and the other driver’s family is demanding money or they’ll call the police. A man then comes on the line, introduces himself as a police officer, and says the matter can be “settled” if money is sent to a mobile wallet within the hour. She’s about to send it when she remembers her daughter telling her about voice scams. She hangs up and calls her grandson’s saved number. He answers, sleepy and confused, from his hostel room. The voice on the call was a clone built from videos he’d posted on social media.

The hijacked group. A shop owner receives a WhatsApp message that looks like it’s from a courier company, asking him to confirm a six-digit code to reschedule a delivery. He’s busy and sends it. Within minutes, his WhatsApp is logged out. Over the next hour, messages go out from his account to dozens of contacts and family groups, asking for urgent loans “until tomorrow,” some with a short voice note in a voice that sounds like his. Two relatives send money before his family manages to warn everyone. He hadn’t turned on two-step verification.

The investment that couldn’t be withdrawn. A young professional sees a video on Facebook in which a well-known businessman appears to recommend an “AI trading platform” that’s helping ordinary Pakistanis earn daily profits. She signs up, deposits a small amount, and the dashboard shows impressive gains. A friendly “account manager” on WhatsApp encourages her to invest more. When she tries to withdraw, she’s told to pay a “tax clearance fee” first. Then another fee. The video was a deepfake, the profits were fake numbers on a screen, and the platform disappears.

In each case, what protects people isn’t technical knowledge. It’s simple habits: verify by calling back, never share codes, and be deeply sceptical of guaranteed profits. We’ll go through all of these in detail.

Part 2: Voice cloning scams

Voice cloning is one of the most frightening AI scams because it attacks something we instinctively trust: the voice of someone we love.

How it works

Modern voice cloning tools can create a convincing imitation of someone’s voice from a short sample, sometimes just a few seconds of clear audio. Scammers get those samples from:

Videos posted on Facebook, Instagram, TikTok and YouTube.
Voice notes forwarded in WhatsApp groups.
Recorded phone calls, including calls where the scammer simply gets you talking.
Public videos of interviews, speeches or events.

The scammer feeds the sample into a voice cloning tool, types what they want the voice to say, or in some cases speaks into a microphone and has their voice converted in real time. Then they call or send a voice note.

Common voice cloning scams

The family emergency. A child, grandchild, sibling or spouse calls in distress: accident, arrest, kidnapping, stuck abroad, needs money urgently. Often a second person comes on the line claiming to be a police officer, lawyer or doctor. This is the classic “distress” scam the FBI has warned about.
The boss or colleague. A “manager” calls an employee asking for an urgent payment, gift cards, or sensitive information. Businesses have lost huge sums this way.
The voice note. A WhatsApp voice note from a “friend” or “relative” whose account has been hacked, asking for a loan. Combined with a hijacked account, a cloned voice note is very convincing.
Bank or official impersonation. Fake calls from “your bank” or an official, sometimes using the cloned voice of a real person you’ve dealt with.

Warning signs

Extreme urgency: “Send it right now.”
Secrecy: “Don’t tell Abbu,” “Don’t call anyone.”
Unusual payment methods: mobile wallet transfers to unknown numbers, cryptocurrency, gift cards, or cash handed to a stranger.
The person can’t or won’t answer personal questions, or the call keeps “breaking up” when you ask.
A call from an unknown number claiming to be someone you know, “my phone broke, I’m using a friend’s.”
Background noise that seems staged, like sirens or crying.

But remember: a good clone may show none of these. Thats why the next section matters most.

How to protect yourself

Set a family code word or question. Agree on a secret word, phrase or question with close family members, something not findable online. Not your pet’s name or your village, but something random, like “blue teapot.” If anyone calls in a crisis asking for money, ask for it. A cloned voice won’t know it. This single step defeats most voice cloning scams.
Hang up and call back. If you get a distressing call, hang up and call the person directly on the number saved in your phone. Or call another family member who’d know where they are. Scammers will try to keep you on the line. Don’t let them.
Ask a question only they would know. Something not on social media: “What did we eat at Nani’s house last Eid?”
Slow down. Scammers rely on panic. Take a breath. A real emergency can wait a few minutes while you verify.
Be careful with unknown numbers. Let unknown calls go to voicemail, or be cautious about saying much. Some scammers record your voice on calls to clone it later.
Limit public voice samples. Consider making social media profiles private, especially those with lots of videos of you talking. Think twice before posting long voice notes in large groups.

For businesses

Set a rule that no payment or change to bank details is ever authorised by voice or video call alone. Require a second confirmation through a separate, known channel, and ideally approval from a second person. This protects against both cloned voices and the deepfake video calls we’ll cover next.

Part 3: Deepfake video calls and fake videos

If voice cloning is unsettling, deepfake video takes it further. Real-time deepfake technology can put someone else’s face on a scammer during a live video call.

The case that made headlines

In early 2024, a finance employee at the engineering firm Arup in Hong Kong transferred around $25 million after a video call in which the company’s chief financial officer and several colleagues appeared. All of them, it turned out, were deepfakes. The employee had initially been suspicious of an email, but the video call, with familiar faces and voices, convinced them. It’s become the textbook example of deepfake fraud against businesses.

Deepfakes aimed at individuals

Fake video calls from relatives or friends asking for money, usually brief and with excuses for poor quality.
Romance scams where the “person” on video calls doesn’t exist, built from AI-generated or stolen faces.
Fake celebrity endorsements. Deepfake videos of famous businesspeople, TV presenters, cricketers or politicians promoting investment schemes, crypto platforms or products. These spread on Facebook, YouTube and TikTok. If a celebrity appears to be telling you about a guaranteed money-making app, it’s almost certainly a scam.
Fake news and misinformation. Fake videos or audio of public figures saying things they never said, often during elections or tensions. Fact-checkers have repeatedly debunked AI-generated audio and video involving officials in our region.

Spotting deepfakes, and why you shouldn’t rely on it

Older deepfakes had visible flaws: unnatural blinking, blurry edges around the face, mismatched lip sync, odd lighting, strange teeth or ears. Some still do, especially in live calls. You can sometimes expose a live deepfake by asking the person to turn their head sideways, wave a hand in front of their face, or stand up, since many real-time systems struggle with these.

But deepfakes are improving fast, and research suggests people are poor at spotting them reliably. So just like with voice clones, the real protection is process:

Verify unusual requests through a separate channel you already trust.
Use code words with family.
In business, never authorise payments based on a video call alone.
Be sceptical of any video, however real it looks, that pushes you towards money, urgency or outrage.

Fake investment ads

This deserves special mention because it’s so common. Deepfake videos of trusted public figures promoting “AI trading bots,” crypto platforms or government-backed investment schemes appear constantly in social media ads. They often lead to slick websites showing fake profits, and victims are encouraged to invest more and more until they try to withdraw and find they can’t. The FBI’s data showed investment scams accounted for the biggest share of AI-related losses. The rule is simple: no legitimate public figure is going to personally promote a guaranteed-return investment in a social media ad.

Part 4: AI-powered phishing and messages

Phishing means tricking people into giving away passwords, codes, money or personal information, usually through fake emails, SMS messages or WhatsApp messages. AI has made phishing much more convincing.

What’s changed

Perfect language. AI writes fluent messages in any language and tone, formal bank-speak or casual Roman Urdu.
Personalisation. Messages that mention your name, employer, recent purchase or location.
Conversation. AI chatbots can carry on a convincing back-and-forth conversation, answering your questions and overcoming your doubts.
Volume. Endless variations make it harder for filters to catch them all.

Common phishing messages in Pakistan

Courier and delivery. “Your parcel couldn’t be delivered, update your address,” with a link to a fake site that asks for card details or personal information.
Bank and wallet alerts. “Your account will be blocked, verify now.” Fake JazzCash, Easypaisa or bank messages asking you to click a link or share a code.
Prizes and schemes. “You’ve won a prize,” “You’re eligible for a government support payment,” often impersonating official programmes, asking for a “registration fee” or your details.
Fake official notices. Messages pretending to be from law enforcement, the FBR, or courts, sometimes including fake FIRs or legal notices to frighten you into paying. The FIA has specifically warned about fake notices used to blackmail people.
Job offers. “Earn from home by liking videos” or fake overseas job offers that require upfront fees.
Account security alerts. Fake Google, Microsoft, Facebook or Instagram warnings leading to fake login pages.

How to protect yourself

Don’t click links in unexpected messages. If a message says there’s a problem with your bank, parcel or account, open the official app or type the website address yourself.
Check the sender carefully, but don’t rely on it alone. Phone numbers and email addresses can be spoofed.
Check website addresses. Look carefully at the address bar for misspellings and extra words. A padlock icon only means the connection is encrypted, not that the site is legitimate. Scam sites have padlocks too.
Never share OTPs, PINs or passwords. No genuine organisation will ask for these by phone, message or email.
Be suspicious of urgency, fear and too-good-to-be-true offers.
When in doubt, call the organisation using the number on its official website or the back of your card.

Part 5: WhatsApp and account takeover

WhatsApp is central to life in Pakistan, for family, business and everything in between. That makes WhatsApp accounts a top target.

How WhatsApp accounts get hijacked

The most common method is surprisingly simple. The scammer tries to register your phone number on WhatsApp on their own phone. WhatsApp sends a six-digit verification code to your phone by SMS. The scammer then contacts you, pretending to be a courier, a telecom company, a government official, a friend, or even WhatsApp support, and tricks you into sharing that code. As the Digital Rights Foundation has reported, scammers have posed as delivery riders and education officials to get these codes. Once you share it, they take over your account.

Once they have your account, they message your contacts and groups asking for urgent loans, often adding a cloned voice note for extra credibility. Your friends and family trusts messages from you, so it works.

How to protect your WhatsApp

Never share your WhatsApp verification code with anyone, ever. Not with “WhatsApp support,” not with a courier, not with a friend. Nobody legitimate needs it.
Turn on two-step verification. In WhatsApp, go to Settings, Account, Two-step verification, and set a six-digit PIN and recovery email. Even if someone gets your SMS code, they can’t register your account without this PIN.
Turn on passkeys if available. WhatsApp supports passkeys on many phones, letting you verify with your fingerprint or face instead of SMS codes.
Check linked devices. Settings, Linked devices. Remove any computers or browsers you don’t recognise.
Control who can add you to groups. Settings, Privacy, Groups. Set to “My contacts” to reduce spam and scam groups.
Silence unknown callers. Settings, Privacy, Calls. This reduces scam calls.
Be cautious with voice notes and requests for money, even from contacts. Verify by calling them directly.

If your WhatsApp is hijacked

Try to re-register WhatsApp on your phone with your number right away. You’ll receive a new code. This logs the scammer out, unless they’ve set two-step verification, in which case they may lock you out temporarily.
Warn your contacts through other means (SMS, calls, social media, other family members) that your account was hacked and not to send money.
Email WhatsApp support from the app’s help section to report it.
Report it to cybercrime authorities (see Part 13).

Other accounts

The same approach, tricking you into sharing a code, is used to take over email, Facebook, Instagram, bank and wallet accounts. The rule is the same everywhere: a code sent to your phone is for you only.

Part 6: Fake websites, shops, apps and investment scams

AI makes it easy to build convincing fake websites and online shops, write fake reviews, and generate realistic product photos.

Fake online shops

Scam shops advertise on social media with prices that are too good to be true: the latest phones, graphics cards, laptops, branded clothes. They take payment and either send nothing, send a fake, or send something completely different. With AI, these sites look more professional than ever, with polished descriptions and glowing fake reviews.

As a computer shop ourselves, we see the aftermath regularly: people who paid for a graphics card at an unbelievable price from a Facebook page that then disappeared. Protect yourself:

If the price is far below every reputable seller, be very suspicious.
Check how long the business has existed, whether it has a physical address, and real reviews from independent sources.
Prefer cash on delivery or secure payment methods when buying from new sellers, and be wary of sellers who insist on advance bank transfer to a personal account.
Search the shop’s name with words like “scam” or “fraud.”
For expensive items, buy from established sellers with a track record and proper warranty.

Fake apps

Fake apps impersonating banks, wallets, loan services, AI tools or popular apps appear on app stores and especially on websites offering direct APK downloads. Some steal login details, others contain malware. Predatory loan apps have also been a serious problem, accessing contacts and photos to harass borrowers.

Download apps only from the official Google Play Store or Apple App Store, and check the developer name.
Avoid installing APK files from websites or WhatsApp messages.
Check app permissions. A calculator doesn’t need your contacts and SMS.
Be particularly wary of “AI” apps promising amazing features. Many are fake or loaded with ads and tracking.

Investment and crypto scams

These are among the most financially damaging scams worldwide, and AI makes them more convincing. Common patterns:

“AI trading bots” promising guaranteed daily profits.
WhatsApp or Telegram “investment groups” with fake members posting fake profits.
Romance or friendship scams that slowly introduce an “investment opportunity.”
Deepfake celebrity endorsements.
Fake platforms showing your “profits” growing, until you try to withdraw and are asked for “taxes” or “fees.”

The golden rules: guaranteed high returns don’t exist; if you can’t withdraw, it’s a scam; never invest because someone you’ve only met online recommends it; and check whether a platform is registered with Pakistan’s Securities and Exchange Commission (SECP), which publishes warnings about unauthorised schemes.

Common scam scripts to know about

Scammers reuse scripts that work. AI makes them more polished, but the basic stories stay the same. Recognising the script is often the fastest way to spot a scam.

“Your card or account has been blocked.” A caller claiming to be from your bank says suspicious activity was detected and asks you to “verify” your card number, PIN or the code you’re about to receive. Banks never ask for your PIN or OTP over the phone.
“I sent money to your number by mistake.” You receive a fake SMS that looks like a wallet credit, followed by a call or message asking you to “return” the money. There was no real credit, check your actual balance in the official app.
“You’ve won a prize” or “lucky draw.” Someone claiming to be from a telecom company, TV programme or official body says you’ve won a car, cash or phone, but need to pay a fee or share a code to claim it.
“Government support payment.” Messages claiming you’re eligible for a government aid programme and need to register through a link or pay a processing fee. Genuine programmes don’t charge fees or ask for codes.
“Your SIM or ID will be blocked.” A caller claiming to be from the PTA or a telecom operator says your SIM will be blocked unless you verify your details or share a code.
“Customs is holding your parcel.” A message or call saying an international parcel addressed to you is stuck at customs and requires a payment to release it.
“Help me, I’m stuck.” The family emergency script, now powered by voice cloning.
“Earn from home.” Simple online tasks like liking videos or reviewing products, with small early payouts to build trust before asking for a “deposit” to unlock bigger earnings.

Notice the common ingredients: a surprise, urgency, and a request for money, a code, or personal details. When you see those together, stop and verify.

Part 7: Sextortion and fake images

This is a difficult topic, but an important one, particularly for parents and young people. AI image tools can create fake explicit images of real people from ordinary photos. Criminals use these, or real images obtained through deception, to blackmail victims.

How it works

Fake images: scammers take public photos from social media and use AI to create fake explicit images, then threaten to share them with family, friends or employers unless paid.
Video call traps: a scammer, often posing as an attractive stranger, gets the victim on a video call, records it, sometimes manipulates it, and then demands money.
Grooming: scammers build trust with young people online, then pressure them to share images, then blackmail them.

Pakistani authorities have conducted raids against organised groups running sextortion and deepfake schemes, and have warned about criminals targeting women in particular through hacked WhatsApp accounts.

If it happens to you or someone you know

Don’t pay. Paying rarely ends it. Scammers usually come back for more.
Stop contact, but don’t delete the evidence. Take screenshots of messages, profiles and payment demands.
Report the account to the platform.
Report to cybercrime authorities. This is a crime, and the victim is not the one who did anything wrong.
Talk to someone you trust. Shame is the scammer’s main weapon. Support from family or friends takes that power away. Organisations like the Digital Rights Foundation run helplines that support victims of online harassment in Pakistan.

For parents

Talk to your children about this calmly and without blame. Make sure they know they can come to you if something goes wrong online, even if they made a mistake, and that you’ll help rather than punish. That one conversation can make a huge difference. Encourage private social media accounts, and caution them about video calls and sharing images with people they’ve only met online.

Part 8: Securing your PC

Now to the practical side of protecting your devices. Let’s start with your computer.

Keep Windows updated

Security updates fix vulnerabilities that attackers exploit. Keep Windows Update turned on and install updates promptly. Restart when asked, since many updates only take effect after a restart.

If you’re still running Windows 10, note that Microsoft ended mainstream support in October 2025. Without ongoing security updates, an unsupported operating system becomes increasingly risky over time. If your PC can run Windows 11, upgrading is strongly recommended. If it can’t, it may be time to consider a hardware upgrade, and we’re happy to advise.

Use built-in protection

Windows Security, which includes Microsoft Defender Antivirus, is built into Windows and provides solid protection for most home users. Make sure it’s on: open Windows Security and check that Virus and threat protection, Firewall, and App and browser control all show green ticks. You don’t necessarily need to buy separate antivirus software, though reputable paid options add extra features.

Keep your browser and apps updated

Your web browser is your main window to the internet and a major target. Chrome, Edge and Firefox update automatically, but make sure they’re restarting to apply updates. Update other software too, especially anything that opens files from the internet.

Be careful what you install

Download software only from official websites or the Microsoft Store.
Avoid cracked software, pirated games and “free” versions of paid programs. They’re one of the most common ways malware gets onto PCs, including information stealers that harvest your saved passwords and browser sessions.
Be very careful with browser extensions. Install only well-known extensions you actually need, and remove ones you don’t use. Malicious extensions, including fake “AI assistant” extensions, can read everything you do in your browser.
Be wary of fake AI tools. Scammers distribute malware disguised as free AI image generators, chatbots or “ChatGPT for desktop” apps. Get AI tools only from the official company website or app store.

Use a standard account for daily use

For extra protection, especially on family PCs, use a standard (non-administrator) account for everyday use. Malware running under a standard account can do less damage.

Turn on device encryption

Device encryption (BitLocker on Windows Pro, or Device Encryption on many Home PCs) protects your data if your laptop is lost or stolen. Check in Settings, Privacy and security, Device encryption. Make sure you save your recovery key somewhere safe, like your Microsoft account, since you’ll need it if something goes wrong.

Back up your files

Backups are your safety net against ransomware, hardware failure and accidents. Follow a simple version of the 3-2-1 rule: keep important files in at least two places, one of which is not connected to your PC all the time, for example a cloud backup plus an external drive you plug in occasionally. Test that you can actually restore from your backups.

Lock your screen

Use a password, PIN or Windows Hello (fingerprint or face) to sign in, and lock your PC when you step away (Windows key and L).

Be careful with AI tools and sensitive data

When using cloud AI chatbots and agents, think about what you paste into them. Avoid sharing passwords, full card numbers, ID numbers and confidential business information. As we discussed in our guide to AI agents, agents that can browse and act on your behalf bring new risks like prompt injection, so give them minimal access and keep approvals on for important actions. For sensitive documents, consider running AI locally so data stays on your machine.

Part 9: Securing your phone

For many people, the phone is more important than the PC, holding banking apps, WhatsApp, email, photos and two-step verification codes.

Keep it updated. Install Android or iOS updates promptly. If your phone no longer receives security updates, consider replacing it, especially if you use it for banking.
Use a strong screen lock: a PIN of at least six digits, or a password, plus fingerprint or face unlock.
Install apps only from official stores, and review permissions.
Turn on Google Play Protect on Android (it’s usually on by default).
Enable Find My Device (Android) or Find My (iPhone), so you can locate, lock or erase a lost phone.
Protect your SIM. Set a SIM PIN, and be alert to “SIM swap” fraud, where criminals get a duplicate of your SIM to receive your codes. If your phone suddenly loses signal unexpectedly and you can’t make calls, contact your mobile operator immediately.
Use app locks for banking and messaging apps where available.
Be careful on public Wi-Fi. Avoid banking on public networks, or use your mobile data instead.
Review app access to your microphone, camera, location and contacts periodically.

How AI is changing malware, and defence

AI doesn’t only help scammers write convincing messages. Security researchers have documented criminals using AI tools to help write malicious code, generate variations of malware to evade detection, and automate the search for vulnerable systems. Fake AI apps and browser extensions have themselves become a popular way to spread information-stealing malware, precisely because so many people are eager to try new AI tools.

The good news is that defenders use AI too, and they’ve been doing it for longer. Microsoft Defender, Google’s Gmail and Safe Browsing, and most modern security tools use machine learning to recognise suspicious behaviour, not just known malware signatures. Banks use AI to flag unusual transactions. Phone makers have added scam call detection and spam filtering that run on the device. These protections block enormous numbers of attacks every day without people noticing.

For home users, the practical takeaway is reassuring: keep your built-in protections switched on and updated, and they’ll handle much of the automated threat. Your job is the part software can’t do well, recognising when a person, a voice or a message is trying to manipulate you into acting against your own interests.

Misinformation and AI-generated content

Not every AI threat is about stealing money. AI-generated images, audio and video are increasingly used to spread false information, from fake statements by politicians to fabricated news events, particularly during elections and times of tension. Fact-checking organisations have debunked numerous AI-generated clips involving officials in South Asia.

A few habits help:

Pause before sharing. Content designed to make you angry or frightened is the most likely to be manipulated, and the most likely to be shared without checking.
Check the source. Is the clip from a reputable news organisation, or a random account? Has any trusted outlet reported it?
Look for fact-checks. Search for the claim along with words like “fact check” or “fake.”
Be wary of “AI detectors.” Tools that claim to detect AI-generated images, audio or text are unreliable and can give both false positives and false negatives. They can be one input, but not proof.
Talk about it at home. Help children and elderly relatives understand that seeing or hearing something is no longer proof that it happened.

Business email compromise, the expensive one

For businesses, one of the most costly forms of fraud is business email compromise. A scammer either hacks a real email account or creates a lookalike address, then impersonates a supplier, executive or partner, usually to redirect a payment. A classic example: an email from a “supplier” saying their bank details have changed and the next invoice should be paid to a new account. AI makes these emails more convincing, and adding a cloned voice call or a deepfake video, as in the Arup case, makes them more convincing still.

The defence is a firm rule: any change to payment details must be verified by calling the supplier on a phone number you already have on file, not one in the email. Make it a policy, so staff don’t feel awkward following it, even when the request appears to come from the boss.

Part 10: Your router and smart home devices

Your home router connects everything to the internet, and it’s often the most neglected device in the house.

Secure your router

Change the default admin password. Many routers ship with simple default passwords like “admin.” Anyone on your network, or sometimes on the internet, could log in and change settings. Log in to your router’s settings page (often 192.168.1.1 or 192.168.0.1, check the label on the router) and set a strong, unique admin password.
Use strong Wi-Fi security. Choose WPA3 if your router and devices support it, otherwise WPA2. Never use WEP or an open network.
Set a strong Wi-Fi password. Long and random, not your phone number or name.
Update the router’s firmware. Router makers release security updates. Check the router’s settings page for an update option, or ask your internet provider. Old routers that no longer receive updates should be replaced.
Turn off WPS and remote management unless you specifically need them.
Use a guest network for visitors and for smart home devices if your router supports it, keeping them separate from your main computers and phones.

If your router was provided by your internet service provider, they may manage some settings. Ask them about firmware updates and changing default passwords.

Smart home devices and cameras

Security cameras, smart doorbells, smart plugs, smart TVs and baby monitors are increasingly common. Many cheap devices have weak security.

Change default passwords on every device, especially cameras and DVR/NVR systems. Unprotected cameras have been found streaming openly on the internet.
Update firmware regularly through the device’s app.
Buy from reputable brands that provide security updates. Very cheap, unknown-brand cameras are a common weak point.
Turn on two-step verification for camera and smart home accounts.
Think about camera placement. Avoid placing indoor cameras in private areas like bedrooms and bathrooms.
Put smart devices on a separate network (guest network) if possible.
Check smart speaker settings. Review voice recording history and privacy settings in the device’s app, and use the microphone mute button when you want privacy.

CCTV systems

Many homes and shops in Pakistan have CCTV systems with DVRs or NVRs connected to the internet for remote viewing. These are frequently installed with default passwords and never updated. If you have one, make sure the admin password has been changed from the default, the firmware is updated, and remote access uses the manufacturer’s secure app rather than open ports on your router. Ask your installer if you’re not sure.

Part 11: Passwords, passkeys and two-step verification

Weak and reused passwords remain one of the biggest causes of hacked accounts. AI hasn’t changed that, but it has made attacks faster.

The problem with reused passwords

Websites get hacked and their password databases leak. Criminals then try those email and password combinations on other sites, like your email, social media and banking. This is called credential stuffing, and it’s automated at huge scale. If you use the same password everywhere, one leak can open all your accounts.

Use a password manager

A password manager creates and stores strong, unique passwords for every account. You only need to remember one master password. Good options include Bitwarden (which has a free plan), 1Password, and the password managers built into Google, Apple and Microsoft accounts. They also warn you if a password appears in a known leak.

Make your master password a long passphrase, several random words, and protect it with two-step verification.

Turn on two-step verification (2FA)

Two-step verification adds a second check beyond your password, so even if someone steals your password, they can’t get in. Turn it on for:

Your main email account (most important, since it can reset other passwords).
WhatsApp (two-step verification PIN).
Banking and wallet apps.
Social media accounts.
Cloud storage and your Microsoft, Google or Apple account.

Options from strongest to weakest:

Passkeys or security keys: the strongest, resistant to phishing.
Authenticator apps like Google Authenticator, Microsoft Authenticator or Authy: strong and widely supported.
SMS codes: better than nothing, but vulnerable to SIM swap and phishing.

Passkeys: the future of logging in

Passkeys replace passwords with a cryptographic key stored on your device, unlocked with your fingerprint, face or device PIN. Google, Apple, Microsoft, WhatsApp and many other services support them. Passkeys can’t be phished in the usual way, because they only work on the genuine website or app, and there’s no password to steal or reuse. Turn them on wherever they’re offered.

Check if you’ve been in a data breach

The website Have I Been Pwned lets you enter your email address and see whether it has appeared in known data breaches. If it has, change the password for that service and anywhere you reused it.

Security questions

Security questions like “What’s your mother’s maiden name?” are easy to research or guess. Where you can, give random answers and store them in your password manager.

Privacy settings worth changing today

The less personal information scammers can find about you, the harder it is for them to build a convincing, personalised scam. These settings take a few minutes each.

Facebook and Instagram

Make your profile private or limit posts to friends. On Instagram, switch to a private account if you don’t need a public audience.
Hide your friends list, phone number, email and date of birth from the public.
Review old public posts, especially videos where you’re speaking at length, and limit who can see them.
Turn on two-step verification and login alerts.
Review which apps and websites are connected to your account and remove ones you don’t use.

WhatsApp privacy

Set Last Seen, Profile Photo and About to “My contacts” or “Nobody.”
Limit who can add you to groups.
Silence unknown callers.

Google and Microsoft accounts

Run Google’s Security Checkup and Privacy Checkup, and Microsoft’s security dashboard. They walk you through important settings.
Check recovery phone numbers and emails are up to date, so you can regain access if you’re locked out.
Review devices signed in to your account and remove any you don’t recognise.

LinkedIn and work profiles

Professional profiles are a goldmine for business email scams and spear phishing, since they reveal who works where, who reports to whom, and who handles payments. Consider limiting what’s visible publicly, and train staff who handle money to expect targeted scams.

Location and photos

Turn off location tagging on social media posts, and be careful about posting travel plans in real time. Photos can also contain location data in their metadata; many social platforms strip this, but messaging apps and direct file sharing may not.

Part 12: Protecting your family and small business

Elderly relatives

Older people are frequent targets, as the FBI data shows aswell. They may be less familiar with AI’s capabilities and more trusting of phone calls. Practical steps:

Explain voice cloning simply: “Computers can now copy anyone’s voice. If I ever call asking for money urgently, ask me our code word.”
Set up the family code word together.
Agree they’ll always call you or another family member before sending money to anyone.
Help set up two-step verification on their WhatsApp, and explain never to share codes.
Silence unknown callers on WhatsApp and consider call-blocking features on their phone.
Keep their phone updated and remove unnecessary apps.
Check in regularly, without making them feel foolish. Scammers rely on victims feeling embarrassed.

Teenagers and children

Talk openly about scams, sextortion and fake images, and make sure they know they can come to you without fear of punishment.
Encourage private social media accounts and careful sharing of personal details, voice and video.
Use parental controls appropriate to their age: Google Family Link, Apple Screen Time, Microsoft Family Safety.
Teach them to recognise phishing, fake giveaways and “too good to be true” offers.
Discuss critical thinking about AI-generated content and misinformation.

Small businesses

Small businesses are increasingly targeted because they often have money to steal and weaker defences than large companies.

Payment verification rules. Never change supplier bank details or make urgent payments based on email, voice or video alone. Verify through a known phone number, and require two people to approve large payments.
Train staff about phishing, voice cloning and deepfakes. A short conversation with real examples goes a long way.
Use business email with 2FA for all staff accounts.
Keep devices updated and backed up, including point-of-sale systems.
Limit access. Staff should only have access to what they need.
Secure your WhatsApp Business account with two-step verification.
Have a plan for what to do if an account is compromised or money is sent to a scammer, including who to call at your bank immediately.
Be careful with AI tools and customer data, as covered in our AI agents guide.

A family security checklist

Family code word agreed.
WhatsApp two-step verification on for everyone.
Main email accounts have 2FA.
Password manager set up for the adults.
All phones and PCs updated, with automatic updates on.
Router admin password changed and firmware updated.
Camera and smart device default passwords changed.
Important files backed up.
Everyone knows: never share OTPs, hang up and call back, slow down.

A 30-minute weekend security tune-up

If all of this feels like a lot, here’s a simple plan you can do in one sitting this weekend. It covers the most important protections for a typical household.

Minutes 0 to 5: WhatsApp. On every family member’s phone, turn on two-step verification with a PIN and recovery email, check linked devices, and silence unknown callers.
Minutes 5 to 10: Email. Turn on two-step verification for your main email accounts, ideally with an authenticator app or passkey, and check recovery details.
Minutes 10 to 15: Updates. Run Windows Update on your PC, check for phone system updates, and make sure your browser is up to date.
Minutes 15 to 20: Router. Log in to your router, change the admin password if it’s still the default, and check for a firmware update.
Minutes 20 to 25: The code word. Agree on a family code word and share it in person, not over WhatsApp. Explain to elderly relatives why it matters.
Minutes 25 to 30: Backups. Make sure your important photos and documents are backed up somewhere, whether cloud storage or an external drive.

Then, when you have more time, set up a password manager, turn on passkeys where available, and go through the privacy settings in Part 10. Each step makes you a harder target, and scammers generally move on to easier ones.

Part 13: What to do if it happens to you

Even careful people get scammed. Scammers are professionals, and anyone can be caught off guard. If it happens, act quickly and don’t blame yourself.

If you’ve sent money

Contact your bank or wallet provider immediately using the official helpline. Explain it’s fraud and ask them to block or reverse the transaction. Speed matters, the sooner you call, the better the chance of stopping the money.
Collect evidence: screenshots of messages, phone numbers, transaction IDs, websites and account details.
Report the crime to the cybercrime authorities.

If you’ve shared a password or code

Change the password for that account immediately, and anywhere else you used it.
Turn on two-step verification if it wasn’t already on.
Check for unfamiliar devices or sessions and sign them out.
For bank details, call your bank to block cards or accounts.
Watch your accounts closely for unusual activity.

If your device may be infected

Disconnect it from the internet.
Run a full scan with Windows Security or a reputable antivirus.
From a different, clean device, change passwords for important accounts, starting with email and banking.
If problems persist, get professional help. In some cases, a clean reinstall of Windows is the safest option, after backing up personal files.

Reporting cybercrime in Pakistan

Cybercrime in Pakistan is handled by the National Cyber Crime Investigation Agency (NCCIA), which took over this responsibility from the FIA’s Cyber Crime Wing. Check the official NCCIA or government website for the current complaint portal and helpline, since channels have changed during the transition. Keep your evidence organised when you report. You can also report scam numbers to the PTA, and report fraudulent accounts to the platforms where you found them, like WhatsApp, Facebook and Instagram. For online harassment, the Digital Rights Foundation’s helpline offers support.

Look after yourself

Being scammed can be distressing and embarrassing. Remember that these crimes are designed by professionals to exploit normal human emotions. Talk to family or friends. Sharing what happened also helps protect others, because the more people know about these scams, the less effective they become.

Part 14: Frequently asked questions

Can AI really clone my voice from a short clip?

Yes. Modern tools can create a convincing imitation from a short, clear sample. Longer samples produce better clones. That’s why limiting public voice and video content, and using a family code word, both help.

How can I tell if a call is a voice clone?

Often you can’t, reliably. Instead of trying to detect it, verify: hang up and call back on a known number, or ask for your family code word.

Can I tell if a video is a deepfake?

Sometimes, from visual glitches, but deepfakes are improving fast. Don’t rely on spotting them. Verify unusual requests through a trusted separate channel.

Do I need to buy antivirus software?

For most home users, the built-in Windows Security is good, as long as it’s on and Windows is updated. Paid antivirus suites add extras like VPNs and identity monitoring. Safe habits matter more than any software.

Is it safe to use AI chatbots?

Generally yes, from reputable companies. Avoid pasting passwords, ID numbers, full card details or confidential business data. Use official apps and websites only.

What is the single most important thing I can do?

For most families: turn on WhatsApp two-step verification, never share OTP codes, and agree on a family code word. Those three steps prevent a large share of the scams we see in Pakistan.

Are passkeys safe?

Yes. Passkeys are more secure than passwords, resistant to phishing, and easier to use. Turn them on wherever available.

Should I stop posting videos of myself and my family?

You don’t have to stop entirely, but consider who can see them. Private accounts with trusted followers reduce the risk of your voice and face being collected by scammers.

My elderly parent got a suspicious call. What should I do?

Reassure them, make sure no money or codes were shared, and if they were, contact the bank immediately. Then set up a code word and two-step verification together.

Can AI help protect me too?

Yes. Email providers, banks and security software increasingly use AI to detect spam, phishing and fraud. Phones now include scam call detection features. These help, but they’re not perfect, so good habits remain essential.

Common myths about AI scams

Myth: “I’d never fall for a scam.”

Scams work by catching people at the wrong moment: tired, busy, frightened or excited. Smart, experienced people fall for them every day, including professionals at large companies. Assuming you’re immune is exactly what makes people careless.

Myth: “Scammers only target rich people.”

Most scams are numbers games. Scammers target everyone, because even small amounts from many people add up. Students, pensioners and small shop owners are all common targets.

Myth: “A caller who knows my details must be genuine.”

Personal details are easy to obtain from data leaks and social media. Knowing your name, CNIC digits or address doesn’t prove a caller is from your bank or any official body.

Myth: “The padlock in the browser means a site is safe.”

The padlock only means your connection to the site is encrypted. Scam sites use it too. Check the actual website address carefully.

Myth: “I’ll recognise my own family’s voice.”

Modern voice clones can be extremely convincing, especially over a phone line and when you’re panicked. That’s why the code word and call-back habits matter more than your ears.

Myth: “Antivirus software protects me from scams.”

Antivirus helps against malware, but it can’t stop you from willingly sending money or sharing a code with a convincing caller. Most AI scams target people, not computers.

A quick glossary

Deepfake: AI-generated fake video, image or audio of a real person.
Voice cloning: using AI to imitate a specific person’s voice.
Phishing: tricking people into giving away information or money through fake messages or websites.
Spear phishing: targeted, personalised phishing aimed at a specific person.
OTP: one-time password, a short code sent to verify your identity.
2FA / two-step verification: a second check beyond your password.
Passkey: a passwordless login method using a cryptographic key on your device.
SIM swap: fraud where criminals obtain a duplicate of your SIM to receive your codes.
Credential stuffing: trying leaked passwords on other websites.
Sextortion: blackmail using real or fake intimate images.
Ransomware: malware that locks your files and demands payment.
Information stealer: malware that harvests saved passwords, cookies and data from your PC.

The bottom line

AI has made scams more convincing than ever. Voices can be cloned, faces can be faked, and phishing messages can be flawless and personal. The old advice to look for bad grammar or a robotic voice no longer protects you. The FBI’s first dedicated count of AI-related fraud, and repeated warnings and raids by Pakistani authorities, show this isn’t a future problem. It’s happening now, to ordinary families and businesses.

The good news is that the best defences are simple and mostly free. Agree on a family code word. Hang up and call back. Slow down when you feel pressure. Never share verification codes. Turn on two-step verification, especially on WhatsApp and email. Use a password manager. Keep your devices and router updated. And talk to your family, especially elderly relatives and teenagers, about how these scams work.

You can’t always spot the fake. But with the right habits, you don’t have to.

If you’d like help securing your PC, setting up backups, updating an old router, or checking whether your computer is still getting security updates, come and see us. We’re always happy to help, and a little time spent on security now can save a lot of pain later.

This brings our ten-part series on the biggest PC and AI topics of 2026 to a close. Thank you for reading. If you missed any, you can find all of them in the blog section on our homepage.

Sources

Planning a build or an upgrade?

Tell us what you already have and we'll help you spend only where it matters.

Browse the shop Ask on WhatsApp