AI Makes Scams More Convincing
How to Protect Yourself
Cybersecurity Awareness Month — Week 3
An unexpected message arrives claiming there is a problem with your bank account. It looks professional, uses familiar language, and asks you to act immediately. Nothing about its spelling or grammar raises suspicion. Should you follow the link?
Artificial intelligence is giving criminals tools to create more convincing messages, fake websites, and impersonations. The awkward wording that once helped us recognize a scam may no longer be there. A polished message deserves the same careful checking as any other unexpected request.
For us, this means the security habits we have been developing matter even more.
Main Takeaway
AI can make a scam sound more believable, but convincing language is not proof of a legitimate request. Verify unexpected messages independently, keep your devices updated, protect each account with a unique password and multifactor authentication, and maintain backups of important files.
You do not need to become a cybersecurity specialist to put these habits into practice.
Start with one important account or device today, then work through the others.
Pause, Check, and then Decide.
When the attack begins with a message
Some attacks begin by persuading us to do something: open an attachment, enter a password, disclose personal information, or send money. This is called social engineering. Phishing is a familiar example, using messages that appear to come from a trusted organization or person.
The message might warn that an account will be closed, announce an unexpected refund, or ask you to review a document. Its purpose is to move you from reading to acting before you have checked the request.
Build the habit of pausing before following an unexpected link. On a computer, hovering over a link can reveal its destination and expose an obvious mismatch. However, a plausible-looking address does not prove that the destination is safe.
If a message claims there is a problem with an account, open the organization’s familiar app or visit its website independently. If someone sends an unexpected attachment, confirm it with the sender through a phone number or another contact method you already trust.
The same principle we used when evaluating internet offers still applies: Pause, Check, and then Decide.
Protecting the device itself
A deceptive message can also lead to malicious software, commonly called malware. Some malware steals information or monitors activity. Ransomware can lock files and demand payment to restore access.
Keeping your operating system and applications updated helps close security weaknesses that criminals may exploit. Enable automatic updates where available, and check that your device’s security protection is active and receiving updates.
Backups provide another layer of protection. Think about the photographs, documents, and records you would have difficulty replacing. Keep a separate backup and make sure you know how to recover files from it. If you use an external backup drive, disconnect it after the backup is complete so it is not continuously exposed to problems affecting the computer.
These measures serve different purposes: updates and security software help prevent damage, while backups help you recover if something goes wrong.
Protecting your accounts
Criminals do not always need to break into your computer. Sometimes they can sign in to an account using a stolen password.
When login information is exposed in a data breach, attackers may try those same credentials on other services. A reused password can turn one compromised account into several.
Use a long, unique password for each account. A password manager can help create and store those passwords without requiring you to memorize them all. Change a password promptly when there is evidence it has been exposed or someone has accessed the account without permission.
Enable multifactor authentication wherever it is available. This adds another step to signing in, such as approval through an authenticator app or a security key. Never share verification codes with an unexpected caller or approve a sign-in request you did not initiate.
When an online service stops working
Some attacks target the availability of a service rather than your information. A denial-of-service attack overwhelms a website or network with traffic, making it difficult or impossible for legitimate users to connect.
For residents, the result may be a temporarily unavailable online service. Its operators are responsible for defending and restoring it. An outage alone does not establish that your computer or account has been compromised.
