Fraudsters No Longer Break In, They Log In: AI Phishing, Cloned Voices and Fake QR Codes

For years we taught people a simple rule: if an e-mail is written in broken language, has odd word order and addresses you as “Dear customer”, delete it. In 2026 that rule no longer works. Generative artificial intelligence writes flawlessly, in any language and in whatever style the attacker chooses.

The way fraudsters operate has changed too. They do not break in through complex code and technical vulnerabilities. They simply log in, because you hand them your password, your payment card or your money yourself. All it takes is a well-written e-mail, a familiar voice on the phone or a QR code on a parking meter.

The numbers confirm it. According to the latest report of the Czech National Cyber and Information Security Agency (NÚKIB), the Czech Republic recorded 21,137 cybercrime offences in 2025, 14% more than the year before. Social engineering and manipulation of victims were among the most common methods (Mobilenet.cz).

Here are three trends everyone should know about, and above all how to defend against them.

1. The end of grammar mistakes: AI phishing

Today a phishing e-mail looks exactly like a message from your bank, a government office or a courier. Correct language, logo, signature, and often context too: it knows you are expecting a parcel, that you recently changed your tariff, or that your company uses a particular accounting system. AI gathers this information from public profiles, company websites and leaked databases.

How well this works was shown by a study by security researchers including Bruce Schneier, published in Harvard Business Review: fully automated phishing written by artificial intelligence achieved a 54% click rate, the same as e-mails from experienced human attackers, and campaign costs fell by more than 95% (StationX, summary of studies). In other words, a high-quality fraudulent e-mail is now cheap and can be sent to millions of people.

That is why the Czech police warn that the old warning signs are no longer enough. The reliable sign of fraud is no longer the form of a message but its content: urgency and a request for money, login details or an account change.

What to look at instead of grammar:

• Does the message want you to do something right now? (“Within 24 hours”, “or your account will be blocked”.)
• Does the link lead to a login page or a payment gateway?
• Does the real address of the link (when you hover over it) match the institution’s official domain?
• Is it asking for something a bank or authority would never ask for by e-mail, such as a PIN, a password or an SMS code?

2. A familiar voice, a stranger: voice cloning and deepfake videos

Vishing with a cloned voice

The phone rings and it is your daughter, your partner or your boss. They are stressed, there has been an accident, they need you to send money immediately or read out a code from an SMS. The voice is right, the intonation is right, even the pet phrase the person always uses.

Cloning a voice no longer takes hours of recordings. According to McAfee, a few seconds of audio are enough, for example from a video on social media (StationX). Anyone with a public Instagram, TikTok or YouTube account has given attackers material for free.

The Czech police point out that even experienced users can no longer rely on the old giveaways (unnatural lip movement, odd intonation, small glitches in the picture) (Mobilenet.cz). Neither voice nor image is proof any more of who you are talking to.

Fake investments with famous faces

Videos spread on social media as ads, in which well-known Czech personalities lure people with “guaranteed earnings” from cryptocurrencies or AI trading. The face and voice were created by AI. Examples from recent months:

The script is always the same: a video, a link, a form asking for your phone number, and then a professional-sounding “broker” who shows you fake profits and pushes for more deposits. When you want to withdraw your money, “fees” and “taxes” appear that you have to pay first.

No politician, presenter or entrepreneur recommends investments in a Facebook ad. Ever.

3. The QR code as a trap: quishing

People have got used to checking links in e-mails. Attackers get around that with QR codes, because you cannot see the address before scanning and the phone often opens it without asking. This kind of fraud is called quishing (from QR and phishing).

It appears in two forms:

• In an e-mail or letter: “Scan the code to cancel the fee”, “Verify your account by scanning”. The QR code bypasses filters that check links in the text of an e-mail.
• Physically on the street: a sticker with a fake code placed over the genuine one on a parking meter, a charging station or a shared e-scooter.

The second variant has already reached the Czech Republic. In autumn 2025 fake QR codes appeared on parking meters in Prague, Brno and Ostrava. In Prague these were pink stickers promising an “EasyPark service extension” that led to a page stealing payment card details. The parking fee was never actually paid, so on top of the stolen money the victim could also get a fine for unpaid parking (Sportdeník / Radiožurnál). The national CSIRT team run by CZ.NIC had already warned earlier about the same trick at charging stations (Lupa.cz).

How to defend yourself:

• Look closely at the QR code on the machine. Is it a sticker placed over the original panel? Do its colour or font differ from the rest of the sign? Leave it alone.
• Before opening it, check the address your phone shows after scanning. If it does not lead to the official domain of the city or operator, walk away.
• For parking, use the official app downloaded from Google Play or the App Store. Then you do not need to scan any QR code.
• Never scan a QR code from an e-mail that pushes you to pay or sign in.

Ten rules of digital vigilance

Technology changes faster than anyone can learn. That is why these ten rules are not based on what fraud looks like but on psychology: all scams exploit the same human weaknesses, namely fear, haste, trust and greed.

1. A family password. Agree on a secret word with your children, parents and partner. If one of you calls from an unknown number (“I’ve got a new phone”) and wants money, they must say it. Never write the password in messages or share it on social media.
2. Hang up and call back. Is the bank, the police, an authority or a courier calling and asking for sensitive information? End the call, look up the official number yourself (on your card, on the institution’s website) and call it. Never call a number the caller gave you.
3. The AI catch question. Suspect you are talking to a clone? Ask a personal question out of context: “What did we have for lunch on Sunday?”, “What was our first dog called?” A clone will dodge the question or end the call.
4. Haste is an alarm. When someone wants you to do something right now and not tell anyone, it is fraud until proven otherwise. A real bank or the police will never push you into an immediate payment.
5. Your bank never wants your PIN, password or SMS code. Not by any route: e-mail, phone or a “safe account”. Anyone who asks for them is a fraudster.
6. Don’t rush to scan QR codes. Do not scan codes from unsolicited e-mails or codes that look as if they were stuck on later.
7. Never invest from an ad. No celebrity will give you investment advice in a Facebook video. Check the company against your national regulator’s warning list (in the Czech Republic, the CNB list) and invest only through licensed institutions.
8. Less public voice and private life. Think about how much video with your voice and how much detail about your family you share publicly. Every video is material for cloning, and every detail is material for a believable story.
9. Two-factor authentication everywhere. Turn it on for e-mail, social media and banking. If a fraudster gets your password, they still cannot log in without the second factor.
10. Talk about it with your loved ones. The most vulnerable are parents and grandparents who have never heard of deepfake technology. Ten minutes of conversation over lunch can save hundreds of thousands.

If it has already happened

Anyone can fall for it and there is nothing to be ashamed of. Speed is what matters, because every minute increases the chance that the money will be gone.

1. Call your bank immediately on the number on the back of your card or in the official app. Have your card and online banking blocked and ask for payments to be stopped or disputed.
2. Change your passwords for accounts the fraudster may have obtained, and wherever you used the same password. Sign out of other devices.
3. Report it to the police (in the Czech Republic on 158, or in person at any police station). Keep everything: messages, numbers, links, payment statements, screenshots.
4. Report the fraudulent website or QR code to your national CSIRT team (in the Czech Republic at csirt.cz). Report a fake QR code on a parking meter to the parking operator or municipal police as well.
5. Beware of the second wave. Victims of investment fraud are often contacted by “recovery” firms or “lawyers” promising to get their money back for a fee. That is fraud too.

Conclusion

Artificial intelligence has not changed what fraudsters want: your money and your login details. It has changed how convincingly they can ask for them. A flawless e-mail, your child’s voice or the prime minister’s face are no longer proof of authenticity.

The good news is that defence is still just as simple. Do not rely on how a message looks or sounds; verify through another channel. Hang up and call back. Have a family password. And when someone is in a hurry, slow down.

If you want to take your digital habits further, you will find practical guidance in my e-book Cyber Self-Defence in the AI Era.

Sources

• AI scams are ever more perfect; police warn you may not recognise a deepfake – Mobilenet.cz (Czech)
• A “deepfake video” convinced a senior – Czech Police (Czech)
• Deepfakes target investors – Deník.cz (Czech)
• A parking ticket trick is spreading across Czechia – Sportdeník (Czech)
• Quishing at charging stations and parking meters – Lupa.cz (Czech)
• Phishing Statistics 2026 – StationX
• Czech national CSIRT team – incident reporting