Stay safe with AI: scams, fake media and your privacy

Learn in your browser · Chapter 01 of 07

AI has made scams more polished and easier to aim. The trick underneath is old, and so is the defence.

A scam deceives you into handing over money, details or account access. Generative AI (software that makes text, images, audio and video on request) does not invent new scams. It makes old ones cheaper, more polished and easier to tailor. That is a reason for a few habits, not for fear.

Scroll sideways to see every column.

What stays the same. The NCSC's tell-tale signs still apply: authority (pretending to be official), urgency (a deadline), emotion (fear, hope, curiosity), scarcity (a rare offer) and current events (a topical hook). Ofcom adds pressure to keep it secret, even from your bank. The aim never changes: to make you act before you check.

Treat star ratings as weak evidence. For investments, the Financial Conduct Authority (FCA) warns that fraudsters' websites and materials can look identical to the real thing, and Ofcom says legitimate investment firms do not cold-call the public.

Learn in your browser · Chapter 02 of 07

You cannot out-spot software. You can build a routine that does not depend on spotting anything.

Official sources word it differently: Stop! Think Fraud, the government campaign, says stop, think, check; Ofcom says stop, check, report. This workbook uses pause, check, verify.

1. Pause. Do not reply, click, pay or read out a code. Hang up or close the chat. Ofcom says a genuine caller will give you time.
2. Check the request. Is it unexpected? Does it want money, a code or details? Is there a deadline, a secret or a new number? Any yes means step 3.
3. Verify by a route you already trust that did not come from the message: the number on your card, an official address you type yourself, a saved contact or another relative. Never use the number or link you were given. Police Scotland warns scammers may keep a line open after you hang up, so call back on another phone if you can.

This may feel rude. A real person can wait ten minutes while you check. If you cannot verify, do not act.

Learn in your browser · Chapter 03 of 07

We once treated pictures, audio and video as evidence. AI has weakened that habit, so learn what to lean on instead.

Synthetic media is content made or changed by AI. Ofcom defines a deepfake as audio-visual content, generated or manipulated using AI, that misrepresents someone or something. It sorts harmful ones into three kinds: those that demean (such as fake sexual images), defraud (scam adverts, impersonation) and disinform (false claims that sway opinion).

Visual tells are unreliable. Forensic examiners look for odd lighting, poor symmetry or audio glitches. But Ofcom's 2024 discussion paper (which it says is not formal guidance) reports that fakers adapt, notes a forensic expert's view that such techniques tend to last two to five years before they need replacing, and cites a 2022 Royal Society finding that most people struggle to spot high-quality deepfakes. In 2025 Ofcom added that users should not be left to identify deepfakes on their own.

Detection tools are not proof. Ofcom's paper cites research by the group Witness that lowering resolution, cropping or duplicating a file often gave wrong results, and that yes or no answers can be hard to interpret. Treat any verdict as one clue. Uploading private pictures to a detector is also a privacy decision.

Provenance labels record origin instead of guessing. Content Credentials, an open standard from the Coalition for Content Provenance and Authenticity (C2PA), attach a signed record to a file stating its origin, edits and any recorded AI use. The standard calls this tamper-evident: changes show up when checked. A 'pin' icon signals that a file carries one.

Scroll sideways to see every column.

Learn in your browser · Chapter 04 of 07

Anything you type into an online AI tool leaves your device. Decide what goes in before you type.

In a March 2023 blog post, the NCSC wrote that queries to a public chatbot are visible to its provider, are stored, and will almost certainly be used to develop the service or model at some point. It advised against including sensitive information, or anything that would cause problems if made public. Policies vary and change, so read the tool's own current information.

• Passwords, one-time codes, PINs and security answers.
• Bank, card and identity numbers, and your own sensitive health, legal or money details.
• Other people's private details, especially health, money and children.
• Confidential work material, unless your employer approves the tool.

The Information Commissioner's Office (ICO), the UK data protection regulator, describes personal information as information that relates to you and identifies you, alone or linked with other information. A name is not the only risk: a job title, a small town and a date can point to one person.

To redact is to remove or replace sensitive details before you share something.

1. Ask what the tool needs to do the job.
2. Replace names with labels such as [TENANT].
3. Delete addresses, numbers, emails and references.
4. Blur specifics, and drop sensitive background it does not need.
5. Read it as a stranger, then add real details back yourself, on your own device.

Make this email firmer: 'Dear Ms Exampleton, I am Robin Placeholder of 9 Imaginary Court, XX1 1XX. Ref DEP-000000. My tenancy with Imaginary Homes Lettings ended on 3 March. I have been off work with anxiety and need the £1,200 deposit back. Call 07XXX XXXXXX.'

Learn in your browser · Chapter 05 of 07

You do not need a technical guide to see what a tool does with your data. You need to know where to look and what to ask.

Menus change often, so this is a method, not button names.

1. Open your account menu and look for Settings, Privacy, Data controls or Security.
2. Find your history: is it saved, and can you delete one chat or all? If there is a temporary or private mode, read what it says it does.
3. Search the settings for improve, train, share, memory, personalise, connected apps and public links.
4. Search the privacy policy for retain, delete, train, review and share.
5. Check security (two-step verification, unknown devices), then note what you found and the date.

If you cannot find an option, note that and type less.

Your rights. UK law gives you rights over your own personal information held by organisations, including AI companies that decide how it is used (the ICO's stated position). The ICO lists rights to be told how it is used, to get copies (a subject access request), to have it corrected or deleted (deletion only in some circumstances), to object, to limit its use and to challenge some solely automated decisions. You do not need a lawyer, and organisations usually have one month to respond.

The privacy notice usually says how to ask. Be specific and keep a copy. If the reply is poor, complain to the organisation, then the ICO, which cannot award compensation. The ICO says several of its pages are under review after the Data (Use and Access) Act, so check the current version.

The ICO says data handled in a purely personal or household activity, with no professional or commercial connection, is outside the UK GDPR's scope, such as writing to a friend. Using other people's details for work is different: follow your employer's rules.

Your footprint feeds scams. The NCSC advises reviewing what you post and your social media privacy settings. Police Scotland advises against publicly sharing videos and audio clips, to reduce voice cloning.

Learn in your browser · Chapter 06 of 07

Embarrassment keeps some people quiet. The official advice is the opposite: act quickly, tell people and report it.

Report Fraud, run by the City of London Police, replaced Action Fraud on 4 December 2025 as the place to report fraud and cyber crime in England, Wales and Northern Ireland. It says anyone could be a victim, and that romance fraud is never the victim's fault.

1. Stop contact and send nothing more.
2. If money, cards or banking are involved, tell your bank first, using the number on your card or 159 if your bank supports it.
3. Report the crime: in England, Wales and Northern Ireland to Report Fraud, online or on 0300 123 2040; in Scotland to Police Scotland on 101. Call 999 if a crime is in progress or someone is in danger.
4. Secure accounts. The NCSC says to change reused passwords, log out other devices, turn on two-step verification, check email forwarding rules and warn contacts.
5. Expect a second approach: fraudsters may offer to recover your money. Hang up. Keep notes of messages, numbers and dates.

Scroll sideways to see every column.

In England and Wales, sharing or threatening to share an intimate image without consent is an offence, and in January 2025 the Ministry of Justice said this includes deepfakes. Creating a fake intimate image of an adult without consent has also been an offence there since 6 February 2026 (legislation.gov.uk, checked 26 September 2026). Scotland and Northern Ireland have separate laws. This is not legal advice: ask the police or a support service what applies to you.

Learn in your browser · Chapter 07 of 07

A few small habits make a whole household harder to fool, and most cost nothing.

This is general information, not legal or security advice. It cannot cover your circumstances, and official guidance changes. If unsure, take advice from a suitably qualified professional or the bodies in Chapter 6.

• A family verification phrase. Police Scotland suggests code words with family for real emergencies. Our design tips: agree it in person; keep it out of photos, social media, texts and emails; use it only when someone urgently asks for money; if it is forgotten, hang up and ring back. It supports call-back and does not replace it.
• Two-step verification. The NCSC calls it one of the most effective ways to protect accounts, even if a password is stolen. Start with email, then banking, shopping and social media. Prefer passkeys where offered (Stop! Think Fraud).
• Updates and passwords. The NCSC says to install updates promptly, turn on automatic updates, and keep a strong password for your email that you use nowhere else. It encourages password managers.
• Talk. Ofcom suggests telling relatives about common scams and asking them to check with you before sending money. Scammers often discourage that.