AI-powered cyber scams are becoming harder to recognise as criminals use artificial intelligence to create convincing phishing messages, fake websites, voice impersonation and deepfake content. CERT-In has warned that AI can make phishing and impersonation attacks more convincing, personalised and scalable, making basic phone security practices increasingly important.
Why AI-Powered Phone Scams Are Harder to Detect
AI-powered cyber scams are not necessarily a completely new category of fraud. Instead, artificial intelligence is giving scammers better tools to make familiar scams more believable.
A fraudulent SMS can be written in fluent language instead of containing obvious spelling mistakes. A phishing email can imitate the tone of a bank, delivery company or government department. A scammer can also use AI-generated voice or video to impersonate a relative, colleague or other trusted person.
CERT-In’s April 2026 advisory says AI systems can generate highly convincing multilingual social engineering content, while its May 2026 guidance identifies AI-driven phishing, impersonation, synthetic identities and deepfake-enabled fraud as emerging threat areas.
For smartphone users, this means that poor grammar or an obviously fake-looking message can no longer be the only warning signs.
The safer approach is to verify the request itself, especially when money, passwords, OTPs or personal information are involved.
Keep Your Phone and Apps Updated
One of the simplest ways to improve smartphone security is to install operating system and application updates promptly.
Software updates can contain security fixes for vulnerabilities that attackers may exploit. CERT-In specifically recommends keeping operating systems, browsers and applications updated and enabling automatic updates where available.
This applies to both Android and iPhone users. It also includes applications used for banking, payments, email, messaging and social media.
Users should avoid delaying security updates simply because the phone continues to work normally.
A phone that appears to be functioning correctly can still contain an unpatched security vulnerability.
Regular updates should therefore be treated as part of routine phone maintenance, similar to charging the device or backing up important information.
Do Not Install Apps From Unknown Sources
Fake applications are one of the practical ways scammers can compromise smartphones.
CERT-In reported an Android malware campaign in March 2026 in which attackers impersonated RTO and e-Challan services and encouraged users to download malicious APK files. The fraudulent applications were designed to steal sensitive information and facilitate unauthorised transactions.
The advisory specifically recommends not installing APK files received through WhatsApp, SMS, Telegram or random websites.
For Android users, keeping installation from unknown sources disabled reduces the chance of accidentally installing a malicious application.
Users should also review an app’s developer information, downloads, reviews and requested permissions before installation. CERT-In recommends downloading applications through official app stores and keeping Google Play Protect enabled.
iPhone users should similarly avoid suspicious links that attempt to redirect them to unofficial downloads or configuration profiles.
Be Careful With AI-Generated Voice Calls
A familiar voice is no longer absolute proof that the person on the other end of a call is genuine.
AI can be used to generate or manipulate voice recordings, while deepfake technology can create realistic audio and video impersonations. CERT-In has warned that such technology can be used for financial fraud and social engineering.
Imagine receiving a call that sounds like a family member asking for an urgent money transfer.
Instead of immediately acting on the request, contact that person through another known number or communication channel.
The same principle applies to workplace requests. If someone appears to be a manager or business contact asking for an unusual payment, verify the request independently before transferring money.
The important protection is not trying to identify every AI-generated voice. It is having a separate verification method.
Never Share OTPs or UPI PINs
AI can make a fraudulent conversation sound convincing, but it cannot turn a scammer’s request for confidential credentials into a legitimate request.
Users should never share their OTP, UPI PIN, debit card PIN, banking password or similar authentication information with another person.
CERT-In’s general online scam guidance warns that fraudsters may impersonate trusted organisations and use urgency or fear to obtain personal information and OTPs.
A scammer may claim that your bank account will be blocked, your SIM will stop working, your parcel has been seized or a government service requires immediate verification.
The specific story can change, but the objective is often the same: make the victim act before checking the information.
If a message or caller asks for an authentication code, stop and verify the request through the organisation’s official channel.
Check Links Before Opening Them
AI can help scammers create convincing messages containing realistic links and branding.
CERT-In advises individuals to be cautious with unsolicited messages, links and attachments, particularly when they request sensitive information or create a sense of urgency. It also recommends verifying links before clicking them.
Do not assume that a link is safe simply because it contains the name of a familiar company.
Instead, look at the actual domain and consider whether you were expecting the message.
For example, if a supposed bank message asks you to update your account, open the bank’s official application or manually enter its known website address instead of following the message link.
The same approach works for courier services, government websites, shopping platforms and financial applications.
Watch Out for Fake Government and Delivery Messages
Government services and delivery companies are frequently used as themes in phishing and malware campaigns because people may respond quickly to a message about a fine, parcel or official document.
The RTO and e-Challan Android malware campaign reported by CERT-In in March 2026 is one example. Victims were encouraged to download malicious APK files after receiving fraudulent challan-related messages.
The safest approach is to verify the information directly.
If you receive an e-Challan notification, access the official government portal yourself rather than installing an application from a message.
If a courier message asks for payment or personal information, check the shipment through the delivery company’s official website or application.
Do not let the urgency of a message decide how you verify it.
Review App Permissions on Your Phone
An application does not automatically need access to everything on your smartphone.
Before installing or using an app, consider whether its requested permissions make sense for its purpose.
For example, a basic utility application requesting access to contacts, SMS, microphone and accessibility services should prompt questions.
CERT-In’s RTO malware advisory specifically warns users to be cautious when granting permissions such as access to SMS, contacts, phone, camera, microphone and storage. It also advises users never to enable Accessibility Services for unknown or unverified applications.
Review permissions periodically and remove applications that you no longer use.
If an unfamiliar application suddenly requests additional permissions, investigate why before approving them.
Use Strong Passwords and Multi-Factor Authentication
AI-powered phishing can target account credentials, which makes strong authentication an important layer of protection.
CERT-In recommends using strong and unique passwords and enabling multi-factor authentication wherever available.
Avoid using the same password for email, social media, shopping and financial accounts.
Your primary email account deserves particular attention because access to it can sometimes help an attacker reset passwords for other services.
Where supported, use an authenticator-based method or other strong authentication option rather than relying only on passwords.
MFA does not eliminate every type of cyber risk, but it can provide another security barrier when a password is compromised.
Be Careful With AI Tools and Fake AI Apps
The growing popularity of generative AI has created another opportunity for scammers.
Users may encounter applications or websites claiming to provide access to popular AI services, image generators, video tools or premium features. Some may be fraudulent or malicious.
CERT-In has previously advised users to conduct due diligence before downloading AI applications and to use verified AI tools. It has also warned about malicious uses of AI for generating convincing phishing content and malware.
Download AI applications only from trusted sources and verify the developer before installing them.
Avoid entering sensitive financial, work or personal information into unfamiliar AI services simply because they promise free or premium features.
What to Do If Your Phone Is Compromised
If you believe you have installed a malicious application or interacted with a scam, act quickly.
CERT-In recommends disconnecting mobile data and Wi-Fi if a malicious Android application has been installed, uninstalling suspicious applications, running a trusted security scan, changing passwords or UPI credentials where appropriate and checking bank accounts for unauthorised transactions.
If money has been lost through cyber financial fraud in India, report it immediately through the National Cyber Crime Reporting Portal or call 1930. CERT-In also advises users to report unusual financial activity to their bank.
Keep screenshots, suspicious messages, phone numbers, transaction records and website addresses. These details can help investigators understand what happened.
A Simple AI Scam Safety Routine
Phone security does not require users to understand how every AI system works.
A practical routine is enough.
Keep the phone updated. Download applications only from trusted sources. Use strong passwords and multi-factor authentication. Check links before opening them. Do not share OTPs or UPI PINs. Independently verify urgent requests involving money or confidential information.
Most importantly, slow down when a message tries to create panic.
AI may help a scammer make a message, voice or website more convincing, but taking a few extra seconds to verify the request can interrupt the fraud.
Key Takeaways
- Keep your phone’s operating system, browser and applications updated, preferably with automatic updates enabled.
- Never install APK files or applications received through unknown links, messages or random websites.
- Independently verify urgent voice, video and payment requests, even when they appear to come from someone you know.
- Never share OTPs, UPI PINs, passwords or other sensitive information with callers, messages or websites you cannot independently verify.
FAQ
Can AI scammers copy someone’s voice?
Yes. AI can be used to create or manipulate realistic audio and video that impersonates another person. CERT-In has warned about deepfake-enabled fraud and social engineering.
How can I check whether a phone message is a scam?
Check who sent it, examine the link and avoid clicking unexpected attachments. If the message concerns your bank, government service, delivery or another account, access the organisation through its official app or website rather than using the message’s link.
Should I install an APK sent through WhatsApp?
No, unless you have independently verified the source and have a specific, legitimate reason to install it. CERT-In has warned about malicious APK campaigns distributed through messaging platforms and recommends using official app stores.
What should I do after losing money to a cyber scam?
Contact your bank immediately and report financial cyber fraud through India’s National Cyber Crime Reporting Portal or by calling 1930. Preserve screenshots, messages, phone numbers and transaction details that may help with the investigation.