AI scams and deepfakes: what to do

The first 15 minutes, and what comes after

You open your phone and see yourself in a video you never made. Your face. Your voice. Saying something you never said. For a second, your brain tries to rationalize it. Then you realize it’s AI-generated, and it’s already out there.

What you’re feeling, whether it’s shock, shame, or fear, is a normal response to something genuinely violating. This isn’t your fault. Take it one step at a time.

1. 1

   Stop it from spreading

   Don’t engage with whoever posted it. Don’t pay if there’s an extortion demand. Don’t forward it to friends to ask if it looks real. Each of these increases your exposure, and paying signals that the tactic works.

   If you’ve already paid, that doesn’t change your options. It was a reasonable response to a frightening situation, and you can still act.

2. 2

   Build your evidence file before it disappears

   This is the step many people skip and later regret. Once content is taken down, proving what happened gets much harder, and evidence is what gives you options with platforms, employers, and police.

   • →Full screenshots that show the URL, the username, and the date and time
   • →Every link where the content appears
   • →The image or video itself, if you can download it
   • →Any connected messages, threats, or comments
   • →A timestamped third-party copy, using a web archive such as the Wayback Machine
3. 3

   Work out what kind of harm it is

   The fastest path forward depends on what’s happening. Most cases blur these categories, and that’s normal.

   • →Intimate or sexual content: go to StopNCII.org (or Take It Down for anyone under 18) and report on the platform immediately.
   • →Sextortion or fraud: contact your bank and the Canadian Anti-Fraud Centre.
   • →Reputational harm: false words or behaviour attributed to you. Document everything. A lawyer can assess defamation or privacy grounds quickly.
   • →Work or school: involve HR or the school administration early, and in writing.
4. 4

   Report it everywhere it appears

   Choose the strongest category the platform offers: “non-consensual intimate images,” “impersonation,” or “harassment and bullying.” Use the words “deepfake” or “AI-generated” explicitly. Ask people you trust to report it too. Multiple reports speed things up.

   For intimate images, StopNCII uses a digital fingerprint to block re-uploads across every participating platform at once, not just the one copy you found.

   Google, Bing, and Yahoo each have a form to remove non-consensual intimate images from search results for your name. Capture your evidence first. Once a link is de-indexed, it’s much harder to find again for police or a lawyer.

5. 5

   Know your legal options in Canada

   Current as of October 2026

   It’s a crime. Since July 18, 2026, the Criminal Code offence of sharing intimate images without consent also covers sexual deepfakes. Threatening to share one is a separate crime, even if nothing is ever posted, with a maximum of 10 years on indictment (Protecting Victims Act, Justice Canada). You can report to police. Bring your evidence file.

   In B.C., the Intimate Images Protection Act explicitly covers altered images, including deepfakes. You can apply to the Civil Resolution Tribunal for takedown orders and damages (B.C. government). Other provinces vary, so local legal advice matters.

   Sextortion, fraud, or a voice scam: treat it like identity theft. Call your bank, report to the Canadian Anti-Fraud Centre (1-888-495-8501), and file a police report. If you already paid, include that. It’s evidence.

   Reputational harm: you may have civil grounds for defamation, privacy violations, or misuse of your likeness. A privacy or media lawyer can tell you quickly.

   On U.S.-based platforms: since May 19, 2026, the U.S. Take It Down Act requires covered platforms to remove reported intimate images, including AI-generated ones, within 48 hours of a valid request.

6. 6

   Bring in the right people early

   Handling this alone usually makes it worse. A trusted friend or partner can help you think clearly while the shock sets in. If it’s circulating at work or school, getting ahead of it in writing protects you. Cases involving minors can go to Cybertip.ca, and privacy complaints to the Office of the Privacy Commissioner of Canada.

7. 7

   Decide whether going public makes sense for you

   You’re not obligated to address it publicly, and quiet removal is often more effective. If it’s spreading at scale or affecting your work, a short statement can help: “This content is AI-generated. Steps are underway to remove it.” No long explanation. No engagement with whoever made it.

   You owe no one an explanation. The person who created this content is responsible for it. You aren’t.

8. 8

   Take the emotional impact seriously

   Many people describe a specific kind of distress: not only that the content exists, but that they can’t control where it goes. Anxiety, shame, hypervigilance, and fear for your safety or reputation are normal responses to a real loss of control. The Ending Violence Association of Canada keeps a directory of local support, and 9-8-8 is there 24/7.

You didn’t create this. Document it, report it, get support, and move forward on your own terms.

Adapted from The digital safety skill I hope you’ll never use on Human+AI.

Five free defences against a call that sounds like someone you love

Cloning a voice used to take hours of clean audio and real technical skill. Now a few seconds is enough to copy someone’s pitch, rhythm, accent, and even the way they laugh, then make them say things they never said.

The scammers aren’t trying to impersonate you to get to you. They impersonate the people you love most. If I got a call right now and heard my kid saying, “Mommy, I need you, I’m in trouble,” I’d panic. It doesn’t matter how smart or tech-savvy you are. When adrenaline and love kick in, logic goes out the window.

The good news: the best defences are free, non-technical, and most take less than five minutes.

1. 1

   Set a family code word

   Agree on a secret word or phrase as a family. Not a pet’s name or a birthday, nothing guessable. If anyone ever gets a frantic call or a strange money request from a loved one, the response is: “Okay, what’s the code word?” Practise it, so younger kids and older relatives remember it when it counts.

2. 2

   Survive the callback

   If a loved one calls from an unknown number asking for help or money, say: “I’m going to call you right back.” Then hang up and call the number already saved in your phone. Not the number that called you, and not one they give you on the call. A real emergency can wait 30 seconds for a callback. A scammer’s spoofed line won’t survive it.

3. 3

   Treat urgency as a red flag

   The whole scam model runs on urgency. “Don’t tell Mom.” “Send it right now.” “Go to the ATM.” If someone is pressuring you to skip your normal logic, that pressure is the tell. Pause, breathe, and check.

4. 4

   Remember the universal payment rule

   A real emergency can’t be fixed with gift cards, wire transfers, or cryptocurrency. Police don’t ask for an e-transfer. Lawyers don’t take gift cards. Hospitals don’t take Bitcoin. If the solution involves prepaid cards, wire transfers, or crypto, it’s a scam.

5. 5

   Run a voice audit

   Search your name and your kids’ names. Look at what audio and video is public: a voicemail greeting, social videos, a podcast, a YouTube clip. Every public recording is potential cloning material. Personally, I don’t post videos or pictures of my kids online anymore. I’d rather keep them off the internet as long as I can.

Set up a code word, do a voice audit, and have this conversation with your family before you need to, not after.

Adapted from Why I don’t post videos of my kids online anymore on Human+AI.

Protect your judgement first, then your passwords

AI is getting better at finding and exploiting software flaws, and security is becoming an AI-versus-AI fight. But the threats most likely to reach you aren’t technical. They’re phishing emails with enough personal detail to be convincing, cloned voices, and fake identities that spend weeks building your trust before asking for anything.

That’s why cybersecurity is shifting from protecting systems to protecting judgement. A message that looks and sounds exactly right is no longer proof that it is.

1. 1

   Verify through a second channel

   If your “bank” calls about suspicious activity, the voice sounds right, the details sound right, and it’s urgent, hang up. Call the number on the back of your card, or type the official website address yourself. Slowing down protects you more than any update you might struggle to install.

2. 2

   Lock down your logins

   • →Never reuse a password. A password manager can create and remember a unique one for every account.
   • →Turn on multi-factor authentication (sometimes called 2-step verification) everywhere it’s offered.
   • →Where you can, use an authenticator app for the codes rather than text messages.
3. 3

   Keep your devices updated

   Updates carry fixes for flaws that were just discovered, so delaying them widens your exposure. Turn on automatic updates for your phone, laptop, and router wherever the option exists. If you can’t get into your router’s settings (I spent half an hour failing to), call your internet provider and ask whether it updates automatically.

4. 4

   Put smart devices on a guest network

   Connect smart cameras, plugs, and speakers to a separate guest Wi-Fi network. If one is compromised, it’s kept away from the laptops and phones that hold everything else.

Adapted from What Claude Mythos means for your security on Human+AI.

Support in Canada

Numbers and links checked in October 2026. If you’re in immediate danger, call 9-1-1.

More on the site

Common questions