Human Hacking in the Age of AI: How Artificial Intelligence Is Supercharging Fraud and Social Engineering
CAVEAT - Its “Cyber Security Awareness Month” here in Canada. AI can help us learn, communicate, create, solve problems, and become more productive. However, like many technologies, it can also be misused by those who wish to exploit others. One area where we are seeing this happen is in fraud and social engineering, something we also refer to as “human hacking.” Our concern is not that AI has suddenly invented fraud, but rather that it is making established fraudulent techniques more convincing, personalized, scalable, and accessible to criminals. We believe understanding these changes, rather than fearing the technology itself, is essential to helping families become more digitally resilient.
When most people hear the word “hacking,” they picture someone sitting behind a computer attempting to break through passwords, exploit software vulnerabilities, or gain unauthorized access to a network. Although these forms of cybercrime certainly exist, there is another approach that can be just as effective, one that targets the person using the technology rather than the technology itself. This is known as social engineering, or what we at The White Hatter like to call “human hacking.” Rather than attempting to defeat a computer’s security systems, a social engineer attempts to manipulate human behaviour. They exploit emotions such as fear, urgency, curiosity, sympathy, trust, love, and sometimes embarrassment to convince someone to do something they would not normally do. That action might involve revealing a password, transferring money, providing personal information, clicking a malicious link, sharing an intimate image, or granting someone access to a device.
For decades, criminals have used these techniques through telephone calls, emails, text messages, fraudulent websites, and face to face interactions. What has changed is the technology available to make these approaches more believable. Artificial intelligence is now providing criminals with tools that can generate convincing messages, imitate voices, fabricate photographs and videos, translate conversations, and personalize fraudulent communications using information gathered from publicly available sources. In some circumstances, AI can also help criminals maintain multiple fraudulent identities or conversations simultaneously, reducing the time and effort traditionally required to manipulate potential victims. In its National Cyber Threat Assessment 2025–2026, the Canadian Centre for Cyber Security warned that AI technologies are lowering barriers to cybercrime while improving the quality, scale, and precision of malicious activity (1). The assessment specifically identified the growing use of AI to make social engineering attacks more personalized and persuasive.
This is an important distinction for parents and caregivers to understand. The fundamental psychology behind fraud has not changed, but the tools available to exploit that psychology have become considerably more sophisticated. A criminal no longer needs to be particularly skilled at writing convincing messages, speaking another language, or creating realistic looking content. AI can assist with many of these tasks, allowing individuals with relatively limited technical expertise to produce communications that appear credible and professional. The technology may be artificial, but the emotions being manipulated are very real, and it is those emotions that often determine whether a fraudulent attempt succeeds.
What Makes AI Enhanced Human Hacking Different?
Traditionally, many fraudulent communications contained warning signs that helped people identify them. Poor grammar, unusual spelling, awkward language, generic greetings, and poorly designed websites often provided clues that something was wrong. Although these warning signs can still be useful, they are becoming less reliable. Generative AI can produce professional looking emails, grammatically correct messages, realistic conversations, and persuasive explanations within seconds. It can also adapt the language and tone of a message to make it appear as though it came from a bank, government agency, employer, school, family member, or trusted friend. More concerning, AI can help criminals move beyond generic messages and develop communications tailored to specific individuals, making the interaction appear more personal and therefore potentially more trustworthy.
Imagine a criminal who discovers through publicly available social media posts that a parent has a teenager who plays competitive hockey, recently travelled to a tournament, and is preparing to graduate from high school. That information could be used to create a convincing fraudulent message appearing to come from a coach, tournament organizer, school administrator, or even the teenager. The criminal does not necessarily need to compromise anyone’s account or gain access to private information. They may only need enough publicly available details to make their communication appear credible. This is where AI can become particularly useful to criminals, helping them organize information, identify relevant details, and construct a message that appears to fit naturally into the recipient’s life.
This represents an important shift in how we need to approach fraud prevention. We can no longer rely primarily on whether a communication looks professional, sounds believable, or contains accurate personal information. Instead, we need to focus on verifying who is communicating with us and whether the request being made is legitimate. Perhaps the most important principle families need to understand is that in the age of AI, authenticity should be verified through trusted processes, not judged by how real something looks, sounds, or feels. This principle applies to telephone calls, emails, text messages, social media conversations, photographs, videos, and even live interactions.
1/ When a Criminal Can Sound Like Your Child: AI Voice Cloning Scams
Consider a scenario where a parent receives a telephone call late in the evening. On the other end is what sounds exactly like their teenage daughter. She is crying, frightened, and struggling to speak. She explains that she has been involved in a serious accident and needs money immediately. Before the parent can ask too many questions, another person takes over the conversation, claiming to be a police officer or lawyer. The caller insists that the situation is urgent, that money must be transferred immediately, and that the parent should not contact anyone else because doing so could make the situation worse. For a parent, hearing what appears to be their child’s frightened voice can trigger an immediate emotional response. Their natural instinct is to help, not to question whether the voice is authentic, and this is precisely the vulnerability criminals are attempting to exploit.
AI voice cloning technology can use samples of recorded speech to generate synthetic audio that resembles a real person’s voice. Depending on the technology and quality of the source material, relatively short recordings may be sufficient to produce a convincing imitation. Those recordings might come from publicly available social media videos, livestreams, interviews, or other online content. The U.S. Federal Trade Commission warned about this technique in 2023, explaining how criminals could use AI generated voices to make traditional family emergency scams more convincing (2). The RCMP has also warned Canadians about fraudulent family emergency calls that may involve digitally manipulated voices resembling the person being impersonated (3). What makes this form of fraud particularly concerning is that the emotional response it triggers can override the very caution we have spent years encouraging families to practise. A parent who believes their child is in immediate danger may not think to question why the caller is requesting an electronic money transfer or why they are being told not to contact anyone else.
The same technique can also work in reverse, something that parents should discuss with their children. A teenager could receive a call that sounds like a parent asking for a password, authentication code, financial information, or some other urgent action. Rather than teaching children simply to recognize suspicious voices, we recommend establishing a family verification process before an emergency occurs. If someone calls claiming to be your child and requests money, end the call and contact your child using a previously verified telephone number or communication method. If you cannot reach them, contact another trusted family member or someone who may know their whereabouts. Families may also establish a private verification word or phrase that can be used during an unexpected emergency, although it should not be the only verification method, particularly if it has been shared electronically or could be discovered by someone who has compromised an account. The goal is to make independent verification a normal family practice, even when the voice on the other end of the telephone sounds familiar.
2/ When Your Bank, Credit Card Company, or Government Agency Isn’t Who You Think It Is
Another concern involves criminals impersonating trusted institutions such as banks, credit card companies, government agencies, and telecommunications providers. Imagine receiving a telephone call from someone claiming to represent your bank’s fraud department. The caller sounds professional, uses appropriate financial terminology, and appears to know information about your account. They explain that suspicious activity has been detected and that immediate action is necessary to protect your money. Perhaps they ask you to confirm a verification code, transfer funds to a supposedly secure account, or install software to help resolve the problem. The caller may even appear to be calling from the bank’s legitimate telephone number, further reinforcing the impression that the communication is authentic.
AI can make these interactions more convincing by helping criminals generate realistic scripts, anticipate questions, and produce professional sounding responses. Voice synthesis and automated conversational systems may also be used to imitate customer service interactions. However, it is important to recognize that AI is not required for caller ID spoofing, a technique criminals have used for years. The danger comes from combining established fraudulent methods with increasingly sophisticated impersonation tools. The Canadian Centre for Cyber Security identifies caller ID spoofing, voice manipulation, and impersonation as important components of voice phishing, commonly known as “vishing”. Its guidance explains how criminals can gather information about a target, impersonate a trusted organization, and create urgency to encourage compliance (4).
There is another variation that parents and caregivers should understand, one that involves the increasing use of search engines and voice assistants to locate customer service information (5). Rather than receiving a fraudulent call, someone may unknowingly initiate contact with a criminal after using a search engine or voice assistant to locate a customer service number. If a fraudulent number appears in search results, an advertisement, or another information source, the person may believe they are calling a legitimate business. AI generated search responses and voice assistants introduce an additional reason to verify the source of contact information rather than assuming a number is authentic simply because a digital assistant provided it. This does not mean every AI assistant is directing people to fraudulent numbers, but it does mean that the information returned by these systems should not automatically be treated as verified.
For parents and caregivers, the practical recommendation is straightforward. Teach family members to use telephone numbers obtained directly from official banking apps, the back of a payment card, or previously verified institutional websites. Never provide a one time authentication code to an unexpected caller, even when the caller claims to represent the organization that issued the code. If someone contacts you claiming there is an emergency involving your account, end the conversation and independently contact the institution. A legitimate concern about your finances can still be investigated after you have verified who you are speaking with, and no reputable financial institution should require you to transfer money to a supposedly safe account to protect it from fraud.
3/ Deepfake Video: When Seeing Someone Is No Longer Proof That It’s Them
For generations, people have relied on photographs and videos as evidence that something happened or that someone said something. Artificial intelligence is challenging that assumption by making it increasingly possible to generate or manipulate video and audio so that a person appears to be speaking or behaving in ways they never actually did. Although deepfakes are often discussed in connection with celebrities, politicians, and non-consensual intimate imagery, they also have significant implications for financial fraud. A criminal might create a video that appears to feature a well-known financial expert promoting an investment opportunity, while another might impersonate a company executive during a video meeting and request an urgent financial transfer. Similar techniques could potentially be used to create fraudulent messages appearing to come from school principals, teachers, coaches, or community leaders.
In June 2025, the Canadian Centre for Cyber Security and the Canadian Anti-Fraud Centre issued a joint advisory warning that criminals were impersonating prominent public figures and senior government officials using text messages and AI generated voices. The campaign involved attempts to obtain money and sensitive information through seemingly credible communications (6). The FBI has documented similar impersonation campaigns involving senior American officials, including AI generated voice messages designed to establish trust with targeted individuals (7). While these particular advisories focused primarily on messaging and voice impersonation, they illustrate the broader problem that synthetic media presents. Familiar identities can be copied and used to manufacture credibility, and the fact that someone appears recognizable does not establish that the communication is genuine.
Parents should also understand that a video call is not automatically a reliable identity check. Although manipulating live video can require greater technical capability than creating a prerecorded deepfake, real time synthetic media is an important emerging concern. This is why we encourage families to teach children and teens that seeing a recognizable person endorse a product, investment, giveaway, or financial opportunity does not establish authenticity. Claims should be verified through independently located official sources rather than links supplied within the video or message. The more extraordinary the promise, particularly when it involves easy money, guaranteed returns, or immediate payment, the more important independent verification becomes.
4/ AI Powered Romance Scams: When the Relationship Is Part of the Fraud
One of the most psychologically complex forms of social engineering involves criminals who establish emotional relationships with their targets. Traditionally, romance scammers invested significant time communicating with victims, developing trust, and creating a sense of emotional intimacy before requesting money. Generative AI can make this process easier to sustain and potentially more scalable by helping criminals write personalized messages, maintain conversations, translate between languages, generate convincing profile photographs, and develop believable personal histories. In some cases, the person communicating with the victim may be using AI generated material to maintain a fictional identity, while in others, AI may be used to assist a human scammer rather than replace them. This distinction matters because the emotional manipulation remains the central mechanism of the fraud, regardless of how much artificial intelligence is involved.
A victim may believe they have developed a genuine relationship with someone who understands them, cares about them, and has become an important part of their life. Over time, that relationship can create a level of emotional trust that makes the person less likely to question unusual requests or inconsistencies. Only after that trust has developed does the financial request appear, often accompanied by a believable explanation involving a medical emergency, travel problem, business difficulty, or other unexpected crisis. Although romance fraud is often associated with adults, parents should recognize that similar emotional manipulation can affect teenagers through online friendships, gaming communities, dating platforms, and social media. For young people, the request may not initially involve money. It might involve gift cards, access to accounts, personal photographs, or information that can later be used for coercion or extortion.
The National Center for Missing & Exploited Children (NCMEC) has documented how offenders use fake identities, emotional relationships, and increasingly AI generated content to exploit young people (8). Rather than simply warning teenagers never to communicate with strangers, we believe parents should teach them how online trust can be manufactured and manipulated. Discuss why someone might rapidly escalate emotional intimacy, discourage outside relationships, insist on secrecy, or create a crisis that requires money or sensitive information. Most importantly, establish a family environment where a child can disclose an uncomfortable online relationship without immediately fearing punishment or the loss of their technology. A teenager who believes disclosure will result in losing their phone may be less willing to seek help when they need it most, which can leave them more vulnerable to continued manipulation.
5/ AI Enhanced Sextortion: When Criminals No Longer Need a Real Intimate Image to Blackmail a Teenager
Perhaps one of the most important emerging examples of AI enhanced human hacking that parents and caregivers need to understand involves the use of fabricated intimate imagery to extort young people. For years, financial sextortion typically involved a criminal manipulating a teenager into sharing an intimate photograph or video, then threatening to distribute that material unless the teenager paid money or complied with additional demands. The psychological manipulation often began with a fraudulent online identity, where the offender pretended to be another teenager, established a friendship or romantic connection, and encouraged the victim to exchange intimate images. Once an image was obtained, the relationship changed dramatically, with the offender threatening to send the material to the teenager’s family, friends, classmates, or social media contacts unless money was transferred immediately.
Artificial intelligence is now changing an important part of this criminal process because, in some cases, criminals no longer need a teenager to provide an authentic intimate photograph. They can manufacture one using AI. In October 2026, Canada’s Cybertip.ca issued a warning that offenders were increasingly using AI generated sexualized deepfakes to extort Canadian teenagers. According to the alert, criminals were using ordinary photographs, sometimes nothing more than a social media profile picture, to create fabricated intimate images of their victims. The offenders then threatened to distribute those images unless the teenager paid money or complied with other demands (9). This is an important development because it removes a step that previously required criminals to convince a young person to share intimate content, potentially expanding the number of young people who could be targeted.
Consider a hypothetical scenario involving a 15 year old boy who receives a message from an unfamiliar account containing what appears to be an intimate photograph of him. He immediately recognizes his face but knows he has never taken or shared such an image. The person sending the message threatens to distribute the photograph to his classmates, parents, and sports teammates unless he transfers money within the next hour. The teenager may understand intellectually that the image is fake, but that knowledge does not necessarily reduce the emotional impact of the threat. He may worry that others will believe the image is real, that classmates will ridicule him, or that his parents will become angry or disappointed. The criminal is counting on those fears and using the fabricated image to create a sense of urgency, shame, and helplessness.
This is human hacking in a particularly harmful form because the offender is using synthetic media to create the very material needed to establish leverage over the victim. NCMEC has also documented cases where offenders created AI generated intimate imagery of children who refused to provide authentic sexual images, with the fabricated material subsequently used to threaten or coerce them. The scale of the broader problem is concerning. In 2025, NCMEC received more than 400,000 CyberTipline reports involving some connection to generative AI and child sexual exploitation. These reports covered several categories of suspected exploitation and should not be interpreted as 400,000 separate victims or confirmed sextortion incidents. Nevertheless, the figures demonstrate the growing role of AI in reported child sexual exploitation.
Parents should also understand that the use of AI generated intimate imagery is not limited to financially motivated strangers. Peers and classmates may create fabricated intimate images to embarrass, bully, intimidate, or humiliate another student. Those images can subsequently become tools for coercion or extortion, even when the original intent was not financial. This is why the distinction between an authentic and AI generated intimate image does not eliminate the harm experienced by the person depicted. The image may be artificial, but the humiliation, fear, reputational damage, and emotional distress can be very real. The RCMP has warned that sextortion can cause significant psychological distress among young people, including feelings of shame, isolation, desperation, and, in severe cases, thoughts of self-harm (10).
We strongly encourage parents to speak with their children about the possibility that someone could create a fabricated intimate image of them without their knowledge or consent. Explain that if someone threatens to share such an image, they should not send money, provide additional photographs, or comply with further demands. Encourage them to stop engaging with the offender, preserve relevant evidence of the threats, report the account, and seek help from a trusted adult. Families should avoid downloading, forwarding, or redistributing suspected child sexual abuse imagery as part of evidence collection, and instead seek guidance from police or a recognized reporting service about preserving evidence safely. In Canada, families can report incidents to Cybertip.ca, local police, and the platforms involved, while NeedHelpNow.ca provides additional resources for young people dealing with the distribution or threatened distribution of intimate images.
Perhaps most importantly, parents should make it clear that their child will not be punished for coming forward and asking for help. A teenager who believes that disclosing an extortion threat will result in anger, embarrassment, or the immediate loss of their phone may attempt to manage the situation alone. That isolation is exactly what the offender wants, and it is one of the reasons we continue to emphasize the importance of relationships, trust, and open communication as foundational elements of online safety.
6/ AI Generated Phishing: When Fraudulent Messages Look Professionally Written
Many parents remember being told that fraudulent emails were easy to identify because they contained spelling mistakes, awkward grammar, or unusual formatting. Although these clues can still be useful, they are no longer sufficient indicators of whether a message is legitimate. Generative AI can produce polished communications that resemble authentic messages from banks, schools, employers, delivery companies, online retailers, and government agencies. It can also help criminals tailor messages to specific circumstances, making the communication appear relevant to the recipient’s daily life. A parent might receive an email appearing to come from their child’s school, advising that an outstanding field trip payment must be completed before midnight, complete with the school’s name, appropriate educational terminology, and a convincing explanation of why payment is required. Another parent might receive a message appearing to come from a youth sports organization requesting updated registration information, while a teenager might receive a message claiming that their gaming account has been suspended and immediate verification is required.
These are illustrative scenarios, but they demonstrate how AI can be applied to familiar fraud techniques. The Canadian Centre for Cyber Security has warned that AI powered tools can help criminals create convincing phishing messages, lowering the level of technical expertise needed to conduct these attacks. The concern is not simply that the messages look better. AI can also help criminals produce large numbers of variations, personalize communications, and adapt language to different audiences. This means that relying on spelling errors, unusual formatting, or generic greetings as the primary indicators of fraud is becoming an increasingly inadequate strategy.
For parents and caregivers, we recommend teaching children and teens to evaluate the action a message is requesting rather than relying primarily on its appearance. Does it ask for money, personal information, passwords, authentication codes, or immediate action? Does it discourage independent verification or create a sense of urgency by threatening consequences if the recipient does not respond? When a message claims to come from a school, sports organization, or other trusted institution, verify it through an established communication channel rather than using the contact information or payment link contained in the message. The goal is to develop a habit of questioning unexpected requests, even when the communication appears polished, professional, and personally relevant.
7/ AI Enhanced Investment Scams: When a Familiar Face Promises Financial Success
Social media has become an important source of financial information for many people, including teenagers and young adults, but it also provides opportunities for fraudulent investment promotions. Criminals can use AI generated photographs, synthetic voices, and manipulated videos to impersonate financial professionals, celebrities, entrepreneurs, or other recognizable individuals. They may combine these materials with fabricated testimonials, professional-looking websites, and persuasive messaging to create the appearance of a legitimate investment opportunity. What makes these scams particularly concerning is that they often exploit legitimate financial aspirations. A teenager interested in cryptocurrency, online investing, or entrepreneurship may be attracted to an opportunity promising unusually high returns with little risk, while a parent looking to improve their family’s financial security may be similarly vulnerable.
AI-generated endorsements can make these opportunities appear more credible, especially when the individual being impersonated is someone the victim already recognizes and trusts. A video that appears to show a well-known entrepreneur discussing a cryptocurrency investment, for example, may be enough to convince someone that the opportunity deserves serious consideration. However, the presence of a recognizable face or voice does not establish that the person actually made the endorsement. We encourage parents to teach young people that an endorsement, testimonial, screenshot, or video is not proof that an investment opportunity is legitimate. Guaranteed returns, pressure to invest immediately, requests for cryptocurrency transfers, and promises of extraordinary profits should trigger further investigation. Families should independently verify the identity and registration status of anyone offering investment services through the appropriate provincial or territorial securities regulator.
8/ When Criminals Use AI to Learn About Your Family Before Contacting You
Perhaps one of the less appreciated aspects of AI enhanced social engineering is how it can assist criminals in gathering and organizing information about potential targets. At The White Hatter, we have long discussed the importance of understanding one’s digital footprint and the role that publicly available information can play in online safety and security. This is where open-source intelligence, commonly known as OSINT, becomes relevant. OSINT involves collecting and analyzing information from publicly available sources and is a legitimate investigative discipline used in law enforcement, cybersecurity, journalism, and other professions. However, the same publicly available information can also be misused by criminals who wish to identify vulnerabilities, impersonate trusted individuals, or develop more persuasive fraudulent communications.
Consider how much information a family might unintentionally share online. A parent’s social media account may identify their employer, children’s names, school activities, vacation plans, and extended family relationships, while a teenager’s account might reveal their sports team, graduation year, friends, hobbies, and upcoming events. Individually, these details may appear harmless, but collectively they can provide the context needed to create a highly personalized fraudulent approach. AI can assist with analyzing large amounts of publicly available information and identifying details that might make a fraudulent communication more persuasive. A criminal who knows that a family member is travelling could create a believable emergency involving a missed flight, lost passport, or unexpected medical expense, while someone who knows that a teenager is applying for university scholarships could create a fraudulent message appearing to come from a scholarship administrator.
This does not mean families should stop sharing their lives online, and it doesn’t mean that every publicly available photograph or personal detail creates an immediate safety risk. It does mean understanding that information shared publicly can sometimes be collected, combined, and used in ways that were never intended. We encourage parents and caregivers to periodically review what information about their family is publicly accessible and consider whether details such as travel itineraries, school schedules, personal contact information, or financial circumstances need to be shared publicly. Teenagers should also understand that digital privacy is not simply about hiding something embarrassing. It is about maintaining greater control over how personal information can be collected, interpreted, and potentially exploited by others.
The Psychology Behind AI Enhanced Fraud: Why Intelligent People Still Get Scammed
One of the most harmful misconceptions surrounding fraud is the belief that only uninformed, careless, or technologically inexperienced people become victims. This misunderstanding can create shame and discourage people from reporting what happened, even though social engineering works precisely because it targets normal human emotions and decision making processes. A parent who hears what sounds like their child crying for help is not responding irrationally by becoming concerned. They are responding as a parent. A teenager who believes their gaming account is about to be permanently deleted may react quickly because that account has social and financial value to them. A grandparent who believes their grandchild has been arrested may prioritize helping someone they love over carefully evaluating the authenticity of the telephone call. Similarly, a teenager who receives an AI generated intimate image of themselves, accompanied by threats to distribute it to their school, may experience genuine fear even when they know the image is fabricated.
Criminals understand these emotional responses and deliberately attempt to exploit them. AI increases the potential effectiveness of these techniques by making the communication appear more familiar, relevant, and believable. Some of the most common psychological mechanisms include authority, where a message appears to come from someone with institutional power; urgency, where immediate action is presented as necessary; fear, where consequences such as financial loss or embarrassment are threatened; and familiarity, where the criminal impersonates someone the victim recognizes. Other techniques involve secrecy and isolation, where the victim is discouraged from discussing the situation with others, emotional attachment, where a relationship is developed to increase compliance, and shame, where the threat of humiliation becomes the primary tool of manipulation. These mechanisms frequently overlap, with criminals combining several of them to increase the likelihood that the victim will act before independently verifying the situation.
These techniques existed long before generative AI, but what AI changes is the ability to package them into increasingly convincing communications. This is why we believe effective fraud prevention must involve more than teaching people how to recognize suspicious links or identify manipulated photographs. It must also involve understanding how human emotions influence decision-making, why urgency can interfere with critical thinking, and how criminals deliberately manufacture situations designed to prevent people from seeking advice. The better families understand these psychological techniques, the more prepared they may be to recognize them when they appear in different forms.
Why Teaching Children to Spot Deepfakes Is Not Enough
There is considerable public discussion about teaching people to identify AI generated content by looking for visual or audio imperfections, such as unnatural facial movements, inconsistent lighting, unusual speech patterns, or mismatched audio. Although these clues may sometimes help, they should not be treated as reliable safeguards. As generative AI improves, many of the obvious imperfections that once distinguished synthetic content from authentic recordings may become less noticeable. This creates a problem with educational approaches that focus primarily on spotting technical mistakes. If we teach children that deepfakes can be identified by looking for distorted facial features or listening for unnatural voices, what happens when the technology produces content without those obvious flaws?
A more sustainable approach is to teach verification skills that remain useful regardless of how convincing AI generated content becomes. The goal should not be to turn every parent or teenager into a deepfake detection expert, but rather to help them recognize when independent verification is necessary. We should also recognize that AI generated content is not automatically fraudulent. Synthetic media has legitimate educational, creative, accessibility, and entertainment applications, and the concern arises when someone uses that technology to misrepresent identity, manufacture evidence, manipulate trust, or coerce another person into taking an action they would not otherwise take. In other words, the problem is not simply that a voice or image was created using AI. The problem is how that content is being used to deceive or exploit another human being.
This distinction is particularly important when discussing AI literacy with children and teenagers. We do not want young people to become so distrustful of digital communication that they begin questioning every interaction or assuming that all online content is fraudulent. Instead, we want them to develop the confidence and critical-thinking skills needed to evaluate situations appropriately. When someone unexpectedly requests money, personal information, account access, or secrecy, verification should become a normal part of the decision-making process. This is a more practical and sustainable approach than relying on visual or audio clues that may become less reliable as the technology continues to evolve.
Practical Ways Families Can Reduce Their Vulnerability to AI Enhanced Human Hacking
At The White Hatter, we believe that parents and caregivers are not powerless when it comes to protecting themselves and their children from AI enhanced fraud. Although no strategy can eliminate every risk, there are practical steps families can take to make successful social engineering more difficult. One of the most important is establishing a family verification protocol, where unexpected requests involving money, emergencies, passwords, or sensitive information must be independently verified, even when the request appears to come from someone the family knows. A previously agreed-upon family verification phrase can provide an additional safeguard, but it should complement rather than replace direct contact through a trusted communication channel. The objective is to make verification a normal family habit rather than something people attempt to remember during a stressful situation.
We also encourage families to teach what we call the power of the pause. Criminals frequently manufacture urgency because they do not want the victim to have time to think critically, independently verify information, or consult someone else. When someone creates pressure to act immediately, particularly when money, personal information, or account access is involved, that should be a reason to slow down rather than accelerate. Parents can reinforce this skill through everyday conversations and realistic scenarios, asking children what they would do if someone claiming to be a friend requested an urgent e-transfer, if a caller who sounded like a parent asked for an authentication code, or if a message threatened to delete a gaming account unless immediate action was taken. These conversations help children practise decision-making before they encounter a real attempt at manipulation.
Another important protective measure involves securing online accounts and reducing unnecessary exposure of personal information. Families should use strong, unique passwords, enable multi factor authentication where available, and consider phishing-resistant methods such as passkeys. Children should understand that one time verification codes, recovery codes, and account credentials should never be shared with unexpected callers or message senders. Parents should also periodically review their family’s publicly accessible digital footprint and consider whether posts reveal information that could be used to create convincing impersonation attempts. The goal is not to disappear from the internet, but to make more deliberate decisions about what information is publicly available and how it might be used by others.
Perhaps one of the most important protective factors, particularly for children and teenagers, is ensuring that reporting remains safe. Young people need to know that they can approach a trusted adult if they believe they have been manipulated, defrauded, threatened, or extorted. Parents should avoid immediately responding with blame, anger, or threats to remove technology, because a child who fears punishment may delay reporting and give the criminal additional opportunities to cause harm. This is especially important in cases involving financial sextortion or AI generated intimate imagery, where shame and embarrassment are often central to the offender’s strategy. Our approach has always been that connection and communication are among the most important protective factors parents can provide, and this becomes even more important when criminals are deliberately attempting to isolate their victims.
Families should also know what to do if fraud or extortion occurs. If money has been transferred, contact the financial institution or payment provider immediately and ask whether the transaction can be stopped or reversed. If account credentials have been disclosed, change the affected passwords using a trusted device and review account security settings. Preserve relevant messages, transaction records, telephone numbers, screenshots of threats, and other evidence, and report financial fraud to local police and the Canadian Anti-Fraud Centre. If the incident involves sexual extortion or AI generated intimate imagery of a minor, report it to Cybertip.ca and local police, while avoiding the downloading or redistribution of suspected child sexual abuse imagery. If identity information has been compromised, families should consider contacting the appropriate credit bureaus and monitoring financial accounts for suspicious activity. Most importantly, the person affected should understand that reporting quickly is far more important than feeling embarrassed about what happened.
The Bigger Picture: Fraud Prevention Is Becoming an AI Literacy Issue
For years, much of our online safety education has focused on protecting personal information, recognizing suspicious links, managing privacy settings, and understanding the risks associated with online communication. Those skills remain important, but AI enhanced social engineering introduces another dimension to digital literacy. Young people now need to understand that digital content can be convincingly manufactured, identities can be impersonated, and communications can be personalized using information collected from multiple sources. They also need to understand that a convincing digital interaction does not necessarily represent an authentic human interaction, and that trust should be established through independent verification rather than appearance, familiarity, or emotional persuasion.
This is one reason we believe AI literacy should become an age-appropriate component of digital literacy education. We are not suggesting that every child should be using generative AI or that younger children need unrestricted access to these technologies. Rather, we believe children should understand the existence and capabilities of AI before they encounter its misuse independently. A child does not need to operate a voice-cloning application to understand that someone might use one to impersonate a family member, just as a teenager does not need to create a deepfake to understand that a video of a celebrity promoting an investment opportunity could be fraudulent. Similarly, a teenager does not need to experience sextortion firsthand to understand that an ordinary photograph could be manipulated into a fabricated intimate image and used to threaten someone. These are knowledge and critical-thinking skills that can be taught without exposing children to inappropriate AI applications.
There is also an important role for schools, particularly as young people increasingly encounter AI generated content through social media, gaming platforms, messaging applications, and online search. Fraud prevention education should not be limited to recognizing phishing emails, but should include discussions about digital identity, online trust, emotional manipulation, financial literacy, consent, synthetic media, and the importance of independent verification. These are transferable skills that will remain relevant even as the underlying technology continues to evolve. We believe that when parents, caregivers, and educators work together to reinforce these concepts, children are better positioned to recognize manipulation and seek help when something does not feel right.
What About the Technology Companies?
Although this article focuses on what parents and caregivers can do, we also believe it is important to recognize that responsibility for preventing AI enhanced fraud should not rest exclusively with individuals and families. Technology companies, financial institutions, telecommunications providers, and online platforms also have responsibilities. AI developers should continue improving safeguards against the unauthorized impersonation of individuals and the misuse of synthetic media, while social media platforms should strengthen their responses to fraudulent advertisements, impersonation accounts, deceptive financial promotions, and the creation or distribution of non-consensual intimate imagery. Financial institutions should continue developing fraud detection systems and verification processes that do not depend solely on recognizing a voice or trusting a telephone number, while telecommunications providers have an important role in reducing caller ID spoofing and other forms of communication-based fraud.
Governments and regulators should also ensure that existing fraud and consumer protection laws remain effective as AI enabled techniques evolve. At The White Hatter, we have consistently argued that education, regulation, and corporate accountability should work together rather than being presented as competing solutions. Teaching families how to recognize social engineering is important, but it does not eliminate the responsibility of organizations to design safer systems and reduce opportunities for criminal exploitation. Parents and caregivers should not be expected to compensate for every weakness in the technologies and services their families use, particularly when those weaknesses are known and can be addressed through better design, stronger safeguards, and meaningful accountability.
The Best Defence Against Human Hacking Is Still Human
Artificial intelligence is changing the fraud landscape, but it has not changed the fundamental reason social engineering works. Criminals succeed when they convince someone to trust a fraudulent communication and take an action that benefits the criminal. What AI is doing is making that communication more believable. A fraudulent email may now look professionally written, a telephone call may sound like someone we love, a video may appear to show a trusted public figure, and a message may contain personal details that make it seem authentic. An intimate image used to blackmail a teenager may not even be real. For parents and caregivers, this creates a challenge because many of the traditional clues we once relied upon are becoming less dependable, but it also creates an opportunity to rethink how we teach online safety.
Rather than telling children simply not to trust what they see or hear online, we can teach them how to establish trust through independent verification. Rather than attempting to identify every new scam, we can teach them to recognize the psychological techniques that many scams share. Rather than responding to every new technological development with fear, we can help families develop the knowledge, confidence, and practical skills needed to navigate it. Perhaps the most important message we can share with our children is that when someone unexpectedly asks them to act urgently, send money, reveal personal information, share intimate content, or keep something secret, it is okay to stop, question, verify, and ask for help, no matter how convincing the person or message may appear.
We would also add one more message, particularly for teenagers. If someone uses an authentic or AI generated intimate image to threaten or blackmail them, they do not have to deal with it alone. They should tell a trusted adult, because help is available and no image or online mistake is worth facing an extortionist alone. AI may be making human hacking more sophisticated, but informed human judgment, strong relationships, and independent verification remain powerful protective tools. At The White Hatter, our philosophy remains the same, facts not fear, facts not emotions, enlighten not frighten, know tech not no tech. The answer to AI enhanced fraud is not to fear every digital interaction, but to understand how manipulation works and develop the skills to recognize it. In a world where artificial intelligence can increasingly imitate the people and institutions we trust, knowing how to verify trust may become one of the most important digital literacy skills we can teach our children.
Digital Food For Thought
The White Hatter
Facts Not Fear, Facts Not Emotions, Enlighten Not Frighten, Know Tech Not No Tech
References
