Not long ago, spotting a scam was relatively straightforward.
The email had spelling errors. The grammar was awkward. The caller had a foreign accent and an implausible story. The urgent wire transfer request came from a prince you'd never heard of. The signals were there if you knew to look for them, and most careful people could identify them with a moment's attention.
That world is gone.
Today's fraud is engineered. It is patient, precise, and powered by artificial intelligence tools that are available to anyone with an internet connection and bad intentions. The tells that once gave bad actors away have been eliminated. What has replaced them is something far more difficult to defend against: fraud that looks exactly like the real thing — because in almost every visible way, it is.
To understand why today's fraud is so much more dangerous, it helps to understand how it actually unfolds. This isn't guesswork — these are documented patterns we see affecting families and individuals across the country.
It typically starts with email.
A bad actor gains access to someone's email account — often through a compromised password or a successful phishing attempt. What happens next surprises most people. They don't immediately do anything. They watch.
For weeks or months, they monitor the account quietly. They learn who the victim's banker is, who their attorney is, which brokerage firms hold their assets. They identify upcoming transactions — a real estate closing, a wire transfer, a year-end gift. They learn the victim's communication style, their relationships, their sense of humor, the nicknames they use with people they trust. They note that the victim's spouse was traveling last week, that a grandchild just started college, that a property sale is approaching.
This phase — what security professionals call "skulking" — can last 200 to 300 days. The bad actor is not rushing. They are building a complete picture, waiting for the right moment, and engineering the perfect exploit.
When they move, they move fast. And they move on multiple fronts at once.
This is where the threat has fundamentally changed in the past few years.
The fraud scenarios above are not new. Man-in-the-middle email attacks have existed for years. What is new is the role artificial intelligence now plays in making them devastatingly effective — and in putting that capability within reach of virtually anyone.
Consider what a bad actor can now do with the information gathered during months of quiet observation:
They can generate written communications — emails, text messages, even formal letters — that perfectly replicate the tone, vocabulary, and style of the people the victim trusts most. No spelling errors. No awkward phrasing. The message sounds exactly like it came from your advisor, your attorney, your banker, because it was written by a system trained on how those people actually communicate with you.
They can clone voices. With a small sample of audio — something as simple as a voicemail or a video posted online — AI tools can generate a voice that is indistinguishable from the original. A victim might receive a phone call that sounds exactly like their daughter, their financial advisor, or their longtime banker.
They can generate realistic video. Deepfake technology has matured to the point where a video call can be manipulated in real time, placing a familiar face on an unfamiliar person.
And they can do all of this simultaneously. A victim might receive an email that appears to come from their attorney, followed by a text confirmation, followed by a phone call from someone who sounds like their banker — all within the same hour, all pointing toward the same urgent request. Each channel appears to confirm the others. The victim's instinct is to trust what they're seeing and hearing because every signal says it's legitimate.
In South Florida, where we work with many clients, we see the consequences of this with devastating regularity. Older individuals — people who built real wealth over a lifetime — finding themselves wired out of everything they had, with very little recourse and no way to reverse what happened. Not because they were careless. Because the fraud was designed to defeat careful people.
Here's a detail that captures just how sophisticated this threat has become.
Brazil has long been known for the kidnapping of wealthy individuals and families. What has changed is how those kidnappings are now planned. Almost without exception, they begin with a digital breach. Attackers gather information digitally first — schedules, routines, security arrangements, patterns of movement — and use that intelligence to optimize the physical operation: when to act, when to avoid, how to maximize success and minimize risk.
The physical threat is now downstream of the digital one. It's a principle that applies well beyond kidnapping: in almost every domain of risk that high-net-worth families face, the digital layer has become the foundation. Address it, and you dramatically reduce exposure across the board. Ignore it, and every other precaution you've taken becomes easier to defeat.
The goal here is not to alarm — it's to equip. Because the same intelligence that powers these threats can be turned toward defending against them. And there are practical, immediate steps that meaningfully reduce your exposure.
Establish a family safe word. For all the sophistication of AI-generated voices and deepfake video, a simple pre-arranged word or phrase that only your family knows remains one of the most effective defenses available. If a call feels off — even from a voice that sounds familiar — ask for the word. A bad actor won't have it.
Always initiate contact yourself. This is the single most important behavioral habit you can develop. When something urgent is requested — a wire transfer, a shared code, an account change — do not respond through the channel that contacted you. Hang up. Close the email. Then reach out to the person or institution directly, through a number or address you already know to be legitimate. This one habit defeats the overwhelming majority of multi-channel fraud attempts.
Protect your email account as the first priority. Almost every sophisticated fraud scenario begins with email access. A strong, unique password, combined with multi-factor authentication using an authenticator app rather than SMS, closes the door on the most common entry point. (We covered this in detail in our previous post.)
Be skeptical of urgency. Urgency is a tool. It is deliberately engineered to short-circuit careful thinking and push people to act before they have time to verify. Legitimate institutions — banks, attorneys, advisors — understand that verification takes time. Anyone who tells you there is no time to verify deserves more scrutiny, not less.
Talk to your family about this. The sophistication of today's fraud means that awareness is itself a form of protection. Families who have had explicit conversations about these threats — who understand what a deepfake voice call is, who know the safe word, who share the habit of always initiating contact — are dramatically harder targets than those who haven't.
We are in the early stages of what may be the most significant technological shift in human history. Artificial intelligence is advancing at a pace that outstrips our ability to adapt naturally — the rate of change is simply faster than our instincts are wired to handle. That gap between the pace of technology and our biological capacity to keep up is exactly where fraud lives.
The answer is not fear. It is not withdrawal from the digital world. It is informed, proactive engagement — understanding the landscape, developing the habits, and building the ecosystem of protection that makes you a much harder target.
The bad actors are using AI. The good news is that so are the defenders. The tools available to protect families today are more capable than they have ever been. The question is simply whether you've put them to work.
Total Digital Security works with families, family offices, and high-net-worth individuals to build comprehensive cybersecurity ecosystems that address all three attack surfaces. To learn more about how we can help protect what matters most, contact us.