FBI warns on AI voice cloning amid tax-season IRS scams

FBI deepfake fraud warning: what’s new and what it means

A federal law-enforcement warning underscores that AI-generated audio and video are accelerating fraud, especially during tax season. Criminals are scaling phishing, vishing, and video spoofs to impersonate tax authorities and trusted intermediaries.

The risk profile is shifting from obvious scams to highly personalized, quickly assembled deepfakes. That raises the likelihood of successful credential theft and fraudulent payments unless verification procedures keep pace.

as published by MDPI in 2025, a study of law-enforcement capacity highlighted AI-driven cybercrime and deepfake fraud as rapidly growing challenges, with agencies adapting structures and partnerships to respond. The paper noted ongoing organizational hurdles even as technology investments rise.

Why AI voice cloning powers tax season IRS impersonation scams

Attackers exploit abundant public voice samples and tax-season urgency to sound convincing and push quick decisions. As reported by Forbes, security leaders have observed a sharp rise in AI-driven attacks around filing deadlines targeting taxpayers and small businesses.

Based on a study by Hayat Bhatti et al., people struggled to distinguish cloned from real voices in vishing scenarios, averaging about 37.5% accuracy. That finding explains why “hear-and-trust” checks routinely fail.

Financial policymakers have warned that generative media can reproduce multiple identity traits, not just signatures. “Deepfake technology enables replicating a person’s entire identity, not just their signature,” said Michael Barr, Federal Reserve governor, who cautioned it could supercharge identity fraud in finance.

Industry assessments also point to seasonal spikes. An identity-fraud report found deepfake-related and synthetic-identity attempts surge in finance, with peaks during April, aligning with tax-filing timelines and increasing impersonation risk.

Treat every inbound call, email, or video as unverified until you confirm via a second, independent channel. Ask for a reference or case number, end the interaction, then reconnect using official contact information you locate yourself.

For suspected voice cloning or synthetic video, preserve evidence and note timestamps. Notify your financial institution; institutions may escalate under Bank Secrecy Act processes, including suspicious activity reporting, and you can also report to federal authorities.

Tax professionals and payroll teams should step up identity verification during filing peaks. Use layered controls for client changes to bank details or refunds, with approvals required over separate channels before releasing sensitive data or funds.

What actually works against AI scams, beyond detectors

Use out-of-band callbacks to official IRS and bank numbers

Verification-by-callback breaks the attacker’s control of the channel. Independently source contact information from official websites or statements, then initiate a fresh call to validate identities and any payment or refund instructions.

Caller ID, email domains, and video presence can all be spoofed. Out-of-band checks, plus mandatory waiting periods for high-risk changes, materially reduce successful fraud even when synthetic media is convincing.

Set family/client passphrases; tighten identity checks during tax season

Simple pre-shared passphrases for families and clients defeat many voice clones. Agree on a phrase and a fallback channel; change them periodically, and never disclose them over inbound calls.

For firms, implement least-privilege access and stepped-up Know Your Customer rechecks during filing surges. Require dual control for bank-account changes and hold releases until verification succeeds on a separate channel.

FAQ about FBI deepfake fraud warning

What specific red flags for deepfake-enabled fraud has FinCEN told banks and fintechs to watch for?

Indicators include deepfake media and synthetic identities in onboarding or payment-change requests, identity-document manipulation, and tax-season surges, alongside reminders of Bank Secrecy Act obligations.

What does the FBI recommend right now to identify and report AI-powered phishing and vishing attempts?

Verify via out-of-band callbacks, distrust urgency, preserve evidence, and report to federal authorities and your bank; institutions can escalate through compliance reporting channels.