Messaging, Voice & AI-Impersonation Scams

Why messaging scams are the UK’s fastest-growing fraud territory

Report Fraud’s 2025 reporting placed SMS smishing, voice / impersonation calls, and platform-DM phishing among the top three growing scam categories by volume. UK Finance’s 2025 Annual Fraud Report attributes over £460m in Authorised Push Payment (APP) losses largely to messaging-driven attacks: a fake bank alert, a WhatsApp from “Mum”, a tech-support call, a Telegram broker DM, a QR-coded parking sign. The common pattern is consistent — the criminal needs the victim to act inside a messaging or voice channel where verification is harder than in a regulated banking flow.

The single most consequential change in 2024-2026 has been AI voice cloning. Generative speech systems now reproduce a target’s voice from 10-15 seconds of public audio (a TikTok clip, a voicemail greeting, a podcast appearance). The combination of cloned voice + spoofed caller ID + a plausible “family emergency” pretext is the highest-conversion scam pattern published in current Report Fraud data.

The scam categories — pick the closest fit

The universal verification rules — apply BEFORE you reply, click, or call back

1. Never call a number from a message. Hang up. Call the organisation back on a number you already trust (the back of your bank card, the official website typed into your browser yourself, your saved contact). Real fraud teams welcome a callback on a verified line.
2. Never click a link from an unsolicited message. Real banks, couriers and government departments communicate through their app, posted letter, or the website you type directly. If you must verify a notice, open the app or type the official domain yourself.
3. Never read an OTP / security code on a phone call. The whole purpose of the code is to prove YOU are authorising something. If you read it to a caller, you authorise their transaction.
4. Apply the “family safe-word” rule. For voice / AI-cloning attacks, agree a short phrase or shared fact with close family that an AI voice clone cannot produce. The challenge-response is the simplest defeat for voice-impersonation fraud.
5. For QR codes, preview the URL before tapping. Modern phone cameras show the URL before navigation. If the domain doesn’t match the brand, don’t open it.
6. For tech-support pop-ups, never call the number on the pop-up. Real Microsoft, Apple and Google never display a phone number in a security warning. Close the browser, reboot if necessary.

If a messaging scam has already cost you money

Recovery is route-dependent — act within hours, not days:

1. UK bank transfer: Use the PSR Claim Wizard. PSR Mandatory Reimbursement covers up to £85,000 within 5 working days for APP fraud.
2. Credit or debit card: Use the Chargeback & Section 75 Generator. Credit cards £100–£30,000 are protected by Section 75 of the Consumer Credit Act 1974.
3. Crypto / foreign wire: Recovery is very limited. Report to Report Fraud on 0300 123 2040 and your bank. Specialised tracing firms exist but cost is high.
4. Voice-impersonation attack with no money sent but voice was recorded / data shared: Block the calling number, screenshot the call log, consider CIFAS Protective Registration if personal details were disclosed.
5. Account takeover via verification code: Run the platform’s recovery flow immediately (Spotify / WhatsApp / Telegram / Instagram). Change passwords + enable 2FA on linked accounts.

Got a specific message you’re unsure about right now?