Topic starter
10/07/2026 9:13 pm
TL;DR: AI-generated personas can sustain convincing video calls, messages, and money requests for months, and Incode’s CEO says deepfakes are now a major attack vector with one-third of defended attacks involving impersonation. The real problem is not spotting the fake after the fact, but replacing instinct with verifiable identity controls before trust forms.
Editorial analysis by NHI Mgmt Group, based on content published by Incode: “AI-Powered Romance Scams: Incode’s CEO Ricardo Amper on AARP’s The Perfect Scam”.
Key questions
Q: What breaks when romance scams are driven by deepfakes instead of real people?
A: The normal human detection model breaks first.
Q: Why do AI-powered romance scams create higher fraud risk than traditional phishing?
A: They sustain trust over time instead of forcing a fast decision.
Q: How can teams tell when deepfake-based impersonation is bypassing normal controls?
A: Look for repeated channel switching, urgency around money, reluctance to use standard verification paths, and relationships that intensify faster than normal.
Practitioner guidance
- Require verified identity before trust deepens Use verified profiles, IDV, or equivalent proofing before extended messaging, private video, or payment requests are allowed to continue.
- Instrument continuous verification in high-trust flows Add repeatable checks at the points where a conversation turns into a financial request, account recovery, or sensitive escalation.
- Train fraud teams to treat deepfake cues as insufficient Update playbooks so reviewers look for relationship timing, payment pressure, and channel switching, not just visual anomalies.
Bottom line: Deepfake-enabled romance scams turn human trust cues into a liability, because the attacker can now hold a convincing interaction long enough to solicit money or access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:36 pm
Human instinct is no longer an identity control: This article shows that visual and vocal cues can be manufactured well enough to sustain trust for hours or months. That means fraud resistance cannot depend on a person noticing discomfort, hesitation, or a clipped voice. The implication is that identity assurance has to move from perception to verification before trust is granted.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when customer conversations may involve synthetic identity?
A: Put verification ahead of trust, not after it. Organisations should require verified profiles, step-up proofing, and transaction controls before a conversation can escalate into payment, access, or sensitive personal disclosure. That reduces the chance that a well-run impersonation campaign can convert attention into loss.
👉 Read our full editorial: AI romance scams are scaling past human detection