AI-made scams in India: cloned voices, deepfake video and “digital arrest”, and the checks that still work

Why this article, and the short version

Generative AI can make a scammer sound like your son and look like your boss. It cannot change what the scammer needs from you, which is secrecy, speed and money, and it cannot change how you can check, which is to hang up and call back on a number you already hold.

That is the whole argument. The rest of this article shows where it comes from. It covers what Indian government sources say about “digital arrest” and fake telecom threats, what the AI evidence shows about cloned voices and deepfake video, which of those claims are firm and which are press reports, and the checks that work whether or not the voice on the line is real.

For incident reporting rules in India (CERT-In, the DPDP Act, 1930) see the guide I keep at security.msrx.co.in/india. For the AI-and-security backdrop, our earlier articles on the PHP flaws AI found and scanning 70 repositories with AI cover the defender’s side of the same shift.

What “digital arrest” is

The Ministry of Home Affairs described the pattern in an alert posted on PIB on 14 May 2024. A large number of complaints on the National Cyber Crime Reporting Portal concerned intimidation, blackmail, extortion and “Digital Arrests” by people posing as police, the CBI, the narcotics department, RBI, the Enforcement Directorate and other agencies.^[1]

Callers typically say the victim has sent, or is to receive, a parcel with illegal goods, drugs, fake passports or other contraband. Sometimes they say a near one is in custody after a crime or an accident. Then money is demanded to “compromise” the case. In some cases victims are made to stay visible over Skype or another video platform until the demands are met, and the fraudsters use studios modelled on police stations and government offices and wear uniforms. The release calls it an organised online economic crime that is learnt to be operated by cross-border crime syndicates.^[1]

Look at what is not in that description: no software hack, no malware, no technical trick. The attack is a story told with authority and urgency. That matters, because it is why a low-tech check can beat it.

The scale is not clear from official sources. A March 2025 answer in Parliament, published on PIB, says the National Crime Records Bureau does not keep separate data on digital arrest scams.^[2] The same release says I4C had blocked more than 3,962 Skype IDs and 83,668 WhatsApp accounts used for digital arrest.^[2] Those are blocking counts, not victim counts, so I give no number of victims or rupees lost.

What generative AI changes, and what it does not

Two things stand out when you set the official description beside the AI evidence. The impersonation was already there before cheap AI: uniforms, a staged office, a confident script. And the demand never changes: stay on the line, tell nobody, pay now.

What generative AI adds is credibility at the edges. It can make the voice familiar, put a face on a video call, and write fluent messages in any language. Each of those removes one old clue (the stranger’s voice, the awkward grammar) that careful people relied on.

Cloned voices: what the evidence shows

The clearest authoritative description I found is from the US Federal Trade Commission, in a consumer alert of March 2023. It says a scammer could use AI to clone the voice of a loved one, and that all he needs is a short audio clip of your family member’s voice, which he could get from content posted online, and a voice-cloning program.^[6] The alert’s advice is plain: “Don’t trust the voice.” Call the person who supposedly contacted you and verify the story, using a phone number you know is theirs, and if you cannot reach them, try another family member or their friends.^[6]

The FTC also lists payment red flags: if the caller says to wire money, send cryptocurrency, or buy gift cards and read out the numbers, those could be signs of a scam.^[6] In India the equivalent would be a UPI transfer, a QR code or a bank transfer pushed under pressure, though that is my adaptation, not the FTC’s words.

Can people tell? A peer-reviewed study in PLOS ONE (published 2 August 2023) played genuine and deepfake audio to 529 people, in English and Mandarin. Listeners correctly spotted the deepfakes only 73% of the time, there was no difference between the two languages, and giving listeners examples improved results only slightly. The authors expect detection to get harder as speech synthesis improves.^[8]

One more official data point is legal rather than technical. In February 2024 the US Federal Communications Commission ruled that calls made with AI-generated voices are “artificial” under US telephone law, and its announcement names the voices of close family members among the imitation risks.^[7] That is US law, not Indian, and it is a ruling about robocalls. I cite it only to show that a regulator has treated voice cloning in scam calls as a real enough problem to act on.

Deepfake video: one well-documented case, and its limits

For video I found one clear, widely reported case, and it is not Indian. The Guardian reported on 17 May 2024 that the British engineering company Arup confirmed it was the victim of a deepfake fraud after an employee in Hong Kong was duped into sending HK$200m (£20m) to criminals during an AI-generated video call. Hong Kong police had said in February that a worker at a then-unnamed company was tricked on a hoax call with people “posing as senior officers of the company”. Arup confirmed that fake voices and images were used, and said its financial stability and business operations were not affected and none of its internal systems were compromised.^[9]

What this case does and does not prove should be said carefully. It shows that a multi-person video call with faked colleagues has fooled a trained employee at a large company. It does not show how common this is, and it does not show that Indian digital-arrest calls use deepfaked officers: the Home Affairs alert describes staged studios and uniforms, not AI faces.^[1] The sensible reading is that the cheap, proven version of the scam works already, and the AI version raises the ceiling on how convincing it can get.

Five checks that work whether or not the voice is real

None of these needs a detector, an app or any knowledge of AI. They are listed in the order I would teach them to a parent.

1. Call back on a number you already hold. This is the FTC’s core advice: use a phone number you know is theirs.^[6] For an official, find the number yourself from the bank card, the bank’s app or the department’s own site. Never use the number the caller gives you, and never a link in a message.

2. Agree a family code word. Choose, in person, a word that only your family knows, and use it when someone asks for money on a call. I want to be precise: the FTC alert I read does not recommend this; the idea appears in readers’ comments under it. I include it because it works without technology and fits the call-back habit, not because a regulator endorses it.^[6]

3. Refuse secrecy and refuse to stay on the line. The Home Affairs description has victims kept on a video call until demands are met.^[1] Any caller who demands that you tell nobody or stay on camera is showing you the shape of the scam. End the call.

4. Slow the money down. Nothing legitimate is lost by waiting an hour to check. A scam is. Ask a family member in person, or ring the bank on its own number.

5. Report within hours. The Home Affairs alert tells people to report on helpline 1930 or at cybercrime.gov.in,^[1] and the DoT release gives the same helpline and portal for people who are already victims.^[3]

What DoT and TRAI say about “your number will be disconnected”

A second common script is the telecom threat. A DoT release posted on PIB on 29 March 2024 says callers in DoT’s name were threatening that mobile numbers would be disconnected or were being misused in illegal activity. It says DoT does not authorise anyone to make such a call and asks people to report such communications at the Chakshu facility on the Sanchar Saathi portal.^[3] It also points people to the “Know Your Mobile Connections” facility, to check the connections registered in their name, and to 1930 and cybercrime.gov.in for those already defrauded.^[3]

TRAI’s Press Release 22/2025 says TRAI does not initiate communication with customers about mobile-number disconnection by message or otherwise, and has not authorised any third party to do so. It adds that disconnection for billing, KYC or misuse is done by the telecom service provider, and advises cross-checking through the provider’s authorised call centres or customer service centres.^[4]

The call-forwarding trick

A different attack uses the phone’s own settings. Storyboard18 reported on 30 December 2025 on an advisory it attributes to I4C: criminals pose as courier or delivery agents, claim a parcel needs confirming or rescheduling, and tell the victim to dial a code beginning with 21 followed by a number the fraudster controls. Once entered, call forwarding is active, so bank verification calls, OTP confirmations and authentication requests from platforms such as WhatsApp or Telegram go to the scammer.^[10]

The reported advice is never to dial codes beginning 21, 61, 67 or similar when an unknown caller tells you to, and, if you suspect forwarding is on, to dial ##002# to cancel all call forwarding, then report to 1930.^[10] This is press reporting of an advisory that I could not open myself. The AI angle is indirect: a fluent, localised script from a model makes the courier call more believable, but the harm comes from the forwarding, not from the AI.

Money, the bank and the RBI circular

If money has gone, speed matters. RBI’s circular of 6 July 2017 on limiting customer liability sets reporting windows for unauthorised electronic banking transactions. Where the fault lies neither with the bank nor with the customer, the customer has zero liability if they notify the bank within three working days; liability is limited if they report in four to seven working days; beyond seven working days it follows the bank’s Board-approved policy. The bank must credit the amount within 10 working days of notification, and the burden of proving customer liability lies on the bank.^[5]

Here is the catch for these scams. In a digital-arrest case the victim usually makes the transfer themselves, under pressure. The circular is about unauthorised transactions, and for a transaction you approved the same circular says that where the loss is due to the customer’s negligence, such as sharing payment credentials, the customer bears the loss until they report.^[5] Whether a tricked-into-approving transfer counts as unauthorised is not something the circular settles, and I cannot settle it either. What I can say is that reporting immediately cannot hurt, and waiting can. I read the 2017 text; later amendments were not checked.

Free tools for the moment of doubt

I built a set of free, browser-based checkers at MSRX Security for the moment you are unsure. They do not replace the five checks; they give you a second signal while you slow down. The scam checker reads a message against known patterns, including Indian ones: fake parcel and customs messages, call-forward codes, telecom threats, e-challan, electricity bill and family-emergency scams. The QR checker reads what a QR code contains, the URL inspector splits a link into its parts, and the phishing email checker looks at an email. If you do not know where to start, the help page asks a few questions and points you on, and if money has already moved, the UPI fraud playbook lists the steps.

A checker is a signal, not a verdict. Our sibling article, can an AI model tell a scam from a real message?, tests how well rules and an AI model do at exactly this job. A message can pass every pattern and still be a scam, and a scary-looking one can be genuine. This ties back to the earlier point: the habit of verifying on a number you hold is what protects you, and a tool only supports it. These tools are MSRX’s own and, like this article, are independent of any government body.

What I could not verify, and how firm each claim is

A scam article invites dramatic numbers. I have avoided them. The table below sorts every major claim by the kind of source behind it.

Facts in this article were checked on 30 October 2026. Contact details, helplines and rules change, so confirm them at the official sites before relying on them.

The message

AI makes the voice and the face less trustworthy, so stop trusting them. Hang up, call back on a number you already hold, refuse secrecy and pressure, and call 1930 within hours if money has moved.

Quick quiz

Tap a question to check your answer.

The Ministry of Home Affairs, I4C, the Department of Telecommunications, TRAI, the Reserve Bank of India, the FTC, the FCC, PLOS, The Guardian, Storyboard18 and the other organisations named are independent of MSRX, and this article is not affiliated with or endorsed by any of them. MSRX is not a government body and does not speak for one. This is general information, not legal, financial or investment advice, and MSRX and its author accept zero liability for any loss arising from use of it, to the fullest extent the law allows, except where the law does not allow that. Facts were checked on 30 October 2026 and may change. Do not enter passwords, card numbers or OTPs into any checker, including ours.