How to Spot AI-Powered Scams
AI has made impersonation cheap. A cloned voice, a fake endorsement video, or a message written in your colleague's exact style now takes a scammer minutes to produce. The tell is rarely the content anymore. It is the pressure: a request that arrives unprompted and needs money or credentials to move fast.
When you hold your own keys, that matters more. There is no fraud desk to reverse a transfer and no bank to freeze it. Onchain transactions are final, so the verification step is the control you have. This guide gives you a routine you can run in under a minute, and explains where Deploy's design limits the damage if something slips through.
The one-question checkpoint
Who started this conversation?
If you did, by opening the app you chose, you are on firm ground. If someone contacted you first, by DM, call, email, or video, treat the request as unverified until you confirm it somewhere you control. The same applies to anything that tells you to hurry. Urgency is the product a scammer is selling.
What AI scams look like in crypto
| Pattern | What it looks like | What to do |
|---|---|---|
| Voice or video clone | A familiar person asks you to send funds or share access, urgently. | Hang up. Call back on a number you already had. |
| Fake endorsement | A deepfaked founder or influencer promotes a trading agent or yield product. | Ignore the clip. Check the product on its official docs and domain. |
| Fake support | "Support" messages you first, asks you to verify or restore your wallet. | Support does not need your seed phrase or private key. Ever. |
| Lookalike site | A near-identical page asks you to connect and sign. | Type the address yourself. Read what any signature permits before approving. |
| Remote access | Someone asks you to install screen-sharing software to "fix" a problem. | Decline. Close the session and secure your accounts. |
A six-step routine
The order matters. Each step creates the space for the next.
- Stop before responding. Do not click, reply, or sign. A pause costs nothing.
- Verify through a source you already trust. Use a bookmarked site or a number you saved earlier, not the link or number in the message.
- Call back on a separate channel. If a person asked, confirm with them directly, outside the thread where the request arrived.
- Never share secrets. Passwords, one-time codes, seed phrases, and exported private keys stay with you.
- Secure the account if you acted. Revoke permissions, move funds you can still control to a fresh wallet, and change credentials.
- Report it and keep the evidence. Save messages, addresses, and transaction hashes. Reporting helps others avoid the same scam.
Common mistakes
- Trusting a familiar face or voice. Both can now be generated.
- Clicking the verification link inside the message that raised the alarm.
- Moving funds to a "safe wallet" that someone else supplies.
- Allowing remote access to your device.
- Staying quiet out of embarrassment. Speed matters after an incident, and so does telling someone.
How Deploy limits what an agent can reach
Scam resistance starts with you. Deploy's architecture adds a boundary around what an agent can do.
Your Deploy wallet is self-custodial, and you can export its private key. When you delegate an agent, it receives a separate session key with a fixed scope. That key can open, close, and manage positions within the agent's strategy. It cannot transfer your assets to another address, and it cannot withdraw your funds. You can revoke it at any time. The agent never receives your main key.
That design narrows the blast radius, but it does not remove the need for care:
- Your main key and seed phrase are the real keys. A scammer who gets them does not need a session key. Treat them as secrets no one legitimate will ask for, including anyone claiming to be from Deploy.
- Check where you are. The product lives at app.deploy.finance and the documentation at docs.deploy.finance. Reach them by typing the address or using your own bookmark, not through a link in a message.
- Read what you sign. A request from an unfamiliar site that asks for broad permissions is a reason to stop, not to proceed.
Before you act, ask
- Did I start this conversation, or did someone else?
- Is anyone asking me to move money or share a credential quickly?
- Can I confirm this through a channel the sender does not control?
- Would I still do this if the voice on the call were not who it sounds like?
- What would make me stop and review?
The bottom line
AI changes how convincing a scam looks. It does not change how a scam works: someone you did not expect is asking you to act before you can think. Make "who started this?" your first checkpoint, verify on a channel you control, and keep your keys to yourself.
Deploy provides educational content, not personalized financial, tax, or legal advice. Earning onchain carries risk, including loss. Review Deploy Finance risks before using an agent.