Seeing isn't proof anymore.
Everything you just saw took seconds to make, at no cost and no skill, and the same is now true for voices and video. A lecture recording, a department profile photo, a podcast interview: that's all the raw material an attacker needs to clone someone on this campus. So a familiar face or voice, or a trusted name in the From line, no longer proves who you're dealing with.
Stay on guard and verify who's who.
• Confirm anything urgent or unusual through a second channel. Call back on a number you already have.
• Don't act on a voice or a face alone when money, data, or access is involved.
• When something feels off, slow down and check.
None of this is hypothetical. Attackers have already used cloned voices and faked video to impersonate leaders and move real money, and the tools get cheaper and more convincing every month.
Real cases:
• A Martinez mom wired $5,400 after scammers used an AI clone of her daughter's voice to fake a kidnapping (ABC7, 2026) · SFist coverage
• A finance worker wired $25M after a video call where every "colleague" was an AI deepfake (Arup, 2024)
• FBI: attackers used AI voice clones to impersonate senior U.S. officials, including the Secretary of State (2025)
• Fraudsters spread deepfake videos of a stock exchange CEO pushing fake investment tips, forcing repeated public warnings (Bombay Stock Exchange, 2026)
• FTC guidance on how AI voice-cloning scams work, and the habit that beats them: hang up and call back on a number you already know (FTC)
See something off? Report it.
• Suspicious email: use the
Phish Reporter button, or forward it to
phishing@stanford.edu.
• A deepfake, a voice-clone call, or a request that feels wrong: contact your local IT support and report it at
uit.stanford.edu/security/report-incident. After hours, call the UIT Service Desk at
650-725-4357.
• On Stanford Slack,
#iso-public carries alerts from the Information Security Office. In an emergency, use
@iso to reach the whole team at once.
• Worried you clicked, replied, or already acted on something? Don't try to fix it alone. Report it right away, the sooner the better, and there's no such thing as a dumb report.
Who made this
Real or AI? comes from the
Stanford Cyber Emergency Response Team (CERT), a volunteer campus advisory group that tracks emerging threats, analyzes vulnerabilities, and shares intelligence across Stanford's academic and administrative units. Any Stanford business or academic unit can join, and students and researchers are welcome with sponsorship from a current member. Learn more or request membership at
cyber-cert.stanford.edu.