A familiar voice calls from an unfamiliar number. It sounds frightened, asks for an urgent e-wallet transfer, and insists that you tell nobody. For a criminology student, the first question is not simply whether the recording sounds artificial. It is how to protect the person, verify the claim, and document what actually happened.
This lesson examines AI-assisted impersonation through a fictional Philippine case. You will practise separating observations from assumptions, identifying useful digital records, and writing an initial incident account without prematurely accusing someone.
Start with the case
Fictional classroom scenario: At 8:15 p.m., Mara receives a call claiming to be her brother. The caller says he has had an accident and needs ₱8,000 immediately. A message supplies an e-wallet number registered under a different name. The caller says his usual phone is unavailable and discourages Mara from contacting their family. Mara transfers the money. At 8:35 p.m., her brother answers his normal number and says he never called.
Your first decision: Which response is strongest?
- Post the recipient’s name and photograph online and label that person the scammer.
- Delete the conversation to stop further contact.
- Contact the payment provider through its official channel, preserve available records, and document what was independently verified.
Reveal the explanation
Response 3. It supports immediate account protection and later investigation. A payment recipient’s name is an investigative lead, not proof of who made the call. Deleting the thread can remove useful context. Public accusations can harm an uninvolved person and expose the victim’s private information. Nothing in the scenario proves that the voice was AI-generated; impersonation is a working hypothesis requiring examination.
Why this topic matters now
In a release dated May 19, 2026, the NBI described an alleged online love-scam and cryptocurrency-fraud operation in Parañaque. Investigators reported recovering computers, phones, and an application reportedly capable of face replacement. This is a specific reported investigation, not proof that every convincing video call is a deepfake or that the people arrested have been convicted.
On September 15, 2026, a Philippine News Agency report on the PNP’s renewed cybercrime campaign described attention to online scams, account hacking and cyber fraud. These dated developments make AI-assisted deception a timely classroom topic. They do not establish a Philippine prevalence figure for voice cloning.
What AI changes—and what it does not
A cloned voice or altered video can imitate a trusted identity. AI-generated text can also make an invented story more fluent and consistent. The FBI’s December 2024 advisory describes criminals using generated text, audio, images and video to make financial fraud more believable.
In our teaching case, the deception depends on urgency, claimed family identity, secrecy and a payment request. The technology might help the caller appear credible, but the investigative task remains to establish conduct, identity and a traceable sequence of events. A convincing voice alone cannot establish who is speaking. An awkward voice alone cannot establish fraud.
Verify through a separate channel
Pause the request and contact the supposed person using a number already known to you, rather than a number supplied by the caller. If that fails, contact another trusted person who can independently check the situation. Do not provide an OTP, password or account access to someone claiming that it is needed to resolve the emergency.
The FBI advisory recommends independently contacting a purported caller and using a private family verification phrase. A phrase is an additional check, not a substitute for independent contact, and should not be posted publicly. In a real emergency, use verified emergency services rather than a payment link supplied by an unknown caller.
Build an evidence record
The checklist below is a classroom organisation tool, not a forensic acquisition procedure. Capture records available to the account owner without probing another person’s accounts or devices. Preserve originals where possible; distinguish an original message or export from a screenshot of it.
- Communication: save available messages, visible sender identifiers, profile links and the complete conversation context. Retain an audio message already received; do not assume that secretly recording a new call is lawful.
- Payment: retain the provider’s receipt, amount, time, recipient identifier and transaction reference. Keep any complaint reference separately.
- Timeline: record when the contact began, what was requested, what the victim did, and when independent verification occurred. Note the device’s displayed time and time zone.
- Handling: record who supplied each item, how it was copied, and where the original remains. Keep an unedited original and a separate redacted teaching copy.
- Limitations: state what is missing. A screenshot may omit earlier messages; a display name may not identify the account controller.
Do not crop or annotate the only copy. Do not submit private recordings to random “AI detector” websites. A screenshot, waveform or detector score by itself does not establish a suspect’s identity or make a record automatically admissible. Lawful acquisition, authenticity and interpretation require appropriate professional handling.
Separate fact, inference and unanswered questions
| Case information | Classification | What it supports |
|---|---|---|
| A receipt records an ₱8,000 transfer. | Documented observation, subject to verification | A payment trail; not the caller’s identity. |
| The brother denies making the call. | A person’s account, to be documented and checked | A reason to investigate impersonation. |
| The voice must have been cloned. | Unverified inference | A possible explanation, not an established finding. |
| The named recipient personally made the call. | Unanswered attribution question | Further investigation is needed. |
A careful initial report might say: “The complainant reports receiving a call from a person claiming to be her brother. A transfer receipt is available. Her brother subsequently denied making the call. The caller’s identity and the method of impersonation remain unverified.” This is more useful than a dramatic conclusion unsupported by the available records.
Respond and report through official channels
If money or an account is involved, contact the bank or e-money issuer promptly through its official app, website or independently verified contact number. Ask what protection and dispute steps are available, retain the case reference, and follow the provider’s instructions. Reporting does not guarantee that funds can be recovered.
The BSP’s official verifier and reporting guide advises reporting suspicious transactions to the institution first. For an unresolved concern involving a BSP-regulated institution, its guide explains escalation through BSP Online Buddy using the institution’s reference number. Use the official PNP or NBI website to confirm current cybercrime complaint channels. Contact the appropriate authorities for an immediate threat to safety.
Understand the legal question without skipping the evidence
Republic Act No. 12010, the Anti-Financial Account Scamming Act, addresses specified money-muling activities and social-engineering schemes involving financial accounts. Its section 4 sets out the prohibited acts and relevant conditions. Do not replace those conditions with the claim that every unusual transfer or every loan of an account automatically proves the same offence.
A fabricated voice is a possible means of deception, not a complete legal classification. Which provisions apply depends on the established conduct and the elements of the offence. For classroom analysis, identify the facts that would need to be proved; leave conclusions about charges to the appropriate legal and investigative process.
Practice: write the first incident note
Using only the fictional case, produce a one-page note with five parts: the reported event, a chronological timeline, an evidence inventory, three unanswered questions, and an immediate protection-and-referral plan. Mark each statement as an observation, a person’s account, or an inference.
For discussion, consider a second possibility: the call used ordinary impersonation rather than voice cloning. Which records would still matter? Your answer should show that sound investigation does not depend on guessing the technology correctly at the start.
Review checklist: Did you avoid blaming the victim? Did you protect identifying information? Did you distinguish the payment recipient from the caller? Did you preserve uncertainty about AI use? Did you propose lawful verification rather than amateur surveillance?
Researched October 4, 2026. The scenario and exercise are original teaching material. Reported investigations are attributed to their sources; allegations are not findings of guilt.