By “Tracey, the Safety Lady” Hawkins, Gen AI Cybersecurity Expert for End Users

A fake business website can be devastating for businesses and tricky if consumers don’t know to question it. They can steal a customer, damage a company’s reputation, send an impostor to someone’s home, and defraud visitors financially.

News10NBC recently interviewed me about fake garage door repair websites targeting consumers in upstate New York. Criminals were copying legitimate companies, using local phone numbers and paying for sponsored search ads so the fake websites appeared before the real ones.

One Wayne County company told the station it finds as many as 30 fraudulent websites using its name each month.

AI has made this kind of business impersonation much easier. Someone can now build a polished website, copy branding and create the appearance of a local company with very little time or technical skill.

Criminals can also spoof a local area code using a process that allows them to make a phone call appear to come from anywhere, even locally, in the target area. This makes caller ID untrustworthy.

How can consumers spot a fake business website?

1. Check the domain through a WHOIS search. The registration date can reveal that a website claiming to represent a long-established company was created only recently.

2. Do not rely on the phone number listed on the website. Confirm it through a previous invoice, a trusted referral, a trade association or another independent source.

Also, remember that the first search result is not always the legitimate business. Consumers typically stop at the first mention of the business name and call. Scammers can pay for sponsored placement which puts them at the top of the list. Scroll down and look for the actual website asks company name.

How can businesses protect their name?

Set up Google Alerts and add the business name as a search topic. Select “as it happens” to get immediate notifications. Whenever that business name shows up published online, you will get a link to the article or listing. Note that this isn’t 100% and doesn’t catch all mentions.

Look for fake websites, unfamiliar phone numbers, sponsored ads and similar domain names on a regular.

Purchase common misspellings and close variations of your website domain name when possible. Secure your real domain with multifactor authentication and automatic renewal to avoid a gap.

Customer education matters, too. Explain how your employees arrive, what identification they carry, how appointments are confirmed and what payment methods you accept. Give customers a verified number they can call before allowing anyone inside.

Criminals may be able to copy your website, but they should not be able to copy the way your customers verify who is at the door.

Education and training raises awareness and helps businesses reduce liability and manage risks.

By “Tracey, the Safety Lady” Hawkins, Safety and Gen AI Cybersecurity Expert for End Users.

Founder of Safety and Security Source in 1995 and The Real Estate Safety University™.

Source: News10NBC/WHEC-TV investigative reporting, June 2026.

By “Tracey, the Safety Lady” Hawkins

Meta removed its controversial Muse Image feature after widespread criticism, but the privacy concerns it exposed didn’t disappear.

Here’s what every individual, parent, entrepreneur, business and nonprofit should know.

The controversy serves as an important reminder that every public photo you post has become more valuable in the age of generative AI, making privacy settings and digital awareness more important than ever.

Meta’s Muse Image feature lasted only a matter of days.

The privacy questions it raised will last much longer.

Muse Image is an AI image-generation feature developed by Meta Superintelligence Labs, introduced earlier this month.

One capability allowed any user to generate AI images by referencing public Instagram accounts and using public photos as visual source material.

Account owners weren’t notified that their images could be used this way.

After criticism from users, privacy advocates, creators and SAG-AFTRA, Meta removed the feature, acknowledging that it had “missed the mark.”

The feature disappeared, but the bigger issue didn’t.

For years, the advice was simple: Think before you post. Generative AI changes that conversation. Now we also need to think about what happens after we post.

That’s no longer just a privacy issue. It’s a cybersecurity issue.

Every Public Photo Has More Value Than You Think

• A family photo reveals relationships.

• A graduation picture confirms a school.

• A conference selfie identifies where you work.

• A volunteer recognition post highlights the organizations you support.

An employee headshot helps establish credibility.

Individually, those details may seem harmless.

Collectively, they create a digital profile that AI can analyze in seconds. Legitimate companies use AI to build products and improve services.

Criminals can use the same publicly available information to create more convincing phishing emails, impersonation scams, fake social media accounts and identity-based fraud.

People often assume cybercriminals break into computers to gather information.

Sometimes they don’t have to. Sometimes we hand it to them.

Public photos, biographies, social media posts and organizational websites often provide everything a scammer needs to build a convincing story.

I’ve spent 31 years teaching people to lock their doors, trust their instincts and create a safety plan before something goes wrong. Today, your digital life deserves that same level of attention because criminals no longer separate the online world from the physical one. Neither should we.

Who Should Be Paying Attention?

The short answer is almost everyone with a public online presence.

Individuals. Every public photo adds another piece to your digital identity. That information can be used to strengthen fake profiles, impersonation attempts and social engineering scams.

Parents. Many children have a digital footprint long before they’re old enough to understand it. Photos shared today may remain online for years and could be repurposed in ways families never intended.

Teens. Teenagers are among the most active social media users and often the least likely to review privacy settings. They’re also frequent targets of AI-generated bullying, impersonation and image abuse.

Entrepreneurs and influencers. Your public image is part of your business. An AI-generated version of your face or voice can confuse customers, damage your credibility or falsely suggest you’ve endorsed a product or cause.

Businesses, nonprofits and associations. Employee headshots, donor recognition, member directories and client testimonials help build trust. They can also provide criminals with information to support impersonation scams targeting customers, donors, members or employees.

None of this means you should stop sharing your story.

It means you should become more intentional about what you share, why you share it and who can see it.

Deepfakes Are Only Part of the Story

Deepfakes receive most of the attention because they’re dramatic.

They’re also only one piece of a much larger problem.

Artificial intelligence can help criminals write better phishing emails, clone voices, create fake identities and personalize scams at a speed that wasn’t possible just a few years ago.

According to the FBI’s Internet Crime Complaint Center, Americans reported more than $20.8 billion in cybercrime losses in 2025. The report also documented more than 22,000 AI-related complaints tied to nearly $900 million in reported losses.

Those numbers reinforce what cybersecurity professionals have been saying for years: criminals adopt new technology just as quickly as legitimate businesses do.

What Has Congress Done?

Lawmakers are beginning to respond, although it’s important to understand where each effort stands.

The TAKE IT DOWN Act is now law. Signed in May 2025, it requires covered platforms to remove qualifying non-consensual intimate images, including qualifying AI-generated intimate content, after receiving a valid request.

The DEFIANCE Act and NO FAKES Act have not yet become law. If enacted, they would expand legal protections against certain forms of AI-generated impersonation and unauthorized digital replicas.

These measures won’t stop every scam, but they send an important message: your face, your voice and your digital identity have value.

What’s the Return on Investment?

People ask me whether AI safety education is really worth the time.

My answer is always the same.

For individuals and families, the investment is a few minutes reviewing privacy settings and learning how criminals use AI. The cost of ignoring it can be identity theft, financial loss or discovering someone has created a fake account using your name or image.

For entrepreneurs, your digital identity is part of your brand. Protecting it is no different than protecting your reputation.

For businesses, nonprofits and associations, the math is straightforward. One AI awareness program costs far less than responding to a successful impersonation scam, rebuilding public trust or managing a preventable crisis.

Prevention has always cost less than recovery. Generative AI hasn’t changed that. It has simply raised the stakes.

Five Ways to Reduce Your Risk

You don’t need to stop using social media. You do need better digital habits.

- Review your Instagram, Facebook and Meta privacy settings regularly. AI features and default settings can change.

- Decide whether every account in your household really needs to be public.

- Think carefully before posting high-resolution photos of children or sharing information that reveals routines, locations or personal details.

- If you own a business or lead a nonprofit, review the photos, biographies and personal information published on your website and social media channels.

- Talk with your family, employees and volunteers about AI-enabled scams. Awareness remains one of the best defenses.

The Bottom Line

Meta’s Muse Image feature is gone.

The next AI feature is already in development.

Technology will continue changing. Criminals will continue adapting. That’s nothing new.

What’s changing is the value of the information we share every day.

I’ve said for 31 years that the best safety plan is the one you create before you need it. Generative AI hasn’t changed that advice. It has expanded it.

Today, protecting yourself means more than locking your doors or updating your passwords. It means protecting your digital identity with the same care you protect your home, your family and your business.

Every photo you post tells a story.

Make sure it’s one you’re comfortable sharing with the world, because once it’s public, you no longer control where that story goes.

Stay up-to-date on technology news and updates. AI is changing on a regular basis and users need to be aware of the personal and business cybersecurity implications.

Frequently Asked Questions

Can AI use my public Instagram photos?

Meta briefly allowed users to generate AI images by referencing public Instagram accounts before removing the feature after widespread criticism. Even so, review your privacy settings regularly because AI features and platform policies continue to evolve.

Is the TAKE IT DOWN Act really law?

Yes. It became law in 2025 and requires covered platforms to remove qualifying non-consensual intimate images, including qualifying AI-generated intimate content, after receiving a valid request.

Have the DEFIANCE Act and NO FAKES Act passed?

No. Both remain proposed federal legislation and have not yet been enacted.

Why should businesses and nonprofits care?

Public photos, employee profiles, donor recognition and client testimonials can all be used to strengthen impersonation scams. Understanding that risk is now part of protecting your organization’s reputation, finances and public trust.

By “Tracey, the Safety Lady” Hawkins

Congress doesn’t unanimously agree on many things anymore.

That’s one reason the recent Senate Judiciary Committee markup on the proposed NO FAKES Act caught my attention.

Republicans and Democrats may disagree on where the legal boundaries should be, but they agreed on something much bigger: artificial intelligence has changed identity theft forever. Criminals no longer have to steal your Social Security number to impersonate you. Increasingly, they can clone your voice, copy your likeness and exploit your identity to scam your family, your customers or your employees.

As someone who has spent more than 31 years teaching people how to recognize danger before it becomes a crisis, I found the hearing encouraging. Congress is finally having the same conversation many of us in the safety and cybersecurity profession have been having for years. Technology is advancing at an extraordinary pace, but our awareness, our policies and our laws have struggled to keep up.

The committee unanimously advanced the legislation, sending it to the full Senate for consideration. While lawmakers debated how to balance innovation with First Amendment protections, they agreed that Americans deserve stronger safeguards against unauthorized AI-generated replicas of their voice and likeness.

Why now?

Because the numbers tell a story that is impossible to ignore.

According to the Federal Trade Commission, Americans reported losing a record $3.5 billion to imposter scams in 2025, nearly triple the amount reported just five years earlier. Nearly $1 billion of those losses involved criminals impersonating businesses, while government impersonation scams accounted for another $920 million.

The FBI is documenting the same trend from a different perspective.

For the first time in the history of the Internet Crime Complaint Center, more than 1 million cybercrime complaints were filed in a single year, resulting in more than $20.8 billion in reported losses. Even more significant, the bureau tracked AI-enabled crime as its own category for the first time, documenting nearly $893 million in reported losses involving criminals who used artificial intelligence to make their scams more believable.

Those numbers represent far more than statistics.

They represent grandparents convinced to wire money to someone they believed was a grandchild in trouble.

Employees who thought they were following instructions from their CEO.

Small-business owners who believed they were paying a trusted vendor.

Families who trusted what they saw and heard because it looked real.

That’s exactly what concerned Sen. Adam Schiff, who warned that generative AI has opened the door to widespread unauthorized exploitation of people’s identities. During the markup, he emphasized that this isn’t simply a Hollywood problem. Everyday Americans are just as vulnerable to having their voices and images copied and misused without permission.

What the NO FAKES Act Would Do

If enacted, the NO FAKES Act would establish federal protections against the unauthorized creation and distribution of AI-generated replicas of a person’s voice or likeness. The legislation is designed to give individuals greater control over their identity while preserving constitutionally protected activities such as news reporting, commentary, parody and satire.

The discussion during the Senate markup made one thing clear. Lawmakers agree that artificial intelligence has created extraordinary opportunities, but they also recognize it has given criminals an entirely new way to exploit trust.

Sen. Amy Klobuchar spoke about seeing manipulated images of herself that looked convincing enough to fool people. Her point wasn’t about politics. It was about how easily artificial intelligence can blur the line between what is real and what is fabricated.

Sen. Ted Cruz emphasized another challenge. Congress must protect Americans from fraud without restricting legitimate speech protected by the First Amendment. Finding that balance will continue to shape the bill as it moves through the legislative process.

The NO FAKES Act is only one piece of a broader federal response.

The TAKE IT DOWN Act, now federal law, gives victims a faster path to removing qualifying non-consensual intimate images, including AI-generated deepfakes, from covered online platforms.

The proposed DEFIANCE Act, which has passed the Senate and awaits action in the House, would strengthen the ability of victims to pursue civil legal action against those who create or distribute sexually explicit AI-generated deepfakes without consent.

Together, these measures acknowledge something we’ve been witnessing for years.

Your identity has become one of your most valuable assets.

Why This Matters to Every One of Us

One of the biggest misconceptions I hear is, “I don’t use artificial intelligence, so this doesn’t affect me.”

Unfortunately, criminals don’t need your permission to use AI against you.

The FTC reported that more than $2.1 billion in fraud losses during 2025 originated on social media. Criminals aren’t scrolling through Facebook, Instagram or LinkedIn because they’re curious about your vacation. They’re gathering information. They study family relationships, employers, birthdays, hobbies, photos, videos and voice recordings that help them build scams designed specifically for you.

That’s why I tell audiences something that often surprises them.

There is no such thing as true online privacy.

Privacy settings are absolutely worth using, but they are only one layer of protection. Friends can unknowingly share your content. Accounts can be compromised. Photos can be copied. Videos can be downloaded. Public information from multiple sources can be combined to build an astonishingly convincing impersonation.

That’s not meant to scare you.

It’s meant to help you make smarter decisions about what you share online.

The same principle applies inside every organization.

The FBI reported more than $3 billion in Business Email Compromise losses during 2025. Today’s criminals aren’t always hacking into networks. They’re hacking human trust. A cloned voice, a convincing email or a realistic video conference may be all it takes to persuade someone to approve a fraudulent wire transfer or disclose sensitive information.

The technology is impressive.

The manipulation is dangerous.

The target has always been the same.

People.

Where We Go From Here

Congress is doing its job by modernizing our laws.

Now it’s our turn to do ours.

Every family should create a verification word or phrase, or code word, that is never shared online. If someone calls claiming to be a loved one in distress, stop the conversation and ask for it before sending money or sharing information.

Every organization should build independent verification into its financial procedures. A single email, phone call or video meeting should never authorize a wire transfer, banking change or sensitive transaction.

Most importantly, every organization should invest in ongoing education.

I’ve spent more than 31 years teaching people how to recognize danger before it becomes a crisis. Whether the threat was personal safety, workplace violence, home security or cybersecurity, one lesson has remained remarkably consistent.

Prepared people make better decisions.

Educated employees ask better questions.

Informed families are harder to deceive.

Technology will continue to evolve.

Criminals will continue to adapt.

Congress will continue updating our laws.

But one truth will never change.

The strongest defense against AI-powered crime isn’t artificial intelligence.

It isn’t another app.

It isn’t another piece of software.

It’s an educated person who knows when to slow down, trust their instincts, verify independently and refuse to let fear or urgency make the decision.

That’s not just my closing thought.

It’s been my life’s work for more than 31 years.

And today, it may be the most important cybersecurity strategy of all.

By "Tracey, the Safety Lady" Hawkins

Which is best and the safest way to protect your devices, accounts, and data?

Passkey?

Password?

Passphrase?

Short answer: Use a passkey whenever a website offers one. If a passkey isn’t available, use a long, unique passphrase. Use a traditional password only when it’s your last option, and never reuse it.

That one decision could protect your bank account, your business, and your identity.

Why Should You Care Right Now?

Every time you create a new online account, you make a decision that could determine whether a cybercriminal gains access to your email, bank account, healthcare records, social media, or business systems.

Most people assume a password, a passphrase, and a passkey are basically the same thing. They’re not. Understanding the difference could keep you from becoming the next victim of an account takeover.

According to the FBI’s 2025 Internet Crime Report, released in April 2026, the Internet Crime Complaint Center (IC3) received 22,364 complaints involving artificial intelligence in 2025, with reported losses of nearly $893 million. It was the first time in the report’s 25-year history that the FBI tracked AI-enabled crime as its own category.

Those numbers aren’t just about technology. They’re about real people who were manipulated into trusting fake emails, fake websites, fake phone calls, cloned voices, deepfake videos, and fake identities.

Criminals are using generative AI to make scams more convincing than ever.

The bottom line: AI isn’t stealing your password. It’s convincing people to willingly hand it over.

The good news? You have stronger options than ever before.

🟥 Password: Good

A password is a combination of letters, numbers, and symbols used to access an online account.

Examples:

- Summer2026!

- BlueDog99

The problem is that many people create short, predictable passwords and then reuse them across multiple websites.

When one company suffers a data breach, criminals immediately try that same username and password on banks, email accounts, shopping sites, and social media platforms. It’s called credential stuffing, and it works because people reuse passwords.

One stolen password can unlock dozens of your accounts in minutes.

Best Practices

- Never reuse a password.

- Create a unique password for every account.

- Store passwords in a reputable password manager instead of writing them on paper or saving them in an unprotected document.

🟨 Passphrase: Better

A passphrase is a series of unrelated words combined into one long credential.

Example:

PurpleCoffeeRiverTrainSunshine!

When it comes to passwords, length beats complexity. A long passphrase is significantly harder for criminals to crack than a short, complicated password full of symbols and numbers. It’s also much easier for you to remember.

Pro Tip: Think in words, not random characters.

🟩 Passkey: Best

A passkey takes security to an entirely different level. Unlike a password or passphrase, you don’t have to remember it or type it. A passkey is securely stored on your phone, tablet, or computer.

When you sign in, your device proves it’s really you. You simply unlock your device with your fingerprint, facial recognition, or device PIN.

Here’s one of the biggest myths I hear in my classes:

Your fingerprint or Face ID is not your passkey.

Your fingerprint or face simply unlocks the passkey securely stored on your trusted device. Your biometric information stays on your device. It isn’t sent to the website you’re signing into.

Think of it this way:

Your fingerprint unlocks the front door. The passkey is the valuable item locked safely inside the house.

Are Passkeys Better Against AI?

This is one of the biggest reasons cybersecurity experts are encouraging people to adopt passkeys.

Even if criminals use AI to create a convincing deepfake of your face or clone your voice, that alone generally isn’t enough to access a passkey-protected account. They would also need your trusted device and would have to overcome its built-in security.

Just as important, passkeys are designed to be highly resistant to phishing attacks.

Fake websites work because they trick people into typing their passwords. With a passkey, there’s nothing to type. Because a passkey is cryptographically tied to the legitimate website, it generally won’t work on a convincing lookalike site.

That’s why organizations like CISA (the Cybersecurity and Infrastructure Security Agency) and the FIDO Alliance recommend phishing-resistant authentication whenever it’s available.

What if a Website Doesn’t Offer Passkeys?

Not every website supports passkeys yet, and that’s okay.

Here’s what I recommend:

- First choice: Use a passkey whenever it’s available.

- Second choice: Create a long, unique passphrase.

- Third choice: If you’re limited to a password, make it unique, store it in a reputable password manager, and turn on multifactor authentication (MFA) whenever it’s available.

⭐ The Biggest Lesson I’ve Learned

I’ve spent more than 31 years teaching people how to stay safer at work, at home, and online.

Here’s one lesson that hasn’t changed:

Criminals don’t break in. They log in.

Most account takeovers don’t happen because someone hacked through a complex firewall.

They happen because someone clicked a link, trusted a fake email, answered a scam phone call, or typed their password into a website that looked legitimate.

AI has made those scams faster to create, more personalized, more believable, and harder to detect.

That’s why stronger authentication matters.

Which One Should You Choose?

If the website offers...| You should choose…

✅ Passkey| Passkey

❌ No passkey| A long, unique passphrase

❌ Only a password| A unique password stored in a password manager, plus multifactor authentication

“Tracey, the Safety Lady” Says:

Technology changes.

Criminals change.

Your security should change, too.

The next time a website asks how you’d like to protect your account, don’t automatically create another password because that’s what you’ve always done.

Choose the strongest option available.

Your identity, your money, your business, and your reputation are worth it.

Frequently Asked Questions

What’s the difference between a password, a passphrase, and a passkey?

A password is a string of characters you create and type. A passphrase is a longer string of unrelated words that is stronger and easier to remember. A passkey is a secure digital credential stored on your trusted device that you don’t have to type, making it highly resistant to phishing attacks.

Are passkeys safer than passwords?

Yes. Passkeys can’t be reused across websites, guessed through brute-force attacks, or typed into fake websites. They’re currently one of the strongest ways to protect online accounts.

Can AI or a deepfake steal my passkey?

Generally, no. A deepfake of your face or voice alone isn’t enough to access a passkey-protected account. An attacker would typically also need your trusted device and would have to bypass its built-in security.

What happens if I lose my phone?

Most passkeys securely synchronize through your Apple, Google, or Microsoft account, allowing you to restore them on a new trusted device.

Many services also let you register passkeys on multiple trusted devices as a backup.

Do I still need a password manager?

Yes. Many websites don’t support passkeys yet, so a password manager remains one of the best ways to create and store unique passwords and passphrases. Many leading password managers now support storing passkeys as well.

About the Author

“Tracey, the Safety Lady” Hawkins is The Gen AI Cybersecurity Expert for End Users Who Protects People, Profits, and Reputations. She teaches people how to NOT get scammed, sued, or shut down.

Since founding Safety and Security Source in March 1995, she has trained organizations in more than 35 states on personal safety, cybersecurity, fraud prevention, and generative AI.

She founded the Business and Non-Profit Safety and Gen AI Cybersecurity UniversityTM.

She is an award-winning keynote speaker, instructor, and nationally recognized safety expert featured by The Today Show, CNN.com, ABCNews.com, The Washington Post, The Boston Globe, CNET, AAA, Essence, and REALTOR® Magazine.

Safety and Security Source

📧 tracey@safetyandsecuritysource.com

📞 816-788-6788

🌐 https://tinyurl.com/BusinessandNonProfitSafety

🔗 linkedin.com/in/traceythesafetylady

© Safety and Security Source 2026

By "Tracey, the Safety Lady" Hawkins

Get the AI Agent Prompt Injection PDF Info Sheet

Everyone is talking about AI agents, and they should be.

Prompt injection is the threat that makes AI agents costly. Many aren’t talking about it.

What is prompt injection?

Prompt injection is a new type of cyberattack that targets AI instead of people. A criminal hides instructions inside an email, document, website, calendar invitation or other content your AI agent is asked to read. Your employees never see those hidden instructions, but the AI might.

If the AI follows the attacker’s instructions instead of yours, it could provide misleading information, expose sensitive data or take actions it was never supposed to take.

Think of prompt injection as social engineering for AI. Instead of trying to fool an employee, the attacker is trying to fool the AI.

The Open Worldwide Application Security Project (OWASP) ranks prompt injection as the No. 1 security risk for AI applications, making it a business risk every organization should understand before deploying AI agents.

Unlike the first generation of AI tools that answered questions or drafted emails, AI agents can actually perform work. They can summarize contracts, organize inboxes, update customer records, schedule meetings, search company files and complete routine tasks that used to consume hours every week.

The business case is easy to make.

Organizations can reduce repetitive work, improve customer service, respond faster and free employees to focus on work that actually requires human creativity and judgment.

That is a competitive advantage.

But every time you give an AI agent permission to access company data or connect to another business system, you’re also giving it another key to your organization.

Here’s the question every CEO, broker, executive director, HR leader and business owner should ask before deploying AI agents.

If someone manipulated this AI tomorrow, what could it cost us?

That question isn’t designed to slow innovation.

It’s designed to protect your return on investment.

The criminals changed their target

For years, cybersecurity training focused on people:

Don’t click suspicious links.

Don’t open unexpected attachments.

Don’t send money because of an urgent email.

Those lessons still matter. Now criminals have another target. Your AI.

One of the fastest-growing threats is called prompt injection. The name sounds technical, but the concept isn’t.

Imagine asking your AI agent to summarize a contract before a meeting. Hidden inside that document is text your employees can’t see, but your AI can. Instead of simply following your instructions, the AI is tricked into following someone else’s.

The Open Worldwide Application Security Project, better known as OWASP, ranks prompt injection as the No. 1 security risk for AI applications. That’s significant because OWASP’s guidance is widely used by cybersecurity professionals around the world.

This isn’t just another IT issue. It’s becoming a leadership issue.

Ripped From the Headlines

Business leaders sometimes ask me whether this is still theoretical.

It isn’t.

In 2025, security researchers disclosed a critical vulnerability in Microsoft 365 Copilot known as EchoLeak. They demonstrated how a single email containing hidden instructions could manipulate Copilot while it summarized a user’s inbox.

Microsoft investigated the issue, released a security update and said it found no evidence the vulnerability had been exploited before the fix.

Researchers later demonstrated another prompt injection attack involving Google’s Gemini assistant.

Hidden instructions embedded in a calendar invitation influenced how the AI interacted with connected smart home devices.

Google addressed the reported issues, but the research reinforced an important lesson.

Neither attack relied on an employee clicking a malicious link.

Neither depended on someone opening a dangerous attachment.

The attack targeted the AI itself.

That changes the cybersecurity conversation.

The FBI is already seeing the broader impact of AI-enabled crime. In its 2025 Internet Crime Report, the bureau documented 22,364 complaints involving artificial intelligence, representing approximately $893 million in reported losses. The FBI also cautioned that the actual numbers are likely much higher because many victims never realize AI was part of the attack.

That should get every business leader’s attention.

Where do you go from here?

If your organization is exploring AI agents, don’t let this article discourage you.

Let it prepare you.

AI agents have the potential to save thousands of hours, reduce operating costs, improve customer service and eliminate repetitive work that keeps talented employees from focusing on what people do best: solving problems, building relationships and making sound decisions.

The opportunity is real. So is the responsibility.

Before you connect an AI agent to your email, customer database, financial systems or company files, put a few simple guardrails in place.

Give AI agents only the access they need to do their jobs.

Keep a human in the loop for financial transactions, contracts, hiring decisions, legal matters and anything involving confidential information. AI should support your people, not replace their judgment.

Train employees to recognize AI-specific threats, including prompt injection, just as you train them to recognize phishing emails and social engineering.

Develop an AI governance policy that defines approved tools, acceptable use, data protection, accountability and incident response before AI becomes part of everyday business operations.

These aren’t barriers to innovation. They’re the foundation for using AI with confidence.

“Tracey, the Safety Lady” Hawkins’ advice:

I’ve spent 31 years helping organizations recognize risks before they become expensive problems.

The businesses that get the greatest return on investment from AI won’t simply deploy the most AI agents.

They’ll deploy them responsibly.

They’ll understand what their AI can access, what it can do and where people need to remain part of the decision-making process.

Technology will continue to evolve. Good judgment never goes out of style. The goal isn’t to fear AI. The goal is to lead it.

When you combine AI with smart governance, employee education and human oversight, you don’t have to choose between innovation and security. You can protect your people, your profits and your reputation while taking full advantage of everything AI agents have to offer.

That’s how you make sure your organization doesn’t get scammed, sued or shut down.

“Tracey, the Safety Lady” Hawkins is a personal safety and generative AI cybersecurity expert for end users, national and international keynote speaker, and founder of Safety and Security Source. Since 1995, she has helped organizations protect their people, profits and reputations through proactive safety, security and AI cybersecurity education. She serves as Board Member and Cybersecurity Chair for the Kansas City AI Club, one of the largest AI clubs in the United States, and as AI Safety and Ethics Lead for WeCodeKC.

Her clients include NAR, ASAE, American Airlines, AARP, Commerce Bank, UMB Bank, H&R Block, the Missouri National Guard and organizations across North America.

Get the AI Agent Prompt Injection PDF Info Sheet

By “Tracey, the Safety Lady” Hawkins

This month, I introduced “Tizzi” to everyone attending my safety presentations, from business women to real estate professionals.

She has a business, a professional headshot, conference photos, travel pictures, family images and an online presence that looks as if it has been built over several years.

If you came across her profile, there's a good chance you wouldn't question whether she was real.

There’s just one problem.

I created her in less than an hour using generative AI.

Tizzi doesn’t exist.

I didn’t create her to fool people. I created her to demonstrate how quickly criminals can build believable online identities and why we can no longer assume that a polished profile represents a real person.

That’s no longer a hypothetical problem. It’s happening every day.

According to the FBI’s 2025 Internet Crime Report, Americans filed more than 1 million cybercrime complaints in 2025, reporting $20.877 billion in losses. For the first time, the report includes a dedicated section on crimes involving artificial intelligence. The FBI received 22,364 complaints involving AI-enabled crime, with reported losses approaching $893 million.

Those numbers come directly from the FBI’s Internet Crime Complaint Center and represent only the crimes that victims recognized and reported.

The FBI has also warned that criminals are using generative AI to create fake social media profiles, realistic photographs, fraudulent identification documents and convincing audio and video to support financial fraud.

In other words, they’re creating people who never existed and making them appear trustworthy.

That’s why Tizzi matters.

She isn’t simply an AI-generated face. She’s a reminder that trust has become one of the easiest things for criminals to manufacture.

Think about how often you decide whether someone is credible. You review job applicants. You accept LinkedIn requests. You respond to messages from potential clients. You join online groups, participate in professional discussions and interact with people you’ve never met in person.

Most of us rely on the same signals we’ve trusted for years: photographs, mutual connections, work history and an active social media presence.

Those signals aren’t enough anymore.

A convincing online identity can now be created in a matter of minutes. The technology is inexpensive, widely available and improving at a remarkable pace. Criminals don’t need to hack your computer if they can persuade you to trust the wrong person.

That’s why organizations need to expand the way they think about cybersecurity.

Firewalls, antivirus software and multifactor authentication remain essential, but they don’t help an employee recognize an AI-generated identity during a hiring interview, a business email exchange or an investment conversation. That requires awareness, critical thinking and training.

The same is true for consumers. Before sending money, changing banking information, responding to an urgent request or accepting an investment opportunity, slow the conversation down and verify who you’re dealing with through an independent, trusted source.

Technology has changed.

Human nature hasn’t.

We still want to believe the person on the other side of the screen is exactly who they claim to be. Criminals understand that, and they’re using generative AI to exploit it.

I created Tizzi to start a conversation.

My hope is that she also helps people pause, ask one more question and verify one more time before placing their trust in someone they’ve only met online.

That simple habit may become one of the most valuable cybersecurity skills we can teach.

How These Scams Usually Begin

Not with hacking…

With conversation.

A wrong-number text.

A Facebook comment.

A LinkedIn request.

A dating app message.

A casual DM.

The criminal slowly builds familiarity and trust.

And because the online profile looks authentic, the victim relaxes.

That’s the real danger of AI.

It can manufacture credibility at scale.

Train people before they become victims

Most employees, executives, HR teams, managers, and consumers have never been trained to spot:

• deepfakes

• synthetic identities

• AI-generated personas

• social engineering tactics

• AI-powered fraud schemes

That lack of awareness is exactly what criminals are counting on.

The Bottom Line

The next scammer won’t necessarily look suspicious.

That’s why generative AI cybersecurity awareness training is now a business necessity and a personal safety skill.

Because in the AI era, “seeing is believing” is no longer a security strategy.

It’s a liability.

---

“Tracey, the Safety Lady” Hawkins, founder of Safety and Security Source and the Business and Non-Profit Safety and Gen AI Cybersecurity UniversityTM is a generative AI cybersecurity expert for end users who helps organizations protect people, profits, and reputations from AI-powered scams, deepfakes, synthetic identities, and social engineering attacks.

She teaches businesses, associations, nonprofits, schools, and consumers how criminals weaponize AI, and how to recognize the warning signs before becoming the next victim.

Americans reported more than $20.8 billion in cybercrime losses in 2025, a 26% increase from the previous year. Business email compromise scams generated more than $3 billion in losses. For the first time, the FBI also tracked complaints that included AI-related information, identifying more than 22,000 complaints and nearly $900 million in losses connected to incidents where artificial intelligence played a role.

And those are only the crimes that were reported.

I’ve spent more than 30 years teaching people how to stay safe. Whether I’m speaking to a room full of executives, a nonprofit board, a housing provider, a school district, or a group of REALTORS®, I hear the same thing:

“We know deepfakes are a problem.”

What I don’t hear is anyone talking about digital twins.

That conversation needs to happen now.

Because one technology is creating new opportunities for organizations.

The other is creating new opportunities for criminals.

And most people don’t understand the difference.

Digital Twins Are Built to Help

A digital twin is an authorized AI-powered version of a person, process, or system.

The word that matters is authorized.

Think of it as your official AI representative.

Organizations are already experimenting with digital twins that answer employee questions, deliver training, support customers, and help scale expertise without adding staff.

An executive’s AI assistant.

A trainer’s AI avatar.

A customer service representative available around the clock.

A compliance guide that can answer routine questions instantly.

Used appropriately, digital twins can improve efficiency, consistency, and productivity.

That’s the promise.

Deepfakes Are Built to Deceive

A deepfake uses many of the same underlying technologies, but for a completely different purpose.

A deepfake is designed to make you believe someone is saying or doing something they never actually said or did.

The word that matters here is unauthorized.

A deepfake is your unauthorized AI impersonator.

Criminals use deepfakes to impersonate executives, property owners, vendors, government officials, family members, and trusted professionals.

The goal isn’t innovation.

The goal is manipulation.

And increasingly, the goal is money.

Why This Matters More Than Most Leaders Realize

Most organizations are still asking:

“Can we spot a deepfake?”

That’s no longer the right question.

The better question is:

“How do we verify identity when AI can convincingly imitate almost anyone?”

Because the old trust signals are disappearing.

A familiar voice isn’t enough.

A video call isn’t enough.

An email from the CEO isn’t enough.

Even caller ID isn’t enough.

When criminals can clone a voice, generate a video, and write a convincing message in seconds, organizations need something stronger than trust.

They need verification.

How the Attack Usually Happens

The process is surprisingly simple.

Criminals gather publicly available information about your organization.

They watch conference presentations.

They listen to podcast interviews.

They study LinkedIn profiles.

They review press releases and social media posts.

Then they use that information to build a convincing impersonation.

The request that follows is almost always urgent.

A wire transfer.

A vendor payment change.

Payroll information.

A confidential document.

Access to a system.

The technology gets the employee’s attention.

The urgency gets the employee to act.

Why Small Organizations Are Not Immune

One of the most dangerous assumptions I encounter is this:

“We aren’t big enough to be targeted.”

Criminals don’t target organizations because they’re famous.

They target organizations because they’re vulnerable.

If your organization handles payroll, donations, wire transfers, contracts, customer information, member data, or vendor payments, you have something worth stealing.

That includes nonprofits.

• Associations.

• Schools.

• Housing providers.

• Credit unions.

• Local governments.

• Small businesses.

And yes, large corporations.

What Leaders Should Do Right Now

You do not need to buy a million-dollar cybersecurity platform to reduce your risk.

Start with process.

1. Require verification before money moves.

2. Create documented callback procedures.

3. Train employees on voice cloning and AI-enabled fraud.

4. Require dual approval for significant financial transactions.

5. Develop an incident response plan before you need one.

6. Most importantly, give employees permission to slow down.

Criminals depend on urgency.

Verification disrupts urgency.

The Bottom Line

Digital twins are likely to become a normal part of how organizations operate.

Deepfakes are likely to become a normal part of how criminals operate.

Both are already here.

Most cybersecurity conversations focus on technology.

The bigger issue is human behavior. Criminals rarely break into systems first. They manipulate people first.

That’s why the organizations that protect their people, profits, and reputations won’t necessarily be the ones with the most expensive software.

They’ll be the ones with employees who know how to pause, question, and verify.

Because in the age of artificial intelligence, the next voice your employee hears may sound exactly like the CEO.

“Tracey, the Safety Lady” Hawkins is an internationally recognized safety and generative AI cybersecurity expert for end users, keynote speaker, trainer, and founder of Safety and Security Source. She teaches businesses, nonprofits, associations, housing providers, schools, government agencies, and community organizations how to protect people, profits, property, and reputations from fraud, scams, cybercrime, violence, and emerging AI threats. Hawkins is the founder of Real Estate Safety University® and Business and Nonprofit Safety and Cybersecurity University®, and host of Ripped From the Headlines: The Safety Edition by “Tracey, the Safety Lady” podcast and newsletter.

By “Tracey, the Safety Lady” Hawkins

The website had a padlock.

The company logo looked right.

The reviews seemed legitimate.

The ad appeared at the top of the search results.

Everything looked exactly the way it should.

Except it wasn’t.

Somewhere between your search and your purchase, a criminal inserted a fake website into the process. By the time many victims realize what happened, the money is gone, their credit card has been compromised, or their personal information is being used in other scams.

This is not a rare problem. According to the FBI Internet Crime Complaint Center’s 2025 Annual Report, Americans reported $20.9 billion in cybercrime losses last year. That’s a 26 percent increase over the previous year. Among the most common complaints were phishing and spoofing schemes, many of which involve fake websites designed to impersonate legitimate businesses.

If you think spotting a fake website is easy, think again.

Today’s fake websites are not the sloppy scams of the past. Artificial intelligence has made it possible for criminals to create polished, professional-looking websites in a matter of hours. Many are so convincing that even experienced internet users have trouble spotting them.

The Scam Starts Long Before You Visit the Website

Most people assume criminals are waiting for victims to stumble across their fake websites.

They’re not.

The criminals are actively studying what people want, need, and search for.

They follow major events, popular products, travel trends, sporting events, concert tours, tax deadlines, and breaking news.

Right now, that could mean FIFA World Cup tickets, vacation rentals, airline reservations, hard-to-find products, customer support numbers, or deeply discounted merchandise.

If people are searching for it, criminals are looking for ways to exploit it.

How the Scam Works

The first step is building a website that looks trustworthy.

Criminals often copy logos, branding, images, and content directly from legitimate companies. They may create a web address that differs from the real one by only a single letter or character.

Next, they find ways to get victims to the site.

That might happen through a sponsored advertisement, a social media post, a QR code, a text message, an email, or even a search engine result.

One of the biggest misconceptions I encounter is the belief that if a website appears near the top of search results, it must be legitimate.

That’s simply not true.

Criminals buy advertisements, too.

Once a visitor lands on the site, the pressure begins.

Only a few tickets remain.

Limited inventory.

Sale ends tonight.

Verify your account now.

These messages are not there by accident. They’re designed to create urgency and discourage verification.

When people feel rushed, they make decisions they might not otherwise make.

The Real Goal Isn’t Always Your Money

Most people think fake website scams are about stealing a payment.

Sometimes they are.

Often, they’re about much more.

Criminals may be collecting:

• Credit card information

• Banking details

• Usernames and passwords

• Driver’s license information

• Passport information

• Social Security numbers

• Email addresses and phone numbers

That information can be used for identity theft, account takeovers, business email compromise, and future scams.

In many cases, the fake purchase is only the beginning.

The Padlock Myth

Let’s clear up one of the most dangerous misconceptions on the internet.

A padlock icon does not mean a website is legitimate.

It simply means the connection between your device and the website is encrypted.

Criminals use encrypted websites every day.

The padlock does not verify the company.

It does not verify the seller.

It does not verify the website.

And it certainly does not guarantee your safety.

Why Artificial Intelligence Changes Everything

Artificial intelligence has dramatically lowered the barrier for cybercriminals.

Years ago, building a convincing fake website required technical skill, time, and effort.

Today, AI can help criminals write professional copy, generate product descriptions, create realistic customer reviews, produce images, and even power fake customer service chat systems.

The result is a scam that looks more polished, more credible, and more believable than ever before.

That’s one reason I spend so much time teaching businesses, nonprofits, associations, entrepreneurs, and consumers how to verify before they trust.

The appearance of legitimacy is no longer enough.

Five Ways to Protect Yourself

Before you buy, book, donate, download, log in, or pay online, take a few minutes to verify what you’re looking at.

• First, search for the company independently rather than relying on links in advertisements, emails, text messages, or social media posts.

• Second, examine the website address carefully. Look for misspellings, extra words, unusual characters, or domain extensions that don’t match the legitimate company.

• Third, verify the business through independent reviews and trusted sources.

• Fourth, contact the company using a phone number you locate yourself, not one listed on a suspicious website.

Finally, pay attention to pressure tactics. Urgency is one of the oldest tricks in the scammer’s playbook.

If someone wants your money immediately, that’s usually the best time to slow down.

Why This Matters to Businesses

Fake websites aren’t just a consumer problem.

Organizations face the same threat.

Employees may be tricked into entering credentials on fraudulent websites. Finance departments may receive payment instructions connected to fake domains. Vendors may be impersonated. Customer information may be exposed.

The FBI reported more than $3 billion in losses from business email compromise schemes in 2025 alone.

Many of those scams begin with deception, impersonation, and trust.

The same tactics used against consumers are being used against businesses every day.

The Bottom Line

The criminals behind fake website scams are counting on one thing: that you’ll trust what you see.

The logo.

The reviews.

The advertisement.

The padlock.

The professional design.

What they’re hoping you won’t do is verify.

That’s why the most important cybersecurity habit isn’t a piece of software.

It’s a behavior.

Pause.

Question.

Verify.

Because five minutes of verification can save thousands of dollars, months of frustration, and a tremendous amount of heartache.

And that’s a much better investment than trying to recover after the damage is already done.

“Tracey, the Safety Lady” Hawkins is a personal safety and generative AI cybersecurity expert for end users, national keynote speaker, educator, and founder of Safety and Security Source.

She helps organizations protect people, profits, and reputations by teaching practical strategies to prevent scams, fraud, cybercrime, and security threats before they happen.

By “Tracey, the Safety Lady” Hawkins, Gen AI Cybersecurity Expert for End Users

Cryptocurrency-backed mortgages have arrived in the American housing market.

So have the criminals looking to exploit them.

As cryptocurrency enters federally conforming mortgage conversations, fraud risk expands.

On March 26, 2026, mortgage company Better Home & Finance and Coinbase announced what Coinbase described as the first crypto-backed conforming mortgage solution.

The development did not happen overnight.

On June 25, 2025, Federal Housing Finance Agency Director William J. Pulte formally ordered Fannie Mae and Freddie Mac to prepare proposals for considering cryptocurrency held on U.S.-regulated exchanges as a qualifying reserve asset without requiring borrowers to convert it to U.S. dollars first.

That represents a historic policy shift.

It also creates a new attack surface for fraud.

Wire fraud has evolved from a rudimentary email scam into a sophisticated, AI-enabled operation capable of draining a closing account in minutes.

Crypto mortgages may represent the next significant expansion of fraud risk within the real estate industry.

WHAT CONSUMERS MUST KNOW BEFORE THEY PLEDGE

For some homebuyers who are cryptocurrency-rich but cash-poor, the product may provide a path to homeownership without requiring the sale of cryptocurrency and the potential tax consequences that may result.

But those buyers are stepping into a high-risk digital environment, and real estate professionals must be prepared to educate them.

Four critical rules consumers need to understand before pledging cryptocurrency as collateral:

1. THE RISK-BASED DISCOUNT

Cryptocurrency assets may be subject to significant risk-based discounts, collateral requirements, and eligibility standards during underwriting.

Consumers should verify the exact loan-to-value treatment directly with their lender.

Anyone promising full face-value credit should be viewed with skepticism.

2. THE CUSTODY REQUIREMENT

Borrowers generally cannot use a cold wallet, such as a Ledger device, or a private decentralized finance account.

Cryptocurrency typically must be held in an approved U.S.-regulated custodial account.

Consumers should verify specific requirements with their lender.

3. THE VERIFICATION TRAP

Scammers send fake links directing borrowers to “verify” their wallets or transfer assets.

Consumers should never click links contained in unsolicited emails or text messages and should access their exchange only through the official website or verified app.

4. THE PAYMENT BUFFER

Unlike traditional crypto trading, pledged cryptocurrency collateral is generally not subject to margin calls while mortgage payments remain current.

Consumers should confirm all liquidation terms, default provisions, and collateral triggers directly with their lender before closing.

THE CYBERSECURITY THREATS REAL ESTATE PROFESSIONALS ARE NOT BEING BRIEFED ON

Three primary cyberattack vectors are likely to target crypto mortgage transactions.

DEEPFAKE IMPERSONATION DURING CLOSING

The FBI’s Internet Crime Complaint Center received more than 22,000 AI-related complaints in 2025.

Fraudsters are increasingly using artificial intelligence to clone voices and create realistic video impersonations of lenders, title professionals, and other trusted parties.

Criminals can create convincing AI-generated voice impersonations from short audio samples found online.

If a lender calls with updated instructions, borrowers should hang up and call back using a verified number.

If a buyer receives an email containing revised wire instructions, no matter how well written, they should independently verify the information through a known, trusted contact before taking action.

The real weapon in these attacks is urgency, confusion, and trust manipulation during a high-stress transaction.

Real estate professionals should consider incorporating fraud awareness and cybersecurity discussions into buyer consultations and listing appointments as part of their overall consumer education process.

BUSINESS EMAIL COMPROMISE

Business email compromise generated approximately $3.04 billion in reported losses in 2025.

Crypto mortgage transactions may introduce additional documentation, verification requirements, and communication touchpoints.

Increased transaction complexity can create more opportunities for confusion, impersonation attempts, and fraudulent instruction changes.

Real estate professionals should implement strong cybersecurity practices, including:

• Multi-factor authentication

• Passkeys or strong passphrases, which are more secure than passwords

• Software and security updates

• Antivirus protection

• Domain-based business email accounts

• Ongoing cybersecurity education

THE FAKE “URGENT VERIFICATION” SCAM

Criminals often exploit the stress and urgency associated with closing deadlines.

Fraudsters may send AI-generated messages claiming a borrower’s cryptocurrency collateral has been rejected, suspended, frozen, or requires immediate re-verification.

The goal is to pressure victims into transferring assets or sharing credentials before verifying the request.

Consumers should stop, independently verify the request, and contact their lender or real estate professional before taking any action.

WHAT REAL ESTATE PROFESSIONALS SHOULD DO RIGHT NOW

Failure to educate consumers about wire fraud, impersonation scams, and transaction-related cyber risks can create reputational, financial, and operational exposure for brokerages.

Three immediate steps every real estate professional should consider:

IMPLEMENT A VERBAL CALL-BACK POLICY

Make independent verbal verification a non-negotiable standard for wire transfers and any changes to financial instructions.

EDUCATE CLIENTS EARLY

Set expectations at the beginning of the transaction.

Consumers who do not understand custody requirements, verification procedures, or fraud risks may be more vulnerable to scams.

TREAT CYBERSECURITY TRAINING AS A PROFESSIONAL STANDARD

The National Association of REALTORS®️ and cybersecurity professionals consistently recommend consumer education, secure communication practices, and independent verification of financial instructions as key fraud-prevention measures.

Associations, brokerages, MLS organizations, and industry professionals should proactively address cybersecurity awareness before a transaction is targeted.

FINAL THOUGHTS

Crypto-backed mortgages may represent the next evolution of home financing.

They may also create new opportunities for fraudsters seeking to exploit complexity, urgency, and consumer unfamiliarity.

The professionals who best protect their clients, their transactions, and their reputations will be those who understand the product, recognize the attack points, and establish verification protocols before the first suspicious email arrives.

By “Tracey, the Safety Lady” Hawkins

Former real estate agent, international safety instructor, founder of Safety and Security Source and The Real Estate Safety University™, and award-winning host of the former National Association of REALTORS® Drive With NAR: The Safety Series podcast. Real estate safety expert since 1995 and Generative AI Cybersecurity Expert for End Users who helps organizations protect people, profits, and reputations.

(AI image of a man on a keyboard entering PII.)

By “Tracey, the Safety Lady” Hawkins

A bank just filed an SEC disclosure tied to the use of an unauthorized AI application.

Let that sink in.

CB Financial Services, parent company of Community Bank, disclosed that sensitive customer information was handled through what the company described as an unauthorized artificial intelligence-based software application. According to the filing with the U.S. Securities and Exchange Commission, the information involved included customer names, Social Security numbers and dates of birth.

The company said the incident did not impact banking operations, payment systems or customer access to accounts. But because of the sensitivity and volume of the information involved, the company determined the incident was material and filed an Item 1.05 Form 8-K cybersecurity disclosure with the SEC. (sec.gov)

This story matters because it does not appear to be a traditional cyberattack.

The filing does not describe ransomware.

It does not describe hackers breaking into systems.

It does not describe malware shutting down operations.

Instead, this appears connected to the use of an unauthorized AI tool by an employee.

That should be a massive wake-up call for every business, nonprofit, association, real estate company, school and financial institution rushing to use generative AI without employee training, governance or safe workplace policies.

Because the greatest cybersecurity risk inside your organization may not be a criminal.

It may be a good employee trying to save time.

Employees everywhere are using AI tools to summarize documents, write emails, automate tasks, analyze spreadsheets and speed up workflows. Many are uploading customer data, contracts, HR files, financial information and confidential records into AI systems they assume are secure.

Some are not approved by the organization.

Some retain data.

Some may expose sensitive information.

And many employees have no idea where that information goes after they paste it into a prompt box.

Cybersecurity professionals call this Shadow AI: employees using artificial intelligence tools without company approval, oversight, cybersecurity safeguards or governance policies.

And now the risks are getting even bigger.

Researchers are also warning about autonomous AI agents like OpenClaw, an open-source AI assistant designed to interact with workplace systems using the same permissions as the employee who installs it.

That means these systems may be capable of:

• Accessing email
• Reading company files
• Connecting to Slack and cloud systems
• Interacting with workplace software
• Automating tasks
• Handling sensitive business information

Most organizations are nowhere near prepared for this level of risk.

Many still have:

• No AI usage policy
• No approved AI tools list
• No employee AI cybersecurity awareness training
• No governance framework
• No restrictions on sensitive data uploads
• No understanding of what employees are already using

Traditional cybersecurity training taught employees not to click suspicious links.

Generative AI changes the equation because employees may accidentally create the exposure themselves by voluntarily uploading sensitive information into systems they trust.

A well known influencer recently told her millions of followers to upload their own financial statements to an AI tool for analysis. Without warning them to redact their personal information first.

That is why organizations need a completely different approach to cybersecurity education now.

Employees need to understand:

• What data AI systems retain
• Whether prompts are stored
• Where uploaded information goes
• Whether information may train models
• What permissions AI agents may possess
• How prompt injection attacks work
• Why convenience can create liability

According to the FBI’s 2025 Internet Crime Report, cybercrime losses reached nearly $21 billion in one year. The FBI also separately tracked AI-related cybercrime complaints for the first time, reporting nearly $893 million in losses connected to AI-enabled fraud, deepfakes and impersonation scams.

And once an incident occurs, the costs rise fast:

• Legal fees
• Regulatory investigations
• Customer notification costs
• Credit monitoring
• Identity theft protection services
• Public relations crisis management
• Reputation damage
• Lost customer trust
• Cybersecurity forensic investigations
• Lawsuits

IBM estimates the average global cost of a data breach reached $4.4 million.

Organizations that address these risks now may dramatically reduce legal, regulatory and reputational damage later.

This is no longer just an IT department problem.

It is a leadership issue.

It is a workforce behavior issue.

It is a culture issue.

And increasingly, it is becoming a boardroom issue.

My generative AI cybersecurity training programs help organizations:

• Recognize Shadow AI risks before they become headlines
• Build safer workplace AI practices
• Protect customer and employee data
• Spot deepfakes, phishing and AI impersonation scams
• Reduce fraud and liability exposure
• Create safer AI usage policies
• Teach employees how to use AI responsibly without exposing the organization

I teach generative AI cybersecurity for end users and protect people, profits and reputations.

As cybersecurity chairperson and board member for the KC AI Club, founder of Safety and Security Source, Real Estate Safety University™ and Business and Non-Profit Safety University™, award-winning podcast host and national safety speaker, I help organizations understand the human side of AI cybersecurity before one employee mistake becomes the next national headline.

Because after a breach, organizations pay for cleanup.

Before a breach, they can invest in prevention.

If you want to be proactive and get Gen AI cybersecurity training scheduled, now is the best time.

Let's schedule a brief call to discuss a game plan.

By "Tracey, the Safety Lady" Hawkins, Gen AI Expert for End Users

I need people to understand something right now.

Fake checks are fooling smart people every single day.

Not careless people or uninformed people.
But, smart people.

Business owners. Property managers. Landlords. Contractors. Nonprofits. Everyday consumers.

And criminals are getting VERY good at this.

Years ago, fake checks were often easier to spot. Today, some of them look incredibly real. Criminals are using:

• counterfeit cashier’s checks
• stolen banking information
• AI-enhanced graphics
• fake business identities
• spoofed emails and text messages
• social engineering tactics designed to pressure people emotionally and financially

That last part matters.

Artificial intelligence is helping criminals create more polished, professional-looking scams faster than ever before. Something “looking legitimate” is no longer enough.

This is no longer just a banking issue.

It is:

• a business issue
• a cybersecurity issue
• a consumer protection issue
• a reputation issue

Because when fraud happens, businesses lose more than money.

They lose:

• time
• productivity
• operational stability
• trust
• credibility
• and sometimes customers

That is the real ROI conversation people should be having.

Fraud prevention protects:

• people
• profits
• reputations
• operations
• and customer trust

Here’s the Mistake That Is Costing People Thousands

People assume: “The money showed up in my account, so the check must have cleared.”

Nope.

That is NOT how this works.

Banks are often required to make some funds available before a check is fully verified.

So yes, the money may temporarily appear in your account.

Then days later:

• the bank reverses the deposit
• the money disappears
• and the scammer is gone

Meanwhile:

• the apartment keys were handed over
• the refund was already sent
• the merchandise was released
• or the contractor already completed the work

This is exactly why these scams continue to work.

The FBI Says Americans Reported Nearly $21 Billion in Cybercrime Losses

According to the FBI’s 2025 Internet Crime Report from the Internet Crime Complaint Center (IC3), Americans reported nearly $21 billion in cyber-enabled losses in 2025 alone.

The FBI also reported:

• more than 1 million cybercrime complaints
• more than 22,000 AI-related complaints
• approximately $893 million in AI-related losses

And criminals are increasingly combining:

• phishing
• impersonation scams
• spoofed communications
• AI-enhanced deception
• social engineering tactics

That matters because fake check scams are evolving too.

Red Flags People Ignore

Some of the biggest warning signs include:

• overpayment requests
• pressure to “act quickly”
• blurry logos or printing
• fake bank information
• mismatched check numbers
• someone refusing identity verification
• out-of-state checks tied to urgent situations

And let me say this clearly:

A real routing number does NOT automatically mean the check is legitimate.

Scammers often use stolen account information connected to real banks.

Check Washing Is Becoming a Huge Problem, Too

Criminals are stealing legitimate checks from mailboxes and chemically removing the original ink.

This is called check washing.

They rewrite:

• the payee
• the amount
• or both

Watch for:

• smeared ink
• discoloration
• damaged paper
• handwriting inconsistencies

Here’s What Smart Businesses Are Doing

The businesses reducing risk are: • slowing transactions down
• verifying identities
• training employees
• using secure electronic payment systems
• creating fraud verification procedures
• protecting mailboxes and outgoing mail

That is the ROI of safety.

Reduced losses.
Reduced liability.
Reduced chaos.
Reduced stress.
Better protection for employees, customers, and the business itself.

Because safety is not just about physical safety anymore.

Financial safety matters too.

Cybersecurity matters too.

Consumer protection matters too.

Final Thoughts

One of the most important safety lessons I teach is simple:

Slow down.

Scammers rely on urgency.

A legitimate customer may become temporarily inconvenienced by verification procedures.

A scammer becomes angry when you refuse to bypass them.

That tells you a lot.

The good news?

Awareness, training, verification procedures, and safer payment practices can dramatically reduce your risk.

Because protecting people, profits, and reputations starts BEFORE the crisis happens.

Reduce your risk and schedule your expert-led training today.

Contact me and let's talk!

Winter is here, covering the U.S. in a snowy blanket; we're all feeling the chill. Staying warm is challenging. However, our homes need protection, too! Let's look at easy, smart tips to keep our homes cozy and safe from the cold. Here are effective ways to defend our homes against the harsh winter and stop those freezing problems before they start.

Before the Blizzard Hits:

• Fortify your pipes:

  • Insulate exposed pipes: Crawl spaces, attics, and outdoor faucets are particularly vulnerable. Foam sleeves, heat tape, electric pipe heat wraps, and even newspaper can offer vital protection.

  • Seal air leaks: Cracks near pipes allow frigid air in. Caulk, weatherstripping, and expanding foam spray are your allies. Consider installing a “chimney balloon” to block air if you don't have a damper. 

  • Disconnect and drain hoses. Don't let frozen water become a ticking time bomb. Cover exterior faucets with styrofoam faucet covers. 

  • Turn up the thermostat. Keep it above 55°F, even slightly, to prevent pipe chills.

  • Invest in smart water sensors near pipes and your water heater to detect potentially freezing leaks. Set up phone notifications.

  • Investigate weather and preparedness apps. These will be especially helpful if there is no electricity to watch TV.

• Clear the snow: Heavy snowfall can weigh down roofs, strain trees, and block walkways. Remove snow from steps, sidewalks, and porches before it melts and turns icy. Regular shoveling is key.

• Prepare for power outages: Stock up on batteries, flashlights, and a non-electric heat source, like a fireplace or camp stove. Fully charge your phones and devices. Have a power bank fully charged.

Protect your video surveillance cameras. Bring the portable cameras inside if the weather is severe. Position them inside the window looking out at your coverage area. Keep in mind that it may not be as effective, especially at night, so utilize the live view option regularly. 

• Document your property. Take pre-storm video or photo walkthroughs of your home, office, or RV. This establishes the property's condition before any potential damage occurs. Include valuables, electronics, appliances, furniture, artwork, etc. Note: This is something that needs to be done anyway. 

When the Cold Clamps Down:

• Keep the water flowing: A slow drip from an outside wall faucet can prevent pipes from freezing. It should be a pencil-sized trickle. Utilize an electric water pipe heat cable, wrap for vulnerable water pipes or heat tape. 

• Open the cabinet and room doors. Let warm air circulate around pipes under sinks and vanities. Open doors to cold rooms or spaces, including basements, garages, laundry rooms, rooms over garages, etc.

• Move vulnerable items: Protect outdoor furniture, potted plants, and decorations from snow and ice.

Facing Frozen Fury:

• Don't panic! Act quickly but safely.

• Turn off the water main. This prevents further damage if a pipe bursts.

• Apply heat cautiously: Use hair dryers, heating pads, warm towels, and space heaters (never open flames!). Focus on thawing specific sections, not the entire pipe. Invest in heat tape and electric heat wraps.

• Call a plumber: For extensive frozen pipes or burst sections, professional help is crucial.

After the Storm:

• Safety first: Check for downed power lines before entering or exiting your property. Beware of gas leaks. 

• Document the damage: Take detailed photos and videos of all damage, including close-ups and wider shots for context. Capture affected items like furniture, walls, and equipment.

• Contact your insurance company: File a claim promptly and follow their instructions for documentation and repairs. 

Beware that scammers come out and impersonate insurance adjusters and contractors. Do your homework and never pay upfront. Ever. 

Clean up and repair: Once the damage is assessed, tackle repairs and restoration work. Use recommended and known contractors. Ask your insurance representative, friends, and neighbors, and check NextDoor and Facebook for recommendations and reviews.

Bonus Tips:

• Invest in a generator for essential appliances like refrigerators and sump pumps.

• Keep sand or kitty litter handy for icy walkways.

• Check on elderly or vulnerable neighbors who might need assistance.

Following these steps and staying prepared can turn winter's wrath into a manageable blip on the radar. Remember, knowledge is power, and a little winter wisdom can protect you and your property and keep you warm and toasty all season long.

So, stay safe, stay warm, and keep this checklist handy!

Image created with the assistance of AI.

In today's world, the safety of tenants is crucial for property owners for a number of reasons. A proactive approach to security is essential to creating a safe and welcoming environment. Plus, it allows property owners to stand out and show their value by providing a secure home. The bonus is that it can reduce your liability.

This includes a blend of physical security measures, active community engagement, and the integration of technological solutions. Together, these elements foster a sense of belonging and safety, making the property more than just a residence but a true home for tenants. It's not merely about access through a key but cultivating a secure, connected, and technologically safe living space.

Here's a checklist from my expert perspective. I offer interactive safety and security training with a focus on business-building and consumer safety and security

.

Physical Defenses:

• Lock It Up: Think of doors and windows as your first line of defense. Use quality and sturdy locks, and remember those deadbolts. Determine if single- or double-cylinder deadbolts are best. Double-cylinder deadbolts are not allowed in some jurisdictions due to improper use and potential safety reasons.

• Light It Up: Darkness is a burglar's best friend. Keep them at bay with bright lights around walkways, entrances, and parking areas. Think of it as putting your property in the spotlight. It also serves to keep tenants safe when getting around the property.

• Trim It Down: Overgrown bushes and trees can be perfect hiding spots for trouble. Keep them neatly trimmed to take away any potential cover.

Community Watch:

• Team Up for Safety: Encourage tenants to look out for each other and immediately report anything suspicious.  That means setting up a phone number or email address for them to report this activity. You must make sure it is monitored and that you respond quickly. A united front is a powerful deterrent.

• Knowledge Is Power: Give tenants personal safety and home security resources and host safety and security workshops, including law enforcement officials and subject matter experts conducting interactive content. Include tips in your newsletters to boost security—like keeping curtains open to discourage break-ins, turning lights on at night, etc.

Tech to the Rescue:

• Smile, you are on camera. Video cameras can watch common areas and building exteriors. Not only is it important that you have a high-definition video with night vision capability but staff should be trained on setting up notifications and monitoring when there is a suspicious motion to stop the crime proactively. There should be two-way communication so that you can issue vocal warnings to the would-be perpetrator. The camera should also have a loud siren to create witness potential.

• Let potential troublemakers know they're being watched. Highly visible signage warning that there is video surveillance is a great deterrent.

• Access Control/Security Entry: Access control systems are like virtual gatekeepers, only allowing entry to those with the right credentials. Secure doors are worthless if tenants allow strangers in. Remind tenants about only allowing their guests in and that other residents should admit their guests.

• Personal Security for Everyone: Personal alarms empower tenants to stay safe coming and going. Offer the option of door alarms for tenants to be safe when at home.

• Implement CPTED, Crime Prevention Through Environmental Design principles.

  (Image created with the assistance of AI).

  Start writing today. Use the button below to create your Substack and connect your publication with Tracey’s Substack

  Start a Substack

Subscribe now