DEV Community: Feroze Ashraff

Deepfake and AI Scams — What's Actually Circulating in NZ Right Now

Feroze Ashraff — Wed, 12 Aug 2026 16:58:39 +0000

🚩 Why this matters for schools

Deepfake scams are not just a celebrity or politics problem. For schools, the practical risk is impersonation: a fake voice note from a senior leader, an AI-written email that sounds like a colleague, a synthetic image used to embarrass a student, or a scam message that borrows enough school context to feel real.

New Zealand's Own Your Online guidance tells people to understand common online risks, including scams and fraud designed to trick people into giving away personal or financial information [1]. AI changes the packaging. The safe response is still familiar: slow down, verify the person, and avoid acting on pressure.

🚩 What counts as a deepfake or AI scam?

A deepfake is synthetic audio, image, or video made or altered to make someone appear to say or do something they did not. In a school context, the risk may look like:

a voice message that sounds like a principal, board member, supplier, parent, or colleague
an AI-written email that imitates a staff member's tone
a fake screenshot or image of a student or staff member
a social-media account using generated photos or copied school details
a phishing page or message that appears after a realistic AI-generated conversation

Netsafe's deepfake guidance treats manipulated media as a safety and harm issue, especially when the material is used to deceive, harass, or pressure someone [2]. Schools should handle these cases as both digital-safety issues and safeguarding issues, not just as technology curiosities.

🚩 How might this show up in a New Zealand school?

The most likely school scenarios are practical and awkward:

a finance or office staff member receives a voice note asking for urgent payment
a teacher receives a message that appears to come from school leadership asking for account details
a student shares an edited image of another student in a group chat
a parent receives a fake message claiming a school payment or account issue
a staff member is impersonated in a social-media or email conversation

Police advice on scams and fraud is clear that scammers try to get money, personal information, or access by making requests look legitimate [3]. Deepfake and AI tools can make that request feel more personal, but the verification steps should not change.

🚩 What warning signs should educators look for?

Do not rely on spotting perfect technical clues. AI-generated material is getting harder to judge by appearance alone. Instead, look at the request and the context.

Useful warning signs include:

urgency around payments, login details, files, codes, or student information
a request that bypasses the school's usual process
a voice note or video that avoids a normal two-way conversation
unusual wording from a familiar person
a new phone number, email address, or chat account claiming to be someone known
pressure not to check with anyone else

If the message asks for money, access, student information, or secrecy, treat it as high risk even if the voice, image, or writing looks convincing.

🚩 How should a school verify a suspicious voice or video request?

Use a second channel you already trust. Do not reply inside the same thread or call the number supplied in the suspicious message.

A safer verification process:

stop the action the message is asking for
contact the person through a known school number, staff directory, or existing account
ask a direct question in a live conversation if the request is sensitive
check whether the request follows the normal approval process
preserve the original message, link, audio, screenshot, or sender details
report the concern to the right school contact

For account and message-level checks, NZAI's How to Spot Phishing Emails, Scams, and Fake Messages remains the baseline. Deepfake verification builds on those habits rather than replacing them.

🚩 What if students are involved?

Student-facing synthetic media can quickly become bullying, harassment, reputational harm, or a privacy problem. If a student appears in a manipulated image, audio clip, or video, the school should avoid treating it as a harmless prank until the facts are clear.

Practical first steps:

preserve evidence without forwarding it around
support the affected student and limit further sharing
involve pastoral, safeguarding, or leadership staff early
consider whether the material includes personal information
avoid making public claims until the school has checked what happened
use the school's existing online-safety and behaviour processes

If personal information has been exposed, misused, or sent to the wrong person, the Office of the Privacy Commissioner's privacy-breach guidance is relevant [4]. The issue may need both student-support and privacy-response handling.

🚩 What should staff be told now?

Keep the staff guidance short. The aim is not to make every educator a media-forensics expert. The aim is to give people a safe default.

A useful staff message:

If a message, voice note, video, or image asks you to make a payment, share access, disclose student information, approve a login, or bypass a normal process, verify it through a separate trusted channel first. Do not act just because it sounds or looks like someone you know.

That rule is simple enough to remember under pressure. It also works for ordinary phishing, supplier fraud, social-media impersonation, and AI-generated scams.

🚩 What should schools put in their AI-safety practice?

AI-scam preparation belongs inside ordinary school cyber and digital-safety habits:

payment and bank-detail changes require second-channel verification
staff know how to report suspicious messages and impersonation attempts
students know that synthetic images or voice clips can cause real harm
school leaders avoid asking staff to bypass normal approval processes by informal message
office and finance staff have a clear escalation path for unusual requests
privacy-breach assessment is part of the response when student or staff information is involved

For broader AI use in teaching, use AI Safety for New Zealand Educators. For student guidance, use AI Safety for Students in New Zealand.

A quick deepfake-scam checklist for educators

✓Does the message ask for money, access, student information, secrecy, or urgent action?
✓Have I verified the request through a separate trusted channel?
✓Am I using a known contact method rather than replying to the suspicious message?
✓Have I preserved the original evidence without forwarding it unnecessarily?
✓If a student is affected, have safeguarding and pastoral staff been involved?

This article was originally published on nzaisecurity.com. Read the full article.

📚 Sources and references

Sources and references

Passwords, Passphrases, and MFA — What Actually Works in 2026

Feroze Ashraff — Thu, 30 Jul 2026 09:42:03 +0000

Use a unique passphrase for every important account, store them in a password manager, and turn on MFA wherever it is offered. If you only fix three things, fix those three first.

🚩 Why this matters in a school context

Your school email account is probably connected to your student records system, your learning platform, your file storage, your communication tools, and sometimes your school's financial or admin systems. If an attacker gets access to that one account, they may be able to reach all of those.

The same applies to students — a compromised school account can be used to send convincing phishing messages to other students and staff, access personal information, or impersonate the account owner in fraudulent contexts.

🚩 What makes a password actually strong

A strong password has three properties: it is long enough that it cannot be cracked by automated attempts, it is unique — not reused across services, and it is not guessable from your personal information.

The practical solution is a passphrase. Instead of a short complicated password like "Kj8!xQ2", use a longer phrase that is easy for you to remember but hard for anyone else to guess: "Correct horse battery staple" is better than "Tr0ub4dor&3" — longer, easier to remember, and significantly harder to crack.

🚩 The password manager question

If you have more than a handful of accounts, remembering unique passwords for all of them is not realistic. A password manager stores your passwords securely in one place, generates strong random passwords for new accounts, and fills in your login details so you do not have to type or remember them.

⚠️ A password manager only needs one strong password to protect everything else. Make that one password a passphrase.

Most browsers have a built-in password manager. Dedicated tools like Bitwarden, 1Password, or KeePass offer more cross-device synchronisation and better security features. If your school provides a managed password manager, use it — it is already integrated with your account setup.

🚩 Multi-factor authentication — what it is and why you should turn it on

MFA means that to log into your account, you need your password and something else — usually a code from your phone or an authenticator app, a fingerprint, or a hardware security key.

Even if your password is somehow exposed — through a data breach, a phishing page, or a reused password — MFA stops the attacker from getting in without also having your second factor.

✅ Turn MFA on for any account that offers it, especially:

your school email or student portal
any platform that stores personal information about you
accounts connected to payment or financial information

⚠️ For most people, an authenticator app (Google Authenticator, Authy, or similar) is the most practical second factor. The code changes every 30 seconds, so even if someone sees one code, it will not work by the time they try to use it.

🚩 Safer recovery settings

When you set up password recovery options — a backup email, a phone number, security questions — treat them with the same care as the password itself:

Use a backup email that is itself secured with a strong password and MFA
Security questions should have answers that are not guessable from your public profiles — your mother's maiden name and your first pet's name are public information if you share much online
If a service offers recovery codes, store them somewhere safe — a locked drawer or a password manager entry, not a note on your desk

🚩 What to do if your password has been exposed

If you learn that a service you use has had a data breach and your password may be among the exposed information:

Do not wait — change that password immediately on any account where you used it
Do not reuse the old password on any other service
Turn on MFA on the affected account and any other account where you used the same password
Check the account's recent activity — look for logins from unfamiliar locations or devices
If the breach involved a school account, notify your IT team so they can monitor for related activity

HaveIBeenPwned (haveibeenpwned.com) lets you check whether your email has appeared in a known data breach. It is worth checking this periodically.

🚩 Password habits to build

These small habits, done regularly, make a meaningful difference:

When you create a new account, use your password manager to generate a unique password — do not recycle an old one
If you hear about a data breach for a service you use, change that password within days — do not let it linger
Do not share passwords with friends, even close ones — they may not handle them as carefully as you do, and friendship changes
If a device is lost or shared, change the passwords for your most important accounts as a precaution

This article was originally published on nzaisecurity.com. Read the full article.

Sources and references

[1] Google. (2025). Avoid and report phishing emails. https://support.google.com/mail/answer/8253

[2] National Cyber Security Centre UK. (2023). Password managers. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/password-managers

[3] Bitwarden. (2025). Password manager for individuals. https://bitwarden.com/products/personal/

[4] New Zealand Police. (2024). Internet scams, spam and fraud. https://www.police.govt.nz/advice/email-and-internet-safety/internet-scams-spam-and-fraud

[5] HaveIBeenPwned. (2025). Have I been pwned? https://haveibeenpwned.com

How to Spot Phishing Emails — The NZ-Specific Guide for 2026

Feroze Ashraff — Sun, 12 Jul 2026 04:23:05 +0000

Phishing emails are still one of the most common ways attackers get passwords, recovery codes, and access to school or personal accounts. They do not need to look obviously fake to work. Most of the time, they just need to make you feel like you need to act fast before you stop to think [1].

This guide gives students and educators a way to assess any suspicious message and a clear plan for what to do next.

🚩 Why Phishing Still Works

Phishing emails do not win because the writing is clever. They win because they arrive when you are busy or distracted.

A typical scam message imitates a real notification — something from Google, Microsoft, a courier service, or your school platform. The language creates urgency: account suspension, unusual activity, billing problems, urgent document review.

Students might encounter fake Google, Microsoft, courier, gaming, or bank messages. Educators might receive account-warning emails, shared-document prompts, or requests that appear to come from a colleague or school leader.

In both cases, the goal is usually one of:

Getting you to enter your password on a fake login page
Persuading you to approve a sign-in prompt you did not initiate
Tricking you into downloading malware or sharing a recovery code

🔍 Warning Signs to Check Before You Click

No single warning sign proves a message is fake, but several together should stop you.

Check the sender address carefully

A message can display a familiar name while using a completely different address underneath. Google's Gmail Help advises users to watch for suspicious messages that look real but ask them to share personal information or click a link they were not expecting [1].

Look past the display name. Check the full sender address. If the email claims to be from Google, Microsoft, your school platform, or a bank, the real sending domain matters — and it will not be a free email service.

Watch for urgency before clarity

A lot of phishing works by making you feel behind, exposed, or about to lose access. The language may mention account suspension, unusual activity, billing issues, or urgent document review.

Urgency alone does not prove a scam. Real services sometimes send urgent alerts. But a legitimate security message should still hold together when you inspect it calmly.

Check the link destination

Hover over the link before clicking. On a phone or tablet, use a long press or another safe preview method if your device offers one. If the visible text says one thing but the destination URL says another, treat it as suspicious.

Google's account-recovery guidance is a good reminder here: when account security is involved, going directly to the service in a new tab is safer than following a message link [2].

Never share passwords or MFA codes

Phishing pages often ask for:

Your password
Recovery codes
One-time passwords (OTP)
Approval of a sign-in request you did not initiate

No legitimate service will email you asking for your password or MFA code. Any message that does is a phishing attempt, regardless of how official it looks.

Watch for unexpected approval requests

Some attacks do not ask for a password — they ask you to approve a sign-in prompt or OAuth access. If you receive a sign-in approval request that you did not initiate, do not approve it. Check your Google account activity directly at myaccount.google.com [3].

🛡️ What to Do If You Receive a Suspicious Message

If you are not sure

⚠️ Do not click, reply, or download anything. Open a new browser tab and navigate directly to the service in question using a known address — go to google.com and sign in from there, rather than from a link in the message.

If you already clicked

Change your password from a clean device immediately. Check your account activity for anything unusual. Revoke any third-party access you do not recognise. If you use the same password elsewhere, change it there too — a password manager makes this manageable [4].

If you entered financial information

Contact your bank or card provider immediately. Monitor your statements for any unusual transactions. Consider placing a credit freeze with a credit reporting agency if you think your details may have been captured.

If you are in a school environment

Report to your IT team or school leadership. If student data may have been involved, the school may have reporting obligations under the Privacy Act 2020. Do not try to manage this alone.

✅ A Quick Decision Framework

Does the message create urgency? (Pressure to act fast = yellow flag)
Does the sender address match the brand it claims to be? (Mismatch = red flag)
Does the link destination match what the message says? (Mismatch = red flag)
Is the message asking for a password, code, or approval? (Yes = red flag)
Would this request make sense if you had not just logged in? (No = yellow flag)

🚨 If you have yellow flags, slow down. If you have red flags, do not click.

This article was originally published on nzaisecurity.com. Read the full article.

📚 Sources and references

[1] Google. Gmail Help. How to recognise and report phishing emails. https://support.google.com/mail/answer/8253

[2] Google. Account Help. Secure your account with recovery options. https://support.google.com/accounts/answer/183723

[3] Google. My Account. Check activity and secure your account. https://myaccount.google.com/notifications

[4] NZ Cyber Security Skills Hub. Password managers explained. https://www.ncsc.govt.nz/resources/cyber-security-basics/password-managers/