Artificial intelligence and online scams

There is a gesture that we constantly repeat: picking up the mobile for a moment to check a message, search for something online, or interact on social media. But the truth is this moment often drags on, breaking the conversation, and suddenly the person we are talking to is left talking to themselves. This is the phenomenon known as 'phubbing' (a portmanteau of 'phone' and 'snubbing'), and therapists describe it as an increasingly common source of conflict, as it has become a daily form of emotional disconnection.

What is concerning is that this seemingly harmless scene explains much better than any graph why digital scams are experiencing a golden age. The problem is not the technology itself, but the habit: we have learned to react to a notification like a conditioned reflex, to trust what appears on the screen, to accept as valid everything that sounds familiar, and to respond quickly when someone pressures us. And this is where cybercriminals have found their golden egg-laying hen.

It is important to note that the technological sophistication level of cybercriminals is truly cutting-edge, as demonstrated by 'EncroChat', an encrypted communication system used by organized crime for criminal activities, with servers in France and modified devices that made traditional intervention difficult.

This system was ultimately deactivated thanks to a complex investigation that involved the installation —with French judicial authorization— of a Trojan-type application via a simulated update, which affected tens of thousands of users in numerous countries, and the results were shared among states through international cooperation; which required confirmation of the legality of the actions taken, as analyzed by the Criminal Chamber of the Supreme Court in Judgment (Plenary) 854/2025, of October 16.

In this context, artificial intelligence (AI) has helped to refine these frauds; even though AI has not invented deception, it makes it cheaper, scales it, and makes it more believable, so that the scam ceases to be a manual activity and becomes an automated process that allows scams to be carried out on an industrial scale. What used to require time and a certain degree of skill to imitate, draft, and manipulate can now be done with AI in a very short time and with such realism that the victim often cannot suspect in time.

One of the common techniques used by cybercriminals is 'voice hacking', which involves cloning a person's voice from small audio snippets, generating messages so realistic that the victim believes they are from someone they know (a family member, a boss, etc.), asking them to make an urgent payment or provide sensitive information, appealing to the emotions associated with a loved one or a superior's authority. And no one is immune, as demonstrated by what happened in February 2025, when several priests in Segovia were attempted to be scammed by imitating the voice of the new bishop, asking them to make a transfer of 2,200 euros to access a supposed inheritance of 40,000 euros that a woman wanted to give to the parish.

Although phishing cases have existed for a long time, the advent of AI has added a new dimension, as it allows processing stolen data (name, phone number, date of birth, address, account numbers, etc.) to design personalized phishing campaigns and launch massive waves of spam emails and fraudulent calls.

And, although this has always been a cause for concern, this new scenario means that events like the news that appeared in the media in April 2025 (later denied) about a possible leak of the Robinson list (a list of people who have opted out of receiving advertising) – which would mean that the data of over 600,000 people could have been on the dark web – raises all alarms.

Another especially harmful tactic involves trying to deceive from a channel that the victim had considered trustworthy. A recurring example is 'SMS spoofing', which consists of sending fake text messages in which the sender's identifier has been spoofed, so that the message appears within the same conversation thread as legitimate text messages, making the victim believe they are in a trusted environment.

Judgment 142/2024 of March 21 from the Provincial Court of Asturias ruled on this matter, declaring a bank responsible for unauthorized payment orders made via 'SMS spoofing', and ordered that the withdrawn amount be returned. The decision was based on the fact that the bank could not prove that there had been gross negligence on the client's part; on the deficiencies of the bank's security system to prevent this type of attack, especially considering it is regarded as a common method; and on the fact that there were warning signs that should have raised suspicions, such as the transfer being instant, for a considerable amount, made from a recently linked device, and to an unusual destination (a foreign electronic money institution).

But, what happens when the scam has already occurred and it is impossible to recover the money? Can the defrauded amount be declared as a capital loss for personal income tax purposes? Binding Resolution V0625-24, dated April 11, 2024, issued by the General Sub-Directorate of the Personal Income Tax, addresses a case of banking fraud (“phishing”) and concludes that the withdrawn amount can constitute a capital loss for personal income tax purposes, as it falls within the scope of Article 33.1 of Law 35/2006, of November 28, on personal income tax and partial modification of the corporate tax laws, on income from non-residents and on wealth (LIRPF), as long as it is duly justified with admissible evidence in law (police reports, claims, documentation, etc.).

However, two important points must be kept in mind: (i) the loss is attributed to the tax year in which the fraud took place, according to the general rule established in Article 14.1.c) of the LIRPF; and (ii) since it does not arise from a transfer of assets, it is treated as general income, subject to applicable offsetting rules and time limits (four years); and, if the amount is ultimately recovered, this recovery will have tax implications, as it restores balance.

Read the full article published in Lawyerpress.