Could you spot AI Scams in seconds?

What happens when we can no longer trust what we see or hear?

With AI-generated content now ‘often indistinguishable’ from authentic media, it is becoming increasingly difficult to tell what is real and what is fabricated. Scammers can impersonate people, manufacture evidence, and exploit the trust we place in everyday digital interactions.

The threat is already evident in Malaysia. Since 2024, the Malaysian Communications and Multimedia Commission (MCMC) has received nearly 12,500 complaints involving AI misuse, resulting in the removal of more than 11,600 deepfake and false content.

And this deception doesn't stop online. Police have warned of a rise in ‘silent calls’, which may be attempts to capture voice samples that scammers can later replicate using AI voice-cloning technology.

More disturbing still is the use of AI to generate child sexual abuse material. The Internet Watch Foundation (IWF) identified 3,440 AI-generated videos of child sexual abuse in 2025, a staggering increase from 13 in 2024.

Why are AI-generated scams and deepfakes becoming harder to detect?

Dr Zulaikha Kadim, Group Chief Technology Officer at MIMOS Berhad, explains that the threat has evolved from obvious, low-quality manipulation to content that is increasingly difficult to distinguish from reality.

One major reason is accessibility. What once required coding expertise, thousands of images, and specialised equipment can now be done using widely available generative AI applications.

“Today, generative AI apps can produce realistic video, voice and images from a simple prompt, such as ‘Buatkan video Menteri umum bantuan RM500’, often in under a minute. What previously required a full studio can now be done with only a mobile phone, which means impersonation and fraud can be produced at a much greater scale,” she said.

Deepfakes have also become significantly more sophisticated. Older fakes only swapped faces, and you could often see that the mouth was not synchronised with the audio. Newer AI models can generate the entire scene, including a Malay dialect voice, the texture of the tudung, and even Jawi text in the background, with all elements consistent with each other, and far fewer obvious visual defects.

Voice cloning has also moved beyond pre-recorded content, allowing scammers to use short social media clips to impersonate individuals during live phone calls.

According to Dr Zulaikha, this is why traditional methods of identifying deepfakes are becoming less reliable. She also points to what she describes as a Malaysian content blind spot, where detection tools may lack sufficient exposure to local faces, accents and cultural nuances, making it harder to accurately identify manipulated content.

On top of that, repeated compression when videos are shared across messaging platforms and social media can strip away subtle forensic traces that detection systems rely on to identify fakes.

Building a foundation for digital trust

If AI can make a fake video look real, how do we know what we are seeing can be trusted?

MIMOS hopes to address this challenge through its MIMOS Trusted Intelligence Platform (TIP), designed to support the testing and validation of technologies aligned with national priorities. It aims to establish a reliable framework for verifying data, AI systems, and digital content in real-world applications.

“MIMOS contributes in three roles. As a Builder, we develop the MIMOS TIP sandbox, pilots, and scalable architecture. As a technology Guardian, we focus on AI detection, including authenticity scoring and scam intent detection, and its integration with verification based on international standards such as C2PA, while maintaining privacy-preserving design. As an Enabler, we plan to provide a Software Development Kit so that authorised agencies, media, and telecommunications companies can integrate verification into their own applications.”

“TIP is designed not just as a deepfake detector, but as a building block towards a national digital trust infrastructure, built on four integrated layers aligned with the Thirteenth Malaysia Plan (2026–2030),” said Dr Zulaikha.

The first layer, Data Foundation, focuses on building a diverse Malaysian dataset covering local accents, faces with tudung, Jawi text, and both real and AI-generated content. This helps MIMOS develop detection models that better understand Malaysia's local context while ensuring responsible data management.

The second layer, AI Intelligence, puts that data to work. Instead of looking for just one giveaway, MIMOS' multi-vector detection technology examines multiple signs of manipulation across images, videos, and audio. It looks for inconsistencies in facial features, lighting and movement; voice characteristics that may indicate cloning, as well as file metadata and other contextual clues.

These findings are used to generate an Authenticity Score, which works much like a blood test, by identifying possible signs of AI generation or manipulation. However, it is not definitive proof. The score reflects the likelihood of manipulation, and its accuracy may be affected when content is compressed on messaging platforms. It also cannot establish who created or published the content.

The third layer, Trust and Verification, complements AI detection by focusing on where digital content comes from and whether it has been altered. Through blockchain-secured trusted logs, content from authorised sources carries a verifiable record of its origin and publication history.

Think of it as a birth certificate combined with a CCTV record. When an authorised organisation, such as a news agency or government ministry, publishes content, the system generates a record containing a digital fingerprint (known as a hash), a digital signature and a timestamp, which is then stored on a tamper-evident blockchain ledger.

When implemented with authorised publishers, the system is designed to support three assurances: integrity, by showing whether content has been altered; origin, by identifying its publisher; and non-repudiation, by establishing when it was published.

The final layer, Application and Delivery, brings these capabilities together in a verification tool designed to be accessible to the Rakyat. By combining the AI Authenticity Score with proof of origin, TIP aims to make it easier for users to check whether digital content can be trusted, with the potential to be integrated into applications they already use.

For organisations, the potential applications are practical. Banks could screen video and voice submissions during customer onboarding or high-value transactions, while newsrooms could verify user-submitted footage before publication. Government agencies and businesses could also use it to check videos impersonating their leaders.

"Such applications could prove particularly valuable in tackling investment scams, where deepfake videos have increasingly been used to deceive victims. PDRM reported RM1.47 billion in losses across 9,603 cases in 2025."

The technology is still under development, with MIMOS currently testing its core detection models in a laboratory environment. The roadmap is to complete the core platform and sandbox environment in 2026, conduct pilots with government agencies and industry partners in 2028, and work towards broader adoption by 2030.

While the ability to detect and verify digital content is important, building trust also means ensuring that the verification process does not come at the expense of personal privacy.

Verifying content without compromising privacy

Verification and privacy must be developed together. A verification system that collects identity documents, faces or voices could itself become a surveillance risk or an attractive target for data breaches. That is why the MIMOS TIP is designed to verify content, not to spy on people, and is built on privacy-preserving principles.

The platform verifies content, not personal data. Each piece of content carries its own proof, which is checked against records of authorised publishers during verification. For the verification check itself, only a digital fingerprint of the content is compared against the record, rather than storing the actual image or video. Identity linkage, where required for accountability, is kept separately under a secure audit trail accessible only through a proper legal process. This means individuals do not need to submit their identity cards or photographs to a central server, and this approach is designed in line with the Personal Data Protection Act.

Personal data must be handled responsibly throughout the lifecycle of an AI system, not just when it is deployed. Developing a Malaysian dataset of faces and voices requires particular care. The platform's approach is therefore guided by consent, data minimisation, the use of synthetic data where possible, secure storage, access controls and clear data retention policies.

“We use verified credentials with a privacy-preserving design. To stop impersonation where anyone can claim to be a bank or an agency, signing keys can be linked to verified credentials issued by a trusted authority. The verifier only sees ‘Signed by verified Malaysian citizen’ and does not see personal details such as a name or identity card number. If there is misuse, accountability is maintained through a secure audit trail that can be accessed under a proper legal process, but the identity is not exposed publicly. We are using open standards such as W3C Verifiable Credentials, and we are not committing to any specific national identity system at this stage,” said Dr Zulaikha.

Protection needs to be layered: technology to detect and verify, organisational safeguards such as call-back procedures and dual approval for large transfers, public awareness, and effective governance, including clear oversight of who can be listed as an authorised source.

For individuals, the most important habits are simple. If you receive an unusual request involving money or personal information, pause, especially if you are being rushed. Hang up and contact the person or organisation directly through a number or channel you already know, not the one provided in the message. Consider agreeing on a family code word for emergencies. Never treat a voice, face or video as proof of identity on its own, because these can now be faked. And if you suspect a scam, report it immediately to the National Scam Response Centre at 997.

We aim to make verification accessible and trustworthy for everyone. The verification can be integrated into applications that the Rakyat already use, so that checking authenticity is as simple as tapping a Verify button. The design aims to reduce the trade-off between security and privacy by enabling verification that content is real without routinely exposing the citizen's identity during the check.

Preparing for the next generation of AI threats

As generative AI continues to evolve, so do the techniques used to manipulate digital content. MIMOS recognises that detection methods must continuously adapt to keep pace with increasingly sophisticated threats. Under its Research and Development roadmap for RMK-13, the focus will be on advancing AI detection, including real-time voice cloning in Bahasa Melayu, identifying scam intent and developing ways for digital content to carry verifiable proof of origin from the moment it is created.

Beyond developing new technologies, MIMOS will continuously test and refine its models against emerging AI tools and real-world scenarios, including compressed videos, phone recordings and conversations that mix Bahasa Melayu and English. The platform will also support responsible AI adoption through verification labels aligned with international standards such as C2PA, allowing the public to distinguish AI-generated content from material originating from verified and authorised sources. This will be complemented by a phased implementation approach, beginning with core platform development in 2026, followed by industry and agency pilots in 2028, and broader adoption targeted for 2030.

Ultimately, the goal is to ensure Malaysia's AI ambitions are matched by the expertise, safeguards and digital trust infrastructure needed to support them. As AI-powered threats become more sophisticated, MIMOS aims to make verification more accessible and reliable, bringing the technology closer to everyday use. As Dr Zulaikha puts it, the aim is to make verifying the truth as easy as forwarding a message, once the platform is piloted and integrated into applications that the public already uses, building that capability here in Malaysia.