By “Tracey, the Safety Lady” Hawkins, Gen AI Cybersecurity Expert for End Users

A fake business website can be devastating for businesses and tricky if consumers don’t know to question it. They can steal a customer, damage a company’s reputation, send an impostor to someone’s home, and defraud visitors financially.

News10NBC recently interviewed me about fake garage door repair websites targeting consumers in upstate New York. Criminals were copying legitimate companies, using local phone numbers and paying for sponsored search ads so the fake websites appeared before the real ones.

One Wayne County company told the station it finds as many as 30 fraudulent websites using its name each month.

AI has made this kind of business impersonation much easier. Someone can now build a polished website, copy branding and create the appearance of a local company with very little time or technical skill.

Criminals can also spoof a local area code using a process that allows them to make a phone call appear to come from anywhere, even locally, in the target area. This makes caller ID untrustworthy.

How can consumers spot a fake business website?

1. Check the domain through a WHOIS search. The registration date can reveal that a website claiming to represent a long-established company was created only recently.

2. Do not rely on the phone number listed on the website. Confirm it through a previous invoice, a trusted referral, a trade association or another independent source.

Also, remember that the first search result is not always the legitimate business. Consumers typically stop at the first mention of the business name and call. Scammers can pay for sponsored placement which puts them at the top of the list. Scroll down and look for the actual website asks company name.

How can businesses protect their name?

Set up Google Alerts and add the business name as a search topic. Select “as it happens” to get immediate notifications. Whenever that business name shows up published online, you will get a link to the article or listing. Note that this isn’t 100% and doesn’t catch all mentions.

Look for fake websites, unfamiliar phone numbers, sponsored ads and similar domain names on a regular.

Purchase common misspellings and close variations of your website domain name when possible. Secure your real domain with multifactor authentication and automatic renewal to avoid a gap.

Customer education matters, too. Explain how your employees arrive, what identification they carry, how appointments are confirmed and what payment methods you accept. Give customers a verified number they can call before allowing anyone inside.

Criminals may be able to copy your website, but they should not be able to copy the way your customers verify who is at the door.

Education and training raises awareness and helps businesses reduce liability and manage risks.

By “Tracey, the Safety Lady” Hawkins, Safety and Gen AI Cybersecurity Expert for End Users.

Founder of Safety and Security Source in 1995 and The Real Estate Safety University™.

Source: News10NBC/WHEC-TV investigative reporting, June 2026.

By “Tracey, the Safety Lady” Hawkins

Meta removed its controversial Muse Image feature after widespread criticism, but the privacy concerns it exposed didn’t disappear.

Here’s what every individual, parent, entrepreneur, business and nonprofit should know.

The controversy serves as an important reminder that every public photo you post has become more valuable in the age of generative AI, making privacy settings and digital awareness more important than ever.

Meta’s Muse Image feature lasted only a matter of days.

The privacy questions it raised will last much longer.

Muse Image is an AI image-generation feature developed by Meta Superintelligence Labs, introduced earlier this month.

One capability allowed any user to generate AI images by referencing public Instagram accounts and using public photos as visual source material.

Account owners weren’t notified that their images could be used this way.

After criticism from users, privacy advocates, creators and SAG-AFTRA, Meta removed the feature, acknowledging that it had “missed the mark.”

The feature disappeared, but the bigger issue didn’t.

For years, the advice was simple: Think before you post. Generative AI changes that conversation. Now we also need to think about what happens after we post.

That’s no longer just a privacy issue. It’s a cybersecurity issue.

Every Public Photo Has More Value Than You Think

• A family photo reveals relationships.

• A graduation picture confirms a school.

• A conference selfie identifies where you work.

• A volunteer recognition post highlights the organizations you support.

An employee headshot helps establish credibility.

Individually, those details may seem harmless.

Collectively, they create a digital profile that AI can analyze in seconds. Legitimate companies use AI to build products and improve services.

Criminals can use the same publicly available information to create more convincing phishing emails, impersonation scams, fake social media accounts and identity-based fraud.

People often assume cybercriminals break into computers to gather information.

Sometimes they don’t have to. Sometimes we hand it to them.

Public photos, biographies, social media posts and organizational websites often provide everything a scammer needs to build a convincing story.

I’ve spent 31 years teaching people to lock their doors, trust their instincts and create a safety plan before something goes wrong. Today, your digital life deserves that same level of attention because criminals no longer separate the online world from the physical one. Neither should we.

Who Should Be Paying Attention?

The short answer is almost everyone with a public online presence.

Individuals. Every public photo adds another piece to your digital identity. That information can be used to strengthen fake profiles, impersonation attempts and social engineering scams.

Parents. Many children have a digital footprint long before they’re old enough to understand it. Photos shared today may remain online for years and could be repurposed in ways families never intended.

Teens. Teenagers are among the most active social media users and often the least likely to review privacy settings. They’re also frequent targets of AI-generated bullying, impersonation and image abuse.

Entrepreneurs and influencers. Your public image is part of your business. An AI-generated version of your face or voice can confuse customers, damage your credibility or falsely suggest you’ve endorsed a product or cause.

Businesses, nonprofits and associations. Employee headshots, donor recognition, member directories and client testimonials help build trust. They can also provide criminals with information to support impersonation scams targeting customers, donors, members or employees.

None of this means you should stop sharing your story.

It means you should become more intentional about what you share, why you share it and who can see it.

Deepfakes Are Only Part of the Story

Deepfakes receive most of the attention because they’re dramatic.

They’re also only one piece of a much larger problem.

Artificial intelligence can help criminals write better phishing emails, clone voices, create fake identities and personalize scams at a speed that wasn’t possible just a few years ago.

According to the FBI’s Internet Crime Complaint Center, Americans reported more than $20.8 billion in cybercrime losses in 2025. The report also documented more than 22,000 AI-related complaints tied to nearly $900 million in reported losses.

Those numbers reinforce what cybersecurity professionals have been saying for years: criminals adopt new technology just as quickly as legitimate businesses do.

What Has Congress Done?

Lawmakers are beginning to respond, although it’s important to understand where each effort stands.

The TAKE IT DOWN Act is now law. Signed in May 2025, it requires covered platforms to remove qualifying non-consensual intimate images, including qualifying AI-generated intimate content, after receiving a valid request.

The DEFIANCE Act and NO FAKES Act have not yet become law. If enacted, they would expand legal protections against certain forms of AI-generated impersonation and unauthorized digital replicas.

These measures won’t stop every scam, but they send an important message: your face, your voice and your digital identity have value.

What’s the Return on Investment?

People ask me whether AI safety education is really worth the time.

My answer is always the same.

For individuals and families, the investment is a few minutes reviewing privacy settings and learning how criminals use AI. The cost of ignoring it can be identity theft, financial loss or discovering someone has created a fake account using your name or image.

For entrepreneurs, your digital identity is part of your brand. Protecting it is no different than protecting your reputation.

For businesses, nonprofits and associations, the math is straightforward. One AI awareness program costs far less than responding to a successful impersonation scam, rebuilding public trust or managing a preventable crisis.

Prevention has always cost less than recovery. Generative AI hasn’t changed that. It has simply raised the stakes.

Five Ways to Reduce Your Risk

You don’t need to stop using social media. You do need better digital habits.

- Review your Instagram, Facebook and Meta privacy settings regularly. AI features and default settings can change.

- Decide whether every account in your household really needs to be public.

- Think carefully before posting high-resolution photos of children or sharing information that reveals routines, locations or personal details.

- If you own a business or lead a nonprofit, review the photos, biographies and personal information published on your website and social media channels.

- Talk with your family, employees and volunteers about AI-enabled scams. Awareness remains one of the best defenses.

The Bottom Line

Meta’s Muse Image feature is gone.

The next AI feature is already in development.

Technology will continue changing. Criminals will continue adapting. That’s nothing new.

What’s changing is the value of the information we share every day.

I’ve said for 31 years that the best safety plan is the one you create before you need it. Generative AI hasn’t changed that advice. It has expanded it.

Today, protecting yourself means more than locking your doors or updating your passwords. It means protecting your digital identity with the same care you protect your home, your family and your business.

Every photo you post tells a story.

Make sure it’s one you’re comfortable sharing with the world, because once it’s public, you no longer control where that story goes.

Stay up-to-date on technology news and updates. AI is changing on a regular basis and users need to be aware of the personal and business cybersecurity implications.

Frequently Asked Questions

Can AI use my public Instagram photos?

Meta briefly allowed users to generate AI images by referencing public Instagram accounts before removing the feature after widespread criticism. Even so, review your privacy settings regularly because AI features and platform policies continue to evolve.

Is the TAKE IT DOWN Act really law?

Yes. It became law in 2025 and requires covered platforms to remove qualifying non-consensual intimate images, including qualifying AI-generated intimate content, after receiving a valid request.

Have the DEFIANCE Act and NO FAKES Act passed?

No. Both remain proposed federal legislation and have not yet been enacted.

Why should businesses and nonprofits care?

Public photos, employee profiles, donor recognition and client testimonials can all be used to strengthen impersonation scams. Understanding that risk is now part of protecting your organization’s reputation, finances and public trust.

By “Tracey, the Safety Lady” Hawkins

Congress doesn’t unanimously agree on many things anymore.

That’s one reason the recent Senate Judiciary Committee markup on the proposed NO FAKES Act caught my attention.

Republicans and Democrats may disagree on where the legal boundaries should be, but they agreed on something much bigger: artificial intelligence has changed identity theft forever. Criminals no longer have to steal your Social Security number to impersonate you. Increasingly, they can clone your voice, copy your likeness and exploit your identity to scam your family, your customers or your employees.

As someone who has spent more than 31 years teaching people how to recognize danger before it becomes a crisis, I found the hearing encouraging. Congress is finally having the same conversation many of us in the safety and cybersecurity profession have been having for years. Technology is advancing at an extraordinary pace, but our awareness, our policies and our laws have struggled to keep up.

The committee unanimously advanced the legislation, sending it to the full Senate for consideration. While lawmakers debated how to balance innovation with First Amendment protections, they agreed that Americans deserve stronger safeguards against unauthorized AI-generated replicas of their voice and likeness.

Why now?

Because the numbers tell a story that is impossible to ignore.

According to the Federal Trade Commission, Americans reported losing a record $3.5 billion to imposter scams in 2025, nearly triple the amount reported just five years earlier. Nearly $1 billion of those losses involved criminals impersonating businesses, while government impersonation scams accounted for another $920 million.

The FBI is documenting the same trend from a different perspective.

For the first time in the history of the Internet Crime Complaint Center, more than 1 million cybercrime complaints were filed in a single year, resulting in more than $20.8 billion in reported losses. Even more significant, the bureau tracked AI-enabled crime as its own category for the first time, documenting nearly $893 million in reported losses involving criminals who used artificial intelligence to make their scams more believable.

Those numbers represent far more than statistics.

They represent grandparents convinced to wire money to someone they believed was a grandchild in trouble.

Employees who thought they were following instructions from their CEO.

Small-business owners who believed they were paying a trusted vendor.

Families who trusted what they saw and heard because it looked real.

That’s exactly what concerned Sen. Adam Schiff, who warned that generative AI has opened the door to widespread unauthorized exploitation of people’s identities. During the markup, he emphasized that this isn’t simply a Hollywood problem. Everyday Americans are just as vulnerable to having their voices and images copied and misused without permission.

What the NO FAKES Act Would Do

If enacted, the NO FAKES Act would establish federal protections against the unauthorized creation and distribution of AI-generated replicas of a person’s voice or likeness. The legislation is designed to give individuals greater control over their identity while preserving constitutionally protected activities such as news reporting, commentary, parody and satire.

The discussion during the Senate markup made one thing clear. Lawmakers agree that artificial intelligence has created extraordinary opportunities, but they also recognize it has given criminals an entirely new way to exploit trust.

Sen. Amy Klobuchar spoke about seeing manipulated images of herself that looked convincing enough to fool people. Her point wasn’t about politics. It was about how easily artificial intelligence can blur the line between what is real and what is fabricated.

Sen. Ted Cruz emphasized another challenge. Congress must protect Americans from fraud without restricting legitimate speech protected by the First Amendment. Finding that balance will continue to shape the bill as it moves through the legislative process.

The NO FAKES Act is only one piece of a broader federal response.

The TAKE IT DOWN Act, now federal law, gives victims a faster path to removing qualifying non-consensual intimate images, including AI-generated deepfakes, from covered online platforms.

The proposed DEFIANCE Act, which has passed the Senate and awaits action in the House, would strengthen the ability of victims to pursue civil legal action against those who create or distribute sexually explicit AI-generated deepfakes without consent.

Together, these measures acknowledge something we’ve been witnessing for years.

Your identity has become one of your most valuable assets.

Why This Matters to Every One of Us

One of the biggest misconceptions I hear is, “I don’t use artificial intelligence, so this doesn’t affect me.”

Unfortunately, criminals don’t need your permission to use AI against you.

The FTC reported that more than $2.1 billion in fraud losses during 2025 originated on social media. Criminals aren’t scrolling through Facebook, Instagram or LinkedIn because they’re curious about your vacation. They’re gathering information. They study family relationships, employers, birthdays, hobbies, photos, videos and voice recordings that help them build scams designed specifically for you.

That’s why I tell audiences something that often surprises them.

There is no such thing as true online privacy.

Privacy settings are absolutely worth using, but they are only one layer of protection. Friends can unknowingly share your content. Accounts can be compromised. Photos can be copied. Videos can be downloaded. Public information from multiple sources can be combined to build an astonishingly convincing impersonation.

That’s not meant to scare you.

It’s meant to help you make smarter decisions about what you share online.

The same principle applies inside every organization.

The FBI reported more than $3 billion in Business Email Compromise losses during 2025. Today’s criminals aren’t always hacking into networks. They’re hacking human trust. A cloned voice, a convincing email or a realistic video conference may be all it takes to persuade someone to approve a fraudulent wire transfer or disclose sensitive information.

The technology is impressive.

The manipulation is dangerous.

The target has always been the same.

People.

Where We Go From Here

Congress is doing its job by modernizing our laws.

Now it’s our turn to do ours.

Every family should create a verification word or phrase, or code word, that is never shared online. If someone calls claiming to be a loved one in distress, stop the conversation and ask for it before sending money or sharing information.

Every organization should build independent verification into its financial procedures. A single email, phone call or video meeting should never authorize a wire transfer, banking change or sensitive transaction.

Most importantly, every organization should invest in ongoing education.

I’ve spent more than 31 years teaching people how to recognize danger before it becomes a crisis. Whether the threat was personal safety, workplace violence, home security or cybersecurity, one lesson has remained remarkably consistent.

Prepared people make better decisions.

Educated employees ask better questions.

Informed families are harder to deceive.

Technology will continue to evolve.

Criminals will continue to adapt.

Congress will continue updating our laws.

But one truth will never change.

The strongest defense against AI-powered crime isn’t artificial intelligence.

It isn’t another app.

It isn’t another piece of software.

It’s an educated person who knows when to slow down, trust their instincts, verify independently and refuse to let fear or urgency make the decision.

That’s not just my closing thought.

It’s been my life’s work for more than 31 years.

And today, it may be the most important cybersecurity strategy of all.

By “Tracey, the Safety Lady” Hawkins

Which is best and the safest way to protect your devices, accounts, and data?

Passkey?

Password?

Passphrase?

Short answer: Use a passkey whenever a website offers one. If a passkey isn’t available, use a long, unique passphrase. Use a traditional password only when it’s your last option, and never reuse it.

That one decision could protect your bank account, your business, and your identity.

Why Should You Care Right Now?

Every time you create a new online account, you make a decision that could determine whether a cybercriminal gains access to your email, bank account, healthcare records, social media, or business systems.

Most people assume a password, a passphrase, and a passkey are basically the same thing. They’re not. Understanding the difference could keep you from becoming the next victim of an account takeover.

According to the FBI’s 2025 Internet Crime Report, released in April 2026, the Internet Crime Complaint Center (IC3) received 22,364 complaints involving artificial intelligence in 2025, with reported losses of nearly $893 million. It was the first time in the report’s 25-year history that the FBI tracked AI-enabled crime as its own category.

Those numbers aren’t just about technology. They’re about real people who were manipulated into trusting fake emails, fake websites, fake phone calls, cloned voices, deepfake videos, and fake identities.

Criminals are using generative AI to make scams more convincing than ever.

The bottom line: AI isn’t stealing your password. It’s convincing people to willingly hand it over.

The good news? You have stronger options than ever before.

🟥 Password: Good

A password is a combination of letters, numbers, and symbols used to access an online account.

Examples:

- Summer2026!

- BlueDog99

The problem is that many people create short, predictable passwords and then reuse them across multiple websites.

When one company suffers a data breach, criminals immediately try that same username and password on banks, email accounts, shopping sites, and social media platforms. It’s called credential stuffing, and it works because people reuse passwords.

One stolen password can unlock dozens of your accounts in minutes.

Best Practices

- Never reuse a password.

- Create a unique password for every account.

- Store passwords in a reputable password manager instead of writing them on paper or saving them in an unprotected document.

🟨 Passphrase: Better

A passphrase is a series of unrelated words combined into one long credential.

Example:

PurpleCoffeeRiverTrainSunshine!

When it comes to passwords, length beats complexity. A long passphrase is significantly harder for criminals to crack than a short, complicated password full of symbols and numbers. It’s also much easier for you to remember.

Pro Tip: Think in words, not random characters.

🟩 Passkey: Best

A passkey takes security to an entirely different level. Unlike a password or passphrase, you don’t have to remember it or type it. A passkey is securely stored on your phone, tablet, or computer.

When you sign in, your device proves it’s really you. You simply unlock your device with your fingerprint, facial recognition, or device PIN.

Here’s one of the biggest myths I hear in my classes:

Your fingerprint or Face ID is not your passkey.

Your fingerprint or face simply unlocks the passkey securely stored on your trusted device. Your biometric information stays on your device. It isn’t sent to the website you’re signing into.

Think of it this way:

Your fingerprint unlocks the front door. The passkey is the valuable item locked safely inside the house.

Are Passkeys Better Against AI?

This is one of the biggest reasons cybersecurity experts are encouraging people to adopt passkeys.

Even if criminals use AI to create a convincing deepfake of your face or clone your voice, that alone generally isn’t enough to access a passkey-protected account. They would also need your trusted device and would have to overcome its built-in security.

Just as important, passkeys are designed to be highly resistant to phishing attacks.

Fake websites work because they trick people into typing their passwords. With a passkey, there’s nothing to type. Because a passkey is cryptographically tied to the legitimate website, it generally won’t work on a convincing lookalike site.

That’s why organizations like CISA (the Cybersecurity and Infrastructure Security Agency) and the FIDO Alliance recommend phishing-resistant authentication whenever it’s available.

What if a Website Doesn’t Offer Passkeys?

Not every website supports passkeys yet, and that’s okay.

Here’s what I recommend:

- First choice: Use a passkey whenever it’s available.

- Second choice: Create a long, unique passphrase.

- Third choice: If you’re limited to a password, make it unique, store it in a reputable password manager, and turn on multifactor authentication (MFA) whenever it’s available.

⭐ The Biggest Lesson I’ve Learned

I’ve spent more than 31 years teaching people how to stay safer at work, at home, and online.

Here’s one lesson that hasn’t changed:

Criminals don’t break in. They log in.

Most account takeovers don’t happen because someone hacked through a complex firewall.

They happen because someone clicked a link, trusted a fake email, answered a scam phone call, or typed their password into a website that looked legitimate.

AI has made those scams faster to create, more personalized, more believable, and harder to detect.

That’s why stronger authentication matters.

Which One Should You Choose?

If the website offers...| You should choose…

✅ Passkey| Passkey

❌ No passkey| A long, unique passphrase

❌ Only a password| A unique password stored in a password manager, plus multifactor authentication

“Tracey, the Safety Lady” Says:

Technology changes.

Criminals change.

Your security should change, too.

The next time a website asks how you’d like to protect your account, don’t automatically create another password because that’s what you’ve always done.

Choose the strongest option available.

Your identity, your money, your business, and your reputation are worth it.

Frequently Asked Questions

What’s the difference between a password, a passphrase, and a passkey?

A password is a string of characters you create and type. A passphrase is a longer string of unrelated words that is stronger and easier to remember. A passkey is a secure digital credential stored on your trusted device that you don’t have to type, making it highly resistant to phishing attacks.

Are passkeys safer than passwords?

Yes. Passkeys can’t be reused across websites, guessed through brute-force attacks, or typed into fake websites. They’re currently one of the strongest ways to protect online accounts.

Can AI or a deepfake steal my passkey?

Generally, no. A deepfake of your face or voice alone isn’t enough to access a passkey-protected account. An attacker would typically also need your trusted device and would have to bypass its built-in security.

What happens if I lose my phone?

Most passkeys securely synchronize through your Apple, Google, or Microsoft account, allowing you to restore them on a new trusted device.

Many services also let you register passkeys on multiple trusted devices as a backup.

Do I still need a password manager?

Yes. Many websites don’t support passkeys yet, so a password manager remains one of the best ways to create and store unique passwords and passphrases. Many leading password managers now support storing passkeys as well.

About the Author

“Tracey, the Safety Lady” Hawkins is The Gen AI Cybersecurity Expert for End Users Who Protects People, Profits, and Reputations. She teaches people how to NOT get scammed, sued, or shut down.

Since founding Safety and Security Source in March 1995, she has trained organizations in more than 35 states on personal safety, cybersecurity, fraud prevention, and generative AI.

She founded the Business and Non-Profit Safety and Gen AI Cybersecurity UniversityTM.

She is an award-winning keynote speaker, instructor, and nationally recognized safety expert featured by The Today Show, CNN.com, ABCNews.com, The Washington Post, The Boston Globe, CNET, AAA, Essence, and REALTOR® Magazine.

Safety and Security Source

📧 tracey@safetyandsecuritysource.com

📞 816-788-6788

🌐 https://tinyurl.com/BusinessandNonProfitSafety

🔗 linkedin.com/in/traceythesafetylady

© Safety and Security Source 2026

By “Tracey, the Safety Lady” Hawkins, Generative AI Cybersecurity Expert for End Users and the Leading Real Estate Safety Expert in the U.S.

Crypto mortgages are officially here.

So are the scammers.

The moment cryptocurrency entered federally conforming mortgage conversations, cybercriminals started looking for the weak spots. And there are plenty of them.

On March 26, 2026, mortgage company Better Home & Finance and Coinbase announced what Coinbase described as the first crypto-backed conforming mortgage solution developed with Better.

This did not happen overnight.

On June 25, 2025, FHFA Director William J. Pulte formally ordered Fannie Mae and Freddie Mac to prepare proposals for counting cryptocurrency as a qualifying asset without requiring borrowers to convert it to dollars first.

That is a historic shift. It is also a brand-new attack surface.

I have been teaching real estate professionals how to spot fraud and protect their clients for more than 31 years. I have watched wire fraud evolve from a fairly crude email scam into a sophisticated, AI-powered operation that can drain a closing account in minutes.

Every time I think the industry has caught up, the criminals take another leap forward.

Crypto mortgages are that leap.

What Consumers Must Know Before They Pledge

Real estate professionals must be prepared to educate consumers.

For homebuyers who are “crypto-rich but cash-poor,” this is a massive opportunity to achieve homeownership without triggering a capital gains tax event. However, they are entering a high-risk digital environment.

The “Safety Lady” Consumer Rules:

The 50–60% “Haircut”:

Explain that their $100,000 in Bitcoin only “counts” as $40,000 to $50,000 toward your loan. Anyone promising them a 1:1 value is a scammer.

The Custody Trap:

They cannot use a cold wallet (like a Ledger) or a private DeFi account. The crypto must move to a U.S.-regulated custodial account (e.g., Coinbase).

Verify the Portal:

Scammers send fake links to “verify” their wallet.

Rule: Advise them to never click a link in an email. Only move assets through the official, verified app of their exchange.

The Payment Buffer:

Unlike traditional crypto trading, there are no “margin calls” if the price of Bitcoin drops. Their assets are only at risk of liquidation if they miss their mortgage payments for 60 days.

The Cybersecurity Threats No One Is Briefing You On

This is where I come in. I help real estate agents understand exactly how criminals will try to steal the money at every point in this process.

1. Deepfake Impersonation during Closing

The FBI’s IC3 received more than 22,000 AI-related complaints in 2025. Fraudsters are now using AI to clone voices and video to impersonate your lender or title officer. Criminals can now use short audio samples to create convincing AI-generated voice impersonations.

The Message: If a “lender” calls with updated instructions, hang up. Call back on a verified number.

If buyers receive an email with updated wire information, advise them not to respond to the email, contact you, the agent, or lender on a known number.

The real weapon is urgency, confusion, and trust manipulation during a high-stress transaction. Agents should educate consumers to avoid successful social engineering.

I strongly advocate and advise real estate agents to make ”Safety Consultations” a part of the seller listing appointment and Buyer Agency Agreement meeting.

This is the opportunity to educate them, as outlined in the NAR Code of Ethics, and to show your value in this post-settlement world.

2. Business Email Compromise (BEC)

BEC generated $3.04 billion in losses in 2025.

In a crypto mortgage, there are two loan structures and two sets of instructions to verify. This doubles the opportunity for a fraudster monitoring your email thread to strike.

The structure may involve multiple sets of instructions and additional transaction complexity, creating more opportunities for confusion and impersonation fraud.

Agents should establish cybersecurity protocols, like multi-factor authentication, passkey or passphrase (as opposed to less secure passwords), security updates, anti-virus, regular expert-led gen AI cybersecurity training for end users, use of domain email accounts (as opposed to free email accounts for business), etc.

3. The Fake “Urgent Verification”

Criminals rely on the stress of the closing window.

They will send “urgent” AI-generated messages claiming your crypto collateral has been “rejected” and you must re-send it to a new address immediately. Advise clients to not panic, but to call your agent.

What Real Estate Professionals Should Do Right Now

The agents and brokers I train are not waiting for a fraud to happen before they act.

Failure to educate consumers about wire fraud and impersonation scams can create reputational, financial, and liability exposure for brokerages.

Implement a Verbal Call-Back Policy:

This must be the non-negotiable standard for *every* wire transfer and change in instructions.

Educate Clients Early:

Use the consumer rules above to set expectations. If a client thinks they can keep their crypto in a private wallet, they are a prime target for a scammer.

Fiduciary Duty: NAR already recommends that brokers offer regular AI cybersecurity and wire fraud training. This is a professional standard, not a suggestion.

The Bottom Line

Crypto mortgages are here. Crypto-backed mortgages may represent the next evolution of home financing. They may also become the next evolution of wire fraud.

The professionals who will protect their clients and their commissions are the ones who understand the product, know the attack points, and have protocols in place before the first suspicious email lands.

Associations, boards, and brokerages should schedule this training proactively since it can be considered a preventable crime and do it before your next deal is at risk.

This is where I come in. I help real estate professionals and consumers understand how criminals exploit technology, trust, urgency, and confusion during high-value transactions.

“Tracey, the Safety Lady” Hawkins, Generative AI Cybersecurity Expert for End Users and International Real Estate Safety Expert

“Criminals do not wait for industries to understand new technology before exploiting it.”

By "Tracey, the Safety Lady" Hawkins

Every day, people are asking ChatGPT and other AI tools questions they should be asking an attorney.

“Do I have a lawsuit?”

“Should I sue?”

“Can you explain this contract?”

“What should I say to my employer?”

Some are even uploading contracts, confidential emails, financial records, medical information, and other sensitive documents.

That’s a mistake.

A recent federal court case, United States v. Bradley Heppner, shows why. According to court records, the defendant used an AI chatbot to organize legal strategy before meeting with his attorney. When investigators later seized his electronic devices, the court ruled that, under the specific facts of the case, those AI conversations were not protected by attorney-client privilege or the work-product doctrine.

In another recent federal case involving the Palisades Fire investigation, prosecutors allege a suspect’s ChatGPT activity became part of the evidence reviewed during the investigation.

The takeaway isn’t that AI is bad.

The takeaway is that AI isn’t your lawyer.

It’s also important to remember that every document you upload and every personal detail you share deserves protection.

The FBI’s Internet Crime Complaint Center tracked AI-enabled crime as a separate category for the first time in 2025, receiving 22,364 complaints involving AI with nearly $893 million in reported losses.

Criminals are using the same technology to create deepfakes, phishing emails, fake documents, and voice impersonation scams.

Here’s how to protect yourself.

✔ Use AI to understand general legal terms.

✔ Use AI to prepare questions for your attorney.

❌ Don’t upload confidential documents.

❌ Don’t ask AI to develop your legal strategy.

If your legal rights, your family, your finances, or your business are on the line, your best source of advice is a qualified attorney who understands your specific situation.

This is exactly why I teach AI safety. Understanding how to use AI wisely doesn’t just help you become more productive. It helps you protect your personal information, recognize scams, avoid costly mistakes, and make better decisions before a problem becomes a crisis.

Technology is changing.

Good judgment is still your best defense.