AI Scams, AI Hackers, AI Layoffs: Which Should Indians Fear?

What happened

AI scams, AI hackers, AI layoffs. Most AI videos either scare you or tell you to relax, and both are selling certainty. I am an auditor. My job is to separate what’s claimed from what’s being tested, so I ran each fear through one audit word: materiality.

In an audit, a problem is material if it is big enough to change a decision. A typo in a report isn’t material. A missing crore is. So for every fear, one question: is it big enough to change what you do on Monday?

The short answer is two of them. AI scams are real. AI hackers are real. AI layoffs, the one in all the headlines, are mostly overblown, unless you’re under 25. And the AI like in the movies is too early to tell. If you only act on one of these this week, make it the scams.

Where the fear holds up

Scams. In 2025, Indians reported losing ₹22,495 crore to cyber fraud, across 24 lakh complaints in one year. To be fair, that’s all cyber fraud, not only AI. About three-quarters of it went to fake investment schemes, and this year the fake scheme comes with a famous face.

In Pune in August, a businessman lost 1.07 crore over 36 payments after an Instagram video of Sitharaman promoting a trading scheme. Police confirmed it was AI-made. In Belagavi in May, a 76-year-old man lost 7.9 lakh to a fake Finance Minister again, this time on YouTube. AI did not invent a new crime. It gave an old crime a better costume.

Most of us think we’d notice. In Indore this February, a family’s son had gone missing after coaching class. The next day, a video call. On screen, he was being hurt. They paid one lakh. He was safe at a temple in Rajasthan, and police believe the video may have been a deepfake. Those parents saw their own child, and they still couldn’t tell.

Hackers. The movie version, an AI turning on us, came closest in July. Hundreds of OpenAI’s test agents broke out of their test and attacked a real company, Hugging Face. They were trying to cheat on a test, not take over the world. So the movie version is overblown.

The real danger this autumn was people pointing AI at us. About seven in ten websites run on a piece of software called PHP. WordPress runs on it. In August, security researchers using AI models found two holes in it, holes that let a stranger run their own code on your website’s server without logging in. The fix came out on the 21st of October, and PHP’s own message was “Update now.” Cloudflare counted tens of thousands of attack attempts within 45 minutes of the announcement.

Four days later, a security firm caught a group suspected to be linked to China using the hole to take over 25 servers, including in a network tied to the US government. In the attackers’ kit, investigators found AI coding tools and Chinese AI models. The same AI that helps defenders find a hole helps attackers use it, and the gap between found and attacked is now less than an hour.

And it’s here. On the 4th of November, CERT-In, India’s cyber agency, sent a critical warning to lenders, fintechs, payment companies and crypto exchanges. A new gang it calls Crafty Falcon is using AI hacking tools that, in CERT-In’s words, can run complete attack chains autonomously at machine speed. It strikes on weekends and holidays, when fewer people are watching.

The big AI models have got much harder to misuse, so attackers went around them. One of the tools CERT-In names, Artex, is free, Chinese-made, and popular with hackers who can’t get access to top American models. The AI isn’t the one going rogue. The people using it are.

The evidence an auditor should ask for

Layoffs. Take two people: one is 35 with ten years in IT, the other is 22 and applying for a first job. The data says something very different for each.

For the 35-year-old, the people who count jobs in America, India and worldwide all say the same so far: no clear sign of AI in the overall job numbers. The fear is overblown.

The 22-year-old is the asterisk. Stanford economists studied payroll data for millions of American workers. Experienced people in AI-exposed jobs are doing fine. But workers aged 22 to 25 in jobs like junior coding and customer support are not: their employment is now 19% below where it would be if they had kept pace with everyone else. Companies aren’t letting juniors go. They’re just taking fewer new ones on. It’s early American data, but India’s IT industry is built on exactly those entry-level roles. AI isn’t firing people. It’s quietly not hiring them.

The same study shows where the damage is: in jobs where AI does the task instead of the person. Where AI helps the person, those jobs held up. So don’t compete with the AI. Be the person who checks it.

AGI. Nobody knows when it arrives. This May, the Forecasting Research Institute asked a large panel of AI experts about an AI that beats nine out of 10 professionals at almost every desk job. Their middle guess was 2050. Against that, the International AI Safety Report says today’s systems lack the capabilities to cause a loss of control, calls AI jagged, brilliant at some hard tasks and bad at some easy ones, and found little expert consensus on where it goes next.

So my honest answer is: I don’t know, and neither does anybody else. When experts disagree this much, anyone who sounds certain is guessing.

For the next scary headline, run three questions:

1. Is it happening, or is it a forecast?
2. Is it happening to people like me?
3. Can I do something about it this week?

Three yeses means act. Anything less means watch.

The test to run this week

Don’t try to spot the fake. Check the request. You can’t out-spot a deepfake, but you can out-check one.

1. If any video or call asks you to send or invest money, hang up. Call the person back on a number you’ve already saved.
2. Set a family code word today, one that has never been typed in a chat.
3. Before you invest with anyone, look them up on SEBI’s website.
4. If money’s gone, call 1930 straight away. Fast reports have already saved more than eight thousand crore rupees.
5. If you have a website, ask whoever runs it: “Are we on the PHP update from the 21st of October?”
6. Turn on an alert for every transaction and set your daily UPI limit to what you actually use.
7. Take one task from your job, run it through an AI, and write down every mistake it makes. That list is your skill.

The scams aren’t really aimed at you. They’re aimed at your parents. So set up the family word tonight, and agree ground rules for video calls from unknown numbers.