Connected & Protected
24/7 Support
AI-Powered IT
24/7 Support • Orange County, CA
HomeBlogModels Are Applying to Be the Face of AI Scams
Security
#Security
#Security / Security News
#AI scams
#deepfake technology
#human trafficking
#cybercrime
#online fraud
#AI face models
#Southeast Asia scams
#pig-butchering scams
#romance scams
#job recruitment scams
#Telegram job postings
#digital deception

Models Are Applying to Be the Face of AI Scams

Dozens of Telegram channels reviewed by WIRED include job listings for “AI face models.” The (mostly) women who land these gigs are likely being used to dupe victims out of their money.

M
Matt Burgess
Content Author
Content Specialist

Matt Burgess is a seasoned journalist specializing in cybersecurity and digital ethics. His expertise encompasses the intersection of technology and crime, providing insights into the evolving landscape of online fraud.

Expertise: Cybersecurity, digital fraud, human trafficking, AI technology, online scams, investigative journalism
Published: March 17, 2026
Updated: May 10, 2026
9 min read

Quick Answer

Models are increasingly being recruited for AI scams, using deepfake technology to deceive victims. This trend highlights a troubling intersection of human trafficking and cybercrime.

TL;DR

This article examines the troubling rise of models applying for jobs as AI faces in scams, revealing how cybercriminals exploit human trafficking victims in Southeast Asia. With advanced technology, they manipulate potential victims through deepfake videos, creating a new wave of online fraud.

Key Takeaways

  • 1AI models are being recruited for sophisticated online scams.
  • 2Cybercriminals utilize deepfake technology to deceive victims.
  • 3The Southeast Asian region has become a hub for these illicit operations.
Models Are Applying to Be the Face of AI Scams

When applying for jobs, Angel talks up her language skills. “I can speak fluent English, I can speak good Chinese, I also speak Russian and Turkish,” the glamorous, 24-year-old Uzbekistani woman explains in a selfie-style video made for recruiters. Angel had arrived in the Cambodian city of Sihanoukville that day, she said, and was ready to start work immediately.

Those impressive language skills, however, have likely been put to use as part of elaborate “pig-butchering” scams targeting Americans. That’s because, instead of applying for a conventional corporate job, Angel was putting herself forward to work as an “AI face model”—sitting in front of a computer all day and making deepfake video calls to manipulate potential scam victims. Her application, which also required her height and weight, says she has already clocked up “1 year as an AI model.”

Angel is far from alone in this pursuit. A WIRED review of dozens of recruitment videos and job ads posted to Telegram show people from around the world—including Turkey, Russia, Ukraine, Belarus, and multiple Asian countries—applying to be AI models or “real face” models in Cambodia and Southeast Asia. The region has become home to vast, industrialized scamming operations that hold thousands of human trafficking victims captive and force them to run online cryptocurrency investment and romance scams.

As well as tricking people into working in scam compounds, these high-tech, multibillion-dollar criminal enterprises can also attract people into seeking “work” as part of the operations. “In the past year until today, they are also hiring people doing AI modeling,” says Hieu Minh Ngo, a cybercrime investigator at the Vietnamese scam-fighting nonprofit ChongLuaDao. “They will give you the software so they can swap their face by using AI and they can do romance scams,” he say

CrowdStrike
Related Product

CrowdStrike Advanced Defend

by CrowdStrike$15.41/mo

CrowdStrike provides advanced cloud-native platform protection for endpoints, cloud workloads, identities, and data with a single lightweight agent.

Learn More
s.

Ngo, a reformed criminal hacker who now tracks scam compound activity and supports victims, identified around two dozen channels on Telegram that have some job postings for AI models in the region. Humanity Research Consultancy, an anti-human-trafficking organization, has also tracked people applying on Telegram for jobs in “known scam hub cities” as “models” and “AI models,” including Angel’s application.

The rise of AI models comes as cybercriminals are broadly adopting AI and using face-swapping as part of their online scamming. Typically, fraudsters will use fake personas to contact potential victims on social media or messaging platforms. They will often use stolen images of celebrities or attractive men or women to entice a person into talking to them.

Once they make contact, they will then bombard them with attention to help build up a relationship, before trying to get them to part with their cash. In some instances, multiple people may control the scammers’ account and message the victim under a single fake persona. But if a potential victim asks for a video call during these interactions—to check if the person they are speaking to is real, for instance—that’s when deepfake video calls and models who have their faces swapped can be used. Some Southeast Asian scam centers have dedicated “AI rooms” where the calls are made from.

Job advertisements for AI models or “real models” reviewed by WIRED demand excessive working hours, offer little free time, and require a relentless schedule. The ads are usually posted by a channel administrator and don’t include contact details or list who someone would specifically be working for. One recruitment post for an alleged six-month contract says the person will need to send photos daily, make video and voice calls, and create audio and video messages. “Approximately 100 video calls per day,” the post says.

Other posts list up to 150 potential calls per day. “Filters may be used, but ensure the image is realistic. Live-action videos are permitted; wigs are prohibited,” another ad reads. For the privilege, the person would allegedly get one full day and four half days off per month. Yet another ad lists working hours as between 10 pm and 10 am in Cambodia and a preference that the person will have a “Western accent.” One model-job ad says: “The company will retain your passport for visa and work permit management.” Taking people’s passports is one of the primary ways scam compound operators hold people captive.

While a few men apply for the AI model roles, the vast majority of applications viewed by WIRED were from young women, mostly in their early twenties. Applicants are asked to send a short video introducing themselves, text about their experience and expectations and photographs of themselves; some are required to include their marital status and “vaccination” status.

"For over three years, I have worked with Chinese companies for different kinds of projects including stock market, cryptocurrency, and love story,” one person says in a recruitment video. Another says: “Based on my experience, I am good handling customer, I persuade them to invest by using my own techniques and discussing how gold trading benefits them."

The video applications do not contain full names or contact details, so WIRED was unable to contact those applying for roles.

Modeling applicants have requested salaries of up to $7,000 per month, according to Humanity Research Consultancy. They also make specific requests about their working conditions, many of which may not be afforded to people who have been trafficked into the scam operations. One woman requested her own room and that she “can go outside.” Another requested that they could “go home on day off” and have a “personal washing machine

SentinelOne
Related Product

SentinelOne Control

by SentinelOne$8.00/mo

Prevention and detection of attacks across all major vectors with fully automated, policy-driven response capabilities and real-time forensics.

Learn More
.”

Although some of the models are recruited to work in the roles and may get more freedoms than victims of human trafficking, says Ling Li, the cofounder of the nonprofit EOS collective which works with victims of the scam industry, they may still face harsh treatment from bosses. “One European victim told us that he saw some Italian models in his compound, but he cannot tell [if] they are [there] willingly or not because they were beaten in front of him,” she says. “And also there is some sexual harassment.”

WIRED sent Telegram a list of two dozen jobs channels and recruitment channels that have advertised AI models, alongside other roles, in recent months. The company did not appear to remove any of the channels; however, a spokesperson says its policies do not allow scamming-related activity to take place.

The vast majority of the model-job ads and applications on Telegram don’t specifically mention scamming work, but they include a host of red flags indicating scamming, Ngo says. “Why [do you] need AI model? That’s the first question,” Ngo says. Other warning signs include the locations being in known scamming sites in Cambodia, claims of high salaries for the region, and frequent requirements for Chinese language skills, Ngo says.

The ads and video applications also include language closely aligned with scams, according to researchers and WIRED’s review of the posts. This includes frequent mentions of “clients,” a term scam operations use instead of “victims,” plus frequent references to cryptocurrency investments or gold trading. One person, who claimed to have been working as an AI model and “real face” model for 18 months, said their previous work involved convincing people to invest: “I really know how to make good communication to a client, how to make them trust us, how to send a good picture to them, and how to make them laughing.”

However, some posts are more explicit, listing a “job market” someone was applying for as: “love scam.” Another post describes a person’s experience as: “3 year as customer service (killer) of scamming platform crypto.”

After Frank McKenna’s mom started getting scam text messages about making investments last year, he began intercepting them and talking with the senders. McKenna, the chief strategist at anti-fraud software firm Point Predictive who has closely tracked “AI models,” says he wanted to understand how they were operating, so he set up a video call between them and his mom.

“The only purpose of that call was to prove that they’re a real person and to gain trust,” McKenna says. During the call, he says, the young woman on camera appeared to be using an AI filter on her face. “It’s kind of glitchy. There’s other people in the room with her, so there’s echoing,” he says. “Then we had another short call with another AI model.”

A month or so later, McKenna says, he saw what appeared to be the same model’s recruitment video posted online, saying she was looking for a new contract as hers had expired. “It was kind of a small world of these AI models who seem to go from place to place, completely voluntarily, making pretty good money,” McKenna says. “They’re probably just in the video room doing calls all day with tons of different victims.”

Originally published on March 16, 2026 by Wired.

Expert Analysis for Orange County Businesses

How this impacts SMBs in Southern California

Tech News Roundup: Models Are Applying to Be the Face of AI Scams

The rise of AI-driven scams, particularly those utilizing human models for deepfake technology, highlights a growing threat to small and medium businesses (SMBs) in Orange County and Southern California. As these sophisticated scams proliferate, they not only target individuals but can also potentially affect business operations and reputation. SMBs must remain vigilant as cybercriminals become increasingly adept at exploiting technology to manipulate and deceive. This trend underscores the necessity for robust cybersecurity measures to protect sensitive information and prevent financial losses.

For local businesses, the implications are clear: investing in managed IT services and comprehensive cybersecurity solutions can serve as a frontline defense against these emerging threats. By ensuring that your systems are well-protected and up-to-date, you reduce the risk of falling victim to scams that exploit advanced technologies like AI. Additionally, implementing strategies such as cloud backup and BCDR can help safeguard your data, ensuring business continuity in the event of a cyber incident. Partnering with experts like The Network Company can provide you with the necessary tools and strategies to navigate this complex landscape safely. Learn more about our services by visiting our cybersecurity and BCDR pages.

Read the full article: Original Source Link

Frequently Asked Questions

What are AI models in scams?

AI models are individuals hired to use deepfake technology to impersonate others in online scams.

How are victims manipulated in these scams?

Fraudsters use fake personas and deepfake videos to build trust and extract money from victims.

Content Quality

Last Reviewed:March 17, 2026
Fact-Checked:March 17, 2026
Sources:18 verified sources
Word Count:1,499 words

Article Tags

Security
Security / Security News
AI scams
deepfake technology
human trafficking
cybercrime
online fraud
AI face models
Southeast Asia scams
pig-butchering scams
romance scams
job recruitment scams
Telegram job postings
digital deception
M

About Matt Burgess

Content Author

Matt Burgess is a seasoned journalist specializing in cybersecurity and digital ethics. His expertise encompasses the intersection of technology and crime, providing insights into the evolving landscape of online fraud.

Expertise: Cybersecurity, digital fraud, human trafficking, AI technology, online scams, investigative journalism

Related Articles

5 critical steps to achieve business resilience in cybersecurity
Security

5 critical steps to achieve business resilience in cybersecurity

What does it really take to keep your organization running when attackers strike? The answer is business resilience—being able to detect, contain, and recover fast enough that disruptions are minimized, customers stay confident, and operations keep moving. From the latest 2026 State of the SOC Report, which is based on more than 900,000 alerts observed between March and December 2025 from the Adlumin Managed Detection and Response (MDR) provided by the N-able SOC, we’ve seen firsthand where security strategies succeed—and where they fall short. Below, we break down five actionable ways to build true resilience for your IT environment, using real-world data, strategic guidance, and frameworks that leading IT teams put into practice today. 1. Stop trusting single-layer security If you’re depending on just endpoint or cloud controls, you’re missing nearly half the risk surface—and the numbers prove it. In 2025, 18% of all alerts at the N-able SOC came from network and perimeter (Unified Threat Management) exploits that bypassed endpoint visibility. Over 137,000 threats were detected where endpoint-only controls would have been blind. What we recommend: Embrace layered, defense-in-depth designs. That means combining identity, endpoint, network, cloud, and perimeter visibility—not just bolting on tools. Relying on a “magic bullet” solution leaves dangerous gaps. Looking for end-to-end coverage of your environment? Check out N-able Unified Security Solutions. 2. Transition from manual to automated response SOC teams can’t keep up with the flood of alerts—N-able handled 2 alerts per minute on average in 2025. That’s why automation and Security Orchestration, Automation and Response (SOAR) saw a 500% YoY surge—almost one in four responses are now orchestrated automatically. Pro tip for IT leaders: Streamline workflows, so triage and containment happen at machine speed, not human speed. Automate password resets, containment, and endpoint remediation, then focus your analysts on proactive threat hunting. 3. Modernize endpoint and identity management Attack patterns are shifting. Out of 909,155 total alerts identified in N-able’s 2026 SOC report, only about half touched the endpoint layer. Identity has become one of the fastest‑growing attack surfaces, and organizations need visibility into suspicious sign‑ins, privilege misuse, and anomalous authentication behavior before a breach unfolds. A flexible, unified endpoint management solution that helps you manage, control, and secure endpoints is table stakes in your tech stack. To address identity attacks, an Identity Threat Detection and Response (ITDR) solution helps close this gap by correlating identity events, detecting credential abuse, and stopping identity‑based attacks in progress. ITDR gives security teams a clearer picture of how users, systems, and privileges are being accessed so they can contain threats early, before lateral movement or escalation occurs. Actionable step: Integrate advanced multi-factor authentication, real-time patch management, and privileged access controls as foundational layers. Add continuous identity monitoring to detect unusual authentication patterns and catch malicious activity that endpoint‑only tools cannot see. Transform your endpoint management – Explore how N-able’s N-central delivers simpler, smarter IT and security management. 4. Build recovery readiness into your plan Resilience isn’t just stopping an attack—it’s restoring operations quickly and minimizing downstream damage. In an N-able case study, an MSP’s customer suffered a 1.5 terabyte ransomware attack on a Friday. Thanks to Cove’s reliable backups (validated via recovery testing), the entire environment was fully restored by Monday, getting the business back online in under 3 days. This rapid recovery dramatically limited downtime and business disruption. Our advice: Test backups regularly, ensure they’re immutable, and tie recovery procedures directly into your SOC playbooks. Business continuity hinges on the speed and certainty of your recovery. See how Cove Data Protection delivers data resiliency by recovering quickly and reliably after every disaster. 5. Prepare for the next attack surface: AI AI is transforming both defense and risk. By 2026, up to 90% of investigations could be automated by AI. But adversaries aren’t far behind—compromised AI orchestration or poisoning can create new attack vectors that bypass traditional controls. What you need to do now: Audit where AI and automation touch your environment and monitor their actions with the same rigor as human activity. Prepare to secure agent-to-agent communications and maintain oversight as AI-driven processes mature. Explore how N-able leverages AI to protect customer environments around the clock. Strengthen your business with resilience-first security Resilience isn’t a buzzword—it’s the only practical answer for IT leaders dealing with today’s complex, fast-moving threat landscape. By focusing on layered defense, automation, unified recovery, and AI-integrated controls, you position your organization for uptime and continued success. Ready to level up your approach? Get started with our Cyber Resilience Primer: What You Need to Know in 2026.

6 metrics IT leaders can’t afford to ignore for business resilience
Security

6 metrics IT leaders can’t afford to ignore for business resilience

If you’re in IT, you know: what we don’t measure puts business resilience at risk. In the face of rising threat volumes, scaling complexity, and board-level scrutiny, tracking the right operational metrics isn’t just about visibility—it’s the foundation for proactive risk management and business continuity. Compliance and insurance demands are also driving the scrutiny around measuring cybersecurity programs. Recent findings from the 2026 N-able State of the SOC Report are clear: the threat landscape keeps shifting, automation and integration are now must-haves, and organizations delivering true resilience measure what matters most. Below are the six metrics that we use to move the needle from firefighting to futureproofing. 1. Mean time to detect (MTTD): The speed of awareness Attackers are faster and stealthier than ever. In 2025 alone, N-able’s SOC processed more than 900,000 alerts, with attackers exploiting both endpoints and newly reemerging network perimeters. Our own data shows that rapid detection is non-negotiable: every extra minute a threat goes unseen increases the likelihood of a business-impacting event. If your MTTD is measured in hours, not minutes, you’re exposing your organization to avoidable risks. Automated threat detection, AI-driven analytics, and streamlined alert management significantly reduce dwell time. Key stat: The N-able SOC now averages 2 alerts per minute, an alert velocity that demands automated detection—not just human monitoring. 2. Mean time to respond (MTTR): From triage to containment It’s not enough to spot threats—you have to contain them fast. MTTR tracks how quickly your team can isolate and neutralize incidents. Integrated SOAR (Security Orchestration, Automation, and Response) workflows now drive a 500% year-over-year increase in orchestrated alert response actions, according to our latest SOC report. The difference? Teams leveraging automation have moved from after-the-fact remediation to business-saving containment in minutes rather than hours. 3. Time to recover: The business resilience reality check A single outage can mean hours or days of operational downtime. That’s why recovery time is a core resilience metric. It’s not just about restoring data; it’s about rebuilding trust and revenue streams. In 2025, we saw the top-performing organizations combine automated backup and disaster recovery solutions, rapid failover, and regular recovery testing to drive down time-to-recover. Cloud-native backups with built-in recovery processes are now the difference between near-instant resumption and prolonged business impact. Access the Cybersecurity Incident Response Plan template to help your team build a structured, comprehensive, and actionable approach to identifying, managing, and mitigating cyber incidents. 4. Endpoint patch compliance: Closing the doors Vulnerability exploits remain a constant threat, and unpatched endpoints often provide the easiest entry points. Maintaining a high percentage of fully patched endpoints helps reduce these paths of attack and strengthens your overall security posture. With centralized patch management, resilient teams can automate updates, track compliance, and remove the guesswork from keeping environments secure. This reduces risk surface area even as your operations grow. 5. Asset and identity coverage: Eliminate blind spots You can’t protect what you don’t see. With over 432,000 endpoint-layer detections and 14,000 identity threats recorded by the N-able SOC team between March and December 2025, the risk of shadow IT or credential theft from memory is real. Eliminating blind spots starts with full visibility across every asset in the environment. As devices, cloud workloads, and remote access points continue to expand, unmanaged or misconfigured assets can create opportunities for attackers to establish a foothold. Continuous discovery and consistent monitoring help ensure nothing operates outside the security team’s line of sight. Identity visibility is equally essential. With credential abuse now a leading attack vector, organizations need awareness of how accounts authenticate, when privileges change, and where anomalies appear across systems. Bringing asset and identity coverage together helps close the gaps attackers look for and strengthens an organization’s overall security posture. Your asset and identity coverage percentage tells you whether you’re operating with full visibility or exposing the business to unseen gaps. Resilient organizations unify asset discovery, endpoint management, and identity monitoring on a single pane of glass—empowering teams to stay ahead even as environments sprawl. Take a tour of N-central and see how we unify IT Ops and SecOps for stronger resilience. 6. Downtime avoided: Quantifying security’s business value Translating technical wins into business outcomes is how IT earns board trust. By correlating incident response and recovery metrics with downtime costs, you deliver a dollar-value impact: tangible proof that your efforts directly protect revenue. Integrated platforms, real-time dashboards, and automatic reporting transform security from a cost center into a business safeguard. Make metrics your roadmap The real message from the latest N-able SOC data? Single-layer approaches and isolated tools are dead ends. According to our recent State of the SOC report, 137,000+ network and perimeter threats bypassed endpoints, and nearly half of all alerts never touched a traditional endpoint. Business resilience is now about defense-in-depth, layered visibility, and automation. If you’re relying on what worked last year, you’re behind. We encourage you to start with these six metrics, identify your gaps, and leverage unified security solutions that support operational clarity and proactive resilience. Ready to up your security game? Learn more about N-able’s unified end-to-end cybersecurity and IT solutions.

5 Steps to break free from alert fatigue and build resilient security operations
Security

5 Steps to break free from alert fatigue and build resilient security operations

How many times has your SOC hit crisis mode at 2:00 AM, with the dashboard blaring red and analysts scrambling to separate real threats from useless noise? We’ve all been there, and if you’re still measuring success by the number of alerts closed, chances are you’re feeling the strain. The truth is, responding to everything is neither sustainable nor effective—and it puts resilience at risk. In this article, we’ll show you the five most important steps you can take to move from alert fatigue to business resilience, supported by hard data from the 2026 N-able State of the SOC Report. These are the practical habits security-driven IT leaders are adopting to future-proof their operations and protect what matters most. 1. Recognize the cost of noise: When “more alerts” means more risk Many SOCs still believe that more data equals better protection. But our 2026 State of the SOC report found that traditional alert volumes have hit a breaking point— our SOC team had to process an average of 2 alerts per minute last year. When everything is urgent, nothing is. Analysts get burned out, and critical threats can slip by undetected, leading to increased dwell times and real business impact. Key N-able SOC stat: 18% of threats in 2025 were only caught by network and perimeter layers—outside endpoint visibility. It’s clear: If you’re over-relying on endpoint or cloud signals, you’re missing threats and putting uptime and client trust at risk. 2. Prioritize outcomes over ticket volume Stop focusing on how many alerts are cleared. This may be a metric for a better understanding of where automation or headcount are necessary but prioritize outcomes. Instead, the right questions are: How quickly did you contain a threat? Did we disrupt business operations or keep recovery swift and effective? A practical, outcome-driven SOC measures: Dwell time: How long before a threat was neutralized? Mean Time to Contain: How quickly were you able to halt an attack? Business downtime avoided: How resilient were you when tested? Tie these metrics back to resilience. When you can tell the CEO or client you prevented X hours of downtime or stopped ransomware in minutes, you position yourself as more than a cost center—you’re a driver of business continuity. Hear how customers use N-able to boost efficiency, gain peace of mind, and ensure business resiliency. 3. Put AI and automation to work—or get left behind According to our SOC report, 90% of all investigations in 2026 could be automated by AI. In fact, only organizations that shifted to AI-centric security models kept up with the onslaught. Those stuck with purely manual playbooks fell behind. Here’s what works: AI-driven correlation to unify context across endpoints, networks, identities, and more. Automation to handle tasks like remediation, account disables, password resets, and notifications—repetitive work that machines do faster and with less error. Last year, our SOAR actions surged 500%, making up almost a quarter of all responses. That’s what resilience in the face of “volume crisis” looks like. Explore the benefits of integrating AI into your strategy and how it impacts your security team across crucial threat and detection stages. 4. Build defense-in-depth (and don’t rely on magic bullets) The “magic bullet” mindset, where a single security layer or tool is supposed to protect everything, doesn’t cut it. The 2026 N-able State of the SOC report underscores that business resilience depends on a defense-in-depth strategy: In 2025, half of all attacks bypassed endpoint controls entirely. 137,187 network and perimeter threats were invisible to endpoint-only deployments. The lesson: Layered security isn’t just “nice to have”—it’s the difference between stopping attacks and suffering a breach. Even with the right foundational layers in place, the real power only emerges when they operate as a unified system. Multi-layer correlation connects the signals coming from identity, endpoint, cloud, network, and perimeter controls, transforming isolated alerts into a clear, actionable picture of an unfolding attack. 5. Design playbooks that focus on business resilience Your playbooks shouldn’t just stop at technical containment—think bigger. The best teams design for resilience, from automated isolation and communication to verified recovery. For ransomware: Confirm the scope rapidly (AI correlates affected assets). Automate isolation of the subnet or systems involved. Communicate with stakeholders per your IR plan. Initiate backup restoration, leveraging recent, immutable recovery points. In our 2026 SOC report, organizations with unified, automated playbooks contained perimeter-initiated attacks in under 10 minutes—even during off-hours. That’s the bar you need to hit. The bottom line Volume and complexity aren’t going away, but SOC fatigue doesn’t have to be your story. By shifting to outcome-driven defense, embracing automation, layering controls, and focusing on measurable resilience, you move from reactive to proactive—protecting your clients, your brand, and your peace of mind. Are you ready to take the next step? Take a tour of Adlumin’s AI-powered XDR platform and expert-led MDR service.

Ready to Transform Your Business?

Discover how our expert IT solutions can help your business thrive.