Threat Spotlight: AI-Written Phishing and Deepfake Fraud

For years we trained staff to spot phishing by its clumsiness — odd grammar, strange phrasing. Generative AI ended that era. Attackers now produce flawless, personalised lures in any language and any corporate tone, and increasingly pair them with cloned audio. The widely reported 2024 case of a Hong Kong finance worker transferring roughly US$25 million after a video call staffed entirely by deepfaked "colleagues" marked the direction of travel.

What AI changed — and what it didn’t

• Changed: volume and polish. Personalised spear-phishing that once took hours of research is now automated.
• Changed: voice. A few seconds of audio — a conference talk, a voicemail greeting — can seed a serviceable clone of your director asking for an urgent transfer.
• Unchanged: the ask. Every variant still funnels toward the same requests — credentials, payments, MFA codes, urgency.
• Unchanged: the defence. Out-of-band verification doesn’t care how convincing the performance was.

Retiring the old training

"Look for spelling mistakes" is now dangerous advice — it teaches staff that polished means safe. Modern training centres on the ask and the channel: unexpected requests involving money, credentials or secrecy get verified through a different channel you initiated, no matter how fluent, personal or senior the request appears.

Practical countermeasures for SMBs

• Payment rule: no transfer or bank-detail change on the strength of any single channel — email, call or video. Callback on a known number, always.
• Consider a family-style code word for genuinely urgent internal requests.
• Phishing-resistant MFA (passkeys) so harvested credentials are worthless.
• Simulate modern lures in training — polished, personalised, urgent — so the reflex matches the threat.

AI made the con more convincing; it didn’t make it unbeatable. Processes that never trust a single channel beat performances of any quality.