For years, one of the most effective ways to avoid phishing and other electronic fraud schemes was to look for poor spelling or grammar. That guidance is no longer enough to prevent fraud losses. Generative AI makes it easy for perpetrators to produce polished emails — and create compelling videos — in mere seconds. Now, many phishing emails are error-free and personalized for the recipient.
What can your business do to combat criminals armed with AI? Let’s take a look.
Fortunately, potential phishing victims still have resources available. For example, instead of evaluating a message’s legitimacy based on its writing quality or appearance, you might question its intent and whether the request makes sense. No matter how professional an email or video appears, if it creates urgency, asks for secrecy or requests login credentials, it should raise concerns. This is particularly true for payment-related emails.
For example, an email that appears to be from one of your business’s suppliers may seem valid. But if it asks you to respond immediately to prevent serious consequences (such as delivery delays of urgently needed materials), instructs you to keep the contents to yourself or provides a link to a website that requires a login and password, be wary. In such cases, the prudent response is to call the supposed sender using a phone number you already have on file before replying to the email.
Apply the same caution to possible deepfakes, or AI-generated video and audio that look and sound realistic but are intended to deceive. Although you may be able to detect a deepfake by searching for video or audio glitches or other signs that it’s not real, it’s best to verify the sender rather than the media. So if a “person” on the phone or in a video conference claims to be someone you know and asks for money, confidential information or login credentials, verify the request directly with that person through another channel, ideally face-to-face.
Also be careful with potentially manipulated documents. Rather than relying on a single document to justify an action (such as authorizing a network user, changing a payer’s address or “correcting” account numbers), compare the document with previously verified records. If you still doubt the request, ask the sender for additional documentation that would be difficult for unauthorized sources to create or access on short notice.
Your organization may conduct cybersecurity awareness and other antifraud training programs to keep employees current on the latest scams. Unfortunately, given the pace of change, security training can quickly become outdated. Today, the most effective defense isn’t studying every new fraud method, which is impractical and time-consuming, but adopting certain habits.
For example, employees should:
The bottom line: Employees should follow your business’s approval procedures for payment authorizations, account updates and other requests.
Red flags haven’t completely disappeared in the age of AI. But spotting them may require a little more scrutiny (sometimes with AI-enabled apps). Make sure your workers understand this paradigm shift and adjust their behaviors accordingly. We can help with employee training, internal controls and, if you suspect fraud, an investigation.