AI-Made Phishing and Deepfakes: Warning Signs and How to Stay Protected

The company accountant receives a voice message in the CEO’s voice: “I’m in a meeting, transfer this amount to this account right away, I’ll explain later.” The voice, the tone, even the favorite phrases are familiar. For years we told employees to spot fake emails by their spelling mistakes and clumsy wording, but AI has erased those signs. Today text, voice and even video can be faked at low cost, so protection must rely on process, not just on spotting fakes by eye.

What are phishing and deepfakes?

Phishing means tricking a person with a fake message into clicking a link, entering a password, opening a file or making a payment. A deepfake is audio, an image or a video created or altered with AI to resemble a real person. To build a fake voice, an attacker sometimes needs only a few short samples of the real voice, for example from public videos or earlier voice messages.

What has AI changed?

• Email and message text is written flawlessly, formally and tailored to the recipient’s role.
• An attacker can use public company information to craft a personalized message that refers to a real project or person.
• Voice messages or calls in the faked voice of a manager or customer are now possible.
• Mass production of varied messages has made the job of simple filters harder.

Signs that still work

• Urgency and pressure: “right now,” “don’t tell anyone,” “I’m in a meeting, don’t call.”
• Unusual requests: payment to a new account, changing a supplier’s bank details, sending a password or verification code.
• Unusual channel: a manager who always emails is suddenly messaging from an unknown number.
• Suspicious sender address or link: a domain resembling the real one with one letter different.
• Small flaws in voice and video: unnatural pauses, flat tone, lips out of sync; though these signs are fading and should not be relied on alone.

The golden rule: always confirm a request for money, passwords or sensitive information through a second, independent channel; call a number you already have, not the one given in the message.

How to protect the company

1. Two-person payment process: every payment or bank detail change requires approval by a second person and a call back to the number on file.
2. Internal code word: for urgent requests from managers, agree on a phrase that only authorized people know.
3. Two-factor authentication: even if someone’s password leaks, two-factor authentication blocks much of the misuse. Never send a verification code to anyone.
4. Email authentication settings: configure your company domain’s SPF, DKIM and DMARC records correctly so spoofing your domain is harder and fewer fake emails reach inboxes.
5. Training with fresh examples: show employees what new scams look like and run simulated exercises.
6. Blame-free reporting: an employee who clicked a link should report it immediately without fear; the first minutes are the most important for containing an incident.

Checklist

• No payment is made based on a single message or call.
• Confirmation through a second channel using a number on file is standard company practice.
• Two-factor authentication is enabled for email and key systems.
• The domain’s SPF, DKIM and DMARC records have been checked.
• Employees know the signs of phishing and deepfakes.
• There is a clear, fast way to report a suspicious message.

Smart scams are defeated by simple, consistent processes. ITPlus724 engineers can review and configure your business email security, domain authentication records and two-factor authentication for your company’s systems.