I have been saying this for years: hackers do not hack systems. They hack people.
AI did not invent social engineering, but it has industrialized it.
The next successful cyberattack against your business may not begin with someone breaking through your firewall. It may begin with a perfectly written email from your CEO, a telephone call from someone who sounds exactly like your CFO or a video meeting with someone who looks and speaks like a trusted employee.
Except it is not them.
For years, we trained employees to look for spelling mistakes, suspicious links, strange email addresses and messages that did not sound quite right. Those warning signs still matter, but AI is removing many of the mistakes criminals used to make.
Attackers can research your company, identify your executives, vendors and employees, study how they communicate and build a highly personalized story. They can reference a real project, imitate someone’s writing style and create enough urgency to make an employee act before thinking.
This is not theoretical.
Microsoft recently documented an AI-assisted fraud campaign involving more than one million emails. Attackers impersonated executives, created fabricated invoices and supporting email conversations, and attempted to convince accounts payable departments to process payments of nearly $50,000.
This was not a badly written email from a supposed foreign prince. It was an entire believable story constructed to look like a legitimate business transaction.
The Canadian Centre for Cyber Security has also warned that AI-powered tools are making convincing phishing attacks more accessible to criminals who may not have advanced technical skills.
The problem is no longer whether your employees can recognize an obviously fake email.
The real question is whether your business can stop a fraudulent request that looks and sounds completely real.
How Can a Business Protect Itself From AI-Powered Fraud?
Businesses can reduce the risk of AI-powered fraud by combining independent verification, strong payment controls, current cybersecurity awareness training, phishing-resistant multi-factor authentication, restricted access, managed threat detection and a tested incident response plan.
Technology is part of the defence, but technology alone will not solve the problem.
If your finance team can transfer money based on a single email, a perfectly configured firewall will not save you. If your help desk will reset an executive’s password because the caller sounds convincing, endpoint protection will not stop it. If employees are entering confidential information into unapproved AI tools, there may be no malware for your security software to detect.
Protecting the business requires secure technology, trained employees and processes that cannot be bypassed simply because a request appears to come from someone important.
The Expera Three-Part Verification Rule
Before acting on an unusual request involving money, access or confidential information, employees should ask three questions:
- Is this request unusual?
- Could acting on it cause financial, operational, privacy or security damage?
- Has it been independently verified through a trusted channel?
If the answers are yes, yes and no, stop.
Do not send the money, disclose the information, reset the account or approve access until the request has been independently verified.
This rule is deliberately simple because employees need to remember it when they are under pressure. A security procedure that nobody can recall during a real incident is not much of a security procedure.
Here are seven ways to put that principle into practice.
1. Verify Unusual Requests Through a Second Channel
Any unexpected request involving money, credentials, confidential information or changes to an account should be verified independently.
That does not mean replying to the original email and asking whether the request is legitimate. It also does not mean calling the telephone number conveniently included in the message. If an attacker controls the original communication, they may control the contact information they provided.
Employees should use information the company already knows to be legitimate. They might call the person at a known telephone number, contact them separately through Microsoft Teams or confirm the request in person.
The second channel must genuinely be separate from the first.
The Canadian Centre for Cyber Security recommends confirming sensitive requests through a second, independent form of communication, particularly when voice cloning may be involved.
This can feel excessive when the original request appears completely legitimate. That is exactly when the process matters most. AI-powered impersonation is designed to remove the odd language and obvious mistakes that would normally make someone suspicious.
A convincing email, telephone call or video meeting should never be enough on its own to authorize a high-risk action.
2. Put Real Controls Around Payments
Fraudsters love urgency because urgency discourages people from stopping to think.
The CEO is supposedly boarding a plane and needs the wire transfer completed immediately. A trusted vendor has suddenly changed banks.
A confidential acquisition requires a deposit before the end of the day. An executive insists that nobody else can be told about the transaction.
Each detail is designed to make the employee feel that following the normal process will create a problem. In reality, the process is exactly what should prevent the problem.
Businesses need clear approval procedures for wire transfers, new vendors, changes to banking information, payroll changes and unusual purchases. Significant transactions should require approval from at least two authorized people, and all changes to payment information should be verified directly with the vendor using previously established contact details.
These rules must apply to everyone.
If an apparent email from the CEO can override the payment approval process, then the business does not really have a payment approval process.
Leaders also need to make it clear that employees will never be criticized for verifying a request. An employee should not be afraid to call the CEO and ask whether a payment is legitimate, even when it turns out to be completely real.
Five minutes of awkwardness is considerably less expensive than sending $100,000 to a criminal.
3. Stop Treating a Familiar Voice as Proof of Identity
We have trusted familiar voices for our entire lives.
If your spouse, business partner or CEO calls and you recognize their voice, your brain naturally accepts that you are speaking with that person. Until recently, that was usually a reasonable assumption.
It is no longer a safe one.
The Canadian Centre for Cyber Security warns that AI voice cloning can be used to impersonate trusted individuals, bypass voice-based authentication and support fraudulent requests.
Executives who participate in podcasts, webinars, conferences, online meetings or social media videos may already have plenty of usable audio available publicly. Deepfake video is also becoming more convincing, which means that even seeing someone on a video call should not automatically authorize a wire transfer, disclosure of confidential information or reset of a critical account.
This does not mean employees should become paranoid every time the telephone rings. It means voice and video can no longer be treated as definitive proof of identity when the request carries significant risk.
Businesses should decide how high-risk requests will be verified before an incident occurs. This might include a known callback procedure, confirmation from a second authorized person, a secure internal workflow or a prearranged verification method that cannot easily be discovered through social media.
A familiar voice may start the conversation. It should not complete the transaction.
4. Train Employees for the Attacks Happening Now
If your cybersecurity awareness training still focuses mainly on bad spelling and suspicious attachments, it is teaching employees to recognize yesterday’s attacks.
Employees need to see realistic examples of executive impersonation, AI-generated phishing, cloned voices, fake vendor requests, fraudulent banking changes, Microsoft 365 credential theft and deepfake video.
The training must also go beyond identifying suspicious messages. Employees need to know what to do when they receive one.
Who should they contact? How should they verify the request? What should happen if the person becomes aggressive or claims the matter is confidential? What if the request appears to come from the owner or CEO?
Attackers understand organizational hierarchy. They know that many employees are uncomfortable questioning senior executives, particularly when the request appears urgent or sensitive.
Leaders need to remove that hesitation by giving employees both permission and an obligation to verify unusual requests.
Effective cybersecurity awareness training should include ongoing education, realistic phishing simulations, clear reporting procedures and visible support from leadership.
The objective is not to embarrass employees who make mistakes or celebrate a perfect phishing-test score. It is to help people make better decisions when a real attack arrives and the answer is not obvious.
5. Strengthen Identity Security and Multi-Factor Authentication
A convincing story may persuade an employee to disclose a password, but the attacker still needs a way into the system.
Multi-factor authentication can prevent a stolen password from immediately becoming a compromised account. However, not all MFA methods provide the same level of protection.
Text messages can be intercepted. Employees can accidentally approve fraudulent push notifications. Sophisticated phishing sites can capture passwords and authentication codes in real time.
For critical systems and high-risk users, businesses should move toward phishing-resistant authentication such as FIDO2 security keys, passkeys or certificate-based authentication.
Conditional Access policies can provide another layer of defence by evaluating the identity, device, location and level of risk before granting access. Administrative accounts should receive particularly strong protection because compromising one can give an attacker control over a much larger portion of the environment.
At a minimum, MFA should be required for email, Microsoft 365, remote access, financial systems, administrative accounts and platforms containing sensitive business information.
The Canadian Centre for Cyber Security includes strong identity verification, phishing-resistant MFA and out-of-band verification among its recommended actions for defending against AI-enabled impersonation.
A capable Managed Service Provider can help configure these controls correctly, apply them consistently and monitor the environment so that security does not gradually weaken as employees, devices and applications change.
6. Limit the Damage One Compromised Account Can Cause
No cybersecurity program can guarantee that nobody will ever click a malicious link, approve the wrong request or expose a password.
The next question is how much damage the attacker can cause when that happens.
If every employee can access everything, one compromised account can quickly become a company-wide incident. Employees should have access to the systems, files and information required for their roles, but they should not retain access they no longer need.
Administrative privileges should be tightly controlled. User permissions should be reviewed regularly. Access should be changed when an employee moves into a different role and removed immediately when someone leaves the company.
This becomes even more important as businesses adopt AI.
Employees are connecting AI tools to email, Microsoft Teams, SharePoint, customer information and internal documents. If an AI application has excessive access, it may be able to retrieve, summarize or expose information the employee should never have been able to see.
Before connecting AI to company data, businesses need to understand what the tool can access, where the information is processed, what the provider retains and what actions the AI is allowed to perform.
A secure AI adoption strategy should include approved tools, data governance, access controls, employee education, an AI policy and a process for assessing new platforms.
The goal is not to stop people from using AI. That would be unrealistic and would put the company at a competitive disadvantage. The goal is to make AI useful without turning it into an uncontrolled doorway into the business.
7. Make Reporting Easy and Practise the Response
The first few minutes after a cybersecurity mistake can make an enormous difference.
Unfortunately, employees sometimes hesitate to report an incident because they feel embarrassed, are afraid of getting in trouble or hope that nothing will happen. That hesitation gives the attacker more time.
Employees need to know exactly who to contact if something feels wrong. They also need clear instructions for what to do if they have already clicked a link, entered a password, approved an MFA request, shared information or authorized a payment.
Depending on the organization, the reporting process might involve a manager, finance, internal IT or the managed cybersecurity services team.
Leadership must create a culture in which immediate reporting is expected and supported. We can usually respond to a mistake if we know about it quickly. It becomes much harder to contain after an attacker has spent several hours inside an account or a fraudulent payment has moved through multiple banks.
Businesses also need a tested incident response plan. It should define who has authority to make decisions, how compromised accounts will be contained, when the bank, cyber insurer and legal counsel will be contacted, and how the business will continue operating during an investigation.
A plan that exists only in a document is not enough. It needs to be tested through a practical tabletop exercise before a real incident occurs.
Take the Expera AI-Powered Fraud Readiness Check
Ask your leadership, finance and IT teams these seven questions:
- Do employees independently verify unusual requests involving money, access or confidential information?
- Do significant payments and banking changes require approval from two authorized people?
- Do employees understand that a familiar voice or video is no longer proof of identity?
- Does cybersecurity training include AI-generated phishing, voice cloning and executive impersonation?
- Are critical systems protected with strong MFA and Conditional Access?
- Do employees and AI tools have only the access they genuinely require?
- Has the organization tested its response to an AI-powered fraud scenario within the past year?
Every “no” represents a gap that an attacker may be able to exploit.
This quick check is not a replacement for a formal cybersecurity or AI risk assessment, but it is a useful place to begin the conversation.
How Expera IT Helps Businesses Manage AI Fraud Risk
After 30 years of helping Canadian businesses use technology securely, I have learned that cybersecurity failures are rarely caused by one missing product.
They usually occur because technology, people and business processes are not working together.
As a Managed Service Provider, Expera IT helps businesses secure and manage Microsoft 365, identities, devices, cloud systems, backups and the technology employees rely on every day.
As a Managed Security Service Provider, we provide layered cybersecurity, employee awareness education, threat monitoring, vulnerability management, reporting and incident response support.
Our AI adoption services help organizations identify valuable AI use cases while putting appropriate controls around company data, employee access and approved platforms.
Our Compliance as a Service, vCIO advisory and vCSO services help leadership connect technology, cybersecurity, compliance and AI risk to the broader goals of the business.
The objective is not to sell another security product or another AI licence. It is to build a business that can use AI productively without becoming easier to deceive.
Would Your Business Stop a Convincing Fake?
Imagine that someone in finance receives a telephone call from the CEO requesting an urgent $75,000 wire transfer.
The caller knows the customer’s name. The amount makes sense. The explanation is believable, and the voice sounds exactly like the CEO.
What happens next?
If the answer depends entirely on whether the employee becomes suspicious, the business is relying on instinct when it should be relying on process.
The real question is no longer, “Would our employees recognize a phishing email?”
It is, “Would our controls stop a convincing fake?”
AI has changed what fraud looks and sounds like. Your cybersecurity strategy, employee training and approval processes need to change with it.
Contact Expera IT to discuss an AI risk assessment, cybersecurity review or managed services strategy for your organization.
