For years, the advice for spotting a scam was simple: look for bad grammar, a strange tone or a voice that doesn't sound right. Artificial intelligence has erased most of those clues.
Criminals now use AI to write polished, personalized phishing emails, clone a person's voice from a short recording, and even stage video calls with fake versions of real executives. In its 2025 Internet Crime Report, the FBI counted about 22,000 complaints involving AI, with nearly $893 million in reported losses, the first year the report tracked AI separately.
In one widely reported 2024 case, a finance employee at the engineering firm Arup in Hong Kong joined a video call with what appeared to be the company's chief financial officer and other colleagues. Every one of them was a deepfake. The employee made 15 transfers totaling about US$25 million before the fraud was discovered.
The tools are new, but the goal is the same as every payment scam: get someone to send money or share access. The defenses that work are mostly habits, not technology.
How AI scams work
- AI-written phishing. Generative AI produces convincing, error-free emails and texts in any style, often personalized with details from your website, LinkedIn or a previous breach. The FBI has warned that criminals use AI-generated text to make social engineering and spear phishing more believable.
- Voice cloning (vishing). A few seconds of someone's voice from a video, voicemail or social media post can be enough to clone it. Criminals use cloned voices of owners, executives, vendors or family members to request urgent transfers or one-time codes.
- Deepfake video calls. Real-time video tools let criminals appear as a known executive or business partner on a video call to approve a payment or share confidential information.
- Fake identities. AI-generated photos, profiles and documents help criminals pose as vendors, job candidates or customers to get inside your business.
Most of these are new versions of business email compromise and CEO fraud: the impersonation is better, but the request is the same.
Warning signs
- An urgent request for a wire, gift cards, a bank-detail change or a login code, especially from someone senior.
- Pressure to act now, or to keep the request confidential.
- A call, voicemail or video from a familiar person who will not let you call them back, or who moves the conversation to a new app.
- A request that skips your normal approval process "just this once."
Simple habits that stop AI scams
- Verify by calling back on a number you already have. If a call, voicemail, video or email asks for money or access, hang up and call the person on a number from your own records. A cloned voice can't answer a call to the real person's phone.
- Agree on a verification phrase for money requests. For owners, executives and the people who approve payments, set a private code word or question that is never shared online. The FBI has recommended secret words or phrases to confirm identity against AI voice impersonation.
- Never approve a payment in the same channel it was requested. A request by email is confirmed by phone. A request by phone is confirmed in person or through your payment system's approval workflow.
- Keep two-person approval for wires and bank changes. One person can be fooled. Two people following a written process rarely are.
- Never share a one-time code. No legitimate caller, IT technician or executive needs your multi-factor authentication code.
- Turn on multi-factor authentication for every account. Even a perfect phishing email fails if a stolen password isn't enough to sign in. Our Microsoft 365 security guide covers the settings.
- Think about what's public. Executive videos, voicemail greetings and detailed staff lists all help criminals. You don't need to disappear online, but know that public voice and video can be used for cloning.
- Train with real examples. Show staff what AI-written phishing and cloned voices sound like, and make it clear that pausing to verify a request from the boss will never get anyone in trouble.
Where to start
Put two rules in writing this week: every request for money or access is verified by calling back on a known number, and no payment is approved in the same channel it was requested. Then set a verification phrase with everyone who can move money.
HUFF DATA SYSTEMS helps Texas businesses train staff, secure email and Microsoft 365, and build payment controls that hold up against AI-driven fraud. If you would like help putting these protections in place, talk with our team.
Sources
- Cryptocurrency and AI Scams Bilk Americans of Billions, FBI
- Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (PSA241203), FBI Internet Crime Complaint Center
- Senior U.S. Officials Impersonated in Malicious Messaging Campaign (PSA250515), FBI Internet Crime Complaint Center
- FBI Warns of Increasing Threat of Cyber Criminals Utilizing Artificial Intelligence, FBI San Francisco
- Report on the Arup deepfake video-call fraud (May 2024), Fortune