The most reliable clue has just disappeared
For a long time, staff were taught to spot a scam by its flaws. An email riddled with spelling mistakes, an awkward greeting, a pixelated logo, an unlikely sender address: so many signals that betrayed the fraud and let people foil it at a glance. That era is coming to an end. With generative AI tools available to everyone, a fraudster can now produce a perfectly written message in seconds, in flawless English or any other language, in a tone tailored exactly to the target.
The change runs deeper than it seems. It is not only the typos that disappear, it is the whole mental reference point on which staff vigilance relied. An employee used to distrusting badly written messages naturally lowers their guard in front of an impeccable email. And that is precisely what attackers exploit: the trust that a polished text inspires.
What AI has put within reach of any fraudster
Artificial intelligence did not invent phishing, it industrialised it and made it credible. Writing a thousand personalised emails, each tailored to the recipient's role and sector, no longer takes a team or hours of work. Campaigns that once looked amateurish gain in volume and precision, targeting an accountant by name about a pending invoice or a manager about a file that is genuinely in progress.
Text is only the visible part. A voice can now be cloned from a few seconds of recording, easy to pick up from an online video or a voicemail. A phone call in which you think you recognise your managing director, with their tone and intonation, is no longer science fiction. The same techniques extend to video, opening the way to faked video calls where the other party does not exist.
The most troubling aspect is how accessible these tools are. These are no longer capabilities reserved for specialist services, but consumer apps, sometimes free, that a fraudster with no particular technical skill can pick up in minutes. This commoditisation explains the surge in attempts: the entry cost of launching a credible attack has collapsed, while the potential gain has not moved. The whole difficulty has shifted from the attacker, who barely has to make any effort, to the victim, who is left with nothing but their judgement to decide.
CEO fraud reaches a new dimension
So-called CEO fraud illustrates this leap well. The principle is old: a fraudster poses as a senior manager and asks an employee for an urgent, confidential bank transfer, playing on authority and time pressure. What has changed is the degree of realism. Where the attack once relied on a simple email, it can now draw on a cloned voice on the phone, or even a short video call, to remove the victim's last doubts.
The psychological effect is formidable. An employee can be trained never to approve a transfer on the strength of an email alone, yet will hesitate to contradict what they believe is their director on the line, insistent and in a hurry. The manipulation does not target a technical flaw, it targets the human reflex of obeying a recognised authority.
The main AI-boosted attacks:
Personalised phishing email: perfect text, tailored tone and context; aimed at stealing credentials or delivering a malicious attachment.
Voice cloning: a credible voice from a few seconds of audio; aimed at transfer fraud or fake support calls.
Faked video call: face and voice simulated in real time; aimed at getting a fraudulent request approved.
Fake text and messaging app messages: high volume, credible links; aimed at sending the victim to a fake sign-in page.
Small businesses have become prime targets
These attacks are often thought to be reserved for large groups, the only ones rich enough to attract sophisticated fraudsters. The opposite is happening. Large companies have invested in security teams, strict procedures and detection tools, which makes them expensive to attack. A small or medium-sized business rarely has these defences, while handling sums large enough to justify the effort. It offers the best ratio between expected gain and difficulty.
The automation that AI enables has finished shifting the target. Since producing a thousand targeted messages costs almost nothing, attackers cast a wide net and hit modest organisations en masse, where a single diverted transfer is already a fine catch. The head of a ten- or twenty-person company who believes it is too small to interest anyone is mistaken about precisely what makes it a target: its size, and the lack of safeguards that size suggests.
Why technology is no longer enough
Against these threats, technical defences remain essential but show their limits. A good spam filter blocks some of the messages, strong authentication such as passkeys and phishing-resistant MFA makes account theft harder, and proper monitoring spots some abnormal behaviour. These layers are necessary, and it would be unwise to do without them.
But none of them protects against the scenario in which an employee, convinced they are doing the right thing, carries out the requested action themselves: they enter their credentials on a credible page, approve a transfer requested by a familiar voice, open an expected document. Technology filters the noise; it does not replace discernment at the decisive moment. And that moment is exactly what AI-boosted attacks try to trap.
Awareness, the only defence that adapts
That leaves the link fraudsters target first and too many organisations neglect: people. An aware team is not recognised by its ability to spot spelling mistakes, a reflex that is now useless, but by its verification habits. Calling someone back on a known number rather than the one they give, applying a dual-approval procedure to any unusual transfer, daring to take time to doubt despite the pressure: these are the reflexes that hold when the message is perfect.
This culture is not built with an annual memo. It grows through regular reminders, realistic simulations and a setting where reporting a doubt is valued rather than mocked. That is the whole purpose of our cybersecurity awareness training, designed for teams who are not IT specialists and yet must decide, on their own, when faced with a credible request.
A few simple rules already make a difference. State that no transfer or change of bank details is approved without a cross-check through a channel different from the one the request came through. Agree that an employee always has the right to take time to check, even under apparent urgency, without fear of looking slow or suspicious. Name a clear contact to whom the slightest doubt can be escalated, and treat every report as a useful contribution rather than a false alarm. These reflexes require no hardware budget, but they only take root if they are stated, repeated and visibly backed by management.
An awareness programme also fits naturally into a wider risk assessment, such as the one offered by our Security Audit package. To take stock of your teams' real exposure, contact us.
Sources: Cybermalveillance.gouv.fr, what to do about phishing · Cybermalveillance.gouv.fr, fake transfer orders and CEO fraud
