Artificial intelligence is helping cybercriminals create convincing phishing emails, cloned voices, false invoices, and fraudulent payment requests at scale. Organizations can reduce exposure by strengthening MFA and email controls, independently verifying financial transactions, and promptly reporting suspicious activity.
The financial consequences are significant. Social-engineering frauds resulted in more than $3 billion in reported losses in 2025 [i], including nearly US$893 million attributed to AI-enabled fraud.[ii]
AI-generated attacks can convincingly imitate trusted colleagues, executives, vendors, or customers. For utilities and critical infrastructure organizations, these campaigns may target payment changes, wire transfers, financial approvals, and sensitive operational information.
The Risk in Practice: Business Email Compromise
Business Email Compromise (BEC) is one of the clearest examples of how AI can turn a familiar scam into a credible and costly business event.
A typical attack may unfold as follows:
- An employee receives a message that appears to come from a senior executive.
- The message requests an urgent wire transfer, payment, or change to banking information.
- References to real projects, vendors, or transactions make the request appear legitimate.
- Polished, AI-generated language removes many of the warning signs employees have been trained to recognize.
- Under pressure to respond quickly, the employee completes the request without independently verifying its authenticity.
Attackers may reinforce the deception with an AI-generated voice message or deepfake communication, creating a greater sense of urgency and adding another layer of apparent legitimacy.
By the time the deception is uncovered, funds may already be difficult, if not impossible, to recover.
Five Practical Ways to Reduce the Risk
No single safeguard can stop every attack. The strongest defence combines technology, independent verification, informed employees, and prompt reporting allowing one control to identify what another may miss.
1. Strengthen Multi-Factor Authentication (MFA)
MFA remains an essential security control, but it is fallible. Attackers now employ techniques such as session hijacking, authentication-token theft, and consent phishing to bypass or exploit traditional MFA methods.
Members should consider the following actions:
-
- Require MFA for all users and all remote access.
- Implement phishing-resistant MFA methods wherever available.
- Disable legacy authentication protocols.
- Review and restrict weak recovery or fallback options.
- Monitor for unusual sign-in activity, repeated authentication prompts, and other authentication anomalies.
MFA should be treated as a strong foundation—not a complete defence.
2. Verify Financial Transactions Independently
No payment, banking change, or financial instruction should be processed solely based on email instructions.
Recommended actions:
- Require verbal confirmation using trusted contact information already on file.
- Implement dual approval processes for wire transfers and electronic payments.
- Independently verify changes to vendor banking information.
- Establish documented call-back procedures.
- Train staff to question unusual or urgent requests.
A simple verification call can help prevent a significant financial loss.
3. Enhance Email Security Controls
Email remains the primary delivery method for phishing attacks. Microsoft’s April 2026 analysis of an
AI-enabled device-code phishing campaign [iii] illustrates how sophisticated these attacks have become. Attackers used AI-generated, role-specific messages and automated tools to guide users through legitimate Microsoft authentication processes, obtain access tokens, and identify higher-value accounts. They also created malicious inbox rules to conceal their activity. The campaign demonstrates why organizations need layered email and identity controls, including phishing-resistant MFA, monitoring for unusual sign-ins, and regular review of mailbox rules.
Organizations should:
- Implement robust email filtering and threat protection.
- Block malicious domains and known phishing indicators.
- Configure DMARC, SPF, and DKIM protections.
- Regularly review mailbox forwarding rules.
- Monitor for suspicious login activity and inbox manipulation.
- Conduct periodic phishing simulations and awareness campaigns.
Technical controls can help reduce risk before malicious messages reach users.
4. Reinforce Staff Awareness
Employees remain a critical line of defence.
Training should focus on:
- Recognizing AI-crafted phishing attempts.
- Identifying requests involving money transfers or credential collection.
- Understanding social engineering tactics.
- Recognizing voice-cloning and deepfake risks.
- Following verification procedures, even when messages appear legitimate.
Staff should understand that questioning unusual requests is both encouraged and supported by management.
5. Promote Rapid Reporting
The speed of reporting often determines whether a phishing incident escalates into a major breach or remains a minor security event.
Employees should immediately report any suspicious emails to their IT department in accordance with internal incident response procedures. This includes unexpected multi-factor authentication (MFA) prompts, requests for credentials, unusual payment or banking instructions, suspected account compromises, or any other activity that appears unauthorized or potentially malicious.
Early reporting enables IT and cybersecurity teams to disable compromised accounts, revoke active sessions, block malicious domains, preserve evidence, and help limit financial or operational impacts.
MEARIE’s cyber response guidance emphasizes that early notification and evidence preservation can improve incident response and reduce downstream impacts.
Conclusion
AI-powered phishing is becoming increasingly convincing, personalized, and difficult to detect. Members can substantially reduce their exposure by reinforcing five connected practices:
- Require strong, phishing-resistant MFA.
- Verify financial transactions through independent channels.
- Maintain robust email security controls.
- Reinforce staff awareness and support employees who question unusual requests.
- Report suspicious activity immediately.
Members should review these controls regularly and use the NetDiligence eRiskHub resources available through The MEARIE Portal to support staff education, payment-verification procedures, control assessments, and incident response exercises. A brief review today can prevent a routine-looking request from becoming a significant financial or operational event.
[i] Federal Bureau of Investigation. (2026). Internet Crime Report 2025. Internet Crime Complaint Center (IC3). U.S. Department of Justice. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
[ii] BitsFromBytes Research. (2026, May 27). Phishing statistics 2026: Email, SMS & social attack data. BitsFromBytes. https://bitsfrombytes.com/phishing-statistics-2026-all-datas-informations/
[iii] Microsoft Defender Security Research Team. (2026, April 6). Inside an AI-enabled device code phishing campaign. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/
At The MEARIE Group, we remain committed to providing the most up-to-date insights on risk management and industry best practices. Should you have any questions or require further information, please do not hesitate to reach out.
