For years, IT departments trained employees to spot a phishing scam using a simple checklist: look for bad grammar, check the sender’s email address for slight misspellings and never click suspicious links.
For a long time, that advice worked.
But in the last two years, generative AI has completely rewritten the rules of cyber warfare. Today, the grammatical errors are gone. The links are often legitimate platforms hijacked by attackers. And most terrifyingly, the scam might not come as an email at all — it might be a phone call that sounds exactly like you.
The evolving tactics of scammers
In the past, phishing was a numbers game. Scammers sent out millions of generic emails hoping a fraction of a percent of recipients would click.
Now, instead of a generic "Invoice Attached" message, modern attackers will scrape LinkedIn, public company directories, websites, email signatures and past data breaches to map your organization’s hierarchy. They will use AI to write a plausible-sounding email from an employee with authority, like the CEO or the controller, to someone in accounts payable, mimicking that employee’s writing style. And they will make a request to change a direct deposit account or to send a payment via a new method.
Sometimes it can go even farther; given a small sample of audio or video, AI tools can generate realistic sounding fake audio and use it in a phone call to back up the email they just forged or even send a video message.
These tactics are also often combined with actual breaches to an internal account, so the emails and Teams calls are actually coming from an executive’s account, like the movie says, the call is coming from inside the house.
Defense in depth
The good news is that there are technical defenses that can help. In particular, real-time monitoring can be implemented for cloud communications accounts like Microsoft and Google to help detect unauthorized access.
But technology can only take you so far, like phishing scams going back ages, this is a people problem. Instead, other solutions should be implemented.
For one, any kind of payment changes should require multiple forms of communication. If you receive an email requesting a wire change, then the policy should be to call the requesting user on a known, trusted phone number and verify the request is genuine. Keep in mind that now some forms of communication are enjoined; if your phone lines run through Teams, that’s the same account as your Microsoft 365 mail, and a scammer might control both, so call a cell phone instead.
It sounds like spy movie stuff, but secret verbal handshakes, like safe words, are a good idea as well. You can have a literal code word like a spy movie or simply instruct your employees to be suspicious and ask questions to verify the person they’re talking to is really the person they claim to be. If you know the caller personally, ask about their kids, or talk about something from the past they should know about as a form of subtle interrogation and identity verification.
Two sets of eyes and ears is also better than one; implement a multi-person approval process for wires or changes to payroll or other forms of monetary transactions. Your employees can back each other up and act as sanity checks, and it’s much harder to fool two people than it is to pressure one overworked employee.
And of course, you can always meet in person for the most important things. Generative AI has yet to figure out how to fake a handshake.
Prepare for more
With the rapid development of generative AI toolsets, this problem is going to get worse before it gets better. It is already possible for scammers to use AI to generate live video and audio impersonating people, which means you might be having a Zoom call with a scammer and not know it. Money is almost always the goal, but people, not computers, are the target. Constant vigilance will be the price we all pay to keep ourselves safe.
For more information, visit netsurit.com.
