In October, we covered phishing and why trained employees are your best early-warning system. This week, we’re answering a question that has come up in almost every conversation since: “How do we protect ourselves from AI-powered scams?”

AI hasn’t changed what scammers want. They still want money, passwords, and access. What’s changed is how convincing they can be, and how cheaply they can do it at scale.

How has AI changed phishing?

AI has removed the warning signs people relied on. Phishing emails used to be full of awkward phrasing and obvious mistakes. Now attackers use AI to write clean, natural messages that match normal business tone, and they personalize each one with details pulled from your website, LinkedIn, or earlier data breaches.

A modern phishing email might mention your real vendor by name, reference a real project, and sound exactly like the person it claims to be from. That’s why “look for typos” is no longer useful advice on its own.

What is deepfake voice fraud?

Deepfake voice fraud uses AI to copy a real person’s voice and impersonate them on a phone call or voicemail. Voice cloning now needs only a few seconds of sample audio, which attackers can often find in a company video, a podcast appearance, or a social media clip.

A typical attempt looks like this: an employee who handles payments gets a call that sounds exactly like the owner or a long-time vendor. The caller is rushed, maybe “between meetings,” and needs a wire sent, a payment detail changed, or gift cards purchased right now. The urgency is the point. It’s designed to keep you from stopping to check.

The same approach is showing up on video calls, where attackers use deepfake video to pose as executives. The scale is real: Deloitte has estimated that generative AI could enable up to $40 billion in U.S. fraud losses by 2027.

Sources: Noqta on AI security risks for small businesses, CMIT Solutions on AI phishing and deepfake voice fraud.

Can you tell if a voice is a deepfake?

Not reliably. Some cloned voices have small tells, like odd pauses or flat emotion, but the technology improves constantly and phone audio hides a lot. Building your defense around detecting fakes by ear is a losing game.

The reliable defense is a process that doesn’t depend on recognizing anyone’s voice.

How do you stop deepfake and AI-powered scams?

You stop them with verification rules that apply every time money, credentials, or sensitive data are involved, no matter who appears to be asking. If a request can’t be confirmed through a separate channel, it doesn’t happen.

The controls that matter most:

Call back on a known number. Any request to send money or change payment details gets confirmed by calling the person at a number already on file, never one provided in the message or call.
Require two people for payments. Wire transfers and new vendor payment details need approval from two people.
Agree on a verification phrase. A simple code word shared among leadership and finance staff confirms a real request.
Treat urgency as a reason to verify. Make it policy that a rushed request slows down, not speeds up.
Never change banking details by email alone. Vendor payment changes get confirmed by phone, every time.

Why does training still matter?

Training is how verification rules become habit. Your team needs to recognize what an AI-powered scam looks and sounds like, know the rules, and feel confident enforcing them, even when the request seems to come from the boss.

That last part matters. An employee needs to know that saying “I’m going to call you back to confirm” will be thanked, not punished. Owners and managers can help by telling their team they always welcome being verified.

Modern security awareness training includes examples of AI-written phishing and voice scams, and simulated phishing tests now use the same polished style attackers do.

Do cyber insurers require these controls?

Increasingly, yes. Many cyber insurance applications now ask about payment verification procedures, multi-factor authentication, and security training. Having these controls in place can make renewals smoother, and missing them can leave you exposed if a fraudulent transfer goes through.

A process beats a good ear

AI will keep making scams more convincing. A simple verification process makes that irrelevant, because no amount of realism gets past “let me call you back on the number I have.”

Let’s test your verification process

At Absolute, we do IT differently. We help East Texas businesses train their teams on AI-era scams and put simple verification rules in place that hold up under pressure. If you’d like to know how your team would handle a convincing call from “the owner,” we’ll help you find out.