Your phone rings. It’s your CEO’s voice, a little rushed: a vendor needs to be paid today, and they’ll explain later. A few years ago that call was easy to trust. Today, it might not be your CEO at all.
AI tools have made it cheap and fast for criminals to write convincing phishing emails and to clone a person’s voice, or even their face on a video call, from a few minutes of public audio or video. Small and medium-sized businesses are a favorite target because they often move money quickly and don’t have a dedicated security team.
What’s changed
- Phishing emails no longer look fake. The old red flags, bad grammar and awkward wording, are disappearing. AI writes clean, personalized messages that reference real names, projects and vendors.
- Voices can be cloned. The FBI has warned that criminals use AI voice and video cloning to impersonate people victims trust, like coworkers, business partners and family members, to get payments or sensitive information.
- Video calls can be faked. In a widely reported 2024 case, an employee at engineering firm Arup transferred about $25 million after a video call in which the “executives” were deepfakes.
Why it matters for your business
According to the FBI’s 2025 Internet Crime Report, Americans reported nearly $21 billion in cyber-enabled crime losses last year, up 26% from 2024. Business email compromise alone cost more than $3 billion, and the FBI tracked over $30 million in business email compromise losses with a confirmed AI connection. That last number is still small, but it’s the one to watch.
6 practical ways to protect your team
- Verify with a call-back. Any request to move money, change bank details or share credentials gets confirmed using a phone number you already have on file, never one from the email or the call itself.
- Use a two-person rule for payments. No single person should be able to approve and send a large or unusual payment.
- Create a code word. Leadership and finance can agree on a simple verbal passphrase for urgent requests. A deepfake won’t know it.
- Turn on multi-factor authentication everywhere. Even if a password gets phished, MFA stops most attackers from getting in.
- Filter before it reaches the inbox. Modern email security tools catch a large share of phishing and impersonation attempts before employees ever see them.
- Train your people regularly. Short, ongoing training and realistic phishing simulations build the habit of pausing when something feels urgent or unusual.
The bottom line
Urgency is the attacker’s best tool. The good news is that a few simple habits, like slowing down and verifying through a second channel, beat even very convincing AI fakes. Technology helps, but process and awareness are what stop the money from leaving your account.
Not sure how prepared your team is? UGT-Group LLC helps growing businesses put the right email security, MFA, payment controls and employee training in place. Start a conversation or call us at (508) 615-6334.
Sources: FBI Internet Crime Complaint Center (IC3) 2025 Internet Crime Report; FBI San Francisco public warning on AI-enabled phishing and voice/video cloning (May 2024).