Webbit
AI Phishing and Deepfake Fraud: How to Protect Your Business in 2027
AI has made phishing and impersonation far more convincing. The red flags, a real case and the payment controls that stop the damage.
A finance assistant gets a message from the managing director, then a short call. The voice sounds right and the request is urgent: a confidential payment to a new supplier, today. Many businesses will face a version of this in 2027, and the person on the other end may not be a person at all.
What changed
Phishing used to give itself away through clumsy wording. Generative AI fixes the wording, translates it cleanly and tailors each message from public information such as LinkedIn profiles and company news. Voice cloning needs only a short clip, and video tools can imitate a face live on a call. The FBI's Internet Crime Complaint Center reported more than 22,000 complaints that referenced AI in 2025, with losses of about USD 893 million, as covered by iTnews. Analysts note that this is a floor, because victims often can't tell whether AI was used.
A real case: Arup, 2024
In early 2024 the engineering firm Arup confirmed that an employee in Hong Kong was tricked into transferring about USD 25 million after joining a video call in which colleagues, including a senior officer, were deepfaked. The widely reported case shows how a believable face and voice can override normal caution, particularly when a request is urgent and confidential.
Red flags that still hold
- Urgency and secrecy together: "pay now, and don't tell anyone."
- A change of bank details, or a first payment to a new supplier.
- A request that bypasses your normal approval route.
- A message that arrives from a new number, a personal email or an unusual channel.
- Pressure to stay on the line or on the call while you act.
Don't rely on spotting visual glitches or odd audio. They're becoming rarer, and a rushed person may not notice them anyway. Treat the process as your defence.
Controls that work
| Attack | Typical sign | Control |
|---|
| Fake invoice or changed bank details | A supplier "has a new account" | Confirm by calling a number you already hold, never one in the email |
| Boss impersonation | Urgent, confidential payment request | Two-person approval above a set amount, with no exceptions for seniority |
| Voice clone call | Familiar voice, odd request | A family-style code word for sensitive requests, and a call-back on a known number |
| Deepfake video call | Unscheduled call, unusual ask | End the call, and verify through a separate channel |
| Spoofed email from your domain | Looks like it came from you | SPF, DKIM and DMARC set to reject |
A simple payment rule for finance teams
- Any new payee or changed bank detail is verified by phone using a number from your records.
- Payments above an agreed limit need a second approver who isn't the requester.
- Nobody can override the rule, including senior leaders. Write that into the policy so it isn't personal.
- Anyone can pause a payment to check, with no penalty if it turns out to be genuine.
- Log every verification so you can show what happened.
Make it easy to say no. Fraud works on social pressure. A rule everyone knows, and a manager who thanks people for checking, gives staff the cover to stop a payment without feeling rude.
Train for the new reality
Run a short session using real examples, including a cloned-voice clip if you can arrange one safely. Show how little audio is needed. Then practise the call-back step in a drill so it feels normal. Also review what the public can find about you: leaders' voices on podcasts and videos, staff names on LinkedIn, supplier lists on your website. You can't remove it all, but you can avoid publishing bank details or payment routines.
Don't forget your own automation
If you use AI chat or voice agents, attackers can also try to trick them into revealing information or taking an action. Our guide to AI agent security covers how to limit what an agent can do. For wider planning, see the 2027 cybersecurity trends and our small business checklist.
Three modern attacks (illustrative)
These scenarios are invented, but each follows a pattern reported in real cases.
The supplier switch. An accounts clerk receives an email, perfectly written in the supplier's usual tone, asking to update bank details before the next payment run. The attached letter looks genuine. The only sign is that the reply-to address differs by one character. A call to the number on file settles it in two minutes.
The urgent voice note. A founder's assistant gets a voice message that sounds exactly like the founder, asking for gift cards or a rushed transfer while they're "in a meeting". The clip was cloned from a conference talk. The rule, "no payment on a voice note alone", stops it.
The fake recruiter. A staff member gets a friendly message about a job, followed by a request to open a document or sign in to a portal. The portal is a copy of your single sign-on page. Multi-factor sign-in with a passkey or authenticator app makes the stolen password far less useful.
Set up email authentication
- Publish an SPF record that lists the services allowed to send mail for your domain.
- Turn on DKIM signing in your email provider so messages carry a verifiable signature.
- Publish a DMARC record. Start in monitoring mode, read the reports for a few weeks and fix any legitimate senders that fail.
- Move DMARC to quarantine, then to reject, once the reports are clean.
- Register look-alike domains if your brand is a frequent target, and watch for new ones.
A thirty-minute staff drill
- Show three real examples of fraudulent messages, including a cloned-voice clip if you can arrange one safely.
- Walk through the payment rule and who can approve what.
- Run a role-play: a "manager" calls the finance desk with an urgent request, and the person practises the call-back.
- Ask the group what would make it hard to follow the rule, and fix that.
- Repeat twice a year with new examples.
If a fake of your leader appears online
- Capture screenshots and links, then report the content to the platform using its impersonation process.
- Warn staff, customers and suppliers through your normal channels, saying clearly what the real route for requests is.
- Tell your bank and your key suppliers, so they know to verify requests.
- Consider a police report if money or personal data was targeted.
Put the controls in place before the call comes
Webbit helps businesses set up email authentication, tighten account access and write payment-verification rules that people will follow. If you want a plain-language review of where fraud could get through at your firm, book a free consultation. You can also see how our cybersecurity services work.
Frequently asked questions
Can deepfakes really fool people on a live call?
Yes. The Arup case in 2024 involved a video call where several colleagues were deepfaked. Treat any urgent, unusual payment request as unverified until you've confirmed it through a separate channel.
Are there tools that detect deepfakes?
Some exist, but none is reliable enough to be your only defence. A process that verifies the request through a known channel works regardless of how good the fake is.
What is DMARC and why does it matter?
DMARC tells receiving mail servers what to do with messages that claim to be from your domain but fail checks. Set to reject, it makes it much harder for criminals to send convincing email as you.
What should we do if we paid a fraudster?
Call your bank immediately and ask for a recall, then report to the police or your national cybercrime agency. Speed matters, because recovery chances fall quickly.
Home · Blog · Book a Free Consultation