AI and the Evolution of Fraud
Artificial intelligence is an operational accelerant across the entire threat landscape. Threat actors are actively using it to automate technical attacks, writing cleaner malicious code and scanning networks for software flaws at machine speed. However, the most immediate and severe risk to an organization isn't just that AI can hack your infrastructure, it's that AI can clone your people. It strips away the traditional warning signs of fraud, like typos and clumsy phrasing, and replaces them with automated operations that look exactly like routine daily business.
Look at the $25 million heist targeting the engineering firm Arup. Fraudsters didn't crack a firewall, nor did they use a complex technical exploit. Instead, they spent months collecting public videos and webinars to harvest the exact workforce OSINT footprint we exposed in Part 1. The threat actors used that media to build highly realistic video and voice clones of the company's CFO and leadership team. By pulling a single finance worker into a video call where every other participant was an AI fabrication, the attackers completely bypassed millions of dollars in network security with a single calendar invite.
AI doesn't just write better malware; it builds better disguises. While automated tools hunt for flaws in your code, deepfakes are used to bypass those defenses entirely by tricking the humans running the system.
How the Attack Scales
The era of spotting a scam by looking for typos or broken grammar is over. While voice fraud isn't a new threat, the underlying technology has completely changed. Back in 2017, a threat actor called my grandmother pretending to be me stuck in jail and begging for bail money. Fortunately, she had the foresight to check with my parents before sending any funds. At the time, that criminal had to spend hours tracking down family phone numbers and using raw emotional panic to mask a poor voice match copied from a voicemail greeting.
Today, AI removes that entire bottleneck. Attackers no longer need to hunt for voicemail greetings or put on an emotional performance to hide a bad impersonation. A threat actor can take a thirty second audio clip from a public video, webinar, or presentation, drop it into cheap software, and instantly replicate an executive’s exact voice, tone, and speech patterns from the outside.
The true game changer here is scale. Attackers are no longer limited to running one slow, manual phone scam at a time. They can launch dozens of these highly realistic, targeted calls simultaneously. This shifts the threat from a single trick into a scalable operation, hitting organizations with realistic deception at a speed that traditional security processes simply aren't set up to handle.
The Flaw of Implied Trust
The real vulnerability here isn't a technical failure. The danger doesn't exist because deepfakes are perfect; it exists because organizations blindly assume that a video stream, an internal message, or a voice on the phone is automatic proof of identity.
The moment a financial operator or an administrator hears a familiar executive voice; they drop their guard. They assume the person on the other end is exactly who they say they are, so they push the request through without double checking. Attackers exploit this exact habit. Exploiting an employee's trust is always faster and cheaper than trying to break network encryption. If your team treats a digital appearance as automatic validation, your process is fundamentally broken.
Practical Verification Rules
Fixing this vulnerability requires strong operational logic and an architecture built around continuous verification. While having the right technical tools is essential to enforce these boundaries, organizations must first build three clear rules into their culture:
- Verify Through a Second Channel: Every major action, such as changing payment routing details or modifying system configurations, must require confirmation through a separate setup. If a request arrives via video call, it must be verified through a completely separate, prearranged channel, before anyone moves money or alters a setting. Never use the exact same communication channel that initiated the request to validate it.
- Focus on the Action, Not the Person: Train your team to evaluate requests based entirely on what is being asked, not who appears to be asking. If an executive demands an urgent, unusual transaction or an immediate security exception, the behavior itself must trigger an automatic pause and review, regardless of how familiar the voice or face seems.
- Create Offline Circuit Breakers: Insert simple, unwritten validation steps within sensitive workflows that cannot be scraped from public data or guessed by an outsider. These steps force a deliberate pause that completely disrupts the momentum of a fast-moving scam.
Strategic Governance Takeaway
As technological spoofing becomes cheaper and more accurate, relying entirely on simple visual and auditory recognition is a critical leadership blind spot. Traditional security boundaries simply aren't built for an environment where human identity can be cloned in seconds.
Resilience requires upgrading your infrastructure to actively enforce continuous verification across every workflow. If your organization's current setup allows a single unverified voice call and video conference to authorize any amount of dollars in risk, you are not managing a modern security program. You are running on luck.
Originally published on LinkedIn.
