When seeing and hearing are no longer believing

AI: AnyIT

What happens when the person asking you to transfer money sounds exactly like your managing director – and is speaking to you in real time?

AI is changing identity impersonation.

Criminals can now create convincing emails that copy the language and style of a director, colleague, supplier or adviser. They can use information from company websites, LinkedIn and social media to make the message personal and believable.

And it does not stop at email.

With only a short recording, perhaps taken from a webinar, podcast or social-media video, AI can clone someone’s voice. An employee could receive a telephone call that appears to come from the chief executive, asking for an urgent and confidential payment. A supplier might seemingly call to change their bank details.

The voice may sound right. The language may feel familiar. The caller may even know the names of colleagues and current projects.

Real-time deepfakes take this further.

Attackers can potentially join a video call looking and sounding like someone you know.

“I spoke to them directly” is no longer the reassurance it once was.

Pause and question

So, what should directors do?

The answer is not to expect every employee to become an AI expert. It is to make sure your processes do not depend on recognising a fake.

Significant payments, password resets and changes to bank details should always be confirmed through a second, trusted channel. Use contact details already held by the business, not those supplied in the message. Consider dual approval for payments, agreed code words for unusual requests and a clear way for employees to raise concerns.

Most importantly, give people permission to pause.

Fraudsters create urgency because urgency stops us thinking. Employees must feel able to question an instruction, even when it appears to come from the most senior person in the organisation.

Directors should also think carefully about the audio, video and business information they share publicly. It may be useful to customers and colleagues, but it can also provide the raw material for impersonation.

This is why I created ‘Quick Take Tuesdays’: short, practical briefings that cut through the noise around AI, identity and cyber risk, and focus on what leaders need to know and do.

AI has not made trust obsolete. But trust alone is no longer enough.

Verify first. Act second.

Find out more