Cybercriminals are using artificial intelligence to make familiar scams more convincing, from personalised phishing emails and cloned voices to fake job applicants who can make their way into company systems.
For years, one of the easiest ways to identify a phishing email was to look at how badly it was written. Strange grammar, spelling mistakes and awkward requests were often enough to raise suspicion. That advice hasn’t completely lost its value, but artificial intelligence is making it considerably less reliable.
A criminal can now use generative AI to write a convincing email, tailor it to a particular employee and reference details about their workplace without spending hours researching the target. The message might look like something a colleague or supplier would send on an ordinary working day. It could even sound like them if the criminal follows up with an AI-generated voice call.
Richard Ford, CTO of cybersecurity company Integrity360, says the technology is making established forms of cybercrime easier to carry out and much harder to recognise.
Phishing, impersonation and social engineering have been around for decades. What AI changes is how quickly criminals can put together a believable approach, and how many people they can target without giving themselves away through obvious mistakes.
A convincing email is easier to produce than ever
Consider how much information someone can find about an employee before making contact. LinkedIn profiles identify their employer, position and colleagues. Company websites list executives and suppliers, while social media posts can reveal conferences they’ve attended or projects they’re working on.
None of this information necessarily needs to be stolen. Much of it is publicly available, and AI can help criminals turn those details into messages that appear to come from someone the recipient knows.
A finance employee, for example, might receive an email apparently from a regular supplier, asking them to update the banking details on an invoice. The wording is professional, the names are correct and the request refers to an existing business relationship. There may be no suspicious attachment or obvious spelling mistake.
If the employee follows the instructions without independently confirming the change, the money could end up in a criminal’s account.
This type of business email compromise isn’t new, although AI can make the impersonation more convincing. The FBI’s 2025 Internet Crime Report, released in April 2026, identified phishing and spoofing among the most frequently reported forms of internet crime in the US. The report recorded nearly $21 billion in reported cyber-enabled crime losses overall, although that figure covers many different types of crime and shouldn’t be attributed to AI alone. FBI+1
Ford’s concern is that organisations still place too much faith in employees recognising fraudulent messages when the usual warning signs are becoming less dependable.
What happens when the voice sounds familiar?
An employee who receives an unusual email from their manager might reasonably decide to phone them before doing anything. That’s generally sensible advice, provided they use a trusted number rather than one supplied in the suspicious message.
AI voice cloning complicates matters because criminals can imitate someone’s speech using recordings of their voice.
A request that initially seemed suspicious over email may become more persuasive when the person on the phone sounds like the executive supposedly making it. The caller might also know enough about the company to answer basic questions, making the conversation feel genuine.
There are parallels with the WhatsApp scam in which criminals impersonate someone’s child to request money. In that case, the criminal invents an emergency and relies on the recipient acting before independently checking the story. Adding a convincing voice can make an already effective deception even more believable.
For businesses, the stakes can be considerably higher when someone is persuaded to approve a large payment, disclose confidential information or provide access to company systems.
Ford argues that organisations need verification procedures that don’t depend entirely on recognising a familiar name or voice.
That might mean requiring a second authorised employee to approve changes to supplier banking details, or contacting an executive through a previously established communication channel before processing an unusual payment.
The important part is that the verification happens independently of the original request. Calling a number included in a suspicious email doesn’t establish that the person answering is legitimate.
Criminals are also exploiting the hiring process
One of the less obvious ways criminals can get into a company is by applying for a job.
AI can help someone create a convincing CV, establish an apparently legitimate professional identity and prepare answers for interviews. Deepfake video and audio tools can also be used to disguise who is actually speaking to a recruiter.
Unlike someone trying to exploit a software vulnerability, a fraudulent applicant who successfully gets hired may eventually receive genuine employee credentials, a company laptop and permission to access internal systems.
There’s already evidence of this happening.
In January 2025, the FBI warned that North Korean IT workers were using AI and face-swapping technology during remote interviews to hide their identities. Some had obtained access to company networks and stolen sensitive information.
The FBI issued another warning on 13 October 2026, describing how North Korean operatives were using stolen identities and intermediaries to secure remote jobs at Western companies. Some of those intermediaries participated in interviews, handled company-issued equipment or helped conceal where the workers were actually based. FBI+1
These cases don’t mean that fraudulent applicants are suddenly everywhere, or that every remote interview should be treated with suspicion. They do demonstrate why recruitment has become part of the cybersecurity conversation.
Ford says HR departments, recruiters and business leaders need to share responsibility for verifying identities rather than treating it exclusively as an IT problem.
An organisation can have strong technical security and still give an attacker legitimate access if its hiring checks fail.
Employees can’t be expected to catch everything
Security awareness training has traditionally encouraged people to question suspicious links, check email addresses and report messages that seem unusual. Those habits remain important, and plenty of phishing attempts still contain recognisable warning signs.
But the assumption that a reasonably alert employee will always recognise an attack becomes difficult to defend when criminals can produce convincing messages and impersonate familiar people.
Ford believes businesses need to put more responsibility on their security processes rather than expecting employees to make the correct judgement every time.
Multi-factor authentication can make stolen passwords harder to use, although some phishing attacks can still bypass weaker forms of authentication. Limiting employees’ access to the systems they actually need can also reduce the damage if an account is compromised.
Monitoring unusual account behaviour provides another opportunity to catch an attack after someone has gained access. These measures won’t prevent every incident, but they give organisations ways to respond when an employee is deceived.
Payment verification deserves similar attention. A request to change banking details, transfer money urgently or disclose sensitive information should follow an established approval process, regardless of how convincing the email or phone call appears.
There’s also a practical issue for employees. If someone suspects a message is fraudulent, they need to know whom to contact and how to verify it without having to make a difficult judgement on their own.
The problem for businesses is that many of the things people once relied on to establish trust can now be imitated. A correctly written email, knowledge of an internal project or a familiar voice can make a request seem legitimate, but none of them proves who’s actually making it. And criminals don’t necessarily need sophisticated new attacks when AI can make the old ones work better.