AI-powered attacks: deepfakes, AI phishing and automation
In short: AI makes social engineering cheaper and more convincing: fluent phishing emails, cloned voices and fake video calls. The defences are mostly process: verify requests through a separate channel, require two people for payments, and use phishing-resistant MFA. Awareness training must now cover fakes that look and sound real.
What changes when attackers use AI
Most AI-powered attacks are not new kinds of attack. They are familiar techniques, such as social engineering, phishing and fraud, made faster and more believable. Old advice like "look for spelling mistakes" no longer works, because generative tools write fluent text in many languages. Attackers can also research targets quickly from public profiles and produce personalised messages for hundreds of people at once.
Deepfakes and voice cloning
A deepfake is synthetic audio, image or video that imitates a real person. Voice cloning can work from fairly short recordings, and conference talks, podcasts and social media videos provide plenty of material. Typical scams include:
- A "CEO" phone call asking finance to make an urgent, confidential transfer.
- A video meeting where some or all participants are fakes, used to approve a payment.
- A "family member" voice message asking for money in an emergency.
- A help desk call using a cloned voice to request a password or MFA reset.
Detection tools for synthetic media exist, but they are not reliable enough to be your only defence. Fakes improve quickly, and calls are often low quality anyway. Design processes that stay safe even if a fake is perfect.
Defences that work
| Threat | Process control | Technical control |
|---|---|---|
| AI-written phishing | Report button and fast triage | Email authentication (SPF, DKIM, DMARC), link and attachment sandboxing |
| Credential theft | Never share codes or approve unexpected prompts | Phishing-resistant MFA such as FIDO2 passkeys |
| Voice or video fraud | Call back on a known number; two-person approval for payments | Payment limits, alerts on new beneficiaries |
| Help desk impersonation | Strict identity checks before resets; no exceptions for "senior" callers | Self-service reset with strong verification, logging of resets |
Tip: agree a private verification phrase or question within teams that handle money, so staff can challenge a convincing caller without awkwardness.
Training and culture
Update awareness training to show realistic examples of fluent phishing and synthetic voices, and stress the behaviours that defeat them: slow down when pressured, verify out of band, and report quickly. Make it safe for staff to challenge senior people, because attackers rely on hierarchy and urgency. When you run phishing simulations, follow your organisation’s policy and get approval; never clone a real colleague’s voice for testing without their written consent.
For exams, link these attacks to familiar categories: business email compromise, vishing (voice phishing), pretexting and impersonation. The controls are the same families you already know, strengthened for more convincing lures.
Practice
Why is "look for poor grammar" weak phishing advice today?
A caller who sounds exactly like the finance director asks for an urgent transfer. What should staff do?
Which MFA type best resists AI-assisted phishing sites?
Key takeaways
- AI makes existing social engineering faster, more fluent and more personal.
- Voice and video can be faked, so they are not proof of identity.
- Out-of-band callback and two-person approval stop most payment fraud.
- Phishing-resistant MFA limits the value of stolen credentials.
- Train people to slow down, verify and report without fear.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.