AI powered fraud and deepfakes require stronger verification controls from SMEs as convincing messages, cloned voices and synthetic video make familiar business requests harder to trust.
The latest Europol cybercrime threat assessment warns that criminals are using generative AI to strengthen social-engineering attacks, tailor scam messages and deploy AI-generated deepfakes. For small and medium-sized enterprises (SMEs), this changes a familiar risk rather than creating an entirely new one: fraudsters still try to obtain money, credentials or confidential information, but they can now imitate trusted people more convincingly and at greater scale.
An urgent payment request may appear to come from a director, a voice message may resemble a known supplier and a video call may seem to confirm an unusual instruction. Visual or verbal familiarity is therefore no longer sufficient evidence of identity. Businesses need verification processes that remain reliable even when an attacker can reproduce a person’s writing style, voice or appearance.
Generative AI makes social engineering more convincing and easier to scale.
Traditional phishing often revealed itself through poor grammar, generic wording or an unfamiliar tone. Generative AI can remove many of those warning signs. Attackers can adapt a message to the target’s role, language and business context, while information taken from websites, social media or earlier data breaches can make the approach appear credible.
Deepfake audio and video add another layer of persuasion. A criminal may impersonate a senior executive, customer or professional adviser and then use urgency, confidentiality or authority to discourage normal checks. The risk is not limited to large companies: smaller organisations may have fewer approval layers, closer informal working practices and less specialist security support, making a convincing exception request especially dangerous.
Businesses should verify high-impact requests through a separate channel.
The most effective control is not asking employees to become expert deepfake detectors. It is designing processes so that a single email, call or video appearance cannot authorise a high-impact action. Payment instructions, changes to bank details, password resets, disclosure of sensitive information and other unusual requests should be confirmed through a second, independently established channel.
The confirming employee should use contact details already held by the organisation, rather than a number or link supplied in the suspicious message. Higher-value transactions may require approval from a second authorised person. The National Cyber Security Centre recommends a layered approach to phishing and advises organisations to verify important email requests through another form of communication. These controls remain useful when the initial approach includes synthetic voice or video.
Clear procedures help staff resist urgency and misplaced authority.
Fraud succeeds when the attacker persuades someone to depart from normal practice. SMEs should make legitimate processes easy to recognise: who can approve payments, how suppliers change account details, when personal information may be released and where employees report a suspicious request. Senior leaders should follow the same rules, because informal exceptions attributed to them can undermine the entire control.
Training should use realistic scenarios without suggesting that every employee can reliably identify synthetic media. Staff need permission to pause, challenge and verify a request, even when it appears to come from someone senior. They should recognise pressure for secrecy, a sudden change of channel, unusual timing and attempts to bypass established approvals as reasons to slow the process down.
Public information and personal data can become material for impersonation.
A convincing scam may be assembled from information that an organisation or its employees have made public. Job titles, reporting lines, travel plans, recordings of senior staff and descriptions of payment processes can help an attacker choose a target and imitate normal communications. Businesses should review what they publish and avoid exposing operational detail that has little public value but significant usefulness to fraudsters.
Personal data may also come from compromised accounts, previous phishing incidents or third-party breaches. This connects fraud prevention with data protection governance: access controls, data minimisation, retention and secure supplier management reduce the information available for misuse. Multi-factor authentication, restricted privileges and effective email-domain protections can also limit the damage when credentials or identity information are targeted.
An AI-enabled fraud incident may become a personal data breach.
If an employee discloses customer information, payroll data or account credentials in response to an impersonation attempt, the organisation may face more than a financial loss. Unauthorised disclosure or access can constitute a personal data breach under the GDPR, requiring prompt assessment of the risks to individuals and, where applicable, notification to the relevant supervisory authority and affected people.
The incident plan should therefore connect finance, IT security, data protection, legal and senior management. Immediate steps may include stopping or recalling a payment, securing accounts, preserving evidence, notifying banks or law enforcement and assessing whether personal data were compromised. Employees should know how to report an incident quickly and should not be discouraged from doing so because they initially believed the request was genuine.
Incident exercises should test whether verification controls work under pressure.
A written policy is useful only if people can apply it during a credible and urgent request. SMEs can test a scenario in which a supplier appears to change bank details, a director requests a confidential transfer or a cloned voice asks an employee to disclose access information. The aim should be to examine the process, not to embarrass an individual who misses a clue.
Exercises can reveal whether contact details are current, whether escalation routes are clear and whether business continuity arrangements work if the normal communications channel is compromised. Reviews should also consider new information published online, changes in payment authority and emerging AI capabilities. Fraud controls should evolve alongside the organisation’s digital footprint and working practices.
AI-enabled fraud should be treated as an organisational governance risk.
Deepfakes are not solely a technical problem for the IT team. They affect financial controls, data protection, supplier relationships, staff training and executive behaviour. Assigning ownership across these functions helps an SME avoid fragmented responses and ensures that new AI risks are considered within existing fraud, security and privacy governance.
The practical objective is not to prove whether every message is AI-generated. It is to ensure that an attacker cannot turn a convincing impersonation into an unverified payment, disclosure or access decision. Strong verification, limited access and a rehearsed response plan remain dependable controls even as synthetic media become more realistic.
Discover how Aphaia helps organisations strengthen governance against AI-enabled fraud and data protection risks.
Aphaia helps organisations connect AI governance with practical data protection, cybersecurity and incident-response measures. Proportionate policies, risk assessments and clear accountability can help SMEs use AI responsibly while preparing for the ways in which the same technologies may be misused against them.
