Last year, you could still teach an employee to catch a phishing email the old way: look for the typos, the odd grammar, the generic “Dear Customer” greeting. That training is now obsolete. The uncomfortable milestone arrived quietly — the fraudulent emails became better written than the real ones.

AI has not invented a new crime; it has industrialized an old one. Social engineering — manipulating a person into handing over access or money — now comes with flawless writing, personal details scraped and assembled in seconds, cloned voices, and even live deepfake video. What has not changed is how these attacks are actually stopped. Technology filters most of them, and disciplined verification defeats the rest. In this article I will show you exactly what AI changed about social engineering, what it did not change, and the specific controls and habits that still stop these attacks cold.

KEY TAKEAWAYS

Five Things to Take With You

The telltale signs are gone. Verizon’s 2026 DBIR found the volume of AI-assisted text in malicious emails has doubled — polished, personalized, and typo-free.
The scam is old; the scale is new. AI lets attackers run tailored spear-phishing against a 20-person Grand Rapids firm as cheaply as a mass blast — small businesses are no longer beneath anyone’s effort.
Voices and faces can no longer authenticate anyone. A few seconds of audio can clone a voice, and criminals have used deepfake video calls to authorize multi-million-dollar transfers.
Verification is the defense that cannot be deepfaked. A callback to a known number and a dual-approval rule defeat attacks that fool both eyes and ears.
Urgency is the last reliable tell. AI can fake fluency, familiarity, voice, and video — what it cannot remove is the attacker’s need for you to act fast and skip the process.

THE TELLTALE SIGNS ARE GONE

Why “Spot the Typo” Training Just Expired

For two decades, security awareness training rested on a comfortable assumption: fraud looks fraudulent. Bad grammar, strange phrasing, mismatched logos — the criminals were far away, writing in a second language, and it showed. That assumption is dead. Generative AI writes fluent, regionally appropriate, context-aware English on demand, and attackers adopted it faster than most businesses adopted it for legitimate work.

The data confirms what we see in client inboxes every week. Verizon’s 2026 Data Breach Investigations Report found that the volume of AI-assisted text appearing in malicious emails has doubled, and that the human element was involved in 62% of breaches. Social engineering drove 16% of all breaches, with email still the primary attack vector — and the overwhelming majority of malicious email remains plain phishing: no attachment, no malware, just persuasion. Meanwhile the FBI’s Internet Crime Complaint Center logged a record $20.9 billion in reported losses in its latest annual report, with roughly 85% of those losses tied to social engineering rather than technical exploits. Fraud specifically enabled by AI tools accounted for $893 million — a brand-new reporting category the FBI had to create because the problem grew too large to ignore.

Read those numbers together and the picture is clear: the dominant cyber threat to a small business is not a hooded genius breaking through your firewall. It is a well-written email, a familiar voice, or a convincing face — asking someone on your team to do something reasonable-sounding, quickly.

WHAT AI ACTUALLY CHANGED ABOUT SOCIAL ENGINEERING

Same Con, Industrial Scale

Every one of these attacks existed before AI. What changed is the cost, the quality, and the reach. Here is the honest comparison:

Element	The Old Playbook	The AI-Era Playbook
Writing quality	Broken English, obvious templates	Fluent, professional, indistinguishable from a colleague
Personalization	“Dear Customer,” one message for millions	Your vendors, your projects, your org chart — scraped and woven in automatically
Scale of targeting	Spear phishing reserved for big targets	Tailored attacks on small businesses at mass-mail prices
Voice	A stranger’s voice on the phone	Your CEO’s voice, cloned from seconds of public audio
Video	Not possible	Live deepfake participants on a video call
Cost to the attacker	Time, skill, language ability	Nearly zero — automation does the work

The Email That Knows Your Vendors

Modern phishing kits scrape LinkedIn, your website, and prior breach data to reference real projects, real coworkers, and real vendor relationships. The result reads like the follow-up to a conversation you were actually having. When a controller receives an invoice “update” that names the correct vendor, the correct project, and the correct amount range, the typo-hunting reflex finds nothing to catch.

The Voice on the Phone

Voice cloning now requires only a few seconds of sample audio — a conference talk, a voicemail greeting, a video on your company’s website. The FBI has warned specifically about criminals using AI-generated audio to impersonate executives and family members, and AI-enabled fraud reported to the bureau approached a billion dollars in the latest reporting year. The “urgent call from the owner” asking accounting to push a payment is no longer a stranger doing an impression. It sounds exactly like the owner.

The Face on the Video Call

In the most instructive case to date, an employee at the engineering firm Arup joined a video conference with what appeared to be the company’s CFO and several colleagues — every one of them a deepfake — and was talked into transferring roughly $25 million. The employee had been suspicious of the initial email, and the video call is what dissolved that suspicion. Seeing is no longer believing, and any defense that depends on recognizing a face or a voice is now a defense that can be manufactured against you.

WHAT STILL STOPS IT

Process Beats Paranoia

Here is the good news, and it is genuinely good: none of this made businesses defenseless. It made one specific defense obsolete — human intuition about what “looks fake” — while leaving the structural defenses fully intact. AI can fake a voice; it cannot fake a callback to the phone number you already have on file. It can fake an email; it cannot fake being enrolled in your multi-factor authentication. The defenses that work now share one property: they do not rely on a human judging authenticity in the moment.

The Attack	The Control That Stops It	Why It Works
AI-written phishing email	Behavior-based email security + a one-click report button	Modern filters analyze sender behavior, infrastructure, and intent — signals AI text cannot disguise
Fake login page harvesting passwords	MFA on every account — phishing-resistant methods or passkeys where possible	A stolen password alone no longer opens anything; passkeys cannot be entered on a fake site at all
Voice-clone call requesting a payment or banking change	Out-of-band verification — hang up, call back on the number already on file	The clone controls the inbound call; it cannot answer the outbound one
Deepfake video call authorizing a transfer	Dual approval for payments above a set threshold — no exceptions, including the boss	Two independent approvals through separate channels cannot be captured in one staged meeting
Vendor impersonation / business email compromise	A standing rule: no banking-detail change is ever actioned from an inbound request alone	The policy removes the decision from the moment of pressure entirely

Notice what every row has in common: the control is boring. It is a policy, a setting, a habit — deployed in advance, enforced without exception, and completely indifferent to how convincing the attacker is. This is layered defense doing what it was designed to do: when the human layer is fooled, the layers around it hold. Conditional access flags the sign-in from the wrong country. The report button gets the email in front of our security team. The callback rule turns a perfect voice clone into a dead end.

THE VERIFICATION PROTOCOL WE GIVE OUR CLIENTS

Steal This Policy — Seriously

If you implement nothing else from this article, implement this. It costs nothing, it takes one meeting to adopt, and it defeats every impersonation attack described above:

No payment, banking change, or gift card purchase is ever completed from an inbound request alone. Not from email, not from a call, not from video, not from text — regardless of who is asking.
Verify out-of-band, every time. Hang up and call back using the number already in your records or vendor file — never a number provided in the request itself.
Dual approval above a threshold. Any transfer over an amount you choose requires two people approving through two separate channels. The threshold matters less than the rule.
Urgency triggers the process, not an exception to it. “Before end of day,” “I’m boarding a flight,” “keep this confidential” — pressure to skip verification is itself the strongest indicator of fraud left.
The boss goes first. Leadership must publicly submit to the same verification rules, so no employee ever fears delaying a “CEO request.” An employee who verifies is rewarded — even when the request turns out to be real.
Report in one click, retrain in minutes. Every suspicious message gets reported, every close call becomes a teaching example, and nobody gets shamed for being fooled by professional-grade deception.

FREQUENTLY ASKED QUESTIONS

Straight Answers, No Scare Tactics

Is security awareness training still worth it if AI phishing is undetectable?

Yes — but the curriculum has to change. Training employees to spot typos is over; training them to follow verification habits is more valuable than ever. The goal is no longer “recognize every fake,” which is impossible. It is “respond to every request for money, credentials, or data with the same verification steps,” which is entirely achievable. Modern training plus phishing simulation builds exactly that reflex, and the reporting culture it creates gives your security team early warning.

Is MFA still effective against AI-powered attacks?

MFA remains one of the highest-leverage controls in existence — Microsoft’s research found it blocks over 99% of automated account-compromise attempts. AI has not changed that math; it has pushed attackers toward MFA-fatigue prompts and real-time phishing relays instead. That is why we increasingly deploy phishing-resistant methods — number matching, hardware keys, and passkeys — which cannot be tricked or relayed by a fake login page at all.

How do I protect my business from deepfake voice and video fraud?

Accept that voices and faces are no longer proof of identity, and move the proof somewhere a deepfake cannot follow: an outbound callback to a number on file, a dual-approval rule, a request logged in your ticketing or payment system. The Arup case is the lesson — the employee’s initial suspicion was correct, and a staged video call overrode it. A verification policy exists precisely so that no single convincing moment can override it.

Would attackers really bother with a small West Michigan business?

They already are. Automation removed the economics that once protected small companies — a tailored attack now costs the criminal almost nothing, and small businesses combine real money with lighter defenses. The FBI’s latest report attributes roughly 85% of cybercrime losses to social engineering, and the businesses we serve across Grand Rapids and West Michigan see these attempts weekly. Being small no longer means being beneath notice; it means being a softer target — unless the boring defenses are in place.

SLOW IS THE NEW SECURE

The Real IT Solutions Standard

Every technology shift produces a moment when the old instincts stop working, and this is one of them. The instinct that a professional email is a legitimate email, that a familiar voice is a real person, that a face on video is proof — all of that has quietly expired. What replaces it is not fear. It is process: a handful of unglamorous rules, enforced without exception, backed by layered technical controls that never get tired and never get flattered into skipping a step.

I have said for years that technology should create stability, not uncertainty — and in the AI era, stability comes from verification you can trust when your own eyes and ears cannot be. If you want to know how your current defenses and payment processes would hold up against a cloned voice or a flawless invoice, Real IT Solutions offers a straightforward security assessment for businesses across Grand Rapids and West Michigan. We will walk your team through the exact protocol above and tailor it to how your money actually moves.

SOURCES

Where These Numbers Come From

Phishing Got a Promotion: How AI Has Rewritten Social Engineering — and What Actually Still Stops It