Phishing Got Smarter: How Attackers Use AI and What Actually Defends Against It

The old advice about spotting phishing emails by their bad grammar stopped working around 2023, when generative AI made fluent, context-aware writing free and instant. The good news is that the defenses that work against AI-assisted phishing are the same ones that worked before — verification procedures, multi-factor authentication, endpoint detection, and trained staff — they just have to be applied more consistently.

This is not a fear piece. AI has not given attackers a magic key to your network. What it has done is lower the cost of producing convincing lures and raise the believability ceiling on social engineering. Understanding exactly what changed, and what didn’t, is how you spend your security budget on the right things.

What AI actually changed about phishing

Three capabilities moved from “expensive and rare” to “cheap and common.”

Fluent, personalized writing at scale. A large language model can take a LinkedIn profile, a company press release, and a public bid announcement, and produce a message that references real projects, real names, and real deadlines. The misspellings and awkward phrasing that used to serve as a tell are gone. For a general contractor in Atlanta, that might look like an email referencing an actual permit filing or a subcontractor the company genuinely works with.

Voice cloning. Publicly available tools can produce a usable imitation of a person’s voice from a short sample. For executives who speak at conferences, record webinars, or appear on podcasts, the sample material is already public. The typical use is a short, urgent voicemail or call: “I’m heading into a closing, I need you to push the wire through today.”

Synthetic documents and video. Invoice fraud has existed for decades, but generating a pixel-perfect vendor invoice with a modified remit-to account used to require some effort. Now it doesn’t. Deepfake video in live meetings is still technically harder and less common against SMBs, but it has been publicly reported in large-company fraud cases, and the tooling continues to get cheaper.

What AI has not changed: attackers still need a credential, a payment, or a file execution to profit. Every one of those steps is defensible.

What the attack actually looks like against a 75-person firm

Most AI-assisted attacks against companies in the 25–300 employee range fall into three patterns.

Business email compromise and wire redirection. Someone impersonates an executive, a vendor, or a title company and asks for a payment to a new account. This is the highest-dollar risk for law firms handling escrow, construction companies managing subcontractor payments, and professional services firms with recurring vendor relationships. Losses in this segment commonly run from the tens of thousands into the low hundreds of thousands, depending on the size of the transaction in flight.

Credential harvesting. A convincing message leads to a fake Microsoft 365 login page. Modern phishing kits can proxy the real login in real time, which means they can also capture the session token after MFA is completed. This is why “we have MFA” is necessary but not sufficient — the type of MFA matters.

Malware delivery. Less common than it used to be, but still present, often via a shared file link or a malicious attachment. For SMBs, projected recovery from a ransomware event in this segment typically runs 3 to 14 days, with daily downtime costs commonly estimated between $5,000 and $25,000 for firms this size. For a medical or dental practice, that’s cancelled appointments; for a manufacturer, it’s a stalled production schedule.

A prevention example: a professional services client of ours had a user receive a well-crafted message pointing at a credential-harvesting page hosted on a newly registered domain. Our email filtering flagged the domain age and the lookalike display name, and the message was quarantined before delivery. Had it landed and the user entered credentials, the expected scope would have been a mailbox takeover followed by invoice-redirect attempts against the firm’s client list — the pattern we see repeatedly in public reporting on BEC.

The defenses that actually hold

Ranked roughly by return on effort for an SMB.

1. Out-of-band verification for money and account changes

This is the single highest-value control, and it costs nothing but discipline. Write it down, make it policy, and make it non-negotiable:

• Any request to change bank details, remit-to addresses, or payroll direct deposit gets verified by phone, using a number already on file — never a number in the email or voicemail.
• Any wire above a defined threshold requires two approvers.
• Urgency is a trigger for more verification, not less. An executive genuinely in a hurry will understand a 90-second callback.

A voice clone can imitate the CEO. It cannot answer the CEO’s known phone number. The verification step defeats the AI advantage entirely, which is why it belongs at the top of the list.

2. Phishing-resistant MFA

If your MFA is SMS codes or push notifications, you are protected against password reuse but not against real-time proxy phishing or MFA fatigue. Move toward number matching at minimum, and toward FIDO2 security keys or passkeys for your highest-risk accounts: finance, executives, IT administrators, and anyone with access to escrow or patient records. Conditional access policies that restrict sign-ins to managed devices or known locations add another layer that a remote attacker with valid credentials cannot easily satisfy.

3. EDR and managed detection

Endpoint detection and response watches behavior, not just signatures, which matters when the initial lure is novel. The important word is managed — an EDR alert at 2 a.m. only helps if someone is watching and responding. That’s a core piece of what we do under /services/cybersecurity/, and it’s the difference between a contained incident and a weekend-long one.

4. Training that reflects current tactics

Annual click-through training doesn’t address voice cloning or invoice fraud. Short, frequent simulations plus a clear, blame-free reporting path work better. Staff should know exactly where to forward a suspicious message and should be thanked for false positives. The goal is reporting rate, not click rate.

5. Email authentication and tenant hardening

SPF, DKIM, and DMARC enforcement reduce direct domain spoofing. Inside Microsoft 365, disabling legacy authentication, limiting mailbox forwarding rules, and alerting on new inbox rules catch the most common post-compromise moves. These are configuration changes, not purchases.

Where AI helps the defender

The same technology works both directions. Modern email security uses language models to evaluate tone, urgency, and relationship context, flagging a message that asks for a payment change from a sender you’ve never transacted with that way. Security operations tooling uses AI to summarize alert chains so a human analyst reaches a decision faster.

Inside your own tenant, tools like Microsoft Copilot can help summarize a long email thread or draft a vendor communication, which is genuinely useful. Be honest about the limits: AI assistance helps catch and triage, it does not eliminate human judgment, and no vendor should tell you otherwise. And as you roll out ai for small business workflows, the same data-governance questions apply — what the tool can see, where the data goes, and who approved it. That’s the subject of a written ai policy, and it’s inseparable from ai security and ai data privacy planning. If staff are pasting client information into public chatbots, you have an exposure problem that has nothing to do with phishing and everything to do with governance.

Vertical notes

Law firms: wire fraud around real estate closings is the headline risk, and attorney-client privilege raises the stakes on mailbox compromise. See /industries/law/.

Medical and dental: a compromised mailbox containing PHI is a reportable event under HIPAA. Breach scope in this segment typically runs from dozens to a few hundred affected records, but notification obligations attach regardless of size.

Construction: subcontractor and supplier payment fraud, often timed to real project milestones that are publicly visible in permit filings.

Manufacturing: vendor invoice fraud plus production downtime, with added CMMC obligations for anyone in a defense supply chain.

A reasonable next step

You do not need to rebuild your security program. Most SMBs we talk to need three things tightened: a written verification procedure for payments, stronger MFA on the accounts that matter most, and someone actually watching endpoint alerts.

If you’d like a straightforward read on where your organization stands, we’re happy to do a short discovery call — 30 minutes, no pitch deck. We’ll walk through your current MFA configuration, your payment verification process, and whether AI tools are already in use in ways nobody has documented. Reach us at /contact/ and we’ll find a time.