The scam that should worry you isn't in your inbox. It's on the phone.
In early 2024, a finance worker at a large engineering firm joined a video call with his CFO and several colleagues. Everyone looked and sounded exactly right. Following their instructions, he sent out roughly $25 million in wire transfers. Every “person” on that call was an AI deepfake. He was the only real human on it. That was a big company with a big target on its back, but the same technology is now cheap and widely available. Cloning a voice takes minutes. A convincing phishing email takes seconds. Your team doesn't need millions on the line for this to matter.
You can't out-tech it. You can learn the tells.
Most AI scams share the same handful of warning signs. Teach your team to slow down when they see any of them: Urgency and secrecy in the same breath. “Do this now, and don't tell anyone.” Real emergencies rarely require both. A voice or video that's slightly off. Odd pauses, a flat tone, or a “boss” who can't answer a simple personal question. A sudden request for money or access. Wires, gift cards, changed bank details, or a login prompt you weren't expecting. A new address or a channel switch. The “vendor” or “exec” emails from a slightly-wrong address, or wants to move you to text or WhatsApp. Too perfect, or just slightly wrong. A flawless note from someone who never writes that way, or small details that don't quite fit.
The one rule that catches most of it.
If a message brings urgency and asks for money, access, or secrecy, stop and verify on a channel you already trust. Call the person back on a number you already had, not the one in the message. For anything involving money or data, confirm with a second person first. A minute of checking costs nothing. The alternative can cost everything.
Make it stick.
Print the poster and put it where the people who move money and manage logins can see it. Adopt the one-page “verify before you act” checklist so the steps are written down, not improvised under pressure. Both are free below, no email required.