Quick answer: AI phishing emails are harder to spot because they are well written, personalised and free of the spelling mistakes people used to rely on. Instead of judging the writing, judge the request: any unexpected message asking for money, passwords, bank detail changes or urgency should be checked through a separate, trusted channel before anyone acts.
Scammers now use generative AI to write convincing emails, clone voices from short recordings and even produce fake video. Small businesses are attractive targets because they often have fewer checks, busy owners who approve payments themselves and staff who want to be helpful. The good news is that the best defences are simple habits and processes rather than expensive software.
Table of Contents
Why AI phishing emails are different
Traditional phishing advice focused on clumsy grammar, odd formatting and generic greetings. Those clues are fading. AI phishing emails can be written in fluent British English, mimic a supplier’s tone, reference real projects scraped from your website or social media, and be produced in bulk with small variations so filters struggle to catch them.
Attackers also combine channels. An email might be followed by a text or a phone call from a voice that sounds like your director, or an invitation to a video call where the person on screen looks familiar. Each step feels like confirmation of the last. The underlying goal is almost always the same: get someone to pay money, reveal login details, open a malicious file or approve something they should not.
Red flags that still work
Even when the writing is polished, the shape of a scam rarely changes. Train yourself and your team to notice these signals:
- An unusual request, such as changing a supplier’s bank details, buying gift cards, paying an unfamiliar invoice or sharing a login code.
- Pressure and secrecy: “this needs to be done before 3pm”, “I’m in a meeting, just get it done”, “keep this between us”.
- A mismatched sender: the display name looks right but the actual address or domain is slightly off, or replies go to a different address.
- Links and attachments you were not expecting, especially login pages for email, cloud storage or banking.
- A change of channel, such as a supposed colleague moving the conversation to a personal messaging app.
- Something that sounds right but feels off: a familiar voice with odd pauses, a video caller who avoids unscripted questions, or a request that does not fit how that person normally works.
Deepfake voice and video scams
Voice cloning tools can imitate a person from a relatively short audio sample, and public videos, podcasts or voicemail greetings can provide that sample. A common pattern is a call that appears to come from a senior person or a family member in urgent need, asking for a quick transfer.
Defending against this does not require spotting technical flaws in the audio. It requires a rule that no payment or sensitive change is approved on the strength of a call or video alone. Hang up and call back on a number you already hold, not one given in the call. Some teams agree a simple code word for genuine emergencies, which a scammer is unlikely to know.
How to protect your business from AI phishing emails
Technology helps, but process is what stops the money leaving your account. Work through these steps:
- Turn on multi-factor authentication for email, banking, accounting software and any cloud storage. It makes stolen passwords far less useful.
- Create a payment verification rule. Any new payee or change to bank details must be confirmed by phone using a number from your own records, and ideally approved by a second person.
- Use your email provider’s security settings. Business email services include spam and phishing filtering, external sender warnings and options for authenticating your domain. Ask your IT provider to check these are switched on.
- Limit what attackers can learn. Review what your website and social profiles reveal about who approves payments, who your suppliers are and when key people are away.
- Make reporting easy and blame-free. Staff should feel comfortable saying “I think I clicked something” straight away. Speed matters more than embarrassment.
- Keep devices updated and use reputable security software, so that a mistaken click is less likely to lead to a compromised machine.
- Practise. Share real examples in team meetings and talk through what you would do.
The National Cyber Security Centre publishes free guidance for small businesses, including how to report suspicious emails. For a wider look at how criminals and defenders are both using AI, read our guide to AI cybersecurity for small businesses.
A worked example: an accountancy practice in Reading
Imagine a three-person bookkeeping practice in Reading. On a Friday afternoon, the practice manager receives an email that appears to come from a long-standing client, a local builder. It references a real recent job, uses the client’s usual friendly sign-off and asks for a refund of an overpayment to “our new account, as the old one is being closed”.
Minutes later, a voicemail arrives in what sounds like the client’s voice, apologising for the rush. Nothing in the writing looks wrong. But the practice has a rule: bank detail changes are always confirmed by calling the number on file. The manager rings the builder, who knows nothing about it. The email came from a lookalike domain, and the voicemail was very likely generated from videos on the builder’s social media.
The practice reports the email, warns the client that their details are being impersonated and reminds other clients by email that it will never change payment arrangements without a phone call. The process did the work, not anyone’s ability to spot a fake.
If someone has already been caught out
- If money has been sent, contact your bank immediately. The sooner they know, the better the chance of stopping or recovering the payment.
- Change any passwords that may have been entered and sign out of all sessions; check email forwarding rules, which attackers often add quietly.
- Report the incident to Action Fraud (or Police Scotland if you are in Scotland) and forward suspicious emails to the NCSC reporting service.
- If personal data may have been exposed, consider whether you need to report a breach to the ICO under UK GDPR. Serious breaches generally need to be reported quickly, so take advice if unsure.
- Speak to your IT support or a cybersecurity professional, and check whether your insurance covers cyber incidents.
Common mistakes small businesses make
Most successful attacks exploit gaps in routine rather than a lack of intelligence. Watch out for these:
- Assuming that because a message is well written and uses your name, it must be genuine. That assumption is exactly what AI phishing emails are designed to exploit.
- Replying to the suspicious email to ask whether it is real. The attacker controls that inbox and will happily confirm.
- Calling the phone number printed in the email or signature rather than one already saved in your records.
- Letting one person set up new payees and approve payments without any second check, especially during holidays when cover staff are unfamiliar with suppliers.
- Sharing too much publicly, such as organisation charts, staff email formats or out-of-office messages that name who is covering payments.
- Treating security as a one-off training session. Criminals keep changing tactics, so short, regular refreshers work better.
None of these fixes needs a large budget. A written payment procedure, a short team conversation every few months and a habit of pausing before acting will stop the majority of AI phishing emails from turning into real losses.
Quick checklist
- Multi-factor authentication switched on for all key accounts.
- Written rule: bank detail changes and new payees confirmed by phone on a known number.
- Two-person approval for payments above a level you choose.
- Staff know how to report a suspicious message and will not be blamed for doing so.
- Email security settings reviewed with your IT provider.
- A code word or call-back routine agreed for urgent requests from senior staff.
- An incident plan listing who to call: bank, IT support, insurer, Action Fraud.
Key takeaways
- AI phishing emails remove the old giveaways, so judge the request, not the writing.
- Deepfake voices and video mean a call is not proof of identity.
- Verification through a separate, trusted channel is the most effective defence.
- Multi-factor authentication, payment rules and a blame-free reporting culture cost little and prevent most losses.
- Act fast if something goes wrong: bank first, then passwords, reporting and professional help.
AI phishing emails: frequently asked questions
Can spam filters catch AI phishing emails?
Filters catch many, but not all. Because messages can be varied and well written, some will reach inboxes. Treat filtering as one layer and rely on verification processes for anything involving money or credentials.
Are there tools that detect deepfake audio or video?
Some detection products exist, but none should be relied on alone, and the technology on both sides changes quickly. A call-back rule using a number you already hold is simpler and more dependable for a small business.
Should we train staff with simulated phishing tests?
They can help if used supportively, alongside discussion of real examples. Avoid naming and shaming people who click, as that discourages the prompt reporting that limits damage.
Who should I contact if I think my business has been scammed?
Contact your bank first, then report to Action Fraud or Police Scotland, and get help from an IT or cybersecurity professional. If personal data is involved, consider your UK GDPR obligations and take legal advice where needed.
