How AI Scams Are Evolving and What Small Businesses Can Do to Stay Protected

The rapid rise in AI scams is a growing concern for businesses, particularly small enterprises that often lack the resources for robust cybersecurity defenses. Attackers are leveraging advanced technologies such as deepfakes, voice cloning, and AI-enhanced phishing to craft convincing and sophisticated attacks. Deloitte, a leading accounting firm, forecasts that generative AI could increase fraud losses to a staggering $40 billion annually by 2027. This alarming projection underscores the urgent need for businesses, especially small enterprises, to strengthen their cybersecurity defenses and stay ahead of these evolving threats.

For small businesses, the most prevalent AI-driven scams include:

1. AI-Enhanced Phishing: These scams generate highly realistic emails and messages designed to deceive employees into disclosing sensitive information or transferring funds. In the past, phishing emails have been easier to identify due to obvious signs like misspelled words, incorrect capitalization, or formatting issues. However, with advancements in AI, attackers can now craft near-perfect replicas of legitimate emails, making it much more difficult to distinguish fraudulent messages from the real ones.
2. Deepfake Video and Audio Manipulation: Fraudsters leverage these technologies to impersonate senior-level employees or trusted partners, deceiving employees into carrying out unauthorized transactions. In one case, a multinational organization lost $25 million after an employee was duped by a deepfake video conference call, transferring money to the attackers. When these types of attacks are combined with spoofed caller ID and social engineering tactics, they can become exceptionally convincing -even the most vigilant employees.
3. Data Analysis: AI tools enable hackers to analyze compromised accounts and craft highly targeted attacks, making fraud detection increasingly difficult for businesses. Once inside a company’s email system, attackers can leverage AI to analyze conversation patterns and identify key targets. They can also download accessible files and utilize AI to sift through data, compiling sensitive information such as names, credit card numbers, and Social Security numbers – data that is then sold on the dark web.

A recent Nationwide survey revealed that approximately one-quarter of small business owners have been targeted by AI-driven scams. The majority of these attacks involved email, voice, or video impersonations of senior-level employees. Shockingly, over half of the respondents admitted to being deceived by a deepfake image or video in the past year. Despite the growing sophistication of these scams, less than half of small businesses have the cyber insurance coverage necessary to protect themselves.[1]

How to Protect Your Business?

To effectively combat the rising threat of AI-driven scams, organizations must implement both proactive and reactive strategies. Here are key actions to protect your business:

1. Verify Callers with Caution: With voice cloning on the rise, caller ID is no longer a reliable indicator of legitimacy. Always double-check any unusual or urgent requests by:
   • Calling a known contact number to confirm the request.
   • Using video verification on internal platforms such as Slack or Microsoft Teams.
   • Employing authentication tools like Okta or Caller Verify for call centers, along with technologies like Phoneprinting by Pindrop for acoustic and behavioral analysis.
2. Cybersecurity Awareness Training: Ensure all employees receive regular training on the latest cybersecurity threats. Tailor training to specific groups such as IT, accounting, and executives, who are often prime targets. Additionally, conduct social engineering simulations to test employee awareness and response.
3. Adopt Robust Authentication: Implement advanced multi-factor authentication (“MFA”), such as biometric verification or hardware tokens, to protect against attacks that exploit session cookies. These measures offer stronger protection than traditional SMS or email-based MFA.
4. Limit Sensitive Data Exposure: Treat data as highly sensitive. Use access controls to restrict who can view critical information, especially in email and cloud systems. Regularly purge unnecessary data, encrypt sensitive information, and maintain an up-to-date inventory to ensure only essential data is stored.

As AI scams become more sophisticated, cybersecurity companies are developing AI-powered tools to counteract these threats. Platforms like Microsoft and Google are already using AI to detect and block AI-generated content in real time. By staying informed and implementing these best practices, organizations can better defend themselves against the growing risk of AI-driven fraud.

If you’re unsure where to begin, please reach out to either the CTBK Forensic Services or CTBK Technology & Security Solutions team for expert guidance and assistance.

Kaitlyn M. Pettit, CPA, CFE kp*****@**bk.com (716) 630-2400 Kaitlyn Pettit is a Senior Manager in the Forensic Services practice and has experience providing Audit, Forensic Accounting and Fraud Investigation, and Litigation Support Services, on behalf of clients.