Attackers use AI too. Check your logins.
Most of the conversation about AI at work is about what your own team can do with it. The people trying to get into your accounts have the same tools, and they are using them for the same reason you are: to write faster, sound more natural and do more in an afternoon. The defenses that stop them are mostly old ones. They just matter more now, and a lot of organizations never finished putting them in place.
The tells your team learned to spot are fading.
For years, the advice for spotting a phishing email was to look for the mistakes. Odd grammar, a greeting that didn't fit, a tone slightly off from how the sender usually writes. Plenty of people got good at this, and it worked because writing a convincing fake took effort.
That effort is mostly gone. A scammer can now produce a clean, polite message in the style of your vendor, your superintendent or your managing partner, and produce fifty variations of it before lunch. They can read a public website, a staff directory or a LinkedIn page and write something that mentions the right project and the right people. The message that asks the clinic's office manager to "review the attached updated W-9" no longer gives itself away in its wording.
Voice is moving the same direction. A short clip of someone speaking, from a webinar or a voicemail greeting, can be enough to imitate them on a phone call. Training people to listen for something that sounds wrong gets harder when very little does.
Logins are the front door.
Most of the damage from these messages comes down to one of two outcomes: someone hands over a password, or someone moves money. Take logins first.
If a stolen password is all it takes to get into an email account, the attacker is now inside your organization's conversations. They can read invoices in progress, see who approves what and reply from a real address. Email is usually the account that resets every other account, so it is worth protecting as if it were the bank login, because in practice it is close to one.
Multi-factor authentication is the single change that does the most here. A code from an authenticator app, a prompt on a phone or a physical key means a password alone isn't enough. Text-message codes are better than nothing but weaker than the other options, because phone numbers can be hijacked. The harder part is coverage. Turning it on for the director and forgetting the shared front-desk inbox, the payroll portal and the old admin account a former contractor set up is common.
A convincing message used to take effort to write, and that effort is mostly gone.
Money moves on a phone call you place yourself.
The other outcome is a payment that goes to the wrong place. The classic version is a vendor email saying their bank details have changed, with new account numbers for the next invoice. Sometimes it comes from a lookalike address. Sometimes it comes from the vendor's real account, after the vendor's own email was taken over.
The defense is a callback rule, and it has to be written down. Any change to where money goes gets confirmed by phone, using a number you already had on file, not one from the message asking for the change. This applies to vendor bank details, payroll direct-deposit changes and any urgent wire request from someone senior. Say a finance clerk at a town office gets an email from the road paving contractor with new remittance details; under the rule, the clerk calls the contractor's number from last year's contract before touching the vendor record.
People skip this step when they feel rushed or when the request seems to come from above. So the rule should say plainly that nobody, including the head of the organization, is exempt, and that a delay caused by a callback is never treated as a mistake.
Agree on a check for voices.
Voice imitation calls for a small agreement inside the team. When a call asks for something unusual, such as a transfer, a gift card purchase, a password or a file sent somewhere new, the person receiving it hangs up and calls back on a known number. For a small team, a shared code phrase that only staff know works too, as long as it is never written in an email or a chat.
This feels awkward the first time, and that is the reason to set it up in advance. If everyone knows the rule exists, calling a colleague back to confirm stops being an accusation. A school district's finance office (or a nonprofit's two-person finance team) can agree to this in a staff meeting in ten minutes.
Ten basics for a smaller office.
None of these needs new software. Most need an afternoon and one person who owns the list. Go through it once now and again each quarter.
- Turn on multi-factor authentication for every email account, including shared and admin inboxes.
- Turn it on for banking, payroll, accounting and any portal that can move money or hold personal records.
- Prefer an authenticator app or physical key over text-message codes wherever the service offers one.
- Use a password manager across the team, so nobody reuses a password between work and home accounts.
- Write down the callback rule for any change to payment details, and name who is allowed to approve one.
- Keep a list of verified phone numbers for your regular vendors, separate from your inbox.
- Agree on how staff confirm an unusual request by phone or video, and practice it once.
- Remove accounts for people who have left, and check for old contractor logins and unused admin accounts.
- Set email to flag messages from outside the organization, so a lookalike address stands out.
- Tell staff exactly who to contact when they clicked something they shouldn't have, and thank them when they do.
