What changed with AI phishing attacks is the price of running one. For 20 years, the reason a 40 person company received fewer convincing scam attempts than a bank came down to arithmetic. Somebody had to read your website, work out who signs the checks, learn how your people write to each other, and compose a message that sounded right. That was hours of human work, so it went where the payoff was largest. Software does that homework now, and it does it for any company whose website exists.
Everything below is what that means for the checks you sign.
The three shapes a scam email has taken
The first generation carried something dangerous inside it, usually an attachment that installed a program or a link to a page that did. Your email protection was built for exactly that, and it is still good at it. It compares what arrives against a list of things already known to be harmful and throws out the matches.
The second generation dropped the dangerous part altogether. A message arrives from a name you know, with no attachment and no link, asking your bookkeeper to update the bank details on an invoice before Friday. There is nothing in it for a filter to catch, because the harm lives in what the message asks rather than in what it contains.
The third generation is that same request, run by software. The research, the writing, the patient replies when your employee asks a question, and increasingly the voice on the phone and the face on the video call. Steve Malone, who leads product and strategy at the email security company IRONSCALES, described this in August 2026 as a fight that has moved to one side’s software against the other’s.
Why the video call stopped being proof
In January 2024, a staff member at the Hong Kong office of the engineering firm Arup received a message about a confidential transaction, apparently from the finance chief in the United Kingdom. The employee was suspicious, which is the outcome most security training aims for. So they were invited onto a video call, where several colleagues appeared with the right faces and the right voices.
They approved 15 transfers into 5 accounts. The firm lost about $25 million. Arup later confirmed publicly that fake voices and images had been used and that none of its internal systems had been broken into.
The detail worth carrying away is not the amount. It is that the employee did hesitate, and that the hesitation was answered by a face they recognized. Recognizing somebody has quietly stopped being a check that proves anything.
Where AI phishing attacks slip past what you already pay for
Most owners have a rough mental picture of email security as a gate. Messages arrive, bad ones get stopped, good ones come through. That picture was accurate for the first generation, and it is why the numbers your provider reports feel reassuring: a large volume blocked, every month, on schedule.
The trouble is that a report of what the gate blocked says nothing about what walked through it. AI phishing attacks are built to walk through it, because they contain nothing that appears on any list. They are ordinary business correspondence with a request in them.
That is why the useful question to your provider is about what happens after delivery. Something arrives in your bookkeeper’s inbox, sits there, and is opened. Is anything watching at that point, and if it is, what did it find last month?
What Americans actually lost
Americans filed 22,364 complaints last year about fraud built with artificial intelligence, and reported losing close to $893 million to it, according to the FBI’s internet crime report covering 2025. Total reported losses across all internet crime came to nearly $21 billion on just over a million complaints.
Two things are worth saying about that figure so you can judge it yourself. It only counts what people reported, so the real number is larger, and it covers a first full year of that category being tracked, which means there is no trend line yet. What it does establish is that this stopped being a demonstration at a conference and started producing losses that a federal agency counts.
Why your policy may call this your own instruction
There is a second cost here that owners rarely see coming, and it sits with your insurance.
When somebody breaks into a system and moves money, most policies handle it. When your own bookkeeper types the transfer, having been deceived into doing it, the picture changes. The instruction that reached your bank was genuine and it came from a person authorized to give it, which is the argument insurers have used to deny these claims, and courts have often agreed with them.
Cover for this usually sits as a separate add-on to the policy rather than inside the main one, and the ceiling on it tends to be modest. Law firm Ward and Smith puts the common range between $25,000 and $250,000. A payment request built by software is unlikely to be modest.
So ask your broker two things while nothing is happening. Does our policy cover a loss where one of our own people approved the payment, and if it does, what is the ceiling on that specific part? Get both answers in writing.
The rule that costs nothing
The defense that works here is not a purchase. It is a sentence you write down and hand to the 2 or 3 people in your company who can move money.
Any request to change bank details, release a payment, or hand over a login gets confirmed by calling that person back before it happens, on the number you already had for them. Never a number printed in the message, and never a reply to the thread.
Then do the part that most companies skip. Say out loud, to those same people, that nobody here will ever be criticized for slowing a payment down to make that call. A rule that quietly costs somebody their standing is a rule that goes unused at 4 p.m. on a Friday, which is exactly when these requests tend to arrive.
Six questions for your IT provider
Print this and take it to your next review.
- Of the scam emails aimed at us, how many are caught after they have already reached somebody’s inbox, and how do you know?
- When one of my staff reports a suspicious message, how long does it take you to tell them whether it was real?
- If somebody impersonates me by voice or on a video call, does anything we currently pay for help at all?
- Which of our accounts can still be opened with a password alone?
- Who on your side reviews the requests to change bank details, if anybody does?
- What did you find last month that our filter did not stop?
The first and the last are the ones that separate a provider who is watching from a provider who is forwarding a dashboard.
What has not changed
The mechanism underneath all of this is old. Somebody asks somebody else to move money and sounds credible while doing it. Software made the credible part cheap and repeatable, and it added a face and a voice to the toolkit.
The countermeasure did not move. Money leaves your company through a small number of people, and a verification habit those people are genuinely allowed to use catches nearly all of this before it costs anything. Buy the protection you need for the messages, ask harder about what it misses after delivery, and put the rule in writing this week.
