The shift in phishing tactics
Traditional phishing attacks often relied on bulk emails containing spelling errors or poor formatting. These were relatively simple for staff to identify. The use of generative artificial intelligence has changed this. Attackers now use AI to generate text that is grammatically correct and matches the tone of professional business communications.
Because these tools can translate and adapt language quickly, the geographic origin of an attacker is no longer obvious. A message from a criminal may look identical to an internal email from a colleague or a notice from a known supplier.
The goal of account takeover
When a member of staff inadvertently provides their login details on a fake page, the attacker gains access to the business network. This is known as account takeover. Once inside, an attacker can monitor email threads, redirect invoices to different bank accounts, or download sensitive data.
Because the attacker is using a legitimate set of credentials, traditional security software may not immediately flag the activity as suspicious. The attacker effectively becomes a valid user within your system.
Limits of standard protection
Many businesses rely on multi-factor authentication (MFA) that sends a code via text message or a mobile app. While these are better than using passwords alone, they are not infallible. Attackers can use techniques to intercept these codes or trick users into approving a login request they did not initiate.
It is not currently known how many successful breaches are directly attributable to AI-generated content versus traditional methods, as the end result—a compromised account—looks the same. However, the volume of high-quality fraudulent emails is increasing.
Steps for UK businesses
To mitigate these risks, businesses should consider moving toward more secure forms of authentication. FIDO2 security keys, which are physical USB or NFC devices, provide a higher level of protection because they are harder to spoof than mobile app notifications.
Internal processes should also be reviewed. If a member of staff receives a request to change bank details or move funds, they should verify this via a known phone number or a face-to-face conversation, rather than relying solely on the content of an email.