AI Security, Deepfakes and Emerging Cyber Threats

What has changed

For years, the advice was simple: if you are unsure, call the person or listen to their voice. AI has weakened that check. Freely available tools can now produce a voice note that sounds like your managing director, a short video call with a familiar face, or an email written exactly in your supplier’s style. Criminals need only a few public clips, such as a speech on social media or a conference video. The trick itself is old: urgency, authority and secrecy. What is new is how real it looks and sounds.

Warning signs in AI-assisted fraud

• Unusual urgency: “Do it in the next 20 minutes, I’m about to board a flight.”
• Secrecy: “Don’t tell accounts yet, this is a confidential deal.”
• A new channel: a leader who never sends voice notes suddenly sends one from an unknown number.
• Bypassing process: a request to skip the normal approver, purchase order or call-back.
• Short or poor-quality calls: the video freezes, the person avoids questions or ends the call quickly.
• Pressure on emotions: flattery, fear of letting the boss down, or a family emergency story.

The independent verification habit

1. 1Pause. A genuine leader will accept a five-minute delay to protect the business.
2. 2Do not reply on the same channel. End the call or leave the chat where the request arrived.
3. 3Contact the person through a channel you already trust: the number saved in your records, the office landline or an in-person check.
4. 4Ask for the agreed code word, or a question only the real person would know and that is not on social media.
5. 5Follow the normal approval process anyway. Verification confirms identity; it does not replace the second approver.
6. 6Report the attempt to your security contact, even if you were not fooled. Others may be targeted next.

Using AI tools safely at work

AI can save real time for drafting emails, summarising notes or translating product descriptions. The risk is what people paste in. Public AI tools may store prompts, and depending on settings, the provider may use them to improve its models. Treat anything you paste into a public tool as information that has left the business. Never paste customer lists, personal data of employees or customers, passwords, API keys, source code, pricing strategy, contracts, financial statements or anything covered by a confidentiality agreement. Also remember that AI output can be wrong, made up or out of date. A person must check it before it is sent to a customer, used in a contract or relied on for a decision.

A one-page AI-use policy for a small business

• Approved tools: list which AI tools staff may use for work, and which account type (personal or business).
• Never paste: personal data, customer data, credentials, financial details, code or confidential documents.
• Human review: a named person checks AI output before it goes outside the business or informs a decision.
• Labelling: be honest with customers when content is substantially AI-generated, where that matters.
• Reporting: tell the security contact if confidential data was pasted by mistake, without fear of blame.
• Review: look at the policy every six months, as tools and settings change quickly.