Welcome to The BizTek Byte, the newsletter for people who’d rather read about IT disasters than live through one. Quick, useful, mercifully jargon-free. Let’s get into it.  

AI is helping scammers create polished emails, imitate familiar voices, and produce convincing images and videos. The old warning signs have not disappeared, but spelling mistakes and strange formatting can no longer serve as a business’s primary defense. 

Today’s harder question is whether employees can independently verify a request before they send money, share credentials, change payment information, or grant access. 

AI-powered fraud succeeds by exploiting trust. A finance employee recognizes the CEO’s voice. An executive sees what appears to be a colleague on video. A customer receives an email that looks like it came from their bank. 

Businesses do not need employees to become deepfake experts. They need clear verification procedures for requests that could cause financial, operational, or reputational harm. 

A member of your finance team receives a call from the CEO. The voice and speaking style sound familiar, but the message creates immediate pressure: a transaction has gone wrong, money must be moved, and no one else can know about it.  

Attackers can use audio from podcasts, webinars, interviews, conference records, and social media to imitate an executive’s voice. The imitation does not need to be flawless. It only needs to sound believable just long enough for someone to act.  

What to watch for 

Treat urgency, secrecy, and requests to bypass normal procedures as warning signs. Pay close attention when someone asks you to change payment information, use an unfamiliar payment method, or complete a transaction without the usual approval.  

A familiar voice does not prove who is speaking.  

What to do 

Require independent verification for high-risk financial requests. Call the executive back using a known number, confirm the request through a trusted internal system, or require approval from a second authorized person.  

Executive teams can also establish a private verification phrase for unusual or urgent requests. No single phone call should provide enough proof to authorize a sensitive transaction. 

Video calls once felt like a reliable way to confirm someone’s identity. AI-generated video has made that assumption risky.  

Scammers can combine cloned voices, manipulated video, and prerecorded material to impersonate executives, vendors, job candidates, or employees. Some attacks may even incorporate synthetic media into live conversations.  

An employee could see an executive authorize a transfer. A vendor could appear on screen to confirm new banking information. A customer could receive a video message that seems to come from someone inside your company.  

The deepfake does not need to withstand a detailed forensic review. It only needs to look convincing on a small screen during a busy workday.  

What to watch for 

Treat pressure as a warning sign, even when the person on screen looks and sounds familiar. Requests involving immediate payments, secrecy, credential changes, unusual access, or exceptions to company policy require additional verification.  

Visual glitches may expose some manipulated videos, but employees should not carry the responsibility of spotting every deepfake. As the technology improves, appearance alone will provide less reliable proof of identity.  

What to do 

Verify the request and the person through a separate, trusted process. Use a known internal messaging account, an established call back procedure, dual approval, or an authorization code before taking sensitive action.  

Your verification process should protect the business even when the person on screen looks completely convincing. 

Poor spelling, awkward greetings, and strange formatting once made many phishing emails easy to spot. Generative AI has weakened those warning signs.  

Scammers can produce polished emails in multiple languages and tailor them to a company, industry, job title, or current event. An employee may receive a convincing message that appears to come from a bank, software provider, supplier, attorney, executive, or customer.  

The email does not need to look suspicious. It only needs to create enough urgency or concern for the recipient to click, reply, or share information.  

What to watch for 

Examine any message that asks you to log in, reset a password, download a file, approve a transaction, confirm payment details, or provide sensitive information. 

Professional writing and familiar branding do not confirm that the sender or request is legitimate. Checks the sender’s full email address, the destination of any links, and whether the request fits the organization’s normal process.  

What to do 

Use a trusted route to reach the account or sender instead of following the path provided in the message.  

If the email claims to come from your bank, open the bank’s app or enter its known web address. If a vendor asks you to change payment information, contact your established representative using information already stored in your system. If a software provider asks you to reset a password, open the service directly instead of clicking the link.  

This prevents the sender from controlling where you go gives you a separate way to verify the request.  

Celebrity impersonation is not new, but AI can make a false endorsement look and sound authentic.  

A video may appear to show an entrepreneur promoting an investment, a doctor recommending a health product, or an industry expert endorsing software, cryptocurrency, or a business service. Scammers borrow the person’s credibility, knowing that a familiar face or voice can lower the viewer’s skepticism.  

The person in the video may be real. The endorsement may not be.  

What to watch for 

Be skeptical of videos that promise guaranteed returns, miracle results, secret methods, exclusive access, or limited-time opportunities. Watch for pressure to act before you have time to research the offer.  

A recognizable person and professional looking video do not prove that the claim is legitimate. 

What to do 

Trace the endorsement back to its source. Check the person’s official accounts or website, the company named in the offer, and reporting from reputable sources. For investments or financial products, confirm the company and individual through the appropriate regulatory records before sending money or sharing information.  

Treat the video as a claim that needs verification, not proof that the endorsement happened.  

Some scammers create urgency. Others take weeks or months to earn someone’s trust before making a request.  

The relationship may begin through social media, a dating app, a professional network, or an online community. The person remembers details, responds consistently, and seems invested in the conversation. Then money or access enters the picture through an emergency, travel problem, investment opportunity, business deal, job offer, or temporary financial crisis.  

AI helps scammers manage more conversations, personalize messages, and communicate across languages. This tactic extends beyond romance fraud. Attackers can use the same trust-building approach in recruiting, vendor relationships, professional networking, and business development.  

What to watch for 

Be cautious when someone avoids meaningful identity verification, refuses to meet, experiences repeated technical problems during live communication, or pressures you to move the conversation away from an established platform.  

An unexpected request for money, credentials, sensitive information, account access, or a business commitment deserves scrutiny, regardless of how long you have communicated with the person.  

What to do 

Verify the person’s identity through sources they do not control before sending money, sharing information, granting access, or entering a business agreement. For business contacts, confirm their role through the organization’s official website or a known company phone number.  

Time and familiarity can create a strong sense of trust, but they do not prove that the person or relationship is legitimate.  

Business can spend time asking whether a voice sounds artificial, a face contains visual glitches, or an email was written with AI. Those clues may help, but they cannot provide a reliable security strategy.  

Ask a more useful question:  

What could someone convince us to do if we believed the message was real? 

A convincing fake becomes a business incident when someone sends money, shares credentials, changes banking information, reveals confidential data, grants access, installs software, or approves a fraudulent transaction.  

Build safeguards around those high-consequence actions. A strong verification process can stop the damage even when no one spots the fake.  

Tools that detect synthetic images, video, audio, and text can support a broader security program. Email filtering, identity verification, multifactor authentication, access controls, and transaction monitoring can also reduce risk.  

No detection tool will catch every convincing fake. As AI-generated content improves, businesses should expect some fraudulent messages, calls, and videos to reach employees.  

Give employees a clear process to follow when that happens. They should know which requests require independent verification, how to verify them, and where to report suspicious activity. Your safeguards should depend on that process, not an employee’s ability to identify manipulated media on sight.   

Businesses have spent years streamlining work through faster approvals, one-click access, instant payments, and automated workflows. That efficiency helps with routine activity, but high-risk actions need additional checks.  

Require two authorized people to approve significant payments. Confirm changes to vendor banking information through a known contact and trusted phone number. Use stronger identity checks for sensitive password resets, and create a verification procedure for unusual executive requests.  

Define which actions require extra verification, who can approve them, and how employees should document exceptions. Employees also need clear permission to question any request that bypasses the established process.  

Apply these safeguards where one mistake could expose money, data, systems, or the business itself.  

Scammers often impersonate senior leaders because employees may hesitate to question someone with authority. Urgency and secrecy make that pressure stronger.  

Leaders can remove that uncertainty by telling employees:  

If a request from me seems unusual, verify it. I would rather have you confirm it twice than act once on a fraudulent instruction.  

Employees also need leaders to support that message in practice. When someone pauses an unusual request or asks for verification, treat it as following procedure, not challenging authority. That response makes verification part of the company’s culture.  

Fast reporting can limit the damage after an employee sends money, shares credentials, clicks a malicious link, or gives an attacker sensitive information. Embarrassment should never keep someone silent.  

Give employees a simple reporting process and make sure they know whom to contact. Depending on the incident, the response team may need to contact a financial institution, attempt to freeze or recall a transfer, reset compromised credentials, terminate active sessions, preserve evidence, or notify affected parties. Legal counsel and the appropriate authorities or regulators may also need to become involved.  

Contact the bank or payment provider as soon as possible after suspected financial fraud because recovery options can narrow with time.  

An incident response plan should assign responsibilities before an incident occurs. During the first hour, the team needs to contain the damage, preserve the right information, and know who has authority to make each call.  

AI-powered impersonation reaches beyond cybersecurity. It affects financial approvals, hiring, vendor management, customer communication, and the trust employees place in company leaders.  

Executives must decide how employees will verify unusual requests, how the company will authenticate sensitive communications, and how the business will respond when someone impersonates its people or brand. Leadership also shapes whether employees feel safe questioning a request that appears to come from someone senior.  

These questions helped shape my book, Leading in the Age of Artificial Intelligence. It examines how AI is changing decision-making, company culture, strategy, and the responsibilities leaders carry as these systems become part of everyday business.  

Leaders do not need to approach AI with fear. They need clear expectations, sound processes, and the willingness to adapt as the risks and opportunities change.  

Employees cannot distrust every message, call, or video and still get work done. They do need stronger proof before taking actions that could expose money, data, accounts, or systems.  

A familiar voice, recognizable face, polished email, or live conversation may no longer provide enough evidence for a high-risk decision. Businesses should build verification into the workflows surrounding those decisions.  

Define which requests require confirmation, which channels employees should use, and whom they should contact when something feels wrong. Make that process simple to follow and support employees when they pause an unusual request.  

Trust still matters. Businesses now need a process for confirming it when the consequences are high.  

Cybersecurity training has long taught employees to ask:  

Does this look suspicious? 

That question still helps, but AI makes a second question essential: 

Can I independently verify it? 

Scammers do not need to create a perfect fake. They need a message, voice, or video that feels credible enough to trigger the wrong action.  

Require employees to verify high-risk requests through a separate, trusted channel. That process separates identity from appearance and keeps urgency from replacing sound judgment.  

Independent verification can stop the fraud even when the fake looks real.