How to Protect Your Team Against AI-Generated Scams

Workshop outline

1. AI-enabled scam tactics

   Deepfake audio and video, automated spear-phishing, fake support bots, romance and investment scams with flawless grammar over weeks.

2. Business protection habits

   Dual approval for wires. Educate customers how you will never ask for passwords. Monitor brand impersonation on social platforms.

3. Deepfake customer service and refund fraud

   Scammers synthesize voices and faces to impersonate customers requesting refunds or password resets. Train support to verify identity using knowledge only true account holders should know — recent order SKUs, last four of payment method on file — not answers easily scraped from social media.

4. Vendor impersonation in procurement

   Fake invoices mimic real vendors with AI-polished layouts and plausible PO numbers scraped from leaks. Match bank detail changes against stored vendor records and confirm through known contacts, not reply-to addresses on the PDF.

5. Payment callback rules that stop deepfake approvals

   Any wire transfer or ACH change above your floor should require a callback to a number stored independently of the email thread — CRM phone field, not signature block. Deepfakes shine on Zoom; they struggle when you dial a known mobile from a separate device. Publish this rule where finance and executives see it weekly, not buried in policy PDFs.

AI-enabled scam tactics

Deepfake audio and video, automated spear-phishing, fake support bots, romance and investment scams with flawless grammar over weeks.

Questions teams ask us

Can banks reverse scam wires?

Sometimes if reported within hours — not guaranteed. Speed is critical.

Employee falls for vishing?

Reset creds, notify bank, preserve recordings, retrain without shaming to encourage future reports.

Can we trust video calls for identity verification?

Treat live video as helpful but not sufficient for money movement. Combine visual recognition with out-of-band codes or pre-shared passphrases for high-risk approvals.

Should we ban AI tools company-wide?

Blanket bans push usage to shadow tools. Clear rules on customer data, payment authority, and verification beat prohibition theater.

Vendor impersonation in procurement

Fake invoices mimic real vendors with AI-polished layouts and plausible PO numbers scraped from leaks. Match bank detail changes against stored vendor records and confirm through known contacts, not reply-to addresses on the PDF.

Centralize new vendor onboarding with dual approval. Urgent one-off requests bypassing onboarding deserve skepticism regardless of polished presentation. Put procurement fraud drills on the CFO's calendar quarterly — ownership beats shared inboxes.

Subscribe to domain monitoring for look-alike registrations of your brand and top suppliers. Early alerts beat post-payment recovery. Record two blocked scams and two near-misses before widening chatbot self-service scope.

Payment callback rules that stop deepfake approvals

Any wire transfer or ACH change above your floor should require a callback to a number stored independently of the email thread — CRM phone field, not signature block. Deepfakes shine on Zoom; they struggle when you dial a known mobile from a separate device. Publish this rule where finance and executives see it weekly, not buried in policy PDFs.

Use dual approval for new vendors and bank detail updates. Scammers love Friday afternoon urgency; normalize slowing down. US banks may not recover funds sent to mule accounts — prevention beats legal remedies.

Log attempted fraud internally without shaming clickers. Teams that hide mistakes repeat them. Share redacted examples in standups so patterns — gift cards, secrecy, executive travel pretense — stay fresh. AI scams rotate scripts; your procedures should be boring and repeatable.

Sources and further reading

• www.ftc.gov
• www.fbi.gov