An accounts assistant receives a message from a supplier. The invoice looks familiar. The writing is polished. There is just one change: payment should now go to a different bank account.

A few minutes later, a voice message arrives urging them to process it quickly.

Nothing about that situation requires a clumsy scammer.

AI-powered phishing uses generated text, audio, images, or other content to make deception more convincing or easier to carry out at scale. The strongest defence combines secure accounts with reliable ways to verify sensitive requests.

The FBI has warned that criminals use generative AI to improve fraudulent messages and create convincing impersonations. Poor spelling was never a reliable security test; it is an even weaker one now.

Verify the request through another channel

A convincing message should not be enough to change a supplier’s bank details.

Call a number already held in your records. Do not use the number supplied in the suspicious message. For significant payments, require a second authorised person to approve the change.

The same rule applies when a request appears to come from the owner.

That may feel awkward in a small business where everyone knows everyone. Make verification a written policy so employees do not have to choose between following procedure and appearing disrespectful.

You might also be interested in: Tech Talent Localization in Lagos, Nigeria

Strengthen the accounts attackers want

Begin with business email, administrator accounts, finance systems, and cloud storage.

Use phishing-resistant sign-in methods, such as appropriately configured FIDO/WebAuthn security keys or passkeys, where supported. CISA recommends moving towards phishing-resistant MFA because ordinary passwords and some verification-code methods remain vulnerable to phishing.

Account recovery needs attention too. Strong login protection loses value if a weak recovery process lets an attacker bypass it.

Train people around believable situations

“Look for strange grammar” is not enough.

Use examples that resemble actual work: an unexpected shared document, a changed invoice, a fake delivery notice, or a request to approve a login.

Teach employees to pause when a message asks them to:

• Move money or change payment details.
• Share passwords, verification codes, or confidential files.
• Install unfamiliar software.
• Ignore normal approval procedures because something is urgent.

A familiar voice should not override those checks.

Make reporting easy and blame-free

People sometimes realise a mistake seconds after making it. That is the moment you want them to speak up.

Give staff a clear reporting route and explain what information to preserve. A screenshot, sender address, and approximate time can help an investigation.

If someone entered credentials, contact the responsible IT person promptly. Recovery may require resetting credentials, revoking active sessions, checking mailbox rules, and reviewing account activity. If money moved, contact the bank immediately through a trusted channel.

AI makes impersonation easier. Your business can respond by making verification routine, even when the message sounds completely convincing.