AI-enabled social engineering of staff

What it is

This is a risk from other people's AI. Generative tools produce fluent, personalised messages in any language, clone a voice from a short recording, and render a face in a live video call. The cues staff were trained to notice, such as poor grammar, an unfamiliar voice or reluctance to appear on camera, no longer indicate anything. Impersonation aimed at customers is covered separately under Generative Content.

How it happens

• A cloned voice of a senior executive telephones with an urgent payment instruction.
• A video call includes generated likenesses of known colleagues.
• Phishing messages are tailored to each recipient from public information.
• A supplier's writing style is imitated to change bank details.

Why it matters

Controls that depend on recognising a person are weakened across the organisation at once. Losses from a single successful impersonation can be large and are rarely recovered.

Warning signs

• Verification procedures accept voice or video as proof of identity.
• Payment or access changes can be authorised on one channel.
• Executives' voices and images are widely available.
• Staff training describes phishing as it looked several years ago.

Who owns it

The chief information security officer owns the threat and the awareness programme. Owners of payment and access processes are accountable for verification that does not depend on recognition.

In practice

A finance officer joins a video call with what appear to be the finance director and two colleagues, who ask for an urgent transfer to complete an acquisition. Everyone else on the call is generated. The same pattern generalises to any process in which seeing or hearing someone is treated as authentication.