For twenty years, employee security training had one reliable tip: look for the typos. Bad grammar, weird phrasing, a greeting that didn't match how your boss actually writes. Those days are over.
Attackers use the same AI tools your team does. The phishing email that lands in your controller's inbox today is written in perfect English, references a real project from your company's LinkedIn activity, and matches the tone of the executive it's impersonating. Business email compromise already costs U.S. companies billions every year according to FBI reporting, and AI just lowered the skill required to run these scams to nearly zero.
Here's what the current attacks look like and what actually stops them.
The Three Attacks Hitting Small Businesses Right Now
1. The flawless executive impersonation.
An email arrives from your CEO's name (the display name is right, the address is one character off, or sometimes the real account is compromised). It asks accounting to update a vendor's banking details or process an urgent wire. The writing is perfect because an AI drafted it, sometimes trained on the executive's actual public writing.
2. The voice call that isn't your boss.
Voice cloning now takes seconds of sample audio, which is easy to get from a voicemail greeting, a webinar, or a social media video. Employees have wired six and seven figures after a phone call that sounded exactly like their CFO. The famous cases involve big companies, but the tooling is cheap enough that small businesses are now targets too.
3. The MFA bypass.
This one surprises people: most multi-factor authentication can be phished. Modern attack kits sit between the victim and the real login page, relay the password and the six-digit code in real time, and steal the session. The employee did everything right, entered a real code, and the attacker is in the mailbox anyway. From there they read quietly for weeks, learn your invoice rhythms, and strike when a big payment is due.
What Doesn't Work Anymore
Spotting typos. Gone, as covered.
Annual training videos. A once-a-year compliance video does not change behavior against attacks this good.
One-time-code MFA alone. Codes from an app or text message are dramatically better than nothing, but they're phishable. They protect against password leaks, not against a live relay attack.
Trusting caller ID or a familiar voice. Both are now spoofable cheaply.
What Actually Works
Phishing-resistant MFA. Passkeys and hardware security keys (FIDO2) are bound to the real website. A fake login page can't relay them, period. Microsoft 365 and Google Workspace both support them today. Rolling this out to email and financial systems is the single highest-impact security upgrade most small businesses can make this year.
Callback procedures for money. Any change to payment instructions, any new wire, any "urgent" financial request gets verified by calling the requester back on a number you already have on file. Not the number in the email. Not a reply. This one policy defeats the entire impersonation category, including the voice clones, because the attacker can't receive your callback.
Dual approval on payments. No single person can change vendor banking details or send a wire above a threshold. Your bank can enforce this on their side too. Ask them.
Lock down the mail platform. Conditional access rules, alerting on suspicious inbox rules (attackers love auto-forwarding), DMARC enforcement so others can't spoof your domain, and modern email filtering that detects AI-generated impersonation patterns. Most businesses we assess have maybe a third of this turned on, and most of it is included in licenses they already pay for.
Short, frequent, realistic training. Five minutes a month with simulated phishing that looks like 2026 attacks, not 2015 attacks. The goal isn't catching every email. It's building one reflex: requests involving money or credentials get verified out-of-band, every time, no matter how legitimate they look.
The Mindset Shift
The old model was "train people to spot fakes." The new model is "assume the message could be fake and build processes that don't depend on spotting it." Perfect detection is impossible now. Verification procedures and phishing-resistant authentication don't care how convincing the fake is, and that's the point.
A Quick Self-Check
- Could one employee, acting on one email, change where a vendor payment goes?
- If your CFO's voice called accounting asking for an urgent transfer, is there a procedure that would catch it?
- Is your MFA a six-digit code, or a passkey?
- Would you know if an attacker set up a forwarding rule in someone's mailbox?
If any of those answers made you uncomfortable, that's the gap. We run email security assessments that cover all of this, and most of the fixes use tools you already own. Get in touch if you want a straight answer on where you stand.