OCTOBER IS CYBERSECURITY AWARENESS MONTH
Outsmarting AI-Powered Phishing & Deepfake Scams
Every October, the cybersecurity community observes Cybersecurity Awareness Month — a reminder that good security habits deserve fresh attention at least once a year. This year, one shift stands out above the rest: attackers are using artificial intelligence to make old scams new again. Phishing emails, phone calls, and even video calls no longer need to look sloppy or sound robotic to be convincing. For businesses like the clients AMCF Consulting works with, that means the rules for staying safe are changing too.
The New Face of an Old Threat
Phishing has always relied on urgency and impersonation, but generative AI has removed most of the friction that used to give scams away. Poor grammar and awkward phrasing — long the telltale signs of a fraudulent email — have largely disappeared, replaced by messages that mirror a company’s actual tone and formatting. Voice-cloning tools now need only a few seconds of audio, often lifted from a public video or voicemail greeting, to recreate a recognizable voice convincingly enough to fool a colleague on a phone call. And deepfake video has advanced to the point that fraudulent “executives” have appeared on live video calls to authorize wire transfers, a tactic already linked to losses in the tens of millions of dollars at organizations that assumed a face on a screen was proof enough.
Why This Matters for Your Organization
Small and mid-sized firms are frequent targets precisely because attackers assume — often correctly — that fewer verification layers stand between a convincing request and a completed transaction. A single AI-assisted business email compromise (BEC) attempt can cost far more than a year of security awareness training, and the reputational damage of a client data breach can outlast the financial hit. Awareness Month is a useful prompt to revisit whether your team’s instincts have kept pace with the tools now being used against them.
Practical Defenses Worth Reinforcing This Month
- Verify out-of-band. Any request to change payment details, move funds, or share credentials — especially one that arrives by email, voicemail, or video and carries urgency — should be confirmed through a second, independently initiated channel, such as calling a known phone number rather than one provided in the message.
- Adopt phishing-resistant authentication. Multi-factor authentication is still essential, but SMS codes can be intercepted or socially engineered. Where possible, move toward passkeys or hardware security keys, which are far harder to defeat even with a convincing pretext.
- Shore up email authentication. SPF, DKIM, and DMARC records make it harder for attackers to spoof your domain convincingly, and reduce the odds that a forged “internal” email reaches an employee’s inbox at all.
- Establish a code word for high-risk requests. A simple, private verification phrase for wire transfers or credential resets — agreed upon in advance, never shared over email — can stop a deepfake voice or video call cold.
- Refresh training with real examples. Static, annual training tends to fade. A short refresher built around this year’s AI-driven tactics keeps the risk concrete rather than theoretical.
- Confirm your incident response plan still works. Make sure employees know exactly who to contact — and how — the moment something looks wrong. Minutes matter once a fraudulent transfer is underway.
A Simple Starting Point
You don’t need to overhaul every process this month. Pick one control from the list above — out-of-band verification is often the highest-impact, lowest-cost place to start — and make sure everyone who handles payments, credentials, or sensitive data knows how to use it. Cybersecurity Awareness Month is less about a single campaign and more about building the habit of asking, “Is this really who it claims to be?” before acting.
AMCF Consulting is glad to help assess where your organization stands and prioritize next steps — reach out any time to talk through your team’s specific risks.
