For years the advice was simple: watch for bad spelling and odd grammar. That advice is out of date. Criminals now use the same AI tools everyone else does, and their emails read like they were written by your office manager.
The FBI has warned that generative AI lets criminals run fraud at a larger scale and make it more believable. That includes cloned voices, fake video and messages with none of the mistakes that used to give a scam away. For a busy front desk, that changes what a scam looks like.
The short version
- Perfect grammar no longer means a message is real.
- A voice can be copied. A familiar voice on a voicemail is not proof of who called.
- The best defense is a habit: verify any request for money, passwords or records by calling a number you already have.
What these scams look like in an office
- The voicemail from the doctor. A message that sounds like the owner asks the office manager to buy gift cards or move money before the end of the day.
- The vendor with new bank details. An email that looks like it came from your supplier or lab says they have changed banks and attaches an updated invoice.
- The payroll change. A message from an “employee” asks to update their direct deposit before the next pay run.
- The fake IT call. Someone claiming to be from your IT company or software vendor asks for remote access, a password, or the code that was just texted to your phone.
- The perfect email. A message that mentions a real coworker or a real invoice, written without a single mistake, with a link to “view the document.”
Why the old warning signs stopped working
AI cleans up spelling, grammar and tone in seconds, in any language. It can also work from what is already public. Your website lists your team. Your social media has video of people talking. Your vendors mention you as a customer. That is enough for a scammer to write a message that sounds like it comes from inside the office, or to imitate a voice your staff hears every day.
Six habits that stop most of it
- Call back on a number you already have. Any request involving money, bank details, passwords or patient records gets verified with a phone call to a known number. Never the number in the message.
- Two people for money changes. New vendor bank details and payroll changes need a second person to confirm before anything moves.
- Agree on a code word. The FBI suggests families pick a secret word to prove who is calling. The same idea works for an owner and an office manager.
- Nobody gets your login code. A legitimate IT provider or vendor will not ask you to read back a code sent to your phone.
- Slow down when it is urgent. Pressure to act right now is the one warning sign AI cannot remove.
- Make it safe to ask. Nobody should get in trouble for double-checking a request from the boss.
The technical side
Habits do most of the work, and the right tools back them up:
- Multi-factor authentication on email, remote access and your core business software.
- Email filtering that flags outside senders and lookalike domains.
- Regular security awareness training, including practice phishing emails.
- Tested backups, in case something gets through anyway.
This is the everyday work of cybersecurity and managed IT support: fewer bad messages reaching your team, and less damage when one does.
If someone falls for it
Speed matters more than blame. Tell your IT team right away, change the affected passwords, and call your bank if money moved. You can report the fraud to the FBI at ic3.gov. If patient or customer information may have been exposed, breach notification rules may apply, so bring in whoever handles compliance for your business.
Want to know how your team would handle it?
Xceltek helps practices and businesses with security training, email protection and round-the-clock support, backed by our sister company Cytek.
Common questions
Can AI really copy someone’s voice?
Yes. The FBI has warned that criminals use AI-generated audio to impersonate people, including in fake emergencies and to get into bank accounts. Treat a familiar voice as a reason to verify, not as proof.
What is the single best defense?
A call-back rule. If a request involves money, passwords or sensitive records, verify it by calling the person on a number you already have on file.
Does multi-factor authentication stop these attacks?
It stops a lot of them, which is why attackers now try to talk people into handing over the code. Turn it on everywhere, and never share a code with anyone who calls or messages you.
