If you look at any suburb this Halloween, you will see countless monsters roaming the streets. Vampires, creatures and ghouls all “wreaking havoc,” going to parties and trick-or-treating.
The real monsters, though, do not look like this. They do not announce themselves as a threat, even jokingly. They dress themselves up in the costume of harmless, helpful allies, and for a firm handling client funds, the costume only needs to work once.
While firms just like yours are using AI tools to supercharge security and productivity, cybercriminals are using this same power to disguise obvious threats with polish and poise.
As night falls and the monsters come out in full force on Halloween night, remember that keeping your firm safe does not mean becoming an expert scam-spotter. It means following a few core tenets of security to calmly recognize when you are faced with an AI-powered threat. Garlic around your neck will not help you here. It is all about these simple processes and safeguards.
Video and audio files used to be a clear differentiator between someone real and someone trying to scam you into moving client funds. Now, with AI, scammers can take many forms, providing realistic voice messages, calls or even videos to convince a member of your team that a request is legitimate, right down to sounding exactly like a client, a partner or an advisor authorizing a transfer.
Even if you can spot telltale signs of AI video or audio generation, those wrinkles are getting ironed out quickly. Your team might not be as good at spotting them as they think, since a lot of “AI tells” are already outdated.
Instead of depending on individual detection by a single employee, focus on hard verification that cannot be faked, especially for any request involving money movement or account changes. These shapeshifters present a new threat that can fool your ears and eyes, but they cannot fake a callback to a number already on file or a documented verification procedure.
In past years, phishing messages had spelling and grammatical mistakes that made them easy to spot. Typos, generic greetings, the overuse of urgent language and other flaws became the benchmarks your team learned to look for.
These same scams have much better costumes now. Dressing up these messages with perfect spelling, grammar, punctuation and readability gives them a sense of authority that many staff are not as skilled at seeing through, especially when the message references a real client or a real transaction your firm is handling.
Like an ancient mummy rising from the tomb, these scams are just as dangerous as they have always been, but with new, fresh wrapping that disguises how monstrous they really are. Move away from looking for issues within the message itself and look for red flags within the request. Do not let your guard down on a request just because the email is spelled correctly and reads well, especially one asking to change where a client’s funds are headed.
In vampire myths, innocents are protected by not inviting vampires into their homes, since these creatures cannot enter enclosed spaces without direct permission. AI works in a similar way. When staff use AI tools, especially those that are not approved by the firm, a phenomenon called Shadow IT, there are boundless opportunities to expose sensitive client data to unvetted programs.
An AI tool cannot go into your systems and read everything on its own, but it will not stop someone if they paste a client’s portfolio summary or account details into the prompt field and ask it to summarize the information. If your firm cannot answer where that information goes, where it would be stored and what the creator of the AI tool is able to do with it, it is not a tool that should be invited to access data your firm is responsible for protecting.
Advancements in AI have made deception tactics and security vulnerabilities cheaper to exploit, faster to implement and more convincing even to trained eyes, and for a firm managing client money, the cost of falling for one of these disguises is rarely small.
If your team can internalize a few small steps to verify before they act, even the most sophisticated disguises will not trip them up.
Need help protecting your firm against AI monsters coming for client data and client funds?
We will discuss how your team is using AI, how sensitive requests are verified and what protections you already have in place. You will leave knowing where your biggest gaps are, and what threats are seriously spooky this Halloween season.
Or call us at 1-833-231-6182.
Today’s fraud attempts don’t have typos or bad grammar anymore. Schedule a free discovery call to find out where your firm’s verification process could use reinforcement.
Every autumn, the medicine cabinet gets a little more crowded. There is cold medicine left over from last winter, vitamins bought in bulk, half-used bottles
It is 4:17 on a Friday afternoon. A bookkeeper receives an email that appears to be from a partner at the firm: “Can you update
October is Cybersecurity Awareness Month, and it is a good time to take stock of what your firm actually knows versus what it thinks it
