AI phishing and deepfake fraud: how the latest attacks work

What is AI phishing?

AI phishing is phishing in which attackers use artificial intelligence to make their attacks more convincing, more personal and larger in scale. Generative AI can write a flawless email in perfect English in seconds, tailored to your job title, your employer and even a current project. What used to be manual work for an experienced fraudster can now be automated on an enormous scale.

In practice, we see AI appearing in three developments. First, phishing emails are becoming far higher in quality: no more clumsy sentences or spelling mistakes. Second, they are becoming more personal, because public information from LinkedIn, for example, is processed automatically (spear phishing at scale). Third, phishing is shifting from text to audio and video, with voice clones and deepfakes. Together, these three undermine exactly the signals people have been trained to spot.

Key point: AI lowers the cost and raises the quality of attacks. As a result, smaller organisations are also attacked more frequently and more convincingly.

Voice cloning and vishing

Vishing - phishing by phone - has been around for a while, but AI makes it far more dangerous. With voice cloning, a voice can be recreated from just a few seconds of audio, for example from a video on social media, a webinar or a recorded voicemail. The attacker then calls an employee while sounding like the director, a colleague from finance or a familiar supplier.

The scenario is often the same: there is haste, a payment has to be made urgently or login details have to be shared, and the request comes from a "trusted" voice. It is precisely that combination of authority, urgency and familiarity that makes the attack effective. Vishing is one of the attack types we cover in our overview of types of phishing attacks.

Deepfake video fraud

The most striking form is deepfake video fraud. Here the attacker deploys not only an imitated voice but also a lifelike moving image of a real person. A well-known example that made headlines worldwide in 2024 is a case in which an employee of a large company saw and spoke to several "colleagues" during a video call - including the finance director - who all turned out to be deepfakes. The employee reportedly transferred a sum of tens of millions before the fraud was discovered.

This technique fits seamlessly onto classic CEO fraud, in which criminals pose as management to force an urgent payment. Where that used to happen by email, it can now happen via a convincing video call. Read more about this attack type in our article on CEO fraud. The technology is becoming cheaper and more accessible, which means SMEs are becoming targets too.

QR code phishing (quishing)

Another growing form is quishing: phishing via a QR code. Instead of a clickable link, the email, letter or poster contains a QR code that leads to a fake login page. This approach is cleverly chosen for two reasons. First, the malicious destination is hidden inside an image, so the message slips past email filters more often, filters that would normally block suspicious links. Second, the victim usually scans the code with their personal phone, outside the secured corporate environment and its filters.

Quishing is often combined with a believable pretext: a "new" parking app, a parcel notification, or a mandatory MFA re-registration. The QR code looks neutral, which removes the usual reflex to check a link.

Why AI phishing hits SMEs in particular

There is a persistent misconception that advanced, AI-driven attacks only affect large multinationals. The opposite is true. Because AI dramatically lowers the cost of a convincing attack, criminals can now also target smaller organisations at scale, organisations that previously "did not pay off enough" for bespoke work. An SME often has fewer technical layers of defence, no dedicated security team and short lines of communication in which an urgent request from "the director" is carried out quickly.

Moreover, the information needed to personalise an attack is readily available: names and job titles on the website, a LinkedIn profile, a photo of the team, a recorded company video. AI processes those public sources automatically into a credible story. Precisely because SMEs are less aware of this threat, they are an attractive target - and all the more reason to prepare employees for it.

Why traditional recognition falls short

For years, awareness training taught employees to watch for spelling mistakes, a strange salutation and a hurried, impersonal tone. With AI phishing, those rules of thumb no longer work:

• No more spelling mistakes: AI writes flawlessly and in the right style
• Highly personal: messages refer to real colleagues, projects or suppliers
• Different channels: attacks come via phone, video or QR code instead of a clickable link
• Genuine-looking senders: the voice and image of known people are imitated

Defence therefore shifts from "spot the mistake" to "trust the process". What matters is not whether a message looks genuine, but whether the correct procedure was followed: was a payment request verified via a second, known channel? That principle holds up even when a message is imitated perfectly.

How do you test your organisation for this?

Knowing how vulnerable your organisation is to these new attacks starts with measuring. A realistic phishing simulation maps out how employees respond, without any real damage. What matters is that the scenarios move with the threat:

• Realistic, flawless phishing emails instead of recognisably poor examples
• Vishing scenarios that imitate telephone manipulation and authority
• CEO fraud and invoice fraud scenarios aimed at finance and management
• Quishing tests with QR codes to measure the reflex when scanning
• Clear agreements on verification via a second channel, and practising those agreements

CoBoo runs realistic phishing simulations for businesses, with scenarios that match current threats such as AI phishing, vishing and CEO fraud. This way you know where your organisation stands and where training has the greatest effect. You will find more background on what is phishing too.

A simulation is also not a one-off exercise. Because attack techniques evolve so quickly - a flawless email today, a deepfake video call tomorrow - periodic testing is essential. By deploying a new scenario every quarter or every six months, you keep employees sharp and see in black and white whether resilience is actually rising. That repeated measurement is also exactly what insurers and auditors increasingly expect.

Frequently asked questions

What is AI phishing?

Phishing in which criminals use AI to make attacks flawless, personal and large in scale, from generated emails to voice clones and deepfake videos.

What is voice cloning and how is it abused?

Recreating a voice with AI based on short audio. Attackers then call as "the director" or a colleague with an urgent request: an advanced form of vishing.

Are deepfake video attacks a real risk?

Yes. There are reported cases in which employees transferred large sums via a deepfake video call. The technology is becoming cheaper, and SMEs can become targets too.

What is quishing (QR code phishing)?

Phishing via a QR code that leads to a fake page. The code slips past email filters more often and is scanned with a phone, outside corporate security.

How do you protect your organisation against this?

Combine awareness, procedures and technology: train on the new forms, verify requests via a second channel, use MFA and test with realistic simulations.