Article summary: Business owners and executives are the highest-value targets in any organization yet their personal phones, laptops and home computers are often the least secured devices. Executive device security requires the same structured approach applied to employee endpoints. Protecting the gatekeeper protects the entire business.
Read more
Article Summary: AI-enhanced fraud is changing how criminals target finance teams (especially Accounts Payable). Attackers can use AI to produce convincing emails, realistic invoices and even cloned voices that bypass the red flags teams once relied on. The most effective defense combines stronger verification steps, tighter payment processes and a culture where pausing to confirm details is always supported.
It is a statistic that sends a shiver down the backs of SME owners, managers and employees.
According to the FBI's 2025 Internet Crime Report, business email compromise (BEC) cost US businesses more than $3 billion last year.
This makes it one of the most financially damaging cybercrimes on record.
AI has made these attacks harder to detect. The question for AP teams is no longer whether they can identify suspicious requests. It is whether the processes around payments make fraud difficult regardless of how convincing it looks.
Why AP Teams Are in the Crosshairs
Accounts payable sits at the intersection of trust and timing. AP teams process invoices, manage supplier details and execute payments often under pressure to keep operations running smoothly.
For attackers, that combination is ideal.
Most successful fraud does not involve breaking into systems.
The FBI's Internet Crime Complaint Center (IC3) has consistently found that BEC attacks rely on impersonation. This involves posing as a trusted executive, supplier or internal colleague to redirect payments or update bank details before anyone notices.
AI has made that impersonation dramatically more scalable.
Where it once required skill and time to craft a convincing request, tools are now widely available that automate the research, writing and contextual tailoring that make fraud blend into normal AP workflows.
By mid-2024, an estimated 40% of BEC phishing emails were already AI-generated with that share expected to grow significantly.
What AI-Enhanced Fraud Looks Like in Practice
Emails That Blend into Normal Workflow
Traditional phishing relied on volume and imperfection. AI has changed that.
Modern BEC emails are grammatically correct and written in the specific tone of the executive or supplier being impersonated. They reference active projects, current invoice numbers and upcoming payment runs.
For AP teams processing high volumes of routine communications, that level of familiarity is exactly what lowers the guard.
Invoice and Payment Redirection
One of the most common AP fraud patterns involves payment redirection.
Attackers may intercept a legitimate invoice exchange and quietly alter the destination account. They then send a short message claiming a supplier has updated its banking details or re-issue a real invoice with minor modifications.
The surrounding content looks entirely legitimate because it is drawn from real correspondence.
Voice Cloning and Executive Impersonation
Email isn’t the only channel being exploited.
AI voice-cloning tools can replicate a person’s voice from a short audio sample. That makes it possible to leave convincing voicemails or place calls that sound like a known executive.
For AP teams accustomed to verbal approvals on high-value or urgent payments, this removes one of the few remaining verification methods that email security alone cannot address.
Why Traditional Checks No Longer Work
Security awareness training still matters and investing in it remains worthwhile. However, AI has changed what AP teams are up against.
Attacks no longer contain the signals that training programs once focused on like awkward phrasing, mismatched logos, odd sender addresses or generic greetings.
Modern fraud emails can reference the recipient's organization, active suppliers and current invoice values drawn from publicly available or previously intercepted sources.
When a fraudulent request is indistinguishable from a legitimate one, placing the burden of detection on the AP team puts it in the wrong place.
The organizations that reduce risk are not asking staff to be more suspicious. They are building verification processes that work independent of how a message looks.
Building Process Around the Risk
The most effective defense is not sharper instincts. It is removing ambiguity from high-risk actions.
Out-of-band Verification as Standard
Any request to change supplier bank details or approve an urgent payment outside the normal cycle should require secondary confirmation through a known independent channel (not a reply to the same email thread). Calling a supplier on a number already on file or confirming with a colleague directly breaks the impersonation chain regardless of how convincing the original request appeared. This step does not require technology. It requires a written procedure and the team's habit of following it.
Layered Access and Authentication Controls
Restricting access to financial systems and enforcing multi-factor authentication limits the damage a compromised account can cause. If an attacker gains access to a vendor's email, MFA requirements on the receiving end create friction that can slow or stop a fraudulent change before any money moves.
A Culture that Supports Slowing Down
Fraud prevention improves when staff feel safe questioning requests (including from senior leadership).
A team member who pauses a payment to verify it is not being obstructive. They are doing exactly what good process requires.
Building that culture starts with leadership modeling the behavior and making clear that slowing down on high-risk actions is always the right call.
The FBI's 2025 Internet Crime Report included a dedicated AI section for the first time and logged more than $893 million in AI-enabled scam losses across more than 22,000 complaints.
When verification is standard and questioning is encouraged, AI-enhanced fraud loses much of its advantage.
The technology attackers use is advancing quickly but the process controls that contain the damage do not need to be complicated. They need to be consistent.
Shift the Burden from People to Process
Concerned about AI-enhanced fraud targeting your finance teams or clients?
Contact us or schedule a consultation to review your current controls and identify where the most important gaps are.
Article FAQs
Why are Accounts Payable teams targeted so often?
AP teams manage payments and supplier details which makes them a direct path for attackers to move money without breaching technical systems.
Can awareness training alone stop AI-driven fraud?
No. Awareness helps but AI scams often look legitimate. Strong verification processes are essential.
Is voice-based fraud really a risk?
Yes. AI voice cloning allows attackers to impersonate executives convincingly which makes phone-based approvals vulnerable.
Article Summary: Adversary-in-the-Middle (AiTM) attacks are a modern phishing technique that steals active login sessions instead of just passwords. Understanding how AiTM works helps businesses reduce exposure to phishing-resistant sign-ins, tighter session controls and faster detection of suspicious access.
You click a link, sign in, approve the MFA prompt and get on with your day while completely unaware that someone else just logged into your account at the same moment.
That scenario surprises many businesses and particularly those that rely on multi-factor authentication (MFA) to protect cloud accounts. However, this is exactly how Adversary-in-the-Middle (AiTM) phishing attacks work.
Rather than stealing passwords for later use, these attacks silently hijack an already-authenticated session in real time.
MFA remains a core control and getting it implemented correctly is still a critical first step for any business.
AiTM attacks exploit something MFA was never designed to protect which is the trusted session that exists after authentication has already completed.
Phishing Has Moved Beyond Passwords
Phishing remains the most common starting point for account compromise but the objective has changed.
Traditional phishing collected usernames and passwords. Modern phishing is after something more immediately useful which is the authenticated session itself.
Security researchers have documented a significant shift toward session and token theft where attackers intercept the authentication process as it happens.
Rather than reusing stolen credentials (which MFA typically blocks) they wait until the user successfully completes login and then steal the session token that proves it already occurred.
The technique has matured quickly. Phishing-as-a-Service (PhaaS) platforms now supply ready-made proxy toolkits that let even low-skilled attackers run AiTM campaigns targeting Microsoft 365 and Google Workspace.
How AiTM Attacks Actually Work
The fake login page that isn’t fake.
An AiTM phishing site is not a basic replica of a login page. It is a live reverse proxy.
The attacker’s infrastructure sits between the user and the real authentication service. Every keystroke, redirect and server response flows through the attacker’s system in real time. From the user’s perspective, nothing looks wrong.
The page behaves exactly like the real service with correct branding, working redirects and a functioning MFA prompt. In most cases, the only clue is a slightly altered URL that goes unnoticed on a mobile screen or when someone is under time pressure.
Why doesn't MFA stop it?
This is where many security assumptions fall apart.
MFA protects the moment of authentication but not what comes after it.
Once a user successfully completes MFA, the service issues a session cookie. What this means is that the cookie signals to the application that the user is already verified. From that point, no password or MFA prompt is required. The system trusts the token. Whoever holds the cookie holds the access.
AiTM attacks simply wait for that cookie to be issued and then steal it.
Microsoft tracked a 146% rise in AiTM attacks over the past year as cybercriminals increasingly shift focus to accounts already protected by MFA.
Much of this increase is driven by PhaaS platforms like Evilginx that allow even low-skilled attackers to run convincing reverse-proxy campaigns at scale while targeting major cloud identity providers with minimal setup.
Session Cookies
Session tokens act as bearer credentials. Whoever possesses the token can access the account with no password or MFA challenge required.
Once the cookie is stolen, the attacker imports it into their own browser and immediately resumes the session.
This is a session replay attack. The attacker does not log in. They pick up where the legitimate user left off inside a fully trusted and already-verified session.
What Happens After a Session Is Stolen
The aftermath of an AiTM attack tends to be quiet which is precisely what makes it dangerous.
The attacker is operating inside a legitimate authenticated session. There are no failed MFA attempts, no unusual login alerts and nothing in standard sign-in logs to signal a problem.
Research from Proofpoint shows that attackers who gain access through session hijacking commonly create hidden inbox rules to redirect mail, register additional MFA methods to lock in persistent access, monitor email threads for financial conversations and use the trusted account to launch phishing campaigns against internal colleagues or finance teams.
These follow-on actions are a key reason AiTM attacks are frequently uncovered late after financial fraud, data exposure or wider network compromise has already begun.
Reducing Your Exposure
MFA is still essential. Building strong authentication practices remains the starting baseline but reducing AiTM risk requires controls that extend beyond the login event itself.
Adopt Phishing-Resistant MFA
Methods like FIDO2 hardware keys and passkeys bind authentication to the specific device and the legitimate domain. A proxy in the middle cannot relay them. The process fails if the URL is not the real one.
The Canadian Centre for Cyber Security analyzed over 100 AiTM campaigns targeting Microsoft Entra ID accounts. It found that phishing-resistant MFA consistently blocked session theft where standard MFA methods (including push notifications and one-time passcodes) did not.
Tighten Conditional Access Policies
Detecting AiTM compromise typically means watching for activity after login: new MFA method registrations, inbox rules created outside business hours, access from unfamiliar locations or unusual data activity.
Authentication logs alone will not surface the problem.
Train Users on URL Awareness
Employees who understand that a working MFA prompt on an unfamiliar-looking page still represents a risk are better positioned to pause, check the URL and report before a session is compromised. A brief team walkthrough of what AiTM lures look like in Microsoft 365 contexts can meaningfully reduce exposure.
Stop Protecting Just the Login Screen
MFA is a baseline rather than a finish line. The businesses that reduce AiTM risk are the ones that understand how sessions, tokens and identity trust actually work and they build controls around each layer rather than just the login screen.
Want to review your identity security controls?
Contact us or schedule a consultation to identify the gaps that matter most before an incident does it for you.
Article FAQs
What is an Adversary-in-the-Middle (AiTM) attack?
An AiTM attack is a phishing technique where attackers use a proxy to intercept login sessions in real time which allows them to steal session cookies after authentication completes.
Can AiTM attacks bypass MFA?
Yes but not by breaking MFA. AiTM attacks wait until MFA succeeds and then steal the authenticated session token so no further verification is required.
How can businesses reduce the risk of AiTM attacks?
Using phishing-resistant MFA, tightening conditional access policies, training users and monitoring for unusual session behavior all help reduce exposure.
MFA is a strong front-door lock. However, it is not the only thing that decides whether someone can get in.
After you sign in, your browser keeps you logged in using a session token (often stored as a session cookie). It is the digital version of a wristband at an event. Once you have been checked, the wristband proves you belong there. If an attacker steals that wristband, they may not need to beat your MFA prompt at all.
That is the core of session cookie hijacking. The attacker isn’t “cracking” MFA. They are skipping it by replaying your already authenticated session.
This is not a reason to stop using MFA. It is a reason to stop treating MFA as the finish line.
When sessions can be stolen, the practical defense shifts to layered controls: phishing-resistant sign-ins, device hygiene, tighter session policies and detection that catches suspicious access early.
Why MFA Isn’t a “Game Over” Control
MFA is still one of the best upgrades most businesses can make but it doesn’t end an attack on its own. The reason is that attackers don’t always try to beat the login step. They try to go around it.
Cloudflare notes that “attackers are finding new ways to circumvent MFA” and that modern incidents are rarely one isolated technique. They are part of a chain of attacks.
In other words, MFA can block a lot of credential theft but it doesn’t automatically protect what happens after a user successfully signs in.
That is where session cookie hijacking comes in.
Microsoft has described adversary-in-the-middle phishing campaigns where attackers use a reverse-proxy site to “steal and intercept” a user’s password and the session cookie that proves they have an authenticated session.
This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They are reusing the session.
What a Session Cookie Is and Why Attackers Want It
When you sign into a web app, the site needs a way to remember that you have already proved who you are. That is what a session is. It is a temporary “logged-in” state that saves you from entering your password and MFA code on every click.
Kaspersky explains that session hijacking is “sometimes called cookie hijacking” because cookies are commonly used to store the session identifier that keeps you authenticated.
Attackers want that session identifier because it is the shortcut.
Proofpoint describes session tokens as digital “keys” that let a user stay authenticated. It warns that stealing valid tokens lets attackers impersonate legitimate users and potentially bypass authentication measures “like MFA.”
That is why session cookie hijacking is so highly leveraged.
If an attacker can steal the cookie or token that represents your active session, they are not trying to defeat the login process. They are attempting to reuse what you already completed and access the same apps and data as if they were sitting at your keyboard.
How Session Cookie Hijacking Actually Happens
A lot of teams picture “account takeover” as someone guessing a password or tricking a user into approving an MFA prompt.
Session cookie hijacking is different. The attacker’s goal is to steal the proof that you are already logged in and then reuse it without triggering another sign-in challenge.
1.) AiTM Phishing
Adversary-in-the-middle (AiTM) phishing is the “proxy login” trap.
You think you are signing into a normal service but you are actually signing into a lookalike page that sits between you and the real site. The attacker relays the login in real time so everything appears to work (including MFA).
Attackers use AiTM phishing sites to “steal and intercept” a user’s password and the session cookie that proves the authenticated session. This is “not a vulnerability in MFA”. The attacker isn’t breaking the MFA. They are capturing the session after MFA is completed and reusing it.
One such campaign “attempted to target more than 10,000 organizations” since September 2021 which shows how scalable this approach has become.
2.) Browser-in-the-Middle Session Stealing
Browser-in-the-middle (BitM) is similar in spirit but it is even more “hands-on” from the attacker’s side.
Instead of stealing a password and running away, the attacker effectively places themselves in control of the browsing session.
Google’s threat intelligence says, “Stealing this session token is the equivalent of stealing the authenticated session.” Once the token is stolen, “an adversary would no longer need to perform the MFA challenge”.
In other words, the attacker isn’t trying to authenticate instead of you. They are trying to ride along after you have authenticated.
3.) Cookie Theft from the Endpoint
Not every session hijack starts with a fancy proxy. Sometimes the attacker simply steals session data from the device itself.
Stealing valid session tokens allows attackers to impersonate legitimate users. Tokens act like digital “keys.” If an endpoint is compromised, those “keys” can be extracted and reused.
Invicti explains that an attacker steals HTTP cookies and can gain access. The goal is often to obtain sensitive information stored in cookies.
MFA Is a Baseline Rather Than a Finish Line
MFA is still essential. It blocks a huge amount of credential theft and makes basic account takeover harder. However, session cookie hijacking is a reminder that attackers don’t always try to defeat the login step. Sometimes they reuse what happens after it.
The practical response is layered and realistic. Make phishing harder to pull off and treat device health as part of identity. Tighten session behavior for high-risk apps. Watch for suspicious access patterns that suggest a session is being replayed.
When those controls work together, MFA stops being a comforting checkbox and becomes what it should be: a strong baseline that is backed by protections around the session itself.
Contact us today for help protecting your login sessions from hijacking.
Article summary: The problem with passwords is not that employees choose weak ones. The entire model of shared secrets is fundamentally brittle and complexity rules don't change that. Going passwordless means a phased transition through stronger authentication layers toward a future where credentials can't be phished or stuffed. This passwordless office guide covers what that transition looks like in practice starting with MFA, rolling out passkeys for primary accounts and consolidating remaining apps under SSO.Read more
Article summary: Browser extensions feel small but they operate inside your browser with access to passwords, session tokens, browsing activity and the content of every page your team visits. A quarterly audit process, a clear approval path and permission-based review close most of these gaps without disrupting how your team works.Read more
A fake recruiter message is one of the cleanest social engineering tricks around because it doesn’t look like a trick.
That is why LinkedIn recruitment scams work so well inside real businesses.
They don’t arrive as malware. They arrive as a normal conversation that nudges someone toward one small action. Click this link, open this file, “verify” this detail and move the chat to a different app.
A few simple checks, a couple of hard-stop rules and an easy way to report suspicious outreach can shut these scams down without slowing anyone down.
LinkedIn Recruitment Scams
LinkedIn recruitment scams artfully blend into normal professional behavior.
The message doesn’t look like a “cyber attack.” It looks like networking and it borrows credibility from recognizable brands, polished profiles and familiar hiring language.
At platform scale, the volume is also hard to wrap your head around.
Rest of World reports that LinkedIn said it “identified and removed 80.6 million fake accounts” at registration from July to December 2024. A LinkedIn spokesperson claimed “over 99%” of the fake accounts they remove are detected proactively before anyone reports them.
Even with that level of detection, enough scam activity still leaks through to reach real employees. That is especially true when scammers tailor their approach to what looks credible in a specific industry and location.
The other reason these scams succeed is that they follow a predictable persuasion pattern: urgency, authority and a quick push to “do the next step.”
The FTC describes scammers impersonating well-known companies and then steering targets toward actions that create leverage. These actions include handing over sensitive personal information or sending money for “equipment” or other upfront costs.
Once someone is rushed into treating the process as real, the scam doesn’t need to be technically sophisticated. It just needs the victim to keep moving.
The Scam Pattern Most Teams Miss
1. A polished approach on LinkedIn
The profile looks credible enough, the role sounds plausible and the message is written in a professional tone. The job post itself may still be oddly generic though.
Amoria Bond notes that fake job postings often “lack details” and lean on broad language to catch as many people as possible.
2. A quick push off-platform
The conversation shifts to email, WhatsApp/Telegram or a “recruitment portal” link. That shift is important because it removes the built-in friction of LinkedIn’s environment and makes it easier to send links, files and instructions.
3. A credibility wrapper: “assessment”, “interview pack” or “onboarding”
Airswift flags link/attachment requests and urgency tactics as common red flags. The story is usually something like: “Download this assessment”, “Review these onboarding steps” or “Log in here to schedule.”
Tag Apps
Make decisions visible and repeatable by tagging apps.
Microsoft explicitly calls tagging apps as sanctioned or unsanctioned an important step because it lets you filter, track progress and drive consistent action over time.
4. The pivot: money, sensitive info or account takeover
Scammers impersonate well-known companies and then ask for things legitimate employers typically don’t: payment for “equipment” or early requests for personal information.
Another variation is more subtle: “verification” steps that are really designed to steal identity details or compromise accounts.
5. Pressure to keep moving
If someone hesitates, the scam leans on urgency: “limited slots”, “fast-track hiring” or “complete this today”. That is why Forbes frames the key skill as slowing down and checking details because the scam depends on momentum.
Red Flags Checklist for Staff
Here are the red flags to look out for.
Red flags in the job posting
- The role is oddly vague or overly broad. Generic responsibilities, unclear reporting lines and “we will share details later” language are common in fake listings.
- The company's presence doesn’t match the brand name. Thin company pages, inconsistent logos/branding or a web presence that feels incomplete are worth pausing on.
- The process is “too easy and too fast.” If the listing implies immediate hiring with minimal steps, treat it as suspicious.
Red flags in recruiter behavior
- They push you off LinkedIn quickly. Moving to WhatsApp/Telegram or personal email early is a common tactic.
- They use a personal email address or unusual contact details. Be specifically cautious of recruiters using free webmail accounts instead of a company domain.
- They avoid verification. If they dodge basic questions, treat that as a signal rather than a scheduling issue.
Hard-stop requests
- Any request for money or fees. Application fees, equipment purchases, “training costs”, gift cards or crypto is a hard stop.
- Requests for sensitive personal info early. Bank details, identity documents, tax forms or “background checks” before a real interview process is established.
- Requests for verification codes. If anyone asks you to read back a one-time code sent to your phone/email, assume they are trying to take over an account.
- Requests for non-public company information like org charts, internal system details, client lists, invoice processes and security tools. Look out for requisitions for anything beyond what a recruiter would reasonably need.
Stop Scams With Simple Defaults
LinkedIn recruitment scams don’t succeed because staff are careless. They succeed because the outreach looks normal, the process feels familiar and the next step is always framed as urgent.
The fix isn’t turning everyone into an investigator. It is setting simple defaults that make scams harder to complete. Slow down before clicking, verify the recruiter and role through official channels, keep conversations on-platform until identity checks out and treat money requests, code requests and early personal data demands as hard stops.
When those habits are standardized, the scam loses its leverage.
Reach out to us today to make sure you have the latest tools to fight this and other types of scams.
At home, security incidents don’t look like dramatic movie hacks. They look like stepping away from your laptop during a delivery or leaving it unlocked while you grab something from another room.
Those ordinary moments repeated over time are how work devices end up exposed.
A remote work security checklist focuses on simple and practical controls that hold up in real life. Put it in place once, make it routine and you will prevent the kinds of issues that hurt most because they were entirely avoidable.
Why Home Is a Different Security Environment
A work laptop doesn’t magically become “less secure” at home. However, the environment around it does.
In the office, there are built-in boundaries: fewer shared users, fewer casual touchpoints and more predictable networks. At home, that same laptop is suddenly operating in a space designed for convenience rather than control.
For starters, physical exposure goes up.
At home, devices move from room to room, sit on tables and countertops and are left unattended for short stretches throughout the day.
That is why a remote work security checklist must treat physical security as part of cyber security.
In its training on device safety, CISA stresses the basics: keep devices secured, limit access and lock them when you are not using them. Those simple habits matter more at home because there is no “office culture” quietly enforcing them for you.
Home is where work and personal life collide and that creates messy and very human risks.
The NI Cyber Security Centre is blunt about it. Don’t let other people use your work device and don’t treat it like the family laptop.
The network is different.
Home Wi-Fi often starts with default settings, old router firmware or passwords that have been shared with everyone who has ever visited.
CISA’s guidance on connecting a new computer to the internet offers the baseline steps many people skip at home. Secure your router, enable the firewall, use anti-virus and remove unnecessary software and default features.
Remote access raises the stakes for identity. In its remote workforce security guidance, Microsoft’s best practices frames remote security around a Zero Trust approach and emphasizes that access should be strongly authenticated and checked for anomalies before it is granted.
The Remote Work Security Checklist
Use this remote work security checklist as your “minimum standard” for company laptops at home. It is designed to be practical, repeatable and easy to enforce without turning everyone into part-time IT employees.
Lock the Screen Every Time You Step Away
Set a short auto-lock timer and get into the habit of locking manually even at home.
Store the Laptop Like It Is Valuable
Assume that “out of sight” is safer than “out of the way.” When you are finished, store your device somewhere protected rather than on the couch, the kitchen counter or in the car.
Don’t Share Work Laptops with Family
At home, good intentions can still lead to accidental clicks. Even a quick “just checking something” can result in risky downloads, unfamiliar logins or unwanted browser extensions.
Use a Strong Sign-In and MFA
Use a long passphrase instead of a clever but short password and never reuse it across accounts. Treat multifactor authentication (MFA) as a baseline requirement instead of a nice extra.
Stop Using Devices That Can’t Update
If a laptop can’t receive security updates, it is not a work device. It is a risk.
Patch Fast
Updates are where most known issues get fixed. The longer you wait means the bigger the risk. Enable automatic updates and restart when prompted.
Secure Home Wi-Fi Like It Is Part of the Office
Use a strong Wi-Fi password and enable modern encryption. If your router still has the default admin login or hasn’t been updated in a long time, consider that your cue to fix it.
Use the Firewall and Keep Security Tools Switched On
Turn on your firewall, keep antivirus software active and make sure both are properly configured. If security tools feel inconvenient, don’t switch them off. Address the friction instead.
Remove Unnecessary Software
The more apps you install means the more updates you need to manage and the more opportunities there are for something to go wrong. Remove software you don’t need, disable unnecessary default features and stick to approved applications from trusted sources.
Keep Work Data in Work Storage
Storing work data in approved systems keeps access controlled, audit-ready and much easier to recover if something goes wrong. Avoid saving work documents to personal cloud accounts or personal backup services.
Be Wary of Unexpected Links and Attachments
If a message pressures you to click, open, download or “confirm now” treat it as suspicious. When in doubt, verify the request through a separate trusted channel before taking any action.
Only Allow Access From “Healthy Devices”
The safest remote setups gate access based on device health. Microsoft warns that unmanaged devices can be a powerful entry point and stresses the importance of allowing access only from healthy devices.
Are Your Laptops “Home-Proof”?
If you want remote work to remain seamless, your devices need to be “home-proof” by default.
That means treating the fundamentals as non-negotiable: automatic screen locks, secure storage, protected sign-ins, timely updates, properly secured Wi-Fi and work data stored only in approved locations.
Nothing complicated. Just consistent execution.
Start by adopting this remote work security checklist as your baseline standard. When the defaults are strong, you reduce avoidable incidents without slowing anyone down.
If you would like help turning these basics into a practical and enforceable remote work policy, contact us today. We will help you standardize protections across your team so remote work stays productive and secure.
Article summary: AI voice cloning has made it possible for attackers to call your accounts payable team sounding exactly like your CEO and the requests they make follow a predictable formula. Deepfake voice scams are an evolution of business email compromise and AP teams are the primary target because they can move money. A simple voice check playbook is the most effective defense available.
The call sounds like your CFO. The cadence is right. The urgency is familiar.
A wire transfer needs to go out today. It is confidential. The normal approval process doesn't apply this time.
This is a deepfake voice scam and accounts payable teams are its most valuable target. Not because they are careless but because their job is to move money quickly when leadership asks.
Building strong controls around financial approvals is no longer just about locking down system access. It is also about what happens when the phone rings and the voice on the other end sounds exactly right.
Why Accounts Payable Teams Are the Primary Target
Accounts payable (AP) teams handle what attackers care about most which is payments. They process invoices, authorize wire transfers and manage vendor banking details. They are also trained to respond quickly to requests from leadership when a request comes marked urgent and confidential.
That combination of financial authority and habitual responsiveness makes AP teams the top target for impersonation-based fraud.
Business email compromise (BEC) has been among the most expensive fraud categories in the US for years. This is where attackers impersonate an executive or vendor over email to redirect payments. Now attackers are adding voice to the same playbook.
Business email compromise cost US businesses $2.77 billion in 2024 alone.
According to the FBI's 2024 Internet Crime Complaint Center report, BEC ranked as the second-highest source of financial losses across all cybercrime categories with over 21,000 complaints filed that year. Adding a cloned voice to the same attack makes the deception significantly harder to dismiss.
How a Deepfake Voice Scam Actually Works
A deepfake is AI-generated audio, video or both that realistically replicates a real person. In a voice scam, the attacker builds a voice clone from publicly available recordings.
Voice cloning tools require only a few seconds of sample audio to produce a convincing replica. The result matches the target's tone, cadence and accent closely enough to mislead people who speak with them regularly.
The FTC has flagged voice cloning as one of the most difficult scams to detect because it exploits a form of trust people aren't trained to question which is recognizing a familiar voice.
More than 1 in 4 executives say their organization has already faced a deepfake fraud attempt targeting financial or accounting data.
In a Deloitte poll, 25.9% of executives reported at least one deepfake incident in the past year and 51.6% expect attacks to increase.
The formula across every documented case is consistent: Authority (a trusted figure is calling), urgency (it needs to happen today) and secrecy (don't involve anyone else). These three levers are chosen specifically to suppress the verification habits that would otherwise stop the transfer.
It is the same impersonation logic behind reply-chain phishing attacks where attackers hijack trusted conversations to manufacture compliance. The difference is that voice is far harder to dismiss in the moment.
Three Scenarios Your AP Team Should Know
The details change. The structure doesn't.
The Urgent Wire Transfer
The "CFO" or "CEO" calls directly about a same-day transfer for a confidential deal. There is always a reason the normal approval chain shouldn't apply.
In early 2024, engineering firm Arup lost $25 million after a finance employee was convinced by a video call in which every participant (including the CFO) was AI-generated.
The Vendor Account Change
A familiar supplier calls to notify the AP team that their banking details have changed. The voice matches the contact on file. The request seems routine. This version is effective because it doesn't require an immediate transfer.
The Confidential Deal
An executive calls ahead of a public announcement and asks for a payment to move before news breaks. The secrecy framing is what makes this version effective. It gives the target a built-in reason not to verify with colleagues.
Your AP Team's Voice Check Playbook
The strongest defense against a deepfake voice scam isn't a detection tool. It is a consistent process your team follows every time regardless of how convincing a call sounds.
1. Never approve a payment based on a call alone.
A phone call is a heads-up rather than an authorization. Any payment request or account change should require confirmation through a second and pre-established channel before anything moves. Think of it as multi-factor verification for financial approvals. One input is never enough to confirm identity or intent.
2. Hang up and call back on a known number.
If a call creates urgency around a payment, hang up and call the person back on a number already verified in your systems. Not a number provided by the caller. Attackers can spoof caller ID and the number they give you may route directly back to them.
3. Set a team code word.
Pre-agreed verification phrases are a layer that voice technology cannot bypass. Ferrari executives foiled an executive impersonation attempt in 2024 simply by asking the caller a personal question the real CEO would have been able to answer.
4. Treat secrecy requests as a red flag.
Legitimate executives don't typically ask AP staff to bypass review processes or keep a payment confidential from colleagues. If a caller says "don't loop anyone else in" or "this needs to stay between us" treat that as a reason to escalate through official channels rather than a professional courtesy to honor.
5. Limit publicly available voice samples.
The FBI has warned that attackers harvest voice audio from public recordings including webinars, conference sessions, LinkedIn posts and social media. Encourage senior staff to think carefully about the volume of audio published under their name and particularly recordings where they speak at length.
Ready to Build Your Team's Defense?
Deepfake voice scams work because the voice sounds like someone your AP team already trusts. The protection isn't a technical product. It is a set of habits.
The businesses that stop these attacks aren't necessarily better equipped. They are just harder to rush.
Contact Sound Computers to schedule a consultation. We can help you put a practical AP security protocol in place and make sure your team knows what to listen for. Call us at (860) 577-8060, reach us online or email info@soundcomputers.net.
Article FAQs
What is a deepfake voice scam?
A deepfake voice scam uses AI-generated audio to impersonate someone you recognize and persuade you to take a financial action. The voice is cloned from publicly available recordings and the result can be convincing enough to fool people who interact with that person regularly.
Why are AP teams specifically targeted?
AP teams have direct authority over payments and are trained to respond quickly to instructions from leadership. That combination of financial control and responsiveness to urgency is exactly what attackers need.
How do attackers clone someone's voice?
Voice cloning software can produce a convincing replica from just seconds of audio sourced from webinars, recorded meetings, video posts or saved voicemails. The output closely matches the original speaker's tone, cadence and accent. Some tools are accessible to anyone with an internet connection and a free account.
What should my AP team do when they receive a suspicious call?
Hang up and call the person back using a number already verified in your systems rather than one provided by the caller. Require any payment or account change to be confirmed through a second channel before acting. If the caller emphasizes urgency or secrecy, treat that as a reason to pause and escalate rather than to proceed.
Article summary: Personal apps, personal cloud accounts and reused passwords on work devices create security gaps that IT rarely sees until something goes wrong. Shadow IT has grown sharply alongside remote and hybrid work and the most common risks are easy to miss. A few straightforward habits and clear policies close most of these gaps without disrupting how your team works day to day.
Most small businesses are thoughtful about who has keys to the building. Fewer are as deliberate about what employees are doing on their work devices at home.
A personal Gmail account used to share a work document. Personal cloud storage for a large file that needs to move quickly. A browser that auto-fills a personal login on a work machine along with every other saved credential.
These habits feel harmless in the moment. They are where data exposure quietly begins.
Closing these gaps doesn't require a major security overhaul. It starts with understanding where business security becomes a daily habit instead of just a policy document.
Why Everyday Habits Create Real Security Gaps
Shadow IT is the term for using apps, accounts or tools that haven't been reviewed or approved by your IT team. It is rarely intentional wrongdoing. Employees reach for familiar and convenient tools when the approved alternatives feel slower or harder to access.
The security problem is a visibility problem. IT can only monitor, patch and protect the tools it knows about. When work data flows through a personal cloud account, a personal messaging app or an unapproved browser extension, that data leaves the managed environment entirely.
A Dashlane survey of 1,500 employees found that nearly 4 in 10 people regularly use unapproved applications on company hardware.
Research cited by Cloudflare shows shadow IT usage increased 59% with the shift to remote and hybrid work with 54% of IT teams saying their organizations are significantly more exposed to a data breach as a result.
This isn't a fringe concern. It is likely happening across your business right now even if no one is tracking it.
The same dynamic applies to AI tools. Our guide on running a shadow IT audit walks through how to find what is being used without slowing your team down.
Where the Lines Blur Most Often
Shadow IT risk doesn't come from one single habit. It comes from the accumulation of small decisions that each seem reasonable on their own.
Password Reuse Across Personal and Work Accounts
When a staff member uses the same password for a personal streaming account or shopping site as they do for their work email, a breach of the personal account can expose the work one. Attackers count on this.
It is called credential stuffing. It is taking passwords stolen from one breach and automatically testing them across hundreds of other services. Your business doesn't need to be breached directly. A supplier, a retailer or any other service your employee uses personally can be the starting point.
According to Cybernews, only 6% of analyzed passwords were unique. The scale of credential reuse means that a breach at an unrelated service is (statistically) also a test of your work systems.
It is the same mechanism behind password spraying attacks. This is where attackers work systematically through common or previously exposed credentials until something opens.
Personal Cloud Storage for Work Files
Google Drive, Dropbox and iCloud are useful personal tools that employees often reach for when moving a large file or picking up work on a personal device. When work documents land in a personal cloud account, they are outside your organization's access controls, encryption policies and retention rules.
If that personal account is later compromised or the employee leaves the company, the data goes with them.
Browser Extensions and Personal Logins on Work Browsers
Many browser extensions have broad permissions like access to page content, form data and session activity across every site the browser visits. Personal extensions installed on a work browser may be sending data to third-party servers without the employee or IT team realizing it.
Saved personal passwords in a work browser profile create a separate risk. There is a hidden bridge between personal and professional credentials that standard security reviews rarely catch.
Personal Email and Messaging Apps on Work Devices
Sending a work file to a personal inbox to finish it at home is one of the most common habits in any office. It bypasses spam filtering, encryption standards and IT monitoring in a single step. Phishing attacks that reach a personal inbox where protections are often weaker can arrive on a work device and spread from there.
A Simple Habit Checklist for Your Team
None of these changes are technically complicated. The barrier is usually awareness and access to better defaults.
1. Keep work and personal browser profiles completely separate.
Most major browsers support separate profiles with different saved passwords, extensions and sync settings. A dedicated work profile means personal credentials don't auto-fill on work sessions and personal extensions don't have access to work activity. This single step eliminates a wide category of accidental data mixing.
2. Never reuse a password between a personal and work account.
CISA's Secure Our World program recommends using unique and strong passwords for every account and a password manager to make that realistic.
When every account has its own credential, a breach somewhere else stays contained. If your organization doesn't already provide a company-approved password manager, that is worth addressing.
3. Use company-approved tools for work files.
Before reaching for personal Dropbox or a personal Google account to move a work file, employees should know what the approved alternative is. Most businesses already have one like SharePoint, OneDrive or Google Workspace. Making those options easy to access removes the main reason employees default to personal tools.
4. Review browser extensions quarterly.
Set a simple reminder to check what extensions are installed on work browsers. Remove anything not actively needed for work and pay attention to extensions with broad site permissions. An annual or quarterly extension review is a quick task that closes a category of risk most security audits miss entirely.
5. Report unauthorized tools before they become a problem.
Employees often know they are using something unapproved but stay quiet because they don't want it removed. An open process where staff can flag what they are using or request approval for a new tool is far healthier than a policy that pushes the behavior underground. Visibility is the starting point for managing shadow IT risk.
Ready to Close the Gaps That Policies Miss?
Personal web habits are one of the most common sources of shadow IT risk in small businesses and one of the easiest to address once they are visible.
The fix isn't a complicated project. It is a clear inventory of what is being used, approved alternatives in place and a team that understands why the habits matter.
Contact Sound Computers to schedule a consultation. We can help you identify what is running on your network, establish practical policies your team will actually follow and close the gaps before they become a problem. Call us at (860) 577-8060, reach us online or email info@soundcomputers.net.
Article FAQs
What is shadow IT?
Shadow IT is the use of apps, tools, accounts or devices that haven't been approved or reviewed by your IT team. It is usually driven by convenience rather than intent but it creates gaps in visibility and security.
Why is password reuse between personal and work accounts risky?
When a personal account is compromised in a data breach elsewhere, attackers automatically test those same credentials against business systems. This is credential stuffing and it is one of the most common ways work accounts are accessed without authorization. Using a unique password for every account managed through a password manager is the straightforward fix.