Your team has probably gotten good at spotting the old warning signs. Bad grammar, a weird sender address, a logo that looks slightly off. Those tells are disappearing. Generative AI has made it trivial for scammers to write business email compromise messages that read exactly like a real colleague wrote them, and the data backing that up is not subtle.
A widely cited analysis from VIPRE Security Group found that roughly 40 percent of business email compromise emails already show signs of AI generation, with some composed entirely by an AI model rather than a human scammer typing in broken English from overseas. Security vendors tracking the trend into 2026, including Kaseya, have warned that AI-generated phishing didn’t just arrive, it became the default toolset attackers reach for first. For a Massachusetts small or mid-sized business, that shift changes the math on what “being careful” actually requires.
Why the Old Red Flags Stopped Working
Business email compromise has always relied on impersonation: a message that looks like it’s from your CEO, your vendor, or your bank, asking for a wire transfer, a password reset, or an invoice payment to a new account. For years, the giveaway was tone. Scripts translated from another language sounded stilted. Urgency was clumsy. A sharp employee could usually catch it on a second read.
AI language models erased that advantage almost overnight. A scammer can now feed a few scraped LinkedIn posts or a company’s own “About Us” page into a model and get back an email that matches your CEO’s actual writing style, references real projects, and uses the right internal shorthand. The same research found that 49 percent of all detected spam is now categorized as business email compromise, and malicious URL volume tied to these campaigns jumped 74 percent year over year. This isn’t a niche threat anymore; it’s become the dominant form of email-based fraud.
Who Attackers Are Actually Targeting
The instinct is to assume executives are the main target, and they are, but not exclusively. Attackers have learned that a convincing message to the right mid-level employee often works just as well, and draws far less scrutiny. The most commonly impersonated and targeted roles tend to fall into a predictable pattern:
- The CEO or owner, impersonated to pressure finance staff into an urgent, off-process payment.
- HR staff, targeted with requests to redirect an employee’s direct deposit to a new account.
- IT and helpdesk staff, impersonated to request password resets or MFA bypasses “on behalf of” a traveling executive.
- Accounts payable, sent a fake vendor invoice with updated banking details that looks identical to the real thing.
What ties these together is that none of them require breaking into your network. The attacker just needs one believable email and one employee moving fast enough not to double check.
What Actually Still Works Against This
Writing quality is no longer a reliable signal, so the fix has to move from “train people to spot bad writing” to “build process steps that don’t depend on writing quality at all.” A few things genuinely move the needle, and they’re not exotic:
- Require a second channel, like a phone call to a known number, before any wire transfer or banking detail change, no exceptions for “urgent” requests.
- Lock down email authentication (SPF, DKIM, and DMARC) so it’s harder for attackers to spoof your own domain against your vendors and clients.
- Deploy modern email filtering that looks at sender behavior and relationship history, not just keyword matching, since AI-written text slides right past old filters.
- Run realistic phishing simulations that use AI-generated lures, not the obviously fake ones from five years ago, so training reflects what people will actually see.
This is also where identity governance earns its keep. If an attacker does manage to trick someone into resetting a password or approving an MFA prompt, the blast radius should be contained by least-privilege access, not open because one account can touch everything. That’s a core part of the security stack work Cloud9 builds for clients, layered monitoring and access controls that assume someone, eventually, will click the wrong thing.
The Cost of Getting This Wrong
Business email compromise losses aren’t theoretical for small businesses, they’re often existential. A fraudulent wire transfer to an attacker-controlled account is, in most cases, simply gone. Banks have limited recourse once funds clear, especially across international transfers, and cyber insurance policies increasingly scrutinize whether reasonable controls, like callback verification, were in place before they’ll pay a claim. Insurers have reported business email compromise claims rising sharply as AI reshapes the threat, which means underwriters are asking harder questions at renewal time about exactly the controls described above.
The businesses that get hurt worst tend to share one trait: they treated email trust as a people problem to be solved with a training video once a year, rather than a process problem that needed hard stops built into how money and data actually move.
Building This Into Your Operations, Not Just Your Inbox
It’s tempting to treat AI-generated phishing as an email security problem that lives entirely inside Outlook or Gmail settings. In practice it touches nearly every part of how a business runs. Finance teams need a written, non-negotiable policy for verifying payment changes. HR needs the same for direct deposit updates. IT needs a documented process for handling password reset requests that doesn’t bend just because the requester claims to be the owner calling from an airport. None of this requires exotic technology, it requires deciding, in writing, before an attack happens, what your people are and aren’t allowed to do under pressure.
This is also where ongoing monitoring earns its value. Modern detection tools can flag the subtle signals a human reader misses entirely, like a login from an unusual location right before a suspicious email goes out, or a mail rule quietly added to forward finance correspondence to an outside address. Those signals rarely show up in the email text itself. They show up in the account activity around it, which is exactly why continuous monitoring matters more now than writing-quality training ever did.
Massachusetts businesses carry an added layer here too. Under the state’s data security regulation, 201 CMR 17.00, a business that loses personal information to a successful compromise has notification and documentation obligations regardless of how convincing the scam email looked. “We got fooled by a really good fake” is not a defense regulators or insurers tend to accept, which is one more reason the written process matters as much as the technology sitting behind it.
Frequently Asked Questions
How can we tell if an email was written by AI?
In most cases you can’t, reliably, by reading alone. Polished grammar and a natural tone are no longer signs of a legitimate email. Verification needs to happen through a separate channel, like a phone call to a known number, rather than through careful reading.
Is this only a risk for large companies with big wire transfers?
No. Attackers specifically target small and mid-sized businesses because the payloads are smaller but the controls are usually weaker, and a single successful request can still mean tens of thousands of dollars gone with little chance of recovery.
What’s the single highest-impact change we can make this month?
Put a mandatory callback verification step in place for any payment or banking detail change, with zero exceptions, even for requests that claim to be urgent or from the owner directly. It’s the one control that defeats nearly every version of this scam.
The Takeaway
AI hasn’t just made phishing emails look better, it’s removed the main defense most businesses have relied on for years: trusting your gut on how a message reads. The fix isn’t a smarter employee, it’s a process that doesn’t ask employees to be the last line of defense at all. Schedule a free security assessment with Cloud9.