In early 2024, a finance worker at the engineering firm Arup joined a video call with his company's CFO and several colleagues. He'd had doubts about the unusual payment request that preceded it - but on the call, everyone looked right and sounded right. So he made the transfers: fifteen of them, totalling $25 million. Every other person on that call was AI-generated, responding to him in real time.
That was two years ago, against a multinational. The tools have got cheaper and better since, and the targets have got smaller. Here is what that means for a business of five to fifty people - and the three procedures that stop it.
Phishing is already your most likely incident
Strip away the science fiction and the baseline is mundane: phishing was the most common attack on UK businesses last year, experienced by 38% of businesses, and 69% of those affected called it their most disruptive incident. Meanwhile only a quarter of businesses have a formal incident response plan.
What AI changes is not the existence of phishing but its quality. The tells we all learnt - clumsy English, generic greetings, odd formatting - were symptoms of scale: criminals sending millions of identical emails couldn't personalise them. AI removes that constraint. A current phishing email can be fluent, reference your actual clients or projects (scraped from your website and LinkedIn), match your MD's writing style, and arrive at a plausible moment - the day an invoice is genuinely due, or while the boss is visibly abroad on social media.
In other words: the era of spotting fakes by looking at them is over. That's not defeatism; it just relocates the defence.
The voice and video versions
Voice cloning needs a small sample of someone's recorded speech - a conference appearance, a podcast, a company video. From that, software can generate that voice saying anything, live, on a phone call. The typical pattern is a call to a bookkeeper or office manager: the "MD", stressed and in a hurry, needs a supplier paid today, and asks them to keep it quiet because the deal is sensitive.
Notice what the attack really targets. It is not a technology exploit; it is a courtesy exploit. It works because the victim doesn't want to insult the boss by double-checking, doesn't want to be the person who slowed a deal down. The Arup employee had doubts - the call is what dissolved them.
Small businesses assume they're beneath this. It's the reverse: an attacker needs days of preparation to fool a bank, and about an hour - one website, one LinkedIn page, one voice sample - to prepare a convincing run at a ten-person firm where a single person controls payments and everyone trusts everyone.
Three procedures that beat it
None of these require buying anything. They require agreeing them in advance and writing them down - a procedure invented during the attack always loses.
1. Second-channel verification for money and credentials. Any request to move money, change payment details or share credentials gets verified on a different channel than the one it arrived on. An email from the MD? Call the MD - on the number in your phone, never one from the email. A phone call? Confirm by message to a known account. This single rule defeats the entire attack class, because the fraudster controls one channel, not two.
2. No exceptions for new bank details. A supplier "changing their account details" is one of the most reliable fraud patterns in existence. The rule: new details are always confirmed by calling the supplier on the number you already had on file - not the one in the notification. Board members and the MD follow the same rule, publicly, so no one can be pressured with "the boss said skip it".
3. Permission to be slow. Write it down as policy: no legitimate payment in this company is so urgent that a 15-minute verification will sink it, and nobody will ever be criticised for checking. Urgency and secrecy are the attacker's only real tools once you can't trust your eyes and ears - remove their force in advance. Some firms add a spoken code word for genuinely sensitive verbal approvals; fine, but the "slow is allowed" rule matters more.
Underneath these, the basics still carry weight: multi-factor authentication everywhere (so a phished password isn't enough on its own), and payment approval split between two people above a threshold. Those basics are also most of what Cyber Essentials asks for since the April 2026 update, and our two-minute security check will tell you where you currently stand on them. If you did nothing but MFA and rule 1, you would be ahead of most of the attacks that will actually reach you.
Procedure beats detection
The security industry's reflex answer to AI phishing is AI defence - detection tools that score emails and flag anomalies. Some of that is genuinely useful, and for a larger firm worth having. But we think it's the second step, not the first. Tools filter; they don't decide. The Arup case wasn't a filtering failure - a human was talked out of his own doubts. The cheapest, most robust defence a small business can deploy this month is a set of rules that don't care how convincing the fake is. Procedure first, products after.
The honest caveat: nothing here makes you unphishable. Someone in a hurry on a bad day will always be catchable - which is exactly why the rules must be written, shared and blame-free. The goal isn't a team that never gets fooled. It's a business where being fooled once doesn't cost £200,000, because the second channel caught it.
Sources
- GOV.UK - Cyber Security Breaches Survey 2025/2026 (DSIT & Home Office, 30 April 2026)
- Hong Kong Police Force - 2024 deepfake fraud case statistics (2025/26 estimates reply)
- CNN Business - Arup revealed as victim of $25 million deepfake scam (May 2024)
- NCSC - Phishing attacks: defending your organisation
Want these three rules written into a one-page policy for your team - and your accounts setup checked while we're at it? That's ordinary work under IT support for business. Get in touch.
