Category: blog
AI has changed email attacks in three areas
- Message quality
- Personalization
- Follow-up impersonation
Grammar errors are less common.
Generic templates are less common.
Attackers are using public information, breached mailboxes, language models, voice cloning, and automated reconnaissance to create more credible requests.
The result
Email security can no longer depend on employees identifying poor spelling or unusual wording.
Transaction verification is required.
The 2026 Attack Pattern
A current business email compromise campaign may follow this sequence
- Public information is collected about the business
- Executives, vendors, employees, and active projects are identified
- A personalized email is generated
- A legitimate mailbox or lookalike domain is used
- A payment, payroll, credential, or bank-detail change is requested
- A voice note or phone call is used to reinforce the request
- Pressure is applied before normal verification occurs
The request may appear to come from
- The owner
- The CFO
- A vendor representative
- An attorney
- A customer
- A bank
- A payroll provider
- A managed service provider
A familiar display name is not proof of identity.
A legitimate mailbox is not proof of authorization.
A familiar voice is not proof of authorization.
Business Email Compromise Has Expanded
Business email compromise traditionally involved compromised accounts, spoofed domains, and urgent payment requests.
AI improves each stage.
Better impersonation
Messages can be produced in the sender’s normal writing style.
Industry terms can be used correctly.
Active projects can be referenced.
Email threads can be summarized and continued.
A message may not contain the traditional warning signs.
Better timing
AI tools can identify when a request is most likely to succeed.
Examples include
- Payroll processing periods
- Vendor renewal dates
- Executive travel
- Acquisition activity
- Tax deadlines
- Construction or purchasing milestones
- Periods when accounting staff are unavailable
More targets
The objective may not be a wire transfer.
Attackers also target
- ACH instructions
- Payroll records
- Vendor bank accounts
- Tax forms
- Customer payment data
- Microsoft 365 or Google Workspace credentials
- Mailbox forwarding rules
- OAuth application permissions
- Remote access credentials
Small businesses are exposed when payment authority and administrative access are concentrated in one or two accounts.
Personalized Phishing Is Harder to Recognize
Personalized phishing messages are created from available context.
Sources may include
- Company websites
- Social media
- Job postings
- Press releases
- Email signatures
- Compromised mailboxes
- Public records
- Vendor portals
- Previous phishing campaigns
The message may mention a real customer.
The invoice may contain a real project name.
The sender may use a valid logo and a familiar signature.
The link may lead to a cloned Microsoft 365 or Google Workspace login page.
The attack is designed to bypass judgment based on appearance.
Controls must inspect sender identity, links, attachments, authentication events, and user behavior.
Deepfake Voice Notes Add a Second Channel
Voice cloning is being used to support email fraud.
An attacker may send an email requesting a payment or account change.
A follow-up call or voice note may then be used to confirm the request.
The audio may sound like
- The business owner
- A department manager
- A vendor contact
- A customer
- A legal representative
This creates false confidence.
The voice note is still part of the attack.
Caller ID is not sufficient verification.
A known voice is not sufficient verification.
Required payment protocol
High-risk requests should require
- Independent verification using a known phone number
- Two-person approval
- Verification through the accounting or vendor record
- A documented confirmation
- A delay for new payment destinations where practical
The phone number in the email should not be used.
The number in the signature should not be used.
The number displayed by caller ID should not be used.
Use a known contact path already stored in the company system.
Email Security Controls for 2026
1. Phishing-resistant MFA
MFA should be enabled for every mailbox.
Phishing-resistant methods should be prioritized
- FIDO2 security keys
- Passkeys
- Hardware-backed authentication
CISA identifies phishing-resistant MFA as the strongest MFA option and recommends FIDO authentication as a broadly available method for small businesses
Implementing Phishing-Resistant MFA
SMS-based MFA is weaker.
Password-only access should not remain enabled.
2. SPF DKIM and DMARC
Email authentication should be configured for every company domain.
- SPF identifies approved sending systems
- DKIM validates message signatures
- DMARC instructs receiving systems how to handle authentication failures
DMARC reporting should be reviewed.
Legitimate senders should be identified.
Policy should be moved toward quarantine or reject after testing.
These controls reduce domain spoofing.
They do not stop every compromised-mailbox attack.
Additional identity and behavior controls are required.
3. Impersonation protection
Email security platforms should evaluate
- Executive impersonation
- Vendor impersonation
- Lookalike domains
- Display-name spoofing
- Reply-to mismatches
- Newly registered domains
- Unusual sender infrastructure
- Changes in writing and conversation patterns
External sender labels should be enabled.
High-risk messages should be quarantined or routed for review.
4. Link and attachment inspection
Safe-link scanning should be enabled.
Attachments should be analyzed before delivery.
Controls should include
- Malicious URL detection
- Credential-harvesting detection
- Attachment sandboxing
- Macro blocking
- Executable file restrictions
- Archive inspection
- QR-code analysis
- Newly created domain detection
AI-generated phishing often uses clean formatting and harmless-looking documents.
Technical inspection is required.
5. Mailbox and identity monitoring
After an account is compromised, attackers may create persistence.
Mailboxes should be monitored for
- Forwarding rules
- Hidden inbox rules
- Suspicious delegates
- OAuth consent
- Unusual sign-ins
- Impossible travel
- Token reuse
- New devices
- Mass downloads
- Unusual sent mail
- Deleted security notifications
A password reset alone may not remove access.
Sessions and tokens may need to be revoked.
Rules and delegated permissions should be reviewed.
6. Transaction controls
Email should not authorize a high-risk transaction by itself.
Written procedures should cover
- Wire transfers
- ACH payments
- Payroll changes
- Vendor bank changes
- Tax form requests
- New payees
- Password resets
- Administrative access
- Customer data exports
Two-person approval should be required.
Verification should be completed outside the original communication channel.
The procedure should apply even when the request appears to come from the owner.
Employee Training Still Matters
Training remains necessary.
It is not sufficient by itself.
Employees should be trained to pause when a request includes
- Urgency
- Secrecy
- Payment changes
- Credential requests
- Unusual file sharing
- A new communication channel
- A request to bypass approval
- A claim that the sender cannot be reached normally
Employees should be allowed to delay the request.
Reports should not be penalized when a message is legitimate.
A false report has limited cost.
A fraudulent payment may not be recoverable.
Tabletop exercises should use the company’s actual payment, vendor, and incident reporting procedures.
How X-Tek Managed Security Supports Email Protection
X-Tek provides managed IT and security services for small and medium-sized businesses.
Email protection can be integrated with broader controls
- Microsoft 365 and Google Workspace security reviews
- MFA deployment
- Domain authentication
- Email filtering
- Endpoint protection
- Network monitoring
- Identity event monitoring
- Patch management
- Backup verification
- Incident response support
- Security policy development
- Employee security training resources
Systems are monitored and remediated.
Suspicious authentication activity is reviewed.
Mailbox configuration changes are investigated.
Security gaps are identified before they become incidents where possible.
Our managed IT and security services support ongoing protection across email, endpoints, networks, cloud systems, and backups.
Additional guidance is available in our posts on AI-powered attacks and network security, small business IT security controls, and proactive network security.
Incident Response After a Suspicious Request
If a fraudulent request is identified
- Stop the transaction
- Contact the bank if funds were sent
- Report the message to IT
- Preserve the email and related headers
- Disable or secure affected accounts
- Revoke sessions and tokens
- Review mailbox rules and delegates
- Inspect sign-in and audit logs
- Identify other recipients
- Notify legal counsel, insurers, and law enforcement as required
The FBI accepts cybercrime reports through the Internet Crime Complaint Center.
The FBI 2025 IC3 report documents continued losses from business email compromise and AI-related fraud.
The FTC small business guidance on impersonation also recommends independent verification and internal payment controls.
Required Baseline
Every small business should have these controls documented
- MFA for every mailbox
- Phishing-resistant MFA for privileged users
- SPF DKIM and DMARC
- Inbound email filtering
- Safe-link and attachment scanning
- External sender labeling
- Mailbox rule monitoring
- OAuth and delegated-access review
- Independent payment verification
- Two-person approval
- Security event logging
- Incident reporting procedures
- Regular backup verification
AI has removed many obvious warning signs.
Security controls must verify identity and activity rather than relying on writing style.
Notifications
Contact Information
Business Solutions Information Request:
https://xtekit.com/business-solutions-information-request/
815-516-8075