AI fraud is industrializing phishing
INTERPOL says AI-enhanced fraud is 4.5x more profitable, and its October campaign warns that deepfakes are erasing the usual tells. Awareness training has to change.
INTERPOL's 2026 Global Financial Fraud Threat Assessment, published in March, found that AI-enhanced fraud is 4.5 times more profitable than traditional methods. It also describes agentic AI systems that can plan and run a fraud campaign end to end, from reconnaissance to ransom demands. Fraud-related INTERPOL Notices and Diffusions rose 54% since 2024.
In October 2026, INTERPOL launched a public-awareness campaign about deepfake scams. The campaign's message is deliberately simple: "Wait. Validate. Don't take the bait." It shows synthetic media used in investment scams, impersonation, romance scams, sextortion, and disinformation, and urges businesses to train staff and adopt multi-step verification.
The usual advice, "look for bad grammar and strange links," no longer covers the threat.
What changed
Generative AI removed the cheap tells. A fraudulent email can now be fluent, personalized, and written in the recipient's language. Voice and video cloning make a phone call or a short video message feel credible. Adversary-in-the-middle phishing kits proxy the real login page, so the victim completes MFA on the attacker's infrastructure.
Microsoft's 2026 Digital Defense Report offers a useful framing: in Defender Experts data, user execution accounted for 30% of initial access and valid accounts for another 20%. The common thread is not a sophisticated exploit. It is a person or a session being trusted.
Why generic awareness training misses
Most annual training tests whether employees can spot a suspicious link. That is necessary but insufficient.
- A deepfake payment request may arrive through a trusted channel, from a known executive, with correct context.
- An invoice change may reference a real project and a real supplier.
- An MFA prompt may be triggered by a real password the attacker already has.
- A ClickFix page may ask the user to paste a command to "fix" a browser problem.
The control that works is a process: verify through a second channel, slow down payment changes, and make reporting easy and blameless.
A two-hour session that changes behavior
A useful training session for an SMB team should cover:
- Payment and invoice fraud. Require out-of-band verification for bank-detail changes, using a known phone number, not the contact details in the email.
- Voice and video impersonation. Agree on a safe word or a second approver for urgent requests.
- MFA and session theft. Explain why approving a push notification can be dangerous and when to re-authenticate.
- Reporting. Give employees a one-click path and a no-blame response. Speed matters more than certainty.
- A short simulation. Walk through a realistic deepfake or executive-impersonation scenario and debrief it.
Izkuna's Anti-Phishing Training is a two-hour session at the current launch price of $300, tailored to the tools and workflows the team actually uses. Pair it with a Web Security Audit — Express when you also need to verify authentication, session, and access-control controls.
Technology alone will not stop a convincing conversation. Trained people with a clear verification process will.
Sources
- INTERPOL: Global Financial Fraud Threat Assessment 2026
- INTERPOL: Deepfake scam awareness campaign, October 2026
- Microsoft 2026 Digital Defense Report
If your team needs a practical, current session, review the Anti-Phishing Training or start with a free 30-minute diagnostic.