AI Phishing and Deepfake Scams: Protect Your NH & MA Business

If you own or manage a business with 5 to 300 employees in Massachusetts or New Hampshire, the scam emails reaching your team no longer look like scams. They are well written, personalized, and sometimes backed by a phone call that sounds exactly like your boss. This guide explains how AI-driven phishing and deepfake fraud actually work, and the practical, low-drama defenses that stop most of it.

What changed: scams that no longer look like scams

For years, the standard advice was “look for typos and awkward grammar.” That advice is now out of date. AI tools can write clean, natural, professional email in seconds, in any tone, and tailor it to a specific person.

Attackers can pull details from your website, your LinkedIn page, a press release, or a job posting. They then write a message that references a real project, a real vendor, or a real colleague. The result reads like something your team would normally receive.

That does not mean you are helpless. It means the defense has to move away from “spot the sloppy email” and toward verifying the request itself, no matter how polished the message looks.

Employee at a desk reviewing a polished, convincing email on a laptop — AI-written phishing is clean, personal, and hard to spot by appearance alone.

Voice clones and fake video meetings

The bigger shift is audio and video. With a short sample of someone’s voice, often taken from a recorded webinar, voicemail greeting, or social media clip, attackers can generate a convincing imitation.

Here is how that tends to show up at a small or mid-sized business:

The urgent call from the “owner.” A bookkeeper or office manager gets a call that sounds like the boss, asking for a quick wire or a batch of gift cards, and asking them to keep it quiet for now.
The vendor who “changed banks.” A familiar-sounding contact from a supplier calls to say future payments should go to a new account.
The fake video meeting. A live video call where one or more participants are digitally generated, used to pressure someone into approving a transfer. Cases of this kind have been publicly reported at larger organizations, and the technique is spreading downward.

The common thread is not the technology. It is urgency, secrecy, and a request to move money or change payment details. Those three signals matter more than how real the voice sounds.

Fake invoices, bank changes, and payroll requests

Most losses from these scams are not dramatic. They come from ordinary-looking business requests that slip through a busy day.

Fake invoices that mimic a real vendor’s format and reference real work.
Vendor bank-detail changes sent by email or phone, redirecting a legitimate payment to a fraudster.
Payroll-change requests that appear to come from an employee asking to update direct-deposit details.
Executive impersonation asking an assistant or finance contact to buy gift cards or process an “urgent” payment.

The FBI’s Internet Crime Complaint Center has consistently ranked business email compromise among the costliest categories of cybercrime it tracks. You do not need a specific number to understand the point: this is one of the most common and expensive ways small organizations lose money.

Five defenses that stop most of it

You cannot out-detect a good fake every time. You can build habits and rules that make a fake irrelevant. These five do most of the work.

1. Call back on a number you already know

Any request involving money, banking details, or credentials gets verified by calling the person back on a number from your own records, never the number in the message or the one that just called you. This single habit defeats most voice-clone and invoice fraud.

2. Require two people for payments and bank changes

No single employee should be able to send a wire, change vendor banking details, or alter payroll deposit information alone. A second approver turns a one-person mistake into a caught attempt. Put the rule in writing so no one feels awkward invoking it, even with the owner.

3. Set up code words

Agree on a simple verbal code word or phrase between owners, finance staff, and key managers. If an urgent request comes in by phone or video, ask for it. A cloned voice cannot supply a secret it was never given.

4. Use phishing-resistant multi-factor authentication

Standard multi-factor authentication (a code sent by text or app) is far better than a password alone, but attackers have learned to trick people into handing those codes over. Stronger, phishing-resistant methods, such as hardware security keys or device-bound sign-in, are much harder to steal. Prioritize them for email, banking, and administrator accounts first.

5. Slow down on purpose

Make it normal, even expected, to pause on urgent money requests. Scams depend on speed. A culture where “let me verify that first” is praised rather than questioned is one of your strongest controls.

Two colleagues confirming a payment request together before approving it — Two-person approval and call-back verification turn a convincing fake into a non-event.

Training your team with real examples

Annual slideshows full of misspelled “Nigerian prince” emails do not prepare people for what they will actually see. Updated training works better when it is short, frequent, and concrete.

Show realistic, well-written examples, including a voice-clone scenario described in plain language.
Teach the three warning signs: urgency, secrecy, and a request involving money or credentials.
Walk through exactly what to do: stop, verify on a known number, get a second approver.
Include finance, HR, and executive assistants. They are the most targeted roles.
Make reporting easy and blame-free. An employee who flags a near-miss quickly is doing the job right.

The goal is not to turn everyone into a security expert. It is to give each person a simple, repeatable response when something feels off.

Frequently asked questions

What is an AI phishing scam?

It is a fraudulent message, usually email or text, written or polished with AI tools so it reads naturally and can be personalized to the target. The goal is the same as traditional phishing: get someone to click a link, share credentials, or send money.

What is a deepfake scam in a business setting?

A deepfake scam uses AI-generated or AI-cloned voice or video to impersonate a real person, such as an owner, executive, or vendor contact. It is typically used to pressure an employee into approving a payment or sharing sensitive information.

How can I tell if a call or video is a deepfake?

Often you cannot, and that is the point. Instead of trying to detect the fake, verify the request: hang up and call back on a known number, ask for a pre-agreed code word, and require a second approver for any money movement.

Does multi-factor authentication still protect us?

Yes. It blocks a large share of account takeovers. Phishing-resistant forms are stronger because they cannot easily be tricked out of an employee, so they are worth adopting first for email, finance, and admin accounts.

What should an employee do if they already sent money or clicked a link?

Tell a manager or your IT provider immediately. For a payment, contact your bank right away, since speed matters for any chance of recall. Quick, blame-free reporting limits the damage far more than hiding a mistake ever could.

Where to go from here

None of these defenses require exotic technology. They require clear rules, a few good habits, and a team that feels safe pausing before they act. For the bigger picture on how AI is reshaping the risks facing local businesses, see our guide on AI cybersecurity threats for Massachusetts and New Hampshire businesses.

LG Tech MSP is the trusted managed IT partner for businesses across Massachusetts and New Hampshire, including professional services, construction, healthcare, manufacturing, and small-to-mid-sized businesses across other industries. If you would like a second set of eyes on how your own payment and verification processes would hold up, here is how to reach us:

Call: (603) 681-6130
Email: info@lgtechmsp.com
Book a scoping call: a short, no-pressure conversation about your setup
Stop by: walk-ins welcome at our Pelham office, no appointment needed, at 2 Beaver Brook Way, Unit C, Pelham, NH 03076

To learn more about how we approach protection for local organizations, visit our cybersecurity services for NH businesses page.

Last updated: October 29, 2026