It’s 2:47 PM on a Friday. A controller at a manufacturing firm in El Segundo gets a voicemail. It’s her CEO’s voice: his cadence, his slight impatience, even the way he clears his throat. He needs a vendor payment pushed through before the bank’s wire cutoff. The email with updated account details is already in her inbox, referencing the correct project name and the correct amount.
None of it is real. Not the voicemail, not the email, not the “CEO.”
Welcome to phishing in 2026, where the scam doesn’t just look like your workday. It sounds like your boss.
The Era of Spotting the Typo Is Over
For a decade, security training taught employees to hunt for warning signs: bad grammar, generic greetings, sketchy formatting. That advice is now dangerously outdated.
Generative AI has erased the tells. Security researchers report that most phishing emails now contain AI-generated content, and AI-written messages earn click rates several times higher than traditional ones. Attackers no longer send a thousand clumsy emails hoping one lands. They send a thousand personalized ones, each referencing real job titles, active projects, and correct financial terminology, generated in minutes.
| Then vs. Now | Traditional Phishing | AI-Powered Phishing (Today) |
| Telltale signs | Typos, odd phrasing, generic greetings | Flawless grammar, personalized detail, correct internal terminology |
| Research required | Weeks of manual reconnaissance | Minutes, scraped and synthesized by AI |
| Channels used | Email only | Email, cloned voice calls, and deepfake video in one coordinated campaign |
| Voice impersonation | Rare and expensive | Cloned from a few seconds of public audio using cheap or free tools |
| FBI-reported BEC losses | ~$1.9 billion (2020) | Over $3 billion (2025) |
Sources: FBI Internet Crime Complaint Center (IC3) annual reports; industry threat research.
For Los Angeles businesses, this isn’t an abstract trend. Escrow wires, entertainment production payments, port logistics invoices, and healthcare vendor transactions move millions through this city every day, and attackers know it.
Anatomy of the Attack, Part 1: The Payment That Feels Routine
Business email compromise (BEC) still starts the same way: the attacker studies your company, identifies who moves money, and sends a message engineered to pass a quick scan. What’s changed is how good that message is.
From: Michael Torres, CEO Subject: Payment needed before EOD — Hargrove project
“Can you process this today? I’m tied up in the Hargrove closing and need this handled before 3 PM. Wire details attached — slight change from the usual account, their bank flagged the old one. Confirm once complete. Don’t loop in accounting, I’ve already cleared it.”
🚩 Red flags, annotated:
- Urgency with a deadline. “Before 3 PM” is designed to beat your review process, not your clock.
- Authority pressure. A request “from the CEO” discourages questions.
- A payment change. New wire details are one of the most reliable indicators of fraud.
- Isolation. “Don’t loop in accounting” removes the second set of eyes that would catch the scam.
- Real context. The project name is correct. Accuracy is no longer evidence of legitimacy; AI-assisted attackers routinely reference genuine deals and vendors.
That last point is the uncomfortable truth: the more legitimate a payment request looks, the more verification it deserves, not less.
Anatomy of the Attack, Part 2: The Login Page That Isn’t
Not every attack asks for money directly. Many are after something more valuable: access.
Subject: Secure document shared with you
“A file has been shared with you via Microsoft 365. Click below to review and approve before Thursday’s meeting.”
The link leads to a pixel-perfect replica of a Microsoft 365 or Google Workspace login page, and credentials entered there are captured instantly.
Attackers rarely cash in right away. They sit inside the compromised mailbox for days or weeks, learning your payment cycles, vendor relationships, and executives’ writing styles. That surveillance becomes raw material for the next attack, one so tailored it’s nearly indistinguishable from a genuine internal email.
Increasingly, they’re harvesting something else too: audio and video. Town hall recordings, voicemail greetings, and social clips give attackers everything they need to clone an executive’s voice or face.
The Defense That’s Now Under Attack: “Just Call to Verify”
Here’s what most security advice from a few years ago won’t tell you: phone verification, the gold-standard defense for years, is itself being weaponized.
Modern campaigns blend channels. The fake email arrives, and when the employee calls to confirm, the “executive” answers. Real-time voice conversion can now transform an attacker’s live speech into a cloned voice during an active call, and some campaigns follow up with deepfake video meetings.
This is no longer theoretical. In one of the most widely reported cases, a finance employee at the global engineering firm Arup wired $25.6 million across 15 transfers after joining a video conference where every other participant, including the apparent CFO, was an AI-generated deepfake built from publicly available footage.
The lesson isn’t that verification is dead. It’s that verification must be structural, not sensory. You can no longer trust what you see or hear, only how the verification happens.
✅ 5 Verification Rules That Survive AI
- Verify out-of-band, always. Confirm payment requests using a phone number from your own records, never a number, link, or reply from the message itself. If they called you, hang up and call back on the known number.
- Treat every banking change as hostile until proven otherwise. New wire details trigger a mandatory hold and multi-person review. No exceptions for urgency. Especially not for urgency.
- Use dual approval for payments above a threshold. No single employee should be able to move significant money alone, no matter how senior the requester sounds.
- Establish a verbal code word for executive payment requests. A pre-agreed phrase that no deepfake can know defeats even a perfect voice clone.
- Never authorize based on a video call alone. If the request originated digitally, the confirmation can’t live in the same digital channel.
At Crimson IT, we help Los Angeles businesses build these controls directly into their payment and approval workflows, so security doesn’t depend on any one employee out-thinking an AI on a busy Friday afternoon.
The New Vectors Your Team Hasn’t Been Trained On
Email is no longer the whole battlefield. Two fast-growing tactics deserve a spot in every current threat briefing.
QR-code phishing (“quishing”). Attackers embed malicious links in QR codes on emails, fake parking notices, and counterfeit “MFA re-enrollment” flyers, because image-based codes often slip past email link scanners. Microsoft’s threat researchers have tracked triple-digit growth in these attempts in recent quarters. If your last security training didn’t mention QR codes, it’s already behind.
MFA fatigue and fallback attacks. Multi-factor authentication is essential, but attackers now target the weak fallback paths: SMS codes, push-notification bombing, and help-desk resets. MFA that keeps a phishable backup route open isn’t truly phishing-resistant.
What a Successful Attack Actually Costs
The wire transfer is just the opening loss. The full bill includes forensic investigation, system-wide password resets, legal consultation, customer notification, operational downtime, and reputational damage that outlasts the incident by years. IBM’s Cost of a Data Breach research puts the average phishing-caused breach near $4.9 million, with compromises often going undetected for more than eight months.
Attackers also know exactly who to target. Small and midsize businesses are hit disproportionately because criminals assume, usually correctly, that they lack formal verification processes and enterprise-grade defenses. OECD research suggests only about a third of small and midsize enterprises have adopted any AI-specific security measures at all.
That gap is the opportunity. For attackers, or for you.
Fighting AI With AI: How Crimson IT Protects LA Businesses
You can’t out-proofread a machine that doesn’t make typos, and you can’t stop AI-powered attacks with defenses designed for the last decade. Here’s what modern protection looks like:
- Behavioral email security that flags anomalies in sender patterns, logins, and data flows, catching what content filters miss now that AI-written attacks no longer look suspicious.
- Phishing-resistant MFA with fallback paths locked down, so a stolen password is a dead end instead of a master key.
- Payment verification workflows built with your finance team: dual approvals, mandatory holds on banking changes, and deepfake-aware callback procedures.
- Current security awareness training covering voice clones, deepfake video, and quishing, not a once-a-year compliance video about typos.
- 24/7 monitoring and rapid response, so an intruder’s dwell time is measured in minutes, not months.
Phishing attacks are designed to blend into your workday. Our job is to make sure verification is built into it.
Take the First Step: Free Phishing Exposure Assessment
How would your team hold up against an AI-crafted attack? Most business owners don’t know until the wire clears.
Crimson IT offers Los Angeles businesses a complimentary phishing exposure assessment. We’ll evaluate your email security, payment verification workflows, and team readiness against current attack techniques, then deliver a prioritized action plan.
Because the question is no longer whether your business will be targeted. It’s whether the attack blends in, or bounces off.
