The tell-tale signs we all learned to spot in scams, bad spelling, clumsy phrasing, a robotic voice, are gone. AI now writes flawless phishing emails, clones a familiar voice from a few seconds of audio, and generates video of a real person saying things they never said. For a small business, the target is usually the same: get someone to move money or hand over a login in a hurry. Since the old visual cues no longer work, your team needs a new, simpler rule set. This is what to teach them.
Stop trusting how it looks and sounds
The most important mindset shift is that a message being well-written, or a voice sounding exactly like your boss, is no longer evidence that it is genuine. AI can fake all of that. A convincing email from "the CEO," a voicemail in a colleague's voice, even a live video call, can all be synthetic. The polish is not proof; if anything, unusual polish combined with an unusual request is now a reason to slow down, not speed up.
Watch for the real tell: the ask
AI fakes the messenger, but the goal gives it away. Almost every one of these scams pushes for the same things: an urgent payment or change of bank details, a gift-card purchase, a password or code, or a login on a page that "needs" re-authentication. Any message combining urgency, secrecy ("don't tell anyone yet"), and a money or credential request should trip the alarm no matter how real it looks or sounds.
The one habit that beats all of it: verify out of band
The single rule that defeats every deepfake is to confirm the request through a different, known channel. Got an urgent email or voicemail from the boss to pay an invoice? Call them back on the number you already have, not one in the message. Asked to change a supplier's bank details? Phone the supplier on their known number. Because the attacker controls the channel they contacted you on, moving to a channel you control breaks the illusion instantly. This is the same discipline that stops business email compromise.
Make it safe to pause
Deepfake scams work by pressuring one person to act fast and alone. So the cultural fix is as important as the technical one: make it explicitly okay, expected even, for anyone to stop and verify a money or login request, and to never be punished for the "delay." A team that knows a five-minute check is always welcome is far harder to rush than one that fears looking difficult.