AI (artificial intelligence) seems to jump out of the headlines every day, and we won’t make any attempt to proclaim we have the latest news on it. But we can tell you should start hardening your defenses all the way around. We still have phishing, smishing and scam phone calls to deal with, but it won’t be long until deep fake voice technology will make it more difficult to tell what’s real, especially under duress.

We see the convergence of two trends at work in this one. First, with a lot of people still working remotely, there are a lot of fuzzy lines about when bosses and their employees interact and how they do it. Second, cyber thieves are always looking for a way to trick you into giving them some of your money.

So, let’s look at a couple of scenarios. The first is decidedly low-tech: email. You get an email from your boss – or a coworker – asking you to transfer some money to them. Or you get an email about an invoice.

Let’s put aside the question of why your boss would ask you for money. Scam requests almost always have a clickable link, ostensibly to enable you to transfer money electronically. Though if you’ve received scam emails from friends traveling abroad who need money wired into an account to help them get home, a request from your boss for money should raise a red flag. If it’s not from your boss, it might appear to be from a company claiming to have an invoice for you to pay.

Voicemail is getting more high-tech, especially as AI gets better. The scary part is that it doesn’t take much anymore for AI to clone a reasonable facsimile of your boss’s or anyone’s voice. It could fake the voice of your spouse, kid, or anyone you know with a message encouraging you to act before you think.

In situations like these, which are becoming more commonplace, you need to take a deep breath and ask a few questions.

How do you know the email is the person you think it’s from? The sender’s name may be one you recognize, but what about the email’s domain? Is your boss’ email from the company domain or a .com or .net address that might be associated with your company? If it looks like your company’s name, is it spelled correctly? Can a request to your business or personal email address for an invoice payment pass the same series of tests?

Go to a company’s website from your browser to verify a payment request. Unless you are 100 percent, rock-solid, absolutely sure, you need to ignore any email addresses or clickable links and go right to the source of the request. Contact your boss from your directory at an email address or phone number you know is correct. Do not use any contact info in the email.

You can try to verify an email address by hitting the reply key to see what comes up. Even if the name is correct, the email address may be a fake. But if the email address was hijacked, even an address that looks correct can be corrupt because it’s been redirected to the scammer.

On the voicemail side, AI has upped the ante. It’s always been easy to spoof any phone number in the world, with country and area codes included. Still, it’s worth a look. Does the phone number look familiar or correct? If not, it may make determining it’s a fake easier. So, your operating rule of thumb here should be not to redial the number; use the number you know instead. Pay attention to the voice you hear. AI is not perfect yet, and you may not hear a cadence or speech pattern you recognize as your boss or relative.

If you need to call back, don’t hit the redial key. It will take you to the phone number the scammers want you to call. Instead, do it from your contact list. If you’re calling a company about an invoice, get a phone number from a trusted place.

While nothing can replace a healthy skepticism about all communications, we can help you head off some problems with security awareness training sessions for offices. Call us – 973—4336676 – or email us to discuss your needs.