What specific AI tactics are criminals using in these attacks?

Criminals are using AI to generate professional-looking emails with minimal effort, personalize messages using publicly available information, clone voices to imitate trusted individuals, create manipulated or synthetic audio, images and videos (deepfakes), and conduct coordinated attacks simultaneously across email, phone calls, messaging platforms and social media.

What should employees do if they receive a suspicious request?

Verify requests involving credentials, approvals, payments or sensitive information by confirming through a separate trusted communication channel. Follow your organization's established business processes, be cautious when urgency is used to pressure immediate action, and report suspicious communications promptly to the organization's incident response channel.

Audio & SpeechAI Safety & AlignmentTop Companies' AI MovesTop Companies AIAug 19, 2026Aug 20, 2026, 06:30 JST

AI voice-cloning fuels surge in social engineering attacks

Send on LINE

3 Key Points

What happened
Scammers are increasingly using AI-powered voice-cloning and deepfake technology to imitate trusted contacts, send personalized phishing emails, and conduct coordinated attacks across email, phone calls, messaging platforms and social media simultaneously. These capabilities, once requiring specialized expertise, are now widely accessible through readily available tools.
Why it matters
AI has dramatically accelerated the speed and scale at which social engineering attacks can operate. Attackers can generate hyper-realistic emails, clone voices, and create manipulated audio, images and videos tailored to specific individuals or teams in minutes—making it harder for employees to spot fraud before disclosing sensitive information or granting system access.
What to watch
The article recommends verifying any unexpected request involving credentials, approvals, payments or sensitive information through a separate trusted communication channel, following established business processes, and reporting suspicious communications promptly. Independently confirming requests can help prevent fraud and impersonation attempts.

Not sure about something? Ask the AI

Questions and answers are published on this page.

Summaries like this, in your inbox every morning.

Get news like this every morning, free

Context & Analysis

Social engineering—manipulating people into disclosing sensitive information or granting unauthorized access—is not a new attack vector. What has fundamentally changed is the democratization and speed of the tools available to attackers. Historically, creating convincing voice imitations, personalized phishing emails, or manipulated videos required significant technical skill and resources. Today, the same capabilities are available through widely accessible AI tools that can execute in minutes rather than hours or days.

The body identifies voice phishing ("vishing") as a particularly concerning trend, where attackers use AI-cloned voices to impersonate executives, colleagues, or family members. By combining voice cloning with deepfakes (AI-generated or manipulated audio, video and images), attackers can create content that appears authentic enough to prompt immediate action before a target has time to verify. The article emphasizes that the core mechanic of social engineering—gaining trust, creating urgency, and manipulating behavior—remains unchanged; only the weapons have become more powerful and accessible.

FAQ

What specific AI tactics are criminals using in these attacks?: Criminals are using AI to generate professional-looking emails with minimal effort, personalize messages using publicly available information, clone voices to imitate trusted individuals, create manipulated or synthetic audio, images and videos (deepfakes), and conduct coordinated attacks simultaneously across email, phone calls, messaging platforms and social media.
What should employees do if they receive a suspicious request?: Verify requests involving credentials, approvals, payments or sensitive information by confirming through a separate trusted communication channel. Follow your organization's established business processes, be cautious when urgency is used to pressure immediate action, and report suspicious communications promptly to the organization's incident response channel.

AI news that matters for your work, delivered every morning.

Pick your industry and the AI tools you use, and get news related to your work every day.

Get it free

Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →

Ask AI

Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.