Same Tricks, Smarter Tools: How AI Is Supercharging Fraud and Social Engineering

Imagine you work in finance for a large company.

One afternoon, you receive a message from your CFO asking you to join a confidential video meeting. You join the call and he’s there too. Some other senior people in the company are also there. They are discussing an urgent transaction and eventually you are asked to make some payments. Because everything looks normal, you do it. Later you find out that none of the people you saw on that call were actually there.

This is not a movie script.

In 2024, an employee in Hong Kong was tricked into transferring about 25 million usd equivalent, after attending what looked like a video conference with senior executives. According to Hong Kong authorities, the criminals used publicly available video and audio to create fake versions of the people in the meeting. 

But there is another side of this story that I think we are not talking about enough. Take away the deepfake video for a moment. What exactly happened? Someone pretended to be an executive.They created a believable story. They introduced urgency. They used authority. They asked someone to transfer money. Does that sound new? Not really. Social engineers have been doing this for years. AI did not invent the scam. It simply gave the scammer better tools.

The Hacker Has Not Suddenly Become a Genius

There is a lot of discussion around "AI-powered social engineering" today, and sometimes you would think criminals have discovered a completely new way of controlling people. For most cases, I don't think that is what has happened. Social engineering still relies on the core drivers it always has: fear, trust, authority, urgency, curiosity, and greed.

A fake CEO telling an employee in 2015 to urgently pay an invoice and a fake CEO doing the same thing in 2026 are still exploiting the same human behaviour. What AI has changed is how well the attacker can do it. Imagine a hacker who is technically good but cannot write proper English. Some years ago, his phishing email might have looked like this:

"Dear Sir, kindly we need you to make payment urgently as CEO has approve it."

Immediately you see something like that, alarm bells start ringing. Today, the same person can put the message into an AI tool and ask:

"Rewrite this like the CFO of a US technology company. Make it professional, urgent but not suspicious."

And in seconds, he has a well written email. No spelling mistakes. No bad grammar. No strange sentences. He can even ask AI to give him five different versions. That is the part people should understand. AI is not necessarily making social engineering more sophisticated. It is making less sophisticated attackers more capable and that is dangerous enough.

Google Threat Intelligence made a similar observation when it studied how threat actors were using generative AI. Their research found that attackers were mostly using AI for things like research, troubleshooting, content creation, translation and improving productivity. In simple terms, AI was (and is) helping criminals do things they could already do, only faster and better.

Deepfakes Are Where Things Become Different

Now, this is where I think we should separate normal AI assisted social engineering from deepfakes. Using AI to improve a phishing email is not revolutionary. Using AI to make your victim see and hear someone who isn't actually there is different. Because for most of our lives, we have been trained to trust our senses. An email from my CEO? Maybe fake. A WhatsApp message from my CEO? I should verify. A phone call where I hear his voice? Now I am becoming convinced. A video call where I can see his face and hear him speaking? At that point, many people's suspicions will reduce considerably and criminals know this.

The FBI has warned about criminals using AI-generated audio and video to impersonate family members, colleagues, executives and other trusted people. The US Federal Trade Commission has also warned about voice cloning scams where criminals take a small sample of someone's voice and use it to impersonate them.

Think about the classic scam where somebody calls a parent: "Mummy, I've been arrested. Please send money quickly. Don't tell Daddy yet." Normally, the parent might realise that the voice doesn't sound right. But what happens when it actually sounds like their child? That is where AI has introduced something genuinely powerful into social engineering. The emotional manipulation is still the same. The urgency is still the same. The criminal is still asking for money. But AI has made the evidence look more real.

AI Is Also Making Fraud Easier to Scale

There is another part of this that worries me even more…it’s scale. Imagine one scammer trying to send personalised phishing emails to 1,000 people. Doing proper research on every person manually would take serious time. But if AI helps with research, writing, translation and personalization, the attacker can potentially do much more work. One person can create hundreds of believable messages. A criminal group can target people in different countries without having fluent speakers of every language. They can create fake profile pictures, fake documents, fake messages, fake voices and in some cases, fake videos. So the biggest change may not even be sophistication, it may simply be economics. AI makes fraud cheaper to produce, faster to produce and easier to produce at scale.

We May Need to Change How We Teach People About Phishing

This also means that some of our traditional security awareness advice needs to change. We cannot keep telling employees: "Check the grammar." The grammar may be perfect. We cannot simply say: "Does the email look professional?" It probably will. Even: "Do you recognise the person's voice?" That may no longer be enough. Instead, organisations should start teaching people to focus more on the request, not just the message.

Ask questions like:

• Is this person normally allowed to request this?
• Is this the normal process for making this payment?
• Why am I being asked to bypass the normal approval process?
• Why is this suddenly confidential?
• Can I verify this request through another channel?

If your CEO sends you an unusual payment instruction by email, call them. If your CFO calls you asking for a large transfer outside the normal process, verify it even if the voice sounds correct, even if the email is perfect and in some cases, even if you can see them on video. Processes will become more important than appearances.

Same Tricks. Smarter Tools.

There is no doubt that AI will continue to change cybercrime. We are already seeing AI being used for phishing, fraud, impersonation, reconnaissance, malware development and many other things. But when it comes specifically to social engineering, I think we should be careful not to make it sound more mysterious than it really is. For the most part, the criminal is still pressing the same buttons namely fear, urgency, trust, authority, greed. The difference is that they now have better tools. The average criminal can communicate better, research faster, target more people, and can work across languages. With deepfake technology, they may even be able to look and sound like someone you trust.

So maybe the biggest threat from AI-powered social engineering is not that AI has created a new generation of genius hackers. It is something much simpler, the hacker doesn't need to be that good anymore. AI can help with the rest.