Small-business owners, a new wave of phishing is landing in inboxes: AI-assisted executive impersonation and forged invoices that look convincingly real. A recent Microsoft Security Blog post outlines campaigns where attackers used AI to draft credentialed-looking emails and fabricates invoices to coax accounts payable into wiring funds. It’s not just sneaky—these scams blend branding, fake email threads, and convincingly crafted invoices to reduce skepticism.
What happened
According to the Microsoft Security Blog, attackers layered deception to impersonate executives and trusted vendors. They used third‑party email services to distribute messages, forged invoices, and even fake email threads to make the request look legitimate. The goal was simple and dangerous: prompt a payment from the accounts payable team before the recipient has time to pause and verify.
Key points from the report include:
- AI-generated email templates crafted to mimic real executives and vendor communications.
- Fabricated invoices and chained email conversations to create a believable narrative.
- Targeted payments via methods like ACH, with campaigns highlighting urgent or routine-looking invoices.
- Impersonation extended to multiple “brand” touchpoints to lower guardrails for skepticism.
- Money requests pushed through quickly, with attackers hoping to bypass traditional verification steps.
While the specifics of campaigns evolve, the pattern is clear: use AI to write the message, mimic trusted brands, and push for a fast payment before doubt can set in. Details may change as investigations continue, but the defenses stay the same: verify through a known channel, and build in checks that can’t be bypassed by a clever email alone.
Why it matters
This isn’t a “big company” problem. Small businesses, freelancers, and growth-minded teams frequently rely on fast invoice payments and last-minute approvals. When an invoice looks like it’s from a familiar vendor and the message is authored to sound urgent, it’s easy to click through or approve without a proper check. The use of AI to tailor messages raises the bar for attackers and makes reliance on memory or past experience less reliable than ever.
What changes for you this month:
- New risk: AI-assisted executive impersonation can spike the credibility of phishing attempts targeting finance teams.
- Decision point: You should adopt stronger payment verification and vendor-authentication processes, not just better email filters.
- Practical cost: A small, structured change—like implementing a two-person payment approval or a vendor-change verification step—can dramatically reduce risk without slowing down routine payments.
Practical steps you can take
The following actions are designed to be tried quickly. Each risk is paired with a defensive action you can test this week.
- 15-minute test: enable basic domain authentication
- Check that your domain is publishing SPF, DKIM, and DMARC records in DNS. If you’re unsure, contact your domain provider or IT support to confirm the following minimum setup: SPF include:spf.protection.outlook.com (or your provider’s equivalent), DKIM enabled for outbound mail, and a DMARC policy of p=quarantine or p=reject after testing.
- Publish a DMARC record like: _dmarc.yourdomain.com with v=DMARC1; p=none; rua=mailto:you@yourdomain; fo=1. This helps you monitor abuse before enforcing stricter rules.
- 15-minute test: tighten email protections in your mail system
- In your email platform, enable impersonation protection and anti-phishing policies. If you’re using a Microsoft 365 setup, turn on Defender for Office 365 policies that flag or block messages that impersonate executives or vendors and review the impersonation alerts.
- Add a rule to quarantine messages that contain the word invoice in the subject or body from external domains if they’re not from known, approved vendors.
- Two-person approval for payments
- Set a policy for payments over a threshold (for example, $5,000 or as appropriate for your business) to require a second reviewer or an additional verification step (phone call to the vendor on a known number, not the one in the email).
- Document the process in your AP handbook and train staff to follow it consistently.
- Verify vendor changes and new invoices
- If you receive a payment request or a new bank account detail, call the vendor using a published number from their official website or your existing contact record—not the number in the email.
- Match the payment request to an approved purchase order and confirm the invoice against the goods/services received.
- Security awareness for the team
- Run a quick, role-specific training module on invoice fraud and executive impersonation. Emphasize that attackers may use AI to tailor messages, and that a quick verification step can prevent a costly mistake.
- Guard against voice-based threats
- If you rely on voice prompts for IT or vendor help, disable voice-only verification for financial requests. Require multi-factor authentication and cross-channel verification for payment approvals.
These controls are not a magic shield, but they create friction for fraudsters without slowing your day-to-day work. Small teams can build a surprisingly strong defense with a few focused changes.
Final thought
Phishing has evolved, and AI is making deception harder to spot from a single email. The practical, human-centered controls—two-person approvals, channel-verified invoices, and stronger email authentication—remain your best guardrails. Start with the quick 15-minute checks, then layer in vendor-management and training. If you’re unsure where to start, pick one change this week and make it part of your regular finance routine.