Business email compromise has always relied heavily on trust. In 2026, attackers are increasingly able to use AI to make that deception more convincing.
Microsoft documented AI-assisted campaigns involving executive impersonation and fake invoices aimed at finance teams.
The technology does not remove the fundamental weakness being exploited: people trust messages that appear to come from someone they know.
That makes payment verification more important than ever.
A request to change banking details, make an urgent payment or bypass an established approval process should be verified through a separate channel.
Do not reply to the suspicious message and ask whether the request is genuine. If the account itself has been compromised, the attacker may simply confirm the fraud.
Use a known telephone number or an established internal process instead.
The lesson applies outside businesses too. Any time a digital request involves money, identity or sensitive information, verify the request independently of the message that created the urgency.