Good language is not proof of identity
Phishing uses deceptive messages to persuade someone to disclose information or take an unsafe action. AI can help produce convincing language, but polished writing does not verify identity. The UK NCSC assessment through 2027 expects AI to enhance existing cyber capabilities; it is an assessment, not a measured incident rate for your business. Verify the request and the account through a known channel.
Verify changes through a known channel
For an unexpected payment change or access request, contact the person through a number or channel already held by the company. Do not use contact details supplied only in the suspicious message. Give employees a way to pause the request and report it without being penalized for slowing the transaction.
Keep privileged access owned by the business
Record owners for the domain registrar, hosting, email and administrator accounts. Prefer individual roles over shared credentials, use supported MFA and keep recovery methods under company control. Privileged access management can begin with a clear inventory, approval and removal process; a product alone does not supply that process.
Prepare for an unavailable contractor
Confirm ownership and recovery options before a developer leaves. If access is already lost, use the provider’s official ownership recovery process and document evidence. Do not bypass authentication or use another person’s account without authorization. Review permissions after staff or supplier changes.
Practice independent verification of payment changes
Convincing writing, voice or a familiar mailbox does not establish authority. A real account can be compromised. A useful exercise tests whether staff use an established independent contact and can pause a request, rather than whether they can guess that content was AI-generated.
- Assign recipient, independent verifier, approver and reporter.
- Use a synthetic supplier bank-change request.
- Verify through an already known contact.
- Record the decision and improvement without transferring money.
Choose a response based on what happened
NCSC assessments through 2027 are forecasts, not measured AI-attack percentages. SPF/DKIM and MFA do not stop every phishing path. Unauthorized session and recovery changes require system-specific action by an authorized person, with relevant evidence preserved.
| What happened | Response direction | Limit |
|---|---|---|
| Read only | Report and preserve the message | Not proof of infection |
| Clicked a link | Report the URL and what followed | A click alone does not prove compromise |
| Entered a password | Authorized account and session review | Changing a password alone may be insufficient |
| Approved unexpected MFA | Urgent review of account access and sessions | Use the platform recovery process |
| Sent a payment | Contact the payment provider promptly and preserve details | No recovery or refund guarantee |
Example: verify a request from a genuine compromised mailbox
An unexpected supplier request arrives from a genuine mailbox. The recipient verifies through the existing supplier contact and pauses payment, with the action recorded as exercise evidence. This is an illustrative scenario, not a customer case or a promised result.
