Table of Contents
Social Engineering Gets an AI Upgrade
MFA Still Matters. But Not All MFA Is Equal
The Attack That Can Beat Your OTP
Moving Toward Phishing-Resistant Authentication
For years, cybersecurity advice rested on a few familiar rules: look for spelling mistakes, be suspicious of strange emails, be weary of urgency, never share your password, and turn on multifactor authentication.
Those rules still matter. But artificial intelligence is changing the threat model.
AI has not invented phishing, impersonation, or social engineering. It has made them cheaper, faster, more personalized, and more convincing. A scammer who once sent an obviously fraudulent email can now generate polished correspondence in seconds, imitate an executive’s writing style, translate a scam into dozens of languages, or potentially put a familiar voice on the other end of the phone.
The numbers suggest this is more than a theoretical concern. In its 2025 Internet Crime Report, the FBI said it received 22,364 complaints containing AI-related information, representing more than $893 million in reported adjusted losses. The FBI specifically identified AI-assisted business email compromise, investment fraud, romance scams, employment scams, and voice-cloning “distress” scams among the emerging threats.
Social Engineering Gets an AI Upgrade
Traditional phishing often relied on volume: send enough emails and eventually someone will click.
Generative AI changes the economics. The FBI has warned that criminals can use AI to produce highly targeted phishing messages with convincing grammar and context, while voice and video cloning can impersonate family members, colleagues, executives, or business partners.
And the attack does not have to arrive by email.
Smishing uses SMS or messaging apps. Vishing uses voice calls or voice messages. In 2025, the FBI warned of a real campaign in which malicious actors impersonated senior U.S. officials using text messages and AI-generated voice messages, attempting to establish trust before directing victims to malicious links or alternative messaging platforms.
Voice cloning creates an especially uncomfortable problem: our brains are conditioned to trust familiar voices. The FTC has warned that modern voice-cloning systems can make impersonation difficult to identify simply by listening, creating opportunities for fraudulent emergency calls, executive impersonation, and extortion.
In other words, “I recognized their voice” can no longer serve as authentication.
Table of Contents
MFA Still Matters. But Not All MFA Is Equal
Multifactor authentication remains one of the most effective steps people and businesses can take to protect accounts. CISA continues to recommend MFA and emphasizes that any MFA is generally better than relying on a password alone.
But there is an important qualification:
MFA is not a single technology.
A text-message code, an authenticator-app code, an approval notification, and a hardware security key are all described as MFA, yet they provide substantially different levels of protection.
SMS one-time passwords are particularly vulnerable. CISA notes that SMS and voice-based MFA can be exposed to phishing, SIM-swapping, and telecommunications attacks and recommends SMS only as a last-resort MFA option.
Authenticator-app OTPs, such as rotating six-digit codes, eliminate some of those telecommunications risks—but they do not eliminate phishing.
NIST’s current Digital Identity Guidelines state explicitly that OTP authentication is not phishing-resistant. The fundamental problem is manual entry: if you can type a code into the legitimate website, you can also be tricked into typing it into a convincing fake one. An attacker can potentially relay that code immediately to the real service.
Table of Contents
The Attack That Can Beat Your OTP
Modern adversary-in-the-middle (AiTM) phishing illustrates the problem.
Instead of simply creating a fake login page and saving your password, an attacker places infrastructure between you and the legitimate service. You enter your real username and password. The attacker forwards them to the real site. The real site requests MFA. You enter the OTP or approve the authentication request.
Everything appears normal.
But the attacker can capture the resulting authenticated session and, in some scenarios, steal the session cookie that proves you already completed MFA. Microsoft has documented phishing kits capable of performing these attacks at scale and bypassing conventional MFA protections.
This does not mean MFA is useless. It means organizations should stop treating “MFA enabled” as the finish line.
Table of Contents
Moving Toward Phishing-Resistant Authentication
The stronger direction is phishing-resistant MFA, particularly FIDO/WebAuthn-based authentication such as hardware security keys and properly implemented passkeys. CISA recommends moving toward FIDO/WebAuthn because authentication is cryptographically bound to the legitimate website rather than depending on a person correctly identifying a login page and typing in a transferable secret.
NIST likewise now requires federal systems at certain assurance levels to offer phishing-resistant authentication and encourages its use whenever practical.
Technology, however, is only part of the answer.
The AI era requires a change in behavior as well: verify the request, not the person appearing to make it. A voice, email address, text thread, or video call should not by itself authorize a wire transfer, password reset, payroll change, or disclosure of sensitive information.
If someone makes an unusual request, contact them through a previously verified channel. Don’t call the number in the suspicious message. Businesses should consider secondary verification and independent approval for high-risk financial or account changes. The FBI specifically recommends independently confirming identities and contact information before acting.
The cybersecurity lesson of the AI era is therefore surprisingly simple:
Trust is becoming easier to manufacture. Verification has to become harder to fake.
Table of Contents
Primary sources
Key sources include the FBI 2025 Internet Crime Report, FBI warning on AI-enabled cybercrime, FBI alert on AI-generated voice and smishing impersonation, FTC analysis of AI voice-cloning risks, NIST SP 800-63B-4 authentication guidelines, CISA guidance on MFA, and Microsoft research on evolving identity attacks.
Frequently Asked Questions
1. Is multifactor authentication (MFA) still worth using?
Yes. MFA still provides significantly better protection than relying on passwords alone. However, not all MFA methods are equally secure. SMS codes and traditional one-time passwords can be intercepted or phished, while phishing-resistant methods such as passkeys and FIDO/WebAuthn security keys provide stronger protection.
2. Can AI really imitate someone’s voice well enough to commit fraud?
Yes. AI-powered voice cloning can now create convincing imitations from relatively small amounts of recorded audio. Criminals can use these tools to impersonate family members, executives, or other trusted individuals. Because of this, a familiar voice should no longer be treated as proof of identity, especially when money, credentials, or sensitive information are involved.
3. What is the best way to protect yourself from AI-powered phishing and scams?
Treat unexpected requests for money, credentials, account changes, or sensitive information with skepticism, even if they appear to come from someone you know. Verify important requests using a separate, previously trusted communication channel, use phishing-resistant MFA where available, and avoid entering login credentials or OTP codes after following links in unsolicited emails or text messages.