Quick answer
Modern phishing uses AI to write convincing messages, clone voices and fake video. The seven most common tactics are: AI-written spear phishing, voice-clone 'CEO' calls, deepfake video meetings, QR-code (quishing) links, fake Microsoft 365 sign-in pages, invoice and bank-detail change fraud, and MFA-fatigue prompts. The best defence is a verify-out-of-band habit plus MFA and email filtering.
Trust the process
Verify unusual money or access requests by calling a known number.
Beware QR codes
Scanning a code on a phone bypasses many email defences.
MFA + training
Technology plus a trained team stops most attacks.
What changed with AI
Attackers now use generative AI to produce clean, personalised messages in perfect English or French, mimic a manager's writing style from public posts, and even clone a voice from a short audio clip. The tell-tale typos are gone, so employees need to look at the request, not just the writing.
The 7 scams (tap a card to flip it)
Click or tap each card below to see what the scam looks like and how to respond.
1. AI spear phishing
Flawless, personalised email that mimics a colleague or vendor.
Tap to flip ↻
2. Voice-clone 'CEO' call
A cloned voice urgently asks for a payment or gift cards.
Tap to flip ↻
3. Deepfake video meeting
A 'manager' on video asks you to approve a transfer.
Tap to flip ↻
4. QR-code phishing
A QR code in an email, PDF or poster leads to a fake login.
Tap to flip ↻
5. Fake Microsoft 365 login
A 'shared document' link opens a convincing sign-in page.
Tap to flip ↻
6. Invoice or bank change
A real supplier's email is spoofed with new bank details.
Tap to flip ↻
7. MFA fatigue
Repeated approval prompts until you tap 'Approve'.
Tap to flip ↻
The one habit that beats them all
Whatever the channel, the pattern is the same: urgency, secrecy and a request for money, credentials or a code. Teach everyone one rule: verify out-of-band. Hang up and call the person on a number you already have, or message them on a separate channel, before acting.
What your business should have in place
- Email filtering and link/attachment scanning that checks URLs at click-time.
- MFA everywhere, ideally phishing-resistant (passkeys or security keys) for admins and finance.
- Payment-change procedure with call-back verification for any vendor bank-detail change.
- Regular short training and simulated phishing so people practise before the real thing.
- A "report it" button and a culture where reporting a mistake quickly is rewarded, not punished.
QueryTel's cybersecurity services and 24/7 SOC can monitor for compromised accounts and help train your team. See also our AI cyberattack defence guide.
Frequently asked questions
How can I tell if an email was written by AI?⌄
You often can't from the writing alone. Focus on the request: unexpected urgency, a change in payment details, a link to sign in, or a demand for secrecy are warning signs regardless of how well it's written.
What is quishing?⌄
Quishing is phishing through QR codes. The code hides the link, so email scanners and users can't easily see where it leads. Avoid scanning unexpected QR codes.
Can MFA stop phishing?⌄
MFA stops many attacks, but attackers use MFA-fatigue and real-time proxy pages. Phishing-resistant methods like passkeys and security keys offer stronger protection.
What should an employee do after clicking a phishing link?⌄
Don't ignore it. Report it to IT immediately, change the password from a clean device and let IT check the account for suspicious sign-ins and inbox rules.
Want a Canadian expert to check this for you?
QueryTel's NOC & SOC engineers support businesses across Toronto, Mississauga and Canada. Ask for a free review, with no obligation.