Security Awareness Training That Covers AI-Written Scams

The old advice was to look for spelling mistakes. That advice has aged badly. Messages written with help from a model have clean grammar, use the right names and refer to real projects, because the material is often gathered from public profiles and earlier correspondence. Training that focuses on surface features teaches people to trust the wrong signal. A better focus is on what a message asks for, how it applies pressure and whether it tries to move the conversation somewhere unusual.

What has changed

Three things have shifted. Text quality is no longer a dependable sign of a fake, because fluent writing is inexpensive to produce. Personalization that once required research can now be generated from a few public facts. Voice and video can imitate someone a staff member knows, which removes the familiar cue of recognizing a voice. Each change weakens an instinct people were taught, so the training has to replace the instinct rather than only warn against it. The message may now be flawless. What it asks people to do is the part that still gives it away.

Teach the behavioral signals

The signals worth teaching are behaviors rather than wording. Ask staff to notice:

• A request that bypasses the normal process, such as a payment to a new account or a change of contact details sent only by email.
• Urgency that discourages checking, such as a deadline that cannot wait for a call.
• Secrecy, where the message asks the recipient not to mention the request to colleagues.
• A request to move the conversation to a channel the organization does not normally use.
• Pressure to act before a second person can review.
• A reason to act that depends on the sender being senior or in a hurry.

None of these proves a scam, and legitimate requests can share some of them. The aim is to trigger a pause, and the pause is where verification happens. Teach the signals with examples from your own organization. A generic list is easy to agree with and hard to recall under pressure, while a case from last quarter's real request sticks.

Make verification a habit

The reliable defense is a rule that does not depend on judging the message. For any request that moves money, changes access or shares sensitive data, verify through a channel the message did not supply. The mechanism matters. The sender controls the content of the message, including any phone number or link inside it. A call to a number taken from the company directory, or a check through an established internal tool, reaches a path the sender does not control. The habit has to be simple enough to follow under pressure, and a rule that senior people follow too makes it easier for everyone else to follow.

The same rule covers voice and video. A familiar voice on a call is not verification, however convincing it sounds. A request that arrives by voice or video should be checked through a separate, pre-agreed route. Some organizations use a shared phrase for high-value requests. The phrase only helps while it stays secret, so it should be changed whenever it may have leaked. Verification also needs an owner for each process. If a payment change must be confirmed by a call, the finance team should maintain the list of numbers and the procedure for updating it.

Run fair simulations

Simulated phishing can help, and it can also backfire. Simulations should test whether the process works, not whether people can be tricked. Keep scenarios realistic without being cruel, match the processes staff would face in real life, and debrief soon after so the lesson attaches to the event. Avoid publishing which individuals clicked. A simulation that embarrasses people teaches them to hide mistakes, which is the outcome least wanted. Measure whether people reported the message and used the verification step, not only whether they clicked. Include the tools staff use every day, such as shared document links and calendar invitations, not only email. Scams move across channels, and training that covers one channel leaves the others open.

Make reporting easy and visible

Training fails if reporting is hard. A report should take one step, go to a named channel and produce some response. When reports lead to blame, people stop making them, and the organization loses the early warning that a scam is circulating. Acknowledge reports quickly, tell people when a report led to action, and treat reports as a sign of a healthy culture rather than of carelessness. A short reply that says what was found and what happened next is often enough to keep people reporting. A rise in reports can mean the training is working, and teams should read it that way before treating it as a problem.

Practice on a sample set

Gather a set of messages, either real ones with identifying details removed or invented examples. Ask several colleagues to sort each one by the signal that fired and the verification step that would apply. Compare answers. Disagreements are the useful part, because they show where the training language is unclear. Revise the signal list until people who did not write it reach the same sort most of the time. Run the same sample again a month later to see whether the reasoning has stuck. Retire each sample once it has been used, so people learn the reasoning rather than the answers.