Can You Still Trust What You See and Hear?
AI-generated messages, cloned voices and increasingly convincing impersonation attempts are changing how we recognize cyber threats. But does that mean the security habits we have relied on for years are no longer enough?
A few years ago, a suspicious email was often easy to recognize. Strange wording, spelling mistakes, an unfamiliar sender or a poorly designed website could give it away.
Today, that is no longer necessarily the case.
Artificial intelligence can generate perfectly written messages in almost any language, imitate familiar voices and create convincing videos. And attackers are no longer limiting themselves to email. Text messages, phone calls and messaging applications have become important channels for social engineering.
According to IBM’s Cost of a Data Breach Report 2026, one in four malicious breaches in its study was AI-enabled.
So, if a message looks professional, sounds familiar and appears to come from someone you know, how can you tell whether it is genuine?
How has AI changed phishing in 2026?
AI has made phishing more convincing by allowing attackers to create fluent, personalized messages quickly and at scale. Familiar warning signs, such as spelling mistakes or awkward language, are becoming less reliable indicators of fraud.
Imagine receiving an email from someone who appears to be a business contact you recently met at an industry event. The message mentions the event, refers to your professional interests and uses the kind of language you would expect from that person. Nothing seems particularly suspicious. But an attacker could have collected those details from publicly available information and used an AI tool to create the message.
The same applies to internal communication. A message that appears to come from a colleague may include accurate names, job titles and references to real business activities. The important question is no longer simply whether the message looks authentic.
It is whether the request itself is legitimate.
An unexpected request to share credentials, approve a payment or open an unfamiliar link deserves verification, regardless of how convincingly it is written.
Why are attackers increasingly using SMS and phone calls?
Text messages and phone calls can be effective phishing channels because people often respond to them quickly, particularly when a message creates urgency. Smaller screens, shortened links and familiar sender names can make suspicious requests more difficult to recognize.
Verizon’s 2026 Data Breach Investigations Report found that the median success rate of phishing through text messages and calls was approximately 40% higher than through email.
Consider a text message warning that your account will be locked unless you verify your identity within 30 minutes. The message includes a link and appears to come from a familiar service. The urgency encourages you to act before checking whether the request is genuine.
This is particularly relevant in a world where businesses increasingly communicate with customers across multiple digital channels.
SMS and other messaging services remain essential communication tools. The risk arises when attackers impersonate legitimate senders and exploit the trust people place in familiar channels.
Before following an unexpected link, three questions can help:
Who is contacting me? A familiar sender name does not prove authenticity.
Why is the request urgent? Artificial deadlines are often designed to prevent verification.
Where does the link lead? A familiar-looking web address may still direct you to a fraudulent website.
If something seems unusual, open the service independently or contact the organization through a trusted channel.
How is AI changing impersonation across communication channels?
AI-powered impersonation is extending beyond written messages to phone calls and video communication. Voice cloning and deepfake technology allow attackers to imitate real people using publicly available recordings, making fraudulent requests increasingly difficult to recognize.
An attacker could impersonate a colleague or business partner during a phone call, using a familiar voice and accurate professional information to request a payment, confidential data or login credentials. Cybersecurity reports describe how these techniques are being combined across email, telephone, text messages and video calls.
As communication becomes increasingly interconnected, verifying the identity of the sender or caller becomes just as important as recognizing the content of a message. A familiar name, voice or face should not replace independent verification when a request involves sensitive information or unusual actions.
How can you verify a request when everything looks legitimate?
The most effective defense against AI-powered impersonation is independent verification. Instead of relying on how convincing a message, call or video appears, confirm unexpected or sensitive requests through a communication channel you already know is genuine.
This is particularly important when a request involves financial transactions, login credentials, confidential information or changes to established procedures. Attackers often create a sense of urgency precisely because it discourages people from taking the time to verify what they have been asked to do.
For example, if someone claiming to be a manager requests an immediate payment, contact that person using their existing phone number rather than the contact details provided in the suspicious message. If a text message asks you to reset your password, open the service directly instead of following the link. And if someone claiming to be IT support requests a login verification code, do not share it.
These precautions may appear simple compared with the sophistication of modern AI technology, but they address the fundamental weakness that social engineering attempts to exploit: persuading someone to act before confirming that a request is legitimate.
The same principle applies to reporting suspicious activity. Even when no information has been shared, alerting the appropriate security team to an unusual request can help identify attempted impersonation and prevent similar attacks against others.
Has AI changed what actually protects us?
Although AI has increased the sophistication and credibility of cyber threats, the fundamental principles of cybersecurity remain largely unchanged. Strong authentication, careful handling of sensitive information, independent verification and timely reporting continue to provide essential protection.
Multi-factor authentication adds another layer of security when passwords are compromised, while phishing-resistant methods such as passkeys and security keys offer additional protection against fraudulent login pages. Keeping devices and applications updated reduces exposure to known vulnerabilities, and limiting access to sensitive information helps reduce the potential consequences of compromised accounts.
However, technical safeguards alone cannot eliminate social engineering. An attacker who successfully convinces someone to approve an unauthorized transaction or disclose confidential information may bypass protections without exploiting a software vulnerability.
This is why cybersecurity awareness remains as important as technological protection. Employees need to understand not only what suspicious communication looks like, but also why apparently legitimate requests may require additional verification.
At HORISEN, information security is an integral part of developing and operating reliable messaging technology, supported by our ISO/IEC 27001:2022 certification. As digital communication continues to evolve, protecting the information exchanged through these systems requires both appropriate technical safeguards and responsible everyday practices.
Artificial intelligence will continue to improve the way businesses communicate, automate processes and serve customers. At the same time, it will make some forms of deception increasingly difficult to recognize.
The challenge is therefore not to become suspicious of every message, call or digital interaction, but to understand when trust needs to be supported by verification.
Because in the age of AI, looking real and being real are no longer the same thing.
Frequently Asked Questions About AI and Cybersecurity
What is AI-powered phishing?
AI-powered phishing uses artificial intelligence to create convincing fraudulent messages that encourage recipients to disclose sensitive information, follow malicious links or take unauthorized actions. AI enables attackers to personalize these messages and make them more difficult to distinguish from legitimate communication.
What is smishing and how does it differ from phishing?
Smishing is a form of phishing carried out through SMS or other text messages rather than email. Attackers typically impersonate trusted organizations and use urgent requests or deceptive links to persuade recipients to reveal information or take action.
What is a deepfake in cybersecurity?
A deepfake is AI-generated or manipulated audio, video or imagery designed to imitate a real person. In cybersecurity attacks, deepfakes can be used to impersonate colleagues, executives or other trusted individuals to obtain information or authorize fraudulent activities.
How can you protect yourself against AI-powered impersonation?
Verify unexpected or sensitive requests through an independent, trusted communication channel, even when a message or caller appears familiar. Avoid sharing authentication codes or confidential information in response to unsolicited requests, and report suspicious activity promptly.
