The UK’s National Cyber Security Centre has assessed that AI is already making cyber intrusion techniques more effective, and expects that trend to accelerate over the next few years. For a recruitment agency, accountancy firm or HR consultancy, that’s not an abstract IT concern. These businesses move client money, hold sensitive personal data on candidates and clients, and run on trust built over years. That combination makes them a genuinely attractive target, not despite being smaller than a multinational, but partly because of it.

Poor spelling and clunky phrasing used to be the easiest way to spot a scam email. Generative AI has quietly removed that safety net. Attackers can now produce fluent, well punctuated messages in perfect English, referencing a recipient’s real job title or a project pulled straight from LinkedIn. According to the government’s 2025 Cyber Security Breaches Survey, phishing was identified as the cause behind 85 percent of the cyber incidents businesses experienced last year. That figure hasn’t dropped as awareness has grown, because the attacks themselves have kept pace.

The uncomfortable truth is that most staff were trained to trust their gut. AI generated phishing is specifically designed to satisfy that gut check.

Text based phishing is only part of the shift. The more striking development is what happens when AI is used to impersonate a real person, in real time, on a call.

In early 2024, a finance employee at Arup, the London headquartered engineering firm behind the Sydney Opera House, joined what he believed was a video call with his CFO and several colleagues. Every person on that call, aside from him, was an AI generated deepfake, built from footage the real executives had appeared in during webinars and conference talks. He’d initially suspected the request was a phishing attempt, but the video call satisfied his doubts, and he authorised 15 transfers totalling roughly $25.6 million before anyone realised what had happened.

That same year, WPP’s chief executive Mark Read was the target of a similar attempt. Scammers built a fake WhatsApp profile using his public photo, then used a cloned voice and pulled YouTube footage to run a fake Microsoft Teams meeting with a senior colleague, attempting to solicit money and personal details. That one failed, caught by an alert employee rather than any piece of software. Read’s own warning to staff afterwards is worth repeating: the techniques now go well beyond email, into virtual meetings and voice as well.

Neither of these firms is small. But the tools behind both attacks have become considerably cheaper and easier to access since 2024, which is exactly why the risk has moved down the size scale rather than staying at the top.

Recruitment, accountancy and HR consultancies sit in an unusually exposed position. Client funds move through accountancy and payroll processes regularly. Candidate and employee data, including bank details and personal documents, sits in recruitment systems as a matter of course. And these firms tend to run lean, without a dedicated security team scrutinising every unusual request.

The financial impact when it goes wrong is significant. The same government survey found that cyber facilitated fraud, where a breach leads directly to a financial loss, cost affected businesses an average of £5,900, rising to £10,000 once genuinely zero cost incidents are excluded. Phishing was identified as the entry point in 54 percent of those fraud cases. For a business the size of most recruitment or accountancy firms, that’s not a rounding error.

The fix isn’t a cleverer list of red flags, because the red flags keep changing. It’s a shift in how staff verify anything unusual before acting on it, combined with training that’s updated as often as the threats are.

A few habits are proving genuinely effective against this new wave of attacks:

• Treat any urgent request for a payment, credential, or sensitive data as a prompt to verify, not a prompt to act. A callback to a known number, not one supplied in the message itself, breaks the spell of even a convincing deepfake.
• Agree a simple verification method in advance for anything involving money or sensitive data, a phrase or process the whole team knows and uses. It sounds basic, but it’s one of the few things a real time deepfake genuinely can’t fake.
• Don’t rely on recognising a face or voice as proof of identity on a video call. That’s precisely the assumption both the Arup and WPP attacks were built to exploit.
• This is where ongoing, simulated training earns its keep over a once a year session. A single annual module teaches people what phishing looked like when it was recorded. Regular, updated simulated phishing keeps pace with what it looks like now.

Cybersecurity Awareness Month runs every October, and it’s a natural point to check whether your organisation’s approach has kept up with how the threat has changed, rather than just ticking the box again. Blue Saffron delivers ongoing cybersecurity training and awareness built around this reality, simulated phishing that evolves alongside real attacks, not a static course run once and forgotten. If you’d like to talk through what that looks like for your team, get in touch.