Two Fake Recruiters in 14 Hours:Why AI Scams Target People, Not Systems, and 3 Ways to Protect Your Team

AI makes it cheap to pretend to be anyone, in email, on the phone and on video. The best defense is not better software. It is a few simple habits your team uses every time money or trust is on the line.

Two fake recruiters in 14 hours

Within 14 hours this week, two recruiters emailed me about AI leadership jobs. One dangled $650,000 to $850,000 a year. Both were fake.

The big number came from someone claiming to work at a real national staffing firm. The email came from a personal Gmail account, the sender's name was spelled two different ways, and a stranger's address sat next to mine in the To line. The follow-up said the hiring manager "asked that I personally reach out."

The other one pitched a Chief AI Officer role with no company, no pay and no phone number. My AI agent needed less than three minutes to show it was fake. The domain was two months old, and the email really came from a personal Gmail account too.

My gut got there first both times. Something didn't add up.

These were easy. The next ones won't be.

AI fakes are getting harder to spot

AI is getting close to the point where a fake person is nearly impossible to tell from a real one. In email, on the phone and on video. Three recent cases show how far it has already gone.

Arup, 2024. A finance worker in the Hong Kong office of Arup, the engineering firm behind the Sydney Opera House, got an email that looked like it came from the company's UK office. He suspected it was phishing. Then he joined a video call with his CFO and several colleagues, and his doubts went away, because they looked and sounded like people he knew. Every one of them was a deepfake. He made 15 transfers to five bank accounts, about $25 million, before he checked with head office. (CNN report)

An Italian private bank, February 2026. The chairman of Fideuram, a private bank owned by Intesa Sanpaolo, got a WhatsApp message that looked like it came from the group's CEO. A call followed in the cloned voice of a senior lawyer. About 95 million euros left the bank, most of it to accounts in China and Hong Kong. Authorities have recovered a little over half. (Gulf News, citing Reuters; Cybernews)

Ferrari, 2024: the one that got away. A scammer messaged one of Ferrari's executives on WhatsApp about a planned acquisition, then called in a cloned version of CEO Benedetto Vigna's voice, down to his southern Italian accent. The executive asked which book Vigna had recommended to him a few days earlier. The caller hung up. (Motor1, citing Bloomberg; MIT Sloan Management Review)

The numbers behind it

In the US, email impersonation scams cost businesses about $3 billion last year, according to FBI complaint data. The FBI's 2025 Internet Crime Report counts 24,768 business email compromise complaints and $3,046,598,558 in losses. Complaints the FBI tagged as AI-related added up to $893,346,472 in losses.

Security systems don't stop a tricked person

I'm a software engineer. I can build systems that are very hard for hackers to break into. But at the end of the day, the people working in a company are human. If a person is tricked into sending the money, the best security system in the world won't make a difference.

Look at the three cases again. None of them needed to break into a computer. Each one needed one person to believe one message.

3 ways to protect your team

If you run a business, here is how to protect your team.

1. Treat urgency as a warning sign. If a message says it has to happen today and has to stay quiet, slow down. Don't act on impulse.
2. Verify with the person directly. Face to face if you can. If not, call them on a number you already have, never the one in the message.
3. Agree on a check only the real person can pass. Ferrari's book question worked because no AI could look it up.

Have you ever had a very convincing phishing email that you almost believed?