How phishing has changed
Generative AI now writes clean, context-aware messages in seconds, in any language, matched to whatever tone the target expects. For startups and growing businesses, that shift lands hard. Small teams move fast, founders approve payments and access requests personally, and much of the company's operation runs through a handful of inboxes and SaaS accounts. The signals people used to rely on are disappearing, so the protection has to come from process and setup instead.
The FBI's Internet Crime Complaint Center has warned that criminals are using generative AI to make fraud more convincing and easier to scale. The tools remove the spelling and grammar errors that used to give scams away, and they help attackers produce tailored messages for far more targets than they could write by hand. The same alert describes voice cloning and deepfake video being used to impersonate executives.
A modern phishing email might reference your latest funding round, name your actual investors and mimic your co-founder's writing style, all pulled from public sources in a few minutes.
Why founders are prime targets
Founders hold the keys. They often have admin rights on the cloud console, the code repository, the bank and the company's main email domain, and they're used to making quick decisions with little friction. Attackers know a well-timed message about an investor update, a wire transfer or an urgent board document is likely to get a fast response.
Process beats instinct
Since you can't rely on spotting the fake, build habits that work regardless. Verify any payment or bank detail changes through a second channel, using a number you already have. Require two people to approve transfers above a set amount, and treat unexpected urgency as a reason to slow down, especially when it comes from someone senior.
Use phishing-resistant multifactor authentication, such as hardware security keys or passkeys, on email and every critical admin account. Encrypting sensitive correspondence also limits the damage if a single inbox is ever compromised.
Watch what your AI tools can reach
AI agents add a new angle. If an assistant can read your inbox and act on what it finds, a malicious email could try to give it instructions directly. Scope agent permissions tightly and keep a human in the loop for anything involving money or credentials. This guide to reviewing permissions before giving an AI agent access to company data covers the questions to ask before launch.
Make reporting easy
Tell your team that reporting a suspicious message is always the right call, even if it turns out to be genuine. Early reports are how small incidents stay small, and they give you a chance to warn everyone else before the same message reaches them.
AI has raised the quality of phishing, but the basics still work. Strong authentication, verified payment processes and tight permissions protect a company far better than trying to out-read a machine that writes perfect prose. Building them in now, while the team is small, is much easier than retrofitting them after a scare.
