AI scams: what reflexes should employees learn?

AI scams in the workplace do not always involve spectacular fake videos. They can also take the form of a highly convincing message, an imitated voice or an urgent request apparently coming from a senior executive. AI mainly makes existing scams more credible and personalized.

An employee may receive a payment request, a change of bank details, an invitation to join a video call or an unusual voice message. In some cases, AI-powered voice fraud can imitate the voice of someone the employee knows. The CNIL also notes that deepfakes can involve audio, images or video.

An urgent, confidential or unusual request should always attract attention. Scammers often try to trigger a fast reaction so that the recipient does not take time to verify the situation. The greater the pressure, the more important it is to slow down.

This reflex is especially important when facing a deepfake scam in the workplace. A familiar voice or convincing video can create an immediate sense of legitimacy. However, urgency should never replace normal validation procedures.

When a request seems unusual, the simplest option is often to check directly with the person concerned. Use a known phone number, a trusted internal channel or contact a colleague who can confirm the request.

This method helps employees verify a suspicious request at work without becoming deepfake specialists. The goal is not to analyze every pixel or voice variation, but to confirm the person’s identity through an independent channel.

A recognizable voice is no longer enough to confirm someone’s identity. A realistic video is not enough either. Deepfake technologies can now modify or generate content that appears authentic.

Employees should therefore focus on the context. Does the request match the person’s usual behavior? Is the communication channel normal? Does the requested action follow internal procedures? These questions are often more useful than trying to spot a visual flaw.

A convincing request is never a reason to automatically share a password, MFA code or banking information. Sensitive data must remain protected, even when the person making the request appears familiar.

This rule should be clearly included in AI scam awareness training for employees. Any unusual request involving a payment, access rights or confidential information should trigger an additional verification step.

When something feels suspicious, employees do not need to investigate the situation themselves. A simple sequence is enough: do not react under pressure → verify the identity → keep the evidence → report the attempt. This helps prevent irreversible actions while quickly passing useful information to the right people.

It is also important to keep messages, screenshots and contact details. Cybermalveillance.gouv.fr recommends, for example, not responding to fraudulent requests, alerting the IT department in a business context and preserving available evidence.

The right message is not “trust no one anymore”. That approach would be difficult to apply in everyday work and would mainly create unnecessary distrust. It is more effective to teach a few simple reflexes: slow down, check the context, confirm through another channel and report the situation when doubt remains.

Deepfake and AI scam training also works better when it uses situations employees may actually face. A fake call from a manager, a payment request or an unusual video meeting makes the risk much more concrete than a theoretical definition.

Regular exercises can then help create lasting habits. Employees gradually learn that a perfectly written message or familiar voice is no longer enough to guarantee authenticity.

At Mandarine Academy, cybersecurity awareness relies on short, practical and varied formats. The Mandarine Learn Cybersecurity catalogue covers phishing, risky behaviors and key digital security reflexes.

Employees can also test their knowledge with True or False about Cybersecurity or the Cybersecurity Serious Game. These formats help strengthen vigilance without turning cybersecurity into a list of restrictions.

The more convincing a scam appears, the more important the verification reflex becomes.

AI scams do not make traditional cybersecurity reflexes obsolete. They make them even more important. A voice, video or message may appear authentic while actually being generated or manipulated.

To protect the organization, employees need to learn how to slow down, verify through another channel, protect sensitive information and quickly report suspicious requests.

Effective AI scam awareness training should not make teams suspicious of everything. It should simply give them the right reference points to stay in control when a situation looks almost too credible.