From Phishing to AI-Driven Impersonation

Early conversations around tech-enabled scams largely centered on email phishing, where fraudsters posed as a bank, vendor, or colleague to steal login credentials or initiate fraudulent wire transfers. That threat hasn’t disappeared, but AI has added a new layer of sophistication on top of it.

The tools organizations use to move faster are the same ones scammers use to look more convincing. Deepfake video and voice cloning can impersonate executives asking employees or customers to act. AI-generated storefronts and lookalike domains can be spun up in far less time than it takes a security team to detect them.

One Scam, Many Victims

San Francisco offers a useful example. In July 2026, the city launched StopScams SF, which it described as the nation’s first comprehensive city-led strategy for scam prevention and victim support. Later that month, the City Attorney sued two hotel-booking websites accused of impersonating legitimate hotels and misleading travelers into paying inflated rates.

The immediate victims were travelers, but the consequences extended further. Hotels had to deal with confused or angry guests, and the scam traded on trust in the local hospitality industry itself. A single incident rarely stays contained to a single target, and the mechanics are the same in every industry.

Scams as Threat Intelligence

Too many organizations still treat a discovered scam as a one-off cleanup task. They report it, get it taken down, and move on, missing what the scam is actually telling them.

Attackers choose which executives to impersonate, which products to clone, and which customer segments to target based on what they believe is valuable, exploitable, or under-defended. A fake login page mimicking a specific product line signals where a company’s customers are vulnerable. A voice-cloning scam posing as the CEO can point to the departments, employees and even board members most at risk. Read correctly, impersonation activity is a live map of where an organization is exposed, months before that exposure shows up as a breach.

What CISOs Should Do With This

1. Audit SOC workflows for blind spots.

If brand and impersonation monitoring sits in a separate function from the SOC’s threat intelligence feed, the signal isn’t reaching the people positioned to act on it. Impersonation data should feed the same prioritization models used for internal alerts, rather than sitting in a marketing or legal silo.

2. Build employee training around real targeting patterns.

Instead of teaching employees to “spot phishing” in the abstract, training should cover how attackers are currently impersonating the company’s own executives, products, and customer-facing channels. That specificity is what makes training stick.

3. Treat every discovered scam as a lead.

When a fake site or cloned voice surfaces, the response shouldn’t end at takedown. Security, legal, and communications teams should check whether the same campaign is running elsewhere, against other executives, products, or customer groups, before it resurfaces somewhere the company isn’t watching.

The Bottom Line

Impersonation scams will keep getting harder to spot as the tools behind them improve. The organizations that stay ahead will be the ones that read each scam as intelligence about where the next attack is headed.