Walk through any neighborhood in Bend on Halloween night and you will pass a hundred monsters. Vampires, werewolves, a six year old dinosaur. They announce themselves from a block away, and the scariest thing any of them will do is take two pieces of candy.
The real monsters do not dress like that. They dress like a vendor you trust, a boss in a hurry, or a helpful little app that just wants to summarize your spreadsheet.
Sam owns a twenty person law firm in Portland and started using AI tools this year to draft correspondence and clean up billing notes. So did the people who send him phishing email. Same technology, opposite intentions, and only one side is wearing a costume.
Garlic will not help. Three plain rules will.
The shapeshifter: a voice you know saying something it never said
A phone call or a video used to be the proof. Text can be faked, but a voice you recognize is real.
Not anymore. A few seconds of audio from a voicemail greeting, a podcast, or a company video is enough to produce a convincing clone of an owner's voice.
The call sounds like the boss. It uses the boss's phrases. It asks the controller to move money before the end of the day.
Can AI really fake a voice well enough to fool an employee?
Yes. The tools are inexpensive, the audio needed is public, and the results fool people who know the speaker well. The tells that used to give clones away are disappearing quickly, so any defense that relies on an employee's ear is already behind. The defense has to sit somewhere the voice cannot reach.
SOURCE: FTC, Cybersecurity for Small Business
That place is procedure. A voice can be faked. A callback to a number on file cannot. A second approval from a second person cannot. Multi-factor authentication on the account cannot.
Shapeshifters fool eyes and ears, not a verification step that does not care what the request sounds like.
How should a business verify a request when the voice or video seems real?
The same way you would if it arrived by email: through a channel the requester did not provide. Hang up and call back at the number you already have. For anything involving money, account access, or credentials, require a second person to approve, and put that rule in writing so nobody has to feel awkward following it. If the real owner is annoyed by a callback, the rule is still right.
The mummy: an old scam in brand new wrappings
For years, phishing had tells. Typos, odd greetings, a sense of manufactured urgency, a link that did not match the sender. Employees were taught to look for the seams.
The seams are gone. AI writes these messages with clean grammar, natural phrasing, and details pulled from a company's own website and social media. The mummy underneath is the same as it ever was. The wrappings are new.
SOURCE: CISA, Secure Our World (Recognize and Report Phishing)
Perfect spelling and a professional tone no longer mean anything. What still gives a scam away is the request itself: an unusual ask, a change to payment instructions, a demand for credentials, or a new link to a login page. Teach your team to judge the request, not the prose, and to treat a polished message with exactly the same caution as a sloppy one.
The vampire: never invite it in
In the old stories, a vampire cannot enter a home unless someone invites it. The rule is worth borrowing, because unapproved AI tools work the same way.
An AI assistant cannot rummage through your files on its own. But it will not stop an employee from pasting a client's financial statements, a patient list, or a draft contract into a free tool and asking for a summary. At that moment the data has left the building, and nobody at the company can say where it went, how long it will be kept, or what the tool's owner may do with it.
What is shadow AI and why does it matter to a small business?
Shadow AI is any AI tool employees use for work without the company approving it or knowing about it. It matters because the data pasted into those tools is often the most sensitive data you hold, and once it is submitted you have lost control of it.
For a law firm, a CPA, or a healthcare practice, that can be a confidentiality or compliance problem before it is ever a security problem. The fix is not banning AI. It is deciding, on purpose, which tools are invited in and what may be shared with them.
Better rules beat better costumes
AI has made deception cheaper to produce, faster to send, and more convincing to trained eyes. That sounds like bad news, and in one narrow sense it is. Your people will not reliably spot the fake.
They do not have to. Every threat above is defeated by a habit that ignores how convincing the request looks: verify through a known channel, require a second approval for money and access, and only use AI tools the company has approved with data the company has cleared.
Can a managed IT provider help a small business set rules for AI?
Yes, and it is becoming a standard part of the job. 10D Tech provides managed IT services and cybersecurity for businesses with 10 to 250 employees across Oregon and southwest Washington, from Portland and Salem through Albany, Corvallis, and Eugene to Bend. AI governance now sits alongside backups and MFA in how we look at a company: which tools are approved, what data is allowed into them, and whether anyone is watching.
At 10D Tech that work is led by Steve, our Managing Partner and AI strategy coach, certified in the AI Business Maturity Model, who helps owners decide which tools belong in the business and what may be shared with them.
The rules themselves are short. Start with three.
What rules should a business set for employee AI use?
Three to start. First, a short list of approved AI tools, chosen because their terms state that your data is not used for training and can be deleted. Second, a plain list of what never goes into any AI tool: client records, financial data, credentials, and anything covered by a confidentiality agreement or regulation.
Third, a named person employees can ask when they are unsure. Write it on one page, share it, and revisit it every six months, because the tools will change faster than the policy.
Sam's firm now has an approved tool, a one page rule, and a callback habit for every wire. The phishing still arrives. It just does not work anymore.
You do not need to become an expert at spotting fakes. You need three rules and a clear picture of where you stand. A complimentary 15 minute Technology Confidence Score call gives you a clear picture of where your systems stand today, along with your score out of 100. See how the Score works at 10dtech.com/aspirin, then schedule at 10dtech.com/Tech_Confidence_Score. Albany, Corvallis, Eugene, Bend: 541-243-4103. Portland, Salem: 971-915-9103.
