AI-Powered Phishing — How BEC Became A Multi-Persona AI Campaign

Business email compromise used to involve one attacker impersonating one executive. In 2026, Proofpoint documented BEC campaigns where AI coordinates multiple fake personas simultaneously — a fake CFO, a fake legal adviser, and a fake supplier contact all building a relationship over weeks before the final payment request arrives. The multi-persona campaign builds trust that no single-source impersonation can achieve, and AI handles all the coordination. My breakdown of how AI transformed phishing from a volume game to a precision operation, and what detection looks like when you can no longer spot it by grammar.

What You’ll Learn

How AI changed phishing from template-based to personalised precision attacks

The multi-persona BEC campaign pattern documented by Proofpoint in 2026

Why traditional phishing awareness training fails against AI phishing

The technical and behavioural detection signals that still work

What organisations need to add to their phishing defence stack in 2026

⏱️ 12 min read

AI-Powered Phishing — 2026 Complete Guide

How AI Changed Phishing
The Multi-Persona BEC Pattern
Why Awareness Training Fails
Detection Signals That Still Work
What to Add to Your Defence Stack

AI phishing is one of the six AI scam types covered in the consumer-facing AI Scams 2026 guide. The credential theft that AI phishing enables feeds directly into the infostealer landscape in AI Infostealer Malware 2026. Check your own exposure with the Email Breach Checker.

How AI Changed Phishing

IBM X-Force’s 2026 Threat Intelligence Index confirmed that AI-enabled credential harvesting is driving significant year-over-year increases in successful phishing outcomes. My framing for the transformation: traditional phishing was a volume game — send a million emails, 0.1% click rate, 1,000 compromised credentials. AI phishing is a precision game — send 50 highly targeted emails to 50 high-value targets, 40% click rate, 20 compromised credentials from people who have admin access, financial authority, or privileged data access. The economics are completely different and the outcomes are significantly worse.

TRADITIONAL vs AI-POWERED PHISHING

# Traditional phishing (pre-AI)

Targeting: mass — same email to thousands of addresses

Content: template — generic greeting, recognisable grammar errors

Personalisation: none or basic (name from email address)

Click rate: 0.1–1% — detectable by content analysis and user training

# AI-powered phishing (2026)

Targeting: precision — OSINT-driven selection of high-value targets

Content: personalised — references real name, job, company, recent activity

Personalisation: deep — LinkedIn posts, company announcements, press releases

Click rate: 3–5x higher than generic — IBM X-Force data 2026

# What AI enables that humans can’t match

OSINT at scale: research 10,000 targets in the time a human researches 10

Writing quality: indistinguishable from legitimate corporate communication

Voice cloning: real-time phone follow-up using AI cloned voice of sender

Multi-channel coordination: email + LinkedIn + WhatsApp + phone simultaneously

The Multi-Persona BEC Pattern

The multi-persona BEC campaign is the 2026 evolution of business email compromise that Proofpoint specifically flagged in their AI-Driven Attacks 2026 briefing. My concern about this pattern: it defeats the verification instinct that a single-source BEC triggers. When you receive a payment request from a fake CFO, you might verify it. When you receive consistent reinforcement from a fake CFO, fake legal adviser, and fake supplier contact over three weeks — all coherent, all remembering previous conversations — the social proof is overwhelming.

MULTI-PERSONA BEC — HOW THE CAMPAIGN RUNS

# Campaign setup (Week 1)

AI creates 3 fake personas: CFO lookalike domain, legal@firm.cc, supplier contact

Each persona: realistic LinkedIn profile, email signature, consistent backstory

Initial contact: low-stakes warm-up emails establishing the relationship

# Trust building (Weeks 2–3)

CFO persona: references a real upcoming deal from public sources

Legal persona: “confirms” the deal structure in parallel communication

Supplier persona: builds a separate relationship establishing payment history

AI: maintains consistency across all three personas simultaneously

# The request (Week 4)

CFO: “As we discussed, please initiate the wire for the acquisition deposit”

Legal: sends “confirmation” of the transaction simultaneously

Supplier: already has payment history — a “change of bank details” request follows

Victim: has corroborating communications from three sources built over weeks

# Why standard verification fails against this

“Check with a colleague” — the fake colleague has also been emailing them

“Look at the email domain” — AI campaigns use very close lookalike domains

“Check with the real CFO” — the fake CFO preemptively warned of “phone being broken”

securityelites.com

AI Phishing Detection — What Still Works in 2026
Detection Method
Status vs AI Phishing
Reliability
Grammar/spelling check
AI writes perfect English — this signal is dead
❌ Dead
Generic greeting detection
AI personalises — “Hi Sarah” not “Dear User”
❌ Dead
Urgency + pressure signals
AI campaigns build urgency gradually — still present
⚠️ Weaker
Domain name check
Lookalike domains — requires careful inspection
⚠️ Still works
Out-of-band verification
Call real person on stored number — defeats all BEC
✅ Reliable
Payment process controls
Dual approval, callback for bank changes
✅ Reliable
DMARC/DKIM enforcement
Blocks domain spoofing — not lookalike domains
✅ Partial

📸 AI phishing detection reliability matrix 2026. Two traditional detection signals — grammar errors and generic greetings — are effectively dead against AI-generated phishing. The reliable defences are all procedural: out-of-band verification and payment process controls. My key training message for finance teams: the controls that stop AI BEC aren’t about spotting the fake email — they’re about the process that must happen regardless of how convincing the email looks.

Why Awareness Training Fails

Gartner’s 2026 cybersecurity trends report specifically called out that GenAI is breaking traditional security awareness approaches. My reading of this finding: the problem isn’t that training has become worthless — it’s that training designed around detecting bad writing is now teaching the wrong skill entirely. My read of why: phishing awareness training is built around teaching people to spot suspicious content. AI phishing doesn’t produce suspicious content. It produces indistinguishable content. The training is teaching people to detect a signal that no longer exists in sophisticated attacks.

WHY TRADITIONAL TRAINING FAILS — AND WHAT TO TEACH INSTEAD

# What traditional training teaches

Look for grammar errors → AI produces perfect grammar

Check for generic greetings → AI personalises with your real name

Be suspicious of urgency → AI builds urgency gradually over weeks

Hover over links → AI uses legitimate-looking domains, URL shorteners

# What 2026 training should teach instead

Process over detection: follow the payment process — every time, no exceptions

Out-of-band verification: any financial request → call the person on a stored number

Bank detail changes: always require in-person or phone confirmation — never email only

New payment recipients: require a second approver regardless of who sent the request

# The shift in mental model

Old: “I can spot a phishing email if I look carefully enough”

New: “I follow the process regardless of whether the email looks legitimate”

The process protects you when your detection skills fail — which AI makes inevitable

Detection Signals That Still Work

RELIABLE DETECTION IN THE AI PHISHING ERA

# Technical: email authentication

DMARC: blocks exact domain spoofing (company.com faked as company.com)

Limitation: doesn’t block lookalike domains (c0mpany.com, company-corp.com)

DMARC + lookalike domain monitoring = more complete coverage

# Technical: AI-generated content detection

Email security vendors adding AI-generated text detection to filters

Signal: statistical patterns in AI-generated text (still detectable in 2026)

Tools: Proofpoint, Microsoft Defender, Abnormal Security

# Procedural: the signals that don’t degrade

Domain check: is this exactly company.com or slightly different?

First contact: is this the first time this person has emailed about this topic?

Request type: does this involve money, credentials, or sensitive data?

Rule: any new financial request → out-of-band verification regardless of email quality

EXERCISE — THINK LIKE AN ATTACKER (10 MIN)

Design an AI Phishing Campaign Against a Target

For educational understanding — designing the attack teaches you what to defend against.

Pick a publicly-listed company as your target organisation.
Pick a finance manager as your target individual (find one on LinkedIn).

1. OSINT RECONNAISSANCE
What public information is available about this person?
LinkedIn: job title, company, how long in role, connections, recent posts
Company website: recent news, leadership team, current projects
Press releases: any recent acquisitions, partnerships, supplier changes?

2. PERSONALISATION PLAN
How would you open your email to reference something specific and recent?
What pretext would use the company’s current news?
What relationship would your fake persona claim?

3. TRUST BUILDING
What low-stakes first email establishes the relationship?
What follow-up email references the first conversation?
How many touchpoints before the financial request?

4. THE REQUEST
What specifically would you ask for?
How would you make the request feel urgent but not suspicious?

5. DEFENCE IMPLICATION
What single procedural control would have stopped you at step 4?
(This is the control worth implementing)

✅ The answer to question 5 is almost always: an out-of-band verification requirement for new payment recipients or bank detail changes. The entire multi-persona campaign collapses when the target calls the real finance director on their known phone number before processing the payment. The sophistication of the attack doesn’t matter — AI can build perfect personas and coherent multi-week relationships, but it cannot intercept a phone call to a number the target independently holds.

What to Add to Your Defence Stack

AI PHISHING DEFENCE — 2026 UPDATES

# Technical additions

DMARC enforcement: p=reject on your domain if not already done

Lookalike domain monitoring: alert on newly registered domains similar to yours

AI content detection: email security platform with LLM-generated text analysis

Phishing-resistant MFA: hardware keys or passkeys — defeats credential phishing entirely

# Process additions

Payment process: any new payee or bank detail change requires phone confirmation

Wire transfer policy: dual approval above threshold — one approval is not enough

Email financial requests: policy that email alone cannot authorise payment

# Training updates

Remove: “look for grammar errors” from phishing training — this is the most urgent update, as it trains a detection signal that AI phishing specifically eliminates

Add: “follow the payment process regardless of how convincing the request looks”

Add: QR code phishing — Proofpoint documented fragment-based attacks in 2026 that split malicious URLs across multiple QR codes to evade detection

QR Code Phishing — The Detection Bypass Evolution

Proofpoint specifically flagged QR code phishing evolution in their 2026 threat briefing. The latest technique — fragment-based QR attacks — splits the malicious URL across multiple QR codes so that no single code contains the full phishing URL. Individual codes pass URL reputation checks because each fragment is meaningless on its own. My concern: this is a targeted attack on the detection layer rather than the user layer, which means technical controls are being specifically circumvented.

QR PHISHING — 2026 TECHNIQUES

# Traditional QR phishing

Email contains QR code linking to phishing site

Bypass reason: mobile cameras scan QR → redirects to phishing page → no email link click tracked

Detection bypass: email security tools scan URLs in hyperlinks, not QR code payloads

# Fragment-based QR attacks (Proofpoint 2026)

Multiple QR codes in email/document — each encodes a URL fragment

Victim scans all codes → JavaScript assembles the full URL → redirects to phishing site

Detection bypass: no single code contains the full malicious URL — all pass reputation checks

# Defence

Decode QR codes in emails before delivery — treat QR content as links

Flag: multiple QR codes in a single email is highly unusual business communication

Train: employees to be as sceptical of QR codes as hyperlinks

AI Phishing 2026 — Key Points

AI phishing: precision over volume — 3–5x higher click rates than generic campaigns

Multi-persona BEC: AI coordinates 3+ fake identities building trust over weeks

Training failure: grammar/urgency detection useless against AI-generated content

What works: process controls — payment policy, out-of-band verification, dual approval

Tech stack additions: DMARC enforcement + lookalike monitoring + phishing-resistant MFA

AI Phishing — Your Next Step

Two immediate actions: enforce DMARC p=reject on your domain today, and update your payment process to require out-of-band verification for any new payee or bank detail change. Those two controls address the most common AI BEC attack path. Check your own email exposure first with the Email Breach Checker.

Quick Check

A finance manager receives an email from what appears to be the company’s CFO requesting an urgent wire transfer. The email is perfectly written, references a real ongoing project, comes from a plausible domain, and is followed up by a second confirming email from a legal contact. What is the correct response?

Frequently Asked Questions

How is AI phishing different from traditional phishing?

Traditional phishing uses template emails sent to thousands of targets with minimal personalisation — detectable by grammar errors, generic greetings, and recognisable pretext patterns. AI phishing uses open-source intelligence to personalise each email with real details about the target — their name, job title, company, recent projects, and public statements. AI generates this personalisation at scale, achieves 3–5x higher click rates than generic campaigns, and produces writing quality indistinguishable from legitimate corporate communication.

What is multi-persona BEC?

Multi-persona business email compromise is an AI-coordinated attack where multiple fake identities — typically a fake executive, a fake legal contact, and a fake supplier — simultaneously build relationships with a target over weeks. AI maintains consistency across all personas, creating a web of corroborating “witnesses” that overwhelms the social proof verification most people rely on. Proofpoint documented this as an emerging BEC pattern in 2026, distinct from traditional single-impersonator BEC attacks.

What is the most effective defence against AI phishing?

Process controls that don’t depend on detecting fake emails. Specifically: requiring out-of-band verification (phone call to a stored number) before any financial transaction, requiring dual approval above a threshold, and never allowing bank detail changes to be processed based on email alone. These controls work regardless of how convincing the email is, because they require an action — a real phone call to a real number — that the AI attacker cannot intercept. DMARC enforcement and phishing-resistant MFA are the technical complements.

Does phishing awareness training still work?

Traditional phishing awareness training — teaching people to spot grammar errors, generic greetings, and urgent language — is significantly less effective against AI-generated phishing because AI produces high-quality, personalised, non-urgent content. Gartner’s 2026 cybersecurity trends specifically noted GenAI is breaking traditional awareness approaches. Updated training should shift focus from content detection to process adherence: follow the payment verification process regardless of how convincing the request looks.

← Related

AI Scams 2026 — Consumer Guide

AI Infostealer Malware 2026