Three AI-assisted scams aimed at Swiss SMEs right now
Not futuristic threats. Three specific patterns that work on companies of your size, and the one countermeasure that stops all three.
The interesting thing about AI-assisted fraud against SMEs is how unglamorous it is. Nobody is breaking into your systems. They are writing better letters, in your language, referring to real details.
The three patterns
1. The supplier who changed bank. An email arrives from a supplier you genuinely use, in correct German, referencing a real invoice number, saying their bank details have changed. The details are correct because the sender has seen real correspondence — from a compromised mailbox somewhere in the chain, not necessarily yours.
What AI changed: the letter is now flawless. The spelling mistakes that used to give this away are gone.
2. The managing director who is travelling. A voice message, or a short video call, from someone who sounds and looks like your boss, asking for an urgent payment. Covered in December when video generation went public; it has since become ordinary rather than notable.
3. The job application with an attachment. A well-written, plausible application for a role you actually advertised, with a CV attached. The attachment is the payload. HR opens everything, by definition, and receives files from strangers as a matter of routine.
The one countermeasure
All three are defeated by the same rule, and none of them by better email filtering: any change to payment details, and any payment outside the normal process, is confirmed by calling a number you already had.
Not the number in the email. Not a number in the signature. The one in your own supplier record, from before this correspondence started.
Why this is the rule that works
Because it does not depend on anyone spotting anything. Detection-based defences fail as the fakes improve, and the fakes are improving faster than training can keep up.
A process rule does not degrade. A colleague who always calls the stored number is protected whether or not the email was convincing, and whether or not they were paying attention that day.
Fifteen minutes to write down, one conversation to explain, and it removes the entire category. Say explicitly that it applies to instructions from the boss, because that is the version that works and the reason it works.