Cyber security in an AI world

• Around eight in ten Britons report receiving an impersonation attempt from someone posing as a trusted person or organisation.
• Only 14% are very confident they could recognise AI-generated or manipulated communications.
• IET urges families to agree a private safe word to help verify unexpected calls or messages.

Britons are being urged to rethink how they decide whether an unexpected call or message is genuine, as new research from the Institution of Engineering and Technology (IET) reveals around eight in ten have received an impersonation attempt from someone posing as a trusted person or organisation.

Released for Cyber Security Awareness Month, the research found that just 14% of Britons are very confident they could recognise an AI-generated or manipulated message, call, image or video.

The IET is highlighting how the familiar cues people have traditionally relied on to judge authenticity – including a person’s voice, a recognised phone number or personal information – can increasingly be imitated or exploited by scammers using AI and information available online.

Familiarity creates trust

More than one in five (22%) would be more likely to believe an approach was genuine if the sender knew information they expected only the real person or organisation to know. A fifth (20%) would be influenced by a familiar-looking telephone number, email address or account, while 13% would be more likely to trust somebody who knew about their recent activities.

A fraudster could, for example, imitate a relative’s voice, mention a genuine holiday or house move discovered online and use exposed contact or account details to support an urgent request for money.

The voice could be generated using AI, while the personal information might have come from social media, a compromised account or an earlier data breach.

Kirsten McCormick, IET AI expert, said:

“We’ve entered an era where authenticity can be generated. AI can create convincing voices, messages, images and even entire personas, so seeing is no longer believing and hearing is no longer confirmation.

“AI isn’t ‘hacking’ people; it is helping criminals become better social engineers, creating more convincing stories, faster and at greater scale. Technology can help defend us, but human judgement remains the final firewall. The skill we increasingly need is verification.”

Impersonation attempts becoming part of everyday digital life

Phone remains the most frequent channel for impersonation attempts. Nearly three in ten (29%) people who have experienced them report receiving suspicious calls every day, with those targeted by phone reporting an average of 26.5 impersonation attempts a month.

Patrick Capaldo, Chair of the IET’s Artificial Intelligence Technical Network, said:

“Very little that we see or hear in the digital world can be trusted anymore, so we must all be cautiously sceptical. And with the versatility of AI-powered attacks, the playing field has more or less been levelled – anyone can be a target.”

“Digital footprints have never been greater liabilities, but they aren’t something to be feared or eliminated. We need to be acutely aware of our own digital footprint so we know what an attacker can and can’t use against us.”

Families unprepared for impersonation

Despite the growing sophistication of impersonation attempts, only around one in ten Britons have agreed a safe word with family or friends to help verify an unexpected request.

Just 28% say they would end an unexpected call and call back using a trusted number, while 13% would contact the person or organisation through another channel.

Few families appear to have discussed how they would respond to impersonation. Only 13% have spoken to older relatives about recognising scams, while just 7% have discussed what to do if somebody’s voice, number or online account is impersonated.

Junade Ali, cyber security expert and Fellow at the IET, said:

“If something feels unexpected or you’re being put under pressure to act, pause and verify it independently. Hang up and call back using a number you already trust such as one on the back of your bank card or a bill, or contact the person through another channel to check the request is genuine.

“For families, the important thing is to have these conversations before a scam happens. Agree how you’ll verify each other in an emergency, so if you do receive a worrying call or message, you already know what to do.”

Four ways to protect your family

The IET is encouraging families to take four simple steps to make it harder for impersonation scams to succeed:

1. Agree a private safe word: Choose something memorable but random and difficult to guess, and only discuss it in person.
2. Pause and verify: Don’t allow urgency, fear or pressure to rush you into acting.
3. Call back independently: End the conversation and use a trusted number you already hold or have found independently.
4. Talk about scams before they happen: Discuss what to do if somebody receives an unexpected request and agree in advance how you will verify each other’s identity in an emergency.