Cybercriminals are increasingly leveraging artificial intelligence, or AI, to create more convincing phishing schemes. Traditionally, phishing emails were easier to identify due to red flags such as poor grammar, odd formatting, or misspelled words. However, with AI, those obvious clues are becoming less common, making it crucial for public and affordable housing agencies to remain vigilant.
We spoke with Michael Konopka, Information Security Manager at HAI Group, who shared key insights to help your agency defend against evolving phishing threats:
"These AI-enhanced phishing attacks will become more common and more accurate," Konopka said. "A multi-layer defense strategy that combines people, processes, and technology is essential to counter these increasingly sophisticated threats."
AI-powered cyberattacks have several unique characteristics that make them particularly dangerous, according to cybersecurity firm CrowdStrike.
To illustrate the evolution of phishing attacks, here are two sample emails — one with common pre-AI red flags and one enhanced by AI technology:
Konopka explained that while this AI-generated email still has some telltale signs of a phishing attempt, it's far more polished and professional than older scams.
"This makes it more likely to fool someone who is busy and not thinking twice before clicking or opening links," he said.
Konopka warns that email threads fabricated with the help of AI are particularly dangerous because they exploit familiarity and trust.
"When an email appears to be part of an existing conversation, people are less likely to question its authenticity," he explained. "Attackers know this and are using AI to craft convincing email chains that manipulate employees into acting without hesitation."
How This Scam Works: In this example, the scammer targets Taylor Monroe (a fake person created for this example), who is responsible for processing payments. The scammer impersonates Chris Palmer, a fabricated colleague from Finance Partners' accounting team. To add credibility, they include a fake earlier email from Elliot Rogers, as allegedly from the company's CEO. This staged conversation creates a sense of legitimacy and urgency, making Taylor more likely to comply with the fraudulent payment request.
Earlier Fabricated Emails in Thread:
While traditional phishing indicators like misspellings and awkward language are less frequent due to AI's ability to generate professional-sounding content, phishing attempts still exhibit warning signs. Be wary of:
Modern email filtering technologies can help counteract AI-driven phishing attempts. These tools use advanced algorithms to analyze incoming messages, identify suspicious patterns, and block potential threats before they reach inboxes. Agencies should invest in email security solutions that leverage AI for added protection.
"Training your staff remains a critical defense," Konopka emphasized.
Strongly encourage employees to "think before you click." The digital age we live in further drives the expectation for quick responses. Additionally, phishing attempts often manipulate emotions to provoke impulsive decisions. Teaching staff to pause, assess, and verify suspicious messages can significantly reduce your agency's risk.
HAI Group Online Training is pleased to offer 13 on-demand cybersecurity training courses, available at no cost to HAI Group policyholders and their employees.
For questions or issues accessing the courses, please contact onlinetraining@haigroup.com.
Consider providing your staff with tools to easily report suspicious emails. Options include:
These tools enable employees to flag potential threats for further analysis, improving your agency's ability to identify and mitigate phishing campaigns.
AI can be a powerful tool, but establishing clear guidelines is essential. Konopka recommends the following when developing your agency's AI policy:
To safeguard against fraud and data exposure, your agency should implement processes that require human oversight. Examples include:
By combining technology, training, and secure processes, your agency can stay ahead of AI-driven phishing schemes and protect its valuable data and digital resources.
For additional free cybersecurity resources, visit HAI Group's Resource Center. To explore cyber insurance coverage options, contact your HAI Group account executive.
This article is for general information only. HAI Group® makes no representation or warranty about the accuracy or applicability of this information for any particular use or circumstance. Your use of this information is at your own discretion and risk. HAI Group® and any author or contributor identified herein assume no responsibility for your use of this information. You should consult with your attorney or subject matter advisor before adopting any risk management strategy or policy.
HAI Group® is a marketing name used to refer to insurers, a producer, and related service providers affiliated through a common mission, management, and governance. Property-casualty insurance and related services are written or provided by Housing Authority Property Insurance, A Mutual Company; Housing Enterprise Insurance Company, Inc.; Housing Specialty Insurance Company, Inc.; Housing Investment Group, Inc.; and Housing Insurance Services (DBA Housing Insurance Agency Services in NY and MI).