The $25 Million Zoom Call
Earlier this year, employees at a multinational company received a video call invitation from what appeared to be their CFO and several senior colleagues. The meeting looked completely normal — familiar faces, familiar voices, familiar mannerisms. The employees followed the instructions they were given and authorized wire transfers totaling $25 million.
Every single person on that call was a real-time AI deepfake. The CFO wasn't there. The colleagues weren't there. The entire meeting was fabricated using artificial intelligence.
This is no longer science fiction. This happened. And the same technology is now being deployed against small businesses across the United States — including right here in Houston.
Why 2026 Is Different
AI has been talked about in cybersecurity for years. What changed is that the tools became fast, cheap, and accessible.
What used to require weeks of work by a skilled criminal now takes 30 seconds:
- •A voice clone from 30 seconds of audio scraped from a YouTube video or LinkedIn post
- •A realistic phishing email generated by AI that uses your company's actual writing style, references real employees by name, and contains zero spelling errors
- •A real-time video filter that overlays a known face onto a live video call
AI-generated phishing emails now achieve click-through rates more than four times higher than human-crafted ones, according to security researchers. The reason is simple: AI removes every signal employees have been trained to look for — bad grammar, generic greetings, off-brand formatting.
The Three Attacks Hitting Small Businesses Right Now
1. AI Voice Cloning — The "CEO Emergency"
An employee receives a call from a number that shows the owner's name. The voice is unmistakably the owner's — because it was cloned from voicemails, video calls, or public recordings. The "CEO" explains there's an emergency: a wire transfer needs to happen immediately, it needs to be kept confidential, and they need the employee to act right now.
The urgency is deliberate. Pressure overrides verification instincts.
2. Hyper-Personalized Phishing Emails
Traditional phishing is easy to spot: "Dear Valued Customer, click here." AI phishing is different. The email references your actual vendor by name, mentions a real invoice number scraped from a data breach, uses the writing style of someone your employee knows, and comes from a domain that looks almost identical to the real one.
These emails are generated at scale. A criminal operation can target hundreds of Houston businesses simultaneously, each attack customized to feel personal.
3. Deepfake Video Calls
As the $25 million case demonstrated, video is no longer a verification tool. Attackers create fake meeting invites, staff joins expecting a routine call, and AI overlays generate real-time video and audio of trusted faces. Finance approvals, access credentials, and sensitive information are surrendered because the person asking "looks" trustworthy.
Why Small Businesses Are Especially Vulnerable
Large corporations have formal multi-step approval processes, dedicated security teams, and verification protocols. Small businesses run on trust and speed — which is exactly what these attacks exploit.
When the boss texts you asking for something urgent, you don't usually ask for three forms of verification. When a vendor emails about an invoice, you don't call back to confirm every time. AI attackers know this and exploit the informal trust that makes small businesses efficient.
How to Defend Your Houston Business
The good news: there are practical, low-cost defenses that make your business significantly harder to attack.
Establish a verbal code word for unusual requests.
For any request involving money, account changes, or sensitive data — especially from a phone call or video — require a pre-agreed code word. No code word, no action. This one step stops voice cloning attacks cold.
Verify wire transfer requests through a second channel.
Any request to transfer money, change payment details, or share credentials should be verified via a separate communication method. If the request came by email, call the person on their known phone number — don't use the number in the email. This is the most effective defense against business email compromise.
Slow down urgency.
AI attacks manufacture urgency because urgency kills verification. Build a culture where "I need to verify this first" is always acceptable — no matter how urgent the request claims to be. Any legitimate colleague will understand. Anyone who pushes back on verification is a red flag.
Train your team on what to look for.
The specific tells of AI-generated content are different from traditional phishing. Train your employees on the new patterns: requests that bypass normal channels, unusual wire transfer amounts, video callers who avoid direct questions or have slight visual artifacts, emails that reference real details but come from slightly wrong domains.
Use Multi-Factor Authentication everywhere.
Even if an attacker gets a password through phishing, MFA prevents them from using it. Enable MFA on email, banking, accounting software, and any business application that supports it.
Network-level threat blocking with Firewalla.
Firewalla's threat intelligence database is updated daily with known phishing domains, malicious IP addresses, and command-and-control servers. Even when an employee clicks a convincing AI-generated link, Firewalla can block the connection before any data is transmitted or malware is installed. It's a safety net at the network level that operates independently of whether an individual employee makes the right call.
The Verification Protocol Every Business Should Implement Today
Print this and post it near every workstation that handles finances or sensitive data:
Before acting on ANY unusual request:
1. Did it come through normal channels? If not, verify.
2. Is there unusual urgency or a request for secrecy? Red flag — slow down.
3. Does it involve money, credentials, or sensitive data? Call back on a known number.
4. Did the caller/sender use the agreed code word? If not, don't act.
This isn't paranoia — it's a process. The businesses that get hit aren't careless; they're just operating without these guardrails.
The Bottom Line
The technology that powers these attacks isn't going to get less sophisticated. It's going to get better, faster, and cheaper every month. Businesses that implement verification protocols and technical defenses today will be significantly harder targets than those that wait until after an incident.
Book a free security consultation — we'll walk through your current exposure, help you implement a verification protocol that fits your team, and configure your network to provide a technical safety net against AI-driven attacks. For most Houston small businesses, this conversation takes an hour and costs nothing.
The $25 million company wishes they'd had that conversation first.