What has actually changed, not just what sounds scary
The classic tell of a phishing email — awkward phrasing, generic greetings, obvious grammar mistakes — has largely disappeared. Large language models can now draft a fluent, business-specific email in seconds, matching a real vendor's tone, referencing real project or invoice details pulled from a prior compromised thread, and adjusting instantly if the first attempt doesn't land. Underwriters have responded by asking harder questions about cybersecurity controls — multi-factor authentication, tested backups and endpoint detection — because those are the controls that still matter once the lure itself is convincing.
The same shift applies to voice: AI voice-cloning tools now need only a short public sample — a webinar clip, a voicemail greeting, a video posted online — to generate a convincing impersonation of a real executive's voice for a phone-based confirmation call, which used to be one of the more reliable fraud checks.
Why this raises the stakes for the industries most exposed to payment fraud
Construction, escrow and title, real estate development, and freight brokerage all share one thing: large, routine, time-sensitive payments moved through email and phone confirmation. Those are exactly the workflows AI-enhanced impersonation targets most effectively, because the fraud only has to be convincing enough to survive one verification step under time pressure.
This doesn't mean the underlying insurance coverage question has changed — social-engineering and funds-transfer fraud coverage still depends on the same policy definitions and sublimits it always has. It means the frequency and sophistication of the attempts against that coverage are both increasing.
Controls that still work against an AI-generated attack
The single most effective control hasn't changed: verify any request to change payment or banking instructions by calling a known phone number on file — not a number provided in the email or message itself, and not a callback to a number that could itself be spoofed. This defeats AI-generated text and cloned voice content equally, because it relies on an independently sourced number, not on judging whether the communication itself sounds real.
Dual authorization for payment changes above a set dollar threshold, and a brief pause before acting on any urgent, deadline-pressured request, are the other two controls that consistently show up in claims data as the difference between a caught attempt and a completed fraud.
What this means for your cyber liability coverage
Because AI is increasing the volume and quality of attempts rather than changing what a policy actually covers, the right response is the same review that's always mattered: confirm your social-engineering/funds-transfer sublimit against your real maximum payment size, confirm whether the policy requires specific verification procedures as a condition of coverage, and make sure your actual internal procedures match what's represented on the application.
If your business hasn't reviewed its cyber liability coverage in the last renewal cycle, this is a reasonable trigger to do so — not because the coverage itself is outdated, but because the frequency of attempts against it is rising.
More on Cyber & Technology Risk
What Cyber Liability Commonly Covers for a Construction Business
Construction businesses handle large, recurring payments and coordinate with dozens of vendors and subs — exactly the profile that makes them a real target for a specific kind of c
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Additional Insured Endorsements: What Subcontractors Get Asked to Provide, and Why
A request to be named "additional insured" is one of the most common insurance requirements a subcontractor sees — and one of the most commonly misunderstood, because a certificate
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
The Six Coverage Lines Most California Contractors Carry
There isn't one "contractor insurance policy" — there's a stack of coverage lines, each answering a different question, usually added in roughly the same order as a business grows.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Frequently asked questions
6 questions — start typing to filter
Has AI actually changed what cyber insurance covers?
No — policy definitions and sublimits for social engineering and funds-transfer fraud haven't changed. What's changed is the volume and convincingness of the attempts being made against that same coverage.
Can AI really clone someone's voice convincingly?
Yes. Modern voice-cloning tools can generate a convincing impersonation from a short public audio sample — a webinar clip or voicemail greeting can be enough.
Does a phone callback still work as a verification control?
Yes, if you call a number independently sourced from your own records — not a number provided in the suspicious message itself, which could be part of the same scheme.
Are certain industries more targeted by AI-enhanced fraud?
Industries with large, routine, time-sensitive electronic payments — construction, escrow and title, real estate development, and freight brokerage — see disproportionate targeting because the payment volume and urgency work in the attacker's favor.
Should I increase my cyber liability limit because of AI?
Not necessarily automatically — but it's a reasonable prompt to re-confirm your social-engineering sublimit against your real maximum payment size, since that's the coverage most exposed to this specific trend.
What is the single best control against this kind of fraud?
A callback to a known phone number on file before honoring any change to payment or banking instructions — it defeats AI-generated text and cloned voice content equally.