AI Phishing and Deepfakes: Why You Stop Them with Procedure, Not by Eye

Summary: AI makes scam emails, fake voices and fake faces natural enough that people can no longer tell them apart by eye. What works is procedure: every request to transfer money or change a bank account is verified through a second channel and approved by two people. In the first half of 2026, Japan recorded 127 cases of fake-CEO fraud.

Part 2 of 6 in the series "AI-Driven Cyberattacks in Japan". For the overall map, see Part 1: the concept and the 3 risk groups.

Contents

1. What has AI changed about phishing and impersonation fraud?
2. Which forms of impersonation are common in Japan?
3. Why is training staff to "look closely at the email" no longer enough?
4. Which procedures stop AI-assisted impersonation fraud?
5. What else should you agree on when working with an overseas vendor?
6. What can procedure not stop?

1. What has AI changed about phishing and impersonation fraud?

AI has changed two things about phishing and impersonation fraud: the quality of the Japanese and the cost of each attempt. Awkward wording used to be the most visible sign of a scam email sent from abroad. That sign is fading.

Japan's police see this trend. The National Police Agency (警察庁) report for the first half of 2026 cites about 730,000 phishing reports in 6 months. The figure comes from the Council of Anti-Phishing Japan (フィッシング対策協議会). The report says that advances in AI have greatly improved how natural the wording is and how accurate the impersonation is. As a result, phishing is harder to spot than before.

There is also evidence from investigations. In a tech support scam targeting people in Japan, Japanese police worked with India's Central Bureau of Investigation (CBI). According to the National Police Agency's 2025 report, the suspects used generative AI to select targets, create pop-up windows and translate into Japanese.

2. Which forms of impersonation are common in Japan?

Four forms of impersonation targeting companies are common in Japan. They differ in the channel used and in what is being faked.

Fake-CEO fraud deserves the most attention from small and mid-sized companies. According to the National Police Agency, this method appeared around January 2026 and follows 4 steps:

1. An email impersonating the president arrives at the company's public email address.
2. The recipient is asked to set up an SNS group, with the reason given as "for a new project".
3. In the group, the "president" asks for the balance of the company's bank account.
4. The "president" demands an urgent transfer to a specified account.

Each successful case caused about ¥31 million in damage on average. The National Police Agency notes that recipients find it hard to notice, because the president's name and the company name are real.

One note on accuracy: the National Police Agency report does not state that the fake-CEO fraud cases used AI. This article includes them because this is the kind of method AI makes cheaper and harder to notice. AI can write emails in the right tone, in the right context, in large volumes.

For deepfakes, the most cited case was reported in Hong Kong in early 2024. A finance employee was reported to have transferred about HK$200 million after a video meeting in which the other participants were fake images. In Japan, the case published by the National Police Agency is the group posing as police, active from October 2024 to May 2025.

3. Why is training staff to "look closely at the email" no longer enough?

Training staff to look closely at emails is no longer enough, because AI has removed the signs they were taught to look for. Traditional phishing drills teach people to find spelling mistakes, incorrect honorifics and unfamiliar domains. AI handles the first two. In fake-CEO fraud, both the sender's name and the company name are real.

With voice and video, the gap is wider. The more senior a person is, the more public videos and speeches exist, which means more material to fake. Asking accounting staff to tell the real president's voice from a fake one puts responsibility where it cannot be met.

Technical measures have limits too. The National Police Agency writes that technical measures alone, such as email authentication and multi-factor authentication, are not enough to prevent phishing damage.

The practical conclusion is to change the question. Stop asking "is this email real or fake?". Instead, the company defines which steps a request of this type must pass before anyone acts on it. Staff then do not need to beat AI at detection.

4. Which procedures stop AI-assisted impersonation fraud?

A procedure stops impersonation fraud when it does not depend on the recipient trusting the communication channel. You can apply the five rules below right away, with no new tools.

1. Verify through a second channel. If a transfer request arrives by email, call back on a phone number you already had on file. Do not call the number written in that email.
2. Two approvers. Transfers above a set threshold need approval from a second person, so that no single person can both receive a request and complete it.
3. A change of receiving account is a separate task. Treat every notice of a partner's new bank account as a high-risk request, with a waiting period and its own verification.
4. "Urgent" and "confidential" are stop signals. A request that is both urgent and forbids asking anyone else goes to a supervisor automatically.
5. Do not move company business into personal SNS groups. The National Police Agency recommends particular caution when you are asked to set up an SNS group. It also recommends reviewing your internal money transfer rules.

Multi-factor authentication is still necessary, because the goal of most phishing is to steal passwords. It makes a stolen password far less valuable, but it does not replace the rules above.

Most important of all, the rules must apply to the president too. If the real president regularly says "transfer it now, no need to confirm", staff cannot tell the real president from a fake one.

5. What else should you agree on when working with an overseas vendor?

When you work with an overseas vendor, both sides should agree on communication channels and payment verification from the start. This relationship has all the conditions for email fraud. Most communication happens by email and chat, the two sides rarely meet in person, and international payments recur on a schedule.

VAON is such a vendor: the development team is in Vietnam and the clients are in Japan. So this is a risk VAON has to account for on both sides. The most concrete scenario is an email impersonating the vendor that says "from this month, please pay into our new account".

Three things are worth writing into the contract or the kickoff meeting minutes:

• A list of official contacts and channels. Who may send invoices, and from which address. A request from a person or channel outside the list has no effect.
• A procedure for changing the receiving account. A change takes effect only when confirmed through a different channel, by a person already named on the list.
• A contact for suspicious cases. A phone number you can call immediately when an unusual request arrives.

At VAON, the CEO personally joins the first meeting with every client, and every project has a weekly report. Together these create a regular communication channel that the client already knows. An unusual request that appears outside that rhythm is easier to notice.

6. What can procedure not stop?

Verification procedures do not stop everything. There are 3 limits worth knowing in advance.

• A real email account that has been taken over. If an attacker has logged in to your partner's mailbox, the email comes from the genuine address. Verifying by phone still works, but checking the domain does not.
• Phishing for passwords. A money transfer procedure has nothing to do with an employee typing a password into a fake page. This part needs multi-factor authentication and login monitoring.
• Procedure fatigue. A procedure that is too heavy gets skipped when people are busy. Apply the verification step only to high-risk requests: money transfers, account changes, granting access rights, sending customer data.

Procedure also does not replace reporting. Once money has been sent in error, time is the deciding factor. Contact your bank and the police immediately.

Preparing to work with a development team overseas? VAON works with you to agree on communication channels, authorized contacts and payment procedures from the first meeting. Book a free consultation

Next article: AI-written malware and faster vulnerability exploitation

References (checked Oct 10, 2026)

• National Police Agency (警察庁), 令和8年上半期におけるサイバー空間をめぐる脅威の情勢等について (Sep 2026): https://www.npa.go.jp/publications/statistics/cybersecurity/data/R8kami/R08_kami_cyber_jousei.pdf
• National Police Agency (警察庁), 令和7年におけるサイバー空間をめぐる脅威の情勢等について (Mar 2026): https://www.npa.go.jp/publications/statistics/cybersecurity/data/R7/R07_cyber_jousei.pdf
• IPA, 情報セキュリティ10大脅威 2026: https://www.ipa.go.jp/security/10threats/10threats2026.html