podcast

Articles

Podcasts

Videos

Find a branch or ATM

Contact our Thought Leadership team—we value your insights!

Have questions or feedback?

Manage your meeting

Need to meet?

Explore the latest insights, reports, and timely topics affecting economic growth at home and around the world.

CIBC Thought Leadership

Connect with us:

This transcript has been generated using machine learning technology. While this technology was trained with CIBC terminology, it may contain errors.
Intro: Welcome to the CIBC Cash Management Podcast. In Part 1 of our discussion on fraud management, we explored how fraudsters use impersonation tactics, account takeovers and business email compromise scams to target organizations. In today’s discussion, we&#8217;ll build on our previous conversation by examining phishing and device takeover attacks, the growing role of artificial intelligence in fraud, and the practical steps organizations can take to strengthen their defenses.
Andre Blanchard: I&#8217;m Andre Blanchard. Joining me today is Ryan Powell, Vice President of Fraud Management at CIBC. Ryan works closely with my team and other teams and clients to help identify fraud trends and strengthen awareness around emerging threats.
Ryan, welcome and thank you for joining us.
Ryan Powell: Thanks, Andre. It&#8217;s great to be here.
Andre Blanchard: So let&#8217;s kick things off, Ryan. Another threat we&#8217;re hearing more about lately is vishing. What does that actually mean.
Ryan Powell: Yeah we hear vishing, smishing, phishing. They&#8217;re all flavors of the same thing. The difference is the channel through which the thread is delivered. So vishing is simply voice phishing, using phone calls to try to obtain passwords, pins or other sensitive details. And the impersonator scams that we talked about earlier are a very common type, but not the only type of phishing.
And it&#8217;s important, as we think through these, to understand that the fraud may not always present itself as simply as we&#8217;re describing here. Fraudsters evolve their tactics. They combine their tactics to take advantage of what they know about their target social, economic situations, and any other scenario that could add some legitimacy to it.
And so we see this in tech support scams. As an example, the caller may claim that your account or device has been compromised. They may offer to help. Instead of asking for a pin or a password, they may instruct the person to install a remote access application, they might ask you to visit an unfamiliar website, share your computer screen, forward your phone calls, or otherwise change security settings.
Once that type of access is granted, the fraudster may be able to view confidential information. They may be able to access your email or banking services, and if they initiate transactions that way, they will appear to come from your legitimate device.
Andre Blanchard: So employees have a big role to play in preventing fraud. What would advice be to those employees on what red flags or warning signs may look like? Right?
Ryan Powell: Warning signs could include an unsolicited call that creates that urgency or fear we discussed earlier. A request to install software or grant remote control instructions to keep the call secret, pressure to stay on the line while signing in, in addition to the requests for passwords, pins, or other secrets that we talked about earlier.
Caller ID alone should never be treated as proof that the caller is legitimate as fraudsters can misrepresent the phone number that they&#8217;re calling from.
Andre Blanchard: And if someone does receive these phone calls, what would you coach them to do?
Ryan Powell: Again, end the call and do not follow the caller&#8217;s instructions. Do not install software, click a link, share your screen, disclose credentials or approve an authentication prompt. Contact the organization using a trusted phone number that you already have on file. If the call concerns a work device or your business account, notify your internal security or IT team promptly.
Andre Blanchard: And hopefully this doesn&#8217;t take place. But what if a person has already installed the software, clicked on the link, or allowed access?
Ryan Powell: Act immediately. Again, time is of the essence. Stop interacting with the caller and contact your organization security or IT team and your bank through trusted channels. Follow your organization&#8217;s incident response instructions, preserve relevant messages and call details, and report any suspicious or unauthorized activity. Do not continue banking or accessing sensitive business systems from an affected device until it has been assessed and secured.
Andre Blanchard: So, Ryan, my understanding is, you know, fraudsters are getting much more advanced leveraging AI and technology. And often they probably don&#8217;t use these types of scams in isolation. Right. So what does that kind of look like in the real world?
Ryan Powell: In the real world, the scams are moving very quickly. They evolve with the technology as we&#8217;ve discussed, and they can be hyper targeted. And what this means is a scam may not present itself quite as clearly as we&#8217;ve discussed here today. It may start in one of these categories, such as a business email compromise or an email asking for a change in access, a change in a payment detail.
But that can evolve to step up to ask you to install software, to ask you to move money. And so it&#8217;s important to be on the lookout for the general red flags of a call or email that is unsolicited, that is asking you to act with urgency or that simply does not make sense.
Andre Blanchard: So we talked a lot about computer and email compromises, but our mobile phones also at risk in the same way?
Ryan Powell: Yes, mobile devices can expose email, text messages, authentication prompts, banking applications and business data. So fraudsters may try to gain screen sharing or remote access capabilities to your mobile phone as well. They may persuade a user to install an application or take over the phone through what we call a SIM related attack.
So employees should protect mobile devices with strong authentication, keep operating systems and applications updated, and treat unexpected prompts or loss of cellular service as reasons to pause and investigate.
Andre Blanchard: Now, as the expert, if you had one message or a simple message that you would give to businesses for their own employees about vishing and device takeovers, what would it be?
Ryan Powell: No legitimate security process should depend on an unexpected caller pressuring you to install remote access software, disclose credentials, or approve an action you did not initiate. So always stop, verify independently and then if something goes wrong, escalate quickly.
Andre Blanchard: So let&#8217;s talk about something that&#8217;s very prevalent in the media today. Let&#8217;s discuss AI and how it is actually part of almost every technology conversation today. Now, is AI changing the fraud landscape? Is that the new fraud battleground?
Ryan Powell: Certainly. AI is increasing the speed, the scale and sophistication of fraud attempts. Fraudsters can use generative AI to produce very polished phishing emails to research their targets, to personalize messages, even imitating writing styles. They can create synthetic or what we call deepfake audio or video that is very convincing.
And those videos can feature a trusted executive, a supplier, a family member, basically anyone. It can make business email compromise, phishing, smishing, and deceptive websites all the more convincing. And that makes traditional warning signs such as poor grammar, spelling, or an unfamiliar tone much less reliable than they once were.
Andre Blanchard: So does that mean we need to be a bit more skeptical in what we&#8217;re hearing or seeing as perhaps a familiar person, and that no longer being enough to validate a request?
Ryan Powell: Totally. We always say trust, but validate. Voices, images and some video can now be faked very convincingly. The practical response is not to become an expert in detecting every deepfake. It&#8217;s to slow down again, verify the source independently, and follow established approval processes. A request involving money credentials, access changes or sensitive information should always be verified through a trusted channel.
Andre Blanchard: Are there any other ways AI can amplify fraud or increase its success rates?
Ryan Powell: Yes, AI can help fraudsters translate messages, automate outreach to many targets. They can combine publicly available information and quickly adjust a scam based on how the recipient response. Just like all of us are thinking about how we can use AI to make our businesses more efficient, fraudsters are doing that too, so it can be used to create or alter purchase orders, invoices, related payment documents.
Whatever form a request takes, the key is to validate its source and any changed instructions. And if your business is onboarding new clients or partners, particularly with no history or in-person relationship, it&#8217;s important to be extra vigilant. Be aware of the types of threats we&#8217;re discussing today and how that shapes your internal policies for extending sales or services on credit advancements and the payment methods you accept.
Because again, fraudsters could be using these tools on documents that they&#8217;re sending to you.
Andre Blanchard: So it really does sound like an AI battleground. How can clients leverage it responsibly to help counter fraud attempts?
Ryan Powell: Clients can look for approved security and treasury tools that use analytics or machine learning to identify unusual activity, to prioritize alerts, and to detect anomalies in payment behavior. They should also use these types of cyber controls to support their email and endpoint security, and really protect their networks.
But technology should reinforce, not replace, strong controls, and that starts with training and awareness. Knowing these threats are out there is the first step in defending against them. Fraudsters often target the human decision point. So the strongest defense is disciplined process controls. Things like dual approvals, transaction limits, segregation of duties and callbacks to trusted numbers to do independent verification.
Human review remains essential, particularly before a high value, urgent or unusual transaction is released, and it&#8217;s important to test these controls. Without testing, you cannot be certain they are operating as intended.
Andre Blanchard: So in addition to those human controls, and in your experience, what should businesses consider before adopting an AI based fraud tool?
Ryan Powell: Well, keep the evaluation practical and aligned with enterprise policies. Start with a very clear use case and involve your fraud, cybersecurity, privacy, legal, risk, procurement, and business owners as appropriate. It&#8217;s key to understand what data the tool uses, where that data is stored, how the outputs are explained, and how the performance is monitored, and businesses should use approved enterprise tools and avoid entering confidential client employee banking or transaction information into public AI services without authorization and appropriate safeguards.
And just as importantly, businesses should have clear and communicated policies for unapproved tools to make sure their employees are not using tools that do not have these types of safeguards in place.
Andre Blanchard: Great advice. So, Ryan, what take away about AI and fraud prevention? Would you want the audience to kind of hone in on?
Ryan Powell: AI is a powerful fraud tool on both offense and defense. It can make scams more convincing, but can also strengthen monitoring and analysis. The strongest defense combines responsibly govern technology with disciplined processes, independent verification, trained employees, and timely escalation.
Andre Blanchard: So, Ryan, when we step back from all these various fraud types, what are the broader habits businesses should build into their current and existing processes?
Ryan Powell: There are a few foundational habits that can really make a difference. First, always use trusted access points for banking. That means going to your regular online banking URL through that saved bookmarked link, rather than relying on a search engine result in the moment. Second, treat unsolicited requests with caution, especially if they involve urgency, credentials, software installation, payment changes, or unusual account details.
Third, and this is key build independent verification into your payment and banking processes. If something changes, confirm it through a separate trusted channel. In large organizations, you may have several team members involved in receiving, reviewing, and approving an invoice and then making the payment.
And it&#8217;s very important that everyone understands who is responsible and conducting that verification. Fourth, design controls so that one person cannot initiate, approve, and release a sensitive payment without the appropriate oversight. Segregation of duties, dual approvals, and proportionate transaction limits can reduce the impact of a single deceptive interaction.
And finally, make sure employees know that if something feels off, they should pause and escalate. A brief delay to verify is far better than a rush decision that leads to a fraud.
Andre Blanchard: These are all strong messages, especially for those folks and teams that are handling payments day in and day out. So fraud prevention is not just a technology issue. It&#8217;s a process and awareness issue as well.
Ryan Powell: Absolutely. Technology plays an important role. But as we said, it should reinforce, not replace awareness controls and consistent verification practices.
Andre Blanchard: Ryan, thank you for joining us and sharing these practical insights. To our listeners, today. We covered bank impersonation, business email compromise, phishing, mobile phone and computer takeovers, and the growing impact of AI on fraud. So a few takeaways from my side. Be cautious of unexpected calls, texts, emails, videos, or authentication prompts related to banking access, payments or device security.
Do not rely solely on caller ID, a familiar voice or video image, or a polished message as proof of identity. Use only your regular online banking URL, ideally from a saved or bookmarked source. Never provide credentials, pins, token numbers, or authentication codes to an unsolicited caller. Do not install remote access software, share your screen or approve a prompt you did not initiate. Independently verify payment access or security requests using a trusted contact method and established approval process. Use only approved AI tools, protect confidential information and retain human review for sensitive decisions and transactions.
Review account activity and alert prompts if a device, account, or transaction may be compromised. Contact your bank and Internal Security or IT teams immediately. Ryan, thank you again for being here and having this important conversation with us.
Ryan Powell: Thanks, Andre. I appreciate the opportunity to talk about this, and I encourage businesses to stay vigilant and keep fraud awareness top of mind.
Andre Blanchard: And thanks to everyone for listening to the CIBC Cash Management Podcast. We hope you found this discussion helpful and practical for your business. Join us again next time for more insights on cash management, payments technology and risk.
Disclaimer: The materials disclosed on this podcast are for informational purposes only and subject to our Code of Conduct, as well as zero rules. The information and data contained herein has been obtained or derived from sources believed to be reliable, without independent verification by CIBC Capital Markets, and to the extent that such information and data is based on sources outside CIBC Capital Markets, we do not represent or warrant that any such information or data is accurate, adequate or complete, notwithstanding anything to the contrary.
Here in CIBC World Markets, Inc. and or any affiliate thereof shall not assume any responsibility or liability of any nature in connection with any of the contents of this communication. This communication is tailored for a particular audience, and accordingly, this message is intended for such specific audience only.
Any dissemination, redistribution, or other use of this message or the market commentary contained herein by any recipient is unauthorized. This communication should not be construed as a research report. The services, securities and investments discussed in this report may not be available to nor suitable for all investors.
Nothing in this communication constitutes a recommendation, offer or solicitation to buy or sell any specific investments discussed herein. Speakers on this podcast do not have any actual, implied, or apparent authority to act on behalf of any issuer mentioned in this podcast. The commentary and opinions expressed herein are solely those of the individual speakers, except where the author expressly states them to be.
The opinions of CIBC World Markets, Inc. The speakers may provide short term trading views or ideas on issuers, securities, commodities, currencies, or other financial instruments, but investors should not expect continuing analysis, views or discussion relating to those instruments discussed herein.
Any information provided herein is not intended to represent an adequate basis for investors to make an informed investment decision, and is subject to change without notice. CIBC Capital Markets as a trademark brand name. Ottawa which Canadian Imperial Bank of Commerce CIBC. Its subsidiaries and affiliates provide products and services to our customers around the world.
For more information about these legal entities, as well as the products and services offered by CIBC Capital Markets, please visit www.cibccm.com.

CIBC Insights

Drivers of Growth

Artificial Intelligence (AI)

Cash management chat – fraud management: Phishing, device takeovers and the role of AI