14 August 2026

Passwords stolen with AI: protecting the accounts that matter

At an accountancy firm in Terrassa, an administrator received an email that appeared to come from her own domain. Subject line: "Your mailbox is near its limit — add space." Correct logo, correct corporate signature, not one typo. She clicked, entered her email username and password, and the page redirected her to her real inbox. Nothing odd happened. Nothing, until two weeks later three clients received a change of bank details for their direct debits.

Nobody came in through the door. They came in with the keys.

Why this is harder to spot now

Old-fashioned phishing gave itself away: odd translations, "Dear Customer", absurd links. With generative AI, whoever runs the attack can write in flawless Catalan, imitate a company's internal tone, and personalise every message with public information — the name of your account manager, the invoicing software you use, the campaign you just announced on your website.

And you do not need to be a big target. These attacks are run at scale: one well-made email is reused across hundreds of small companies with four details changed. An eight-person firm is often a better return than a corporation with a security department.

The prize is not the password either. It is what sits behind it: the mailbox — from which bank-detail changes get sent to your clients — the document system, the online banking, the payroll software.

The warning signs

• An email that makes you click to resolve an urgency. Mailbox full, invoice outstanding, password expiring today, parcel held. The hurry is the tool, not the excuse.
• A login screen immediately after clicking a link. Legitimate services rarely ask for your password straight after an email.
• The sender address does not match the real domain. Look at the whole domain, not the display name: microsoft-support.net is not microsoft.com.
• Someone asks for your verification code by phone, messaging app or chat. No legitimate company ever asks for it.
• Second-factor prompts you did not trigger. If your phone asks "Approve this sign-in?" and you are not signing in anywhere, somebody already has your password.
• Your own emails disappearing. Attackers often create rules that move bank alerts or client replies straight to the bin.

Four measures worth the effort

1. Two-factor authentication everywhere, with an app rather than SMS. This is the single measure that stops most per unit of effort. SMS can be intercepted or diverted with a SIM swap; an authenticator app on the phone cannot. Prioritise corporate email, banking and the document system.

2. A password manager for the team. Not so passwords get longer, but so they stop repeating. If the mail password is the same as one from an online shop that was breached three years ago, it is not secret any more. There is also a side effect worth more than it looks: a manager will not autofill on a fake domain. That silence warns people better than any training session.

3. A verification channel outside email. Any change of bank details, payment data or access rights is confirmed by phone, on a number you already had written down. Never the number in the message. Write the rule down and make sure everyone who touches payments knows it.

4. Review who has access to what, twice a year. Still-active accounts of people who left, shared accounts with no owner, admin rights nobody needs any more. Half an hour of work, and it reduces the attack surface more than any tool.

If you think it has already happened

The order matters, because time is against you:

1. Change the password and close every open session on the affected account. Every major service has a "sign out of all devices" option.
2. Check the mail rules. Delete any you did not create — this is where attackers hide the evidence.
3. Check the forwarding settings and the recovery address. A silent forward to an outside address is the quietest way to keep reading your mail after you have changed the password.
4. Warn clients and suppliers who may have received something in your name, by phone or on a channel other than the compromised one.
5. Then work out how they got in, and whether the same password opens anything else.

If money has already moved, the sequence is different and the clock is much tighter — I set it out in the piece on the first 24 hours.

Why this belongs in operations, not just in security

Almost everything above is a process decision rather than a technical one: a rule about bank-detail changes, an access review somebody owns, a list of who holds admin rights. The technology is the easy half. The half that fails is the one where nobody is accountable for the rule between incidents.

This article is general information, not legal or security advice for a specific case.