A steady stream of panel discussions, conference sessions and industry briefings over the past year have treated AI-enabled fraud as an emerging concern. The examples shared were often striking but felt like outliers: a deepfake CFO authorizing a wire transfer, a voice clone that fooled a single finance employee at a single company. Memorable, but easy to categorize as edge cases rather than a pattern that most organizations should be actively planning for.

New research from KPMG Canada released this month offers a harder look at where things actually stand.

The Numbers Have Changed the Conversation

KPMG surveyed 251 Canadian business leaders across companies ranging from $50 million to over $1 billion in annual revenue. Among those who experienced fraud in the past year, 81 percent said the attack was AI-enabled, and seven in ten were targeted more than once. Nearly three-quarters lost up to five percent of annual profits to AI-driven scams. The most common attacks were not sophisticated one-off scenarios. They were AI-generated phishing emails, deepfake documents, and voice-clone calls impersonating executives.

These are volume attacks. Automated, scalable, and increasingly difficult to distinguish from legitimate communications.

A few standout numbers from the survey:

• 81% of business leaders who experienced fraud say the attack was AI-enabled
• 72% lost between 1% and 5% of annual profits to AI-driven fraud in the past year
• 94% are concerned about AI-powered attacks in the year ahead
• 26% have a comprehensive, tested response plan to defend against them

That final number is where the problem becomes a communications problem: ninety-four percent of leaders are worried about an attack. Only twenty-six percent have a response plan that has actually been tested. The gap between concern and preparedness is significant, and for communications teams, it represents a specific and addressable risk.

Why This Is a Communications Problem, Not Just a Security Problem

Security and fraud teams are increasingly awake to the AI threat. Investment in detection technology is growing, and over half of the companies surveyed are now deploying AI to identify anomalies and flag suspicious activity. That progress matters.

What it does not address is what happens publicly when an attack succeeds.

When a deepfake of a CEO circulates on social media, when a voice-clone call authorizing a wire transfer is reported in the press, when phishing emails impersonating your brand reach customers at scale, the communications response needs to be as prepared as the technical response. In most organizations, it is not. Communications functions are still treated as a late-stage addition to incident response rather than a core component of it.

That model was always imperfect. In the AI era, it is a liability.

Five Actions Communications Leaders Should Take Now

Preparedness built before an incident is the only kind that reliably holds up during one. The following steps are practical, executable, and relevant regardless of whether or not an organization has experienced an AI-enabled attack.

Get inside the incident response plan

Most cyber response plans still treat communications as a downstream activity, something that activates once the technical teams have assessed the situation. Push for a seat at the table during tabletop exercises. Understand the specific scenarios your security team is planning for and build the corresponding message architecture in advance. A deepfake event requires a different communications posture than a ransomware attack or a data breach. Generic response templates will not hold up under AI-specific scenarios.

Build your verification infrastructure

When an AI-generated attack mimics your leadership or your brand with alarming accuracy, the speed and credibility of your response depends on having pre-established channels that stakeholders already trust. That means known communication addresses, pre-approved verification protocols, and clear public guidance on how customers, partners, and media can confirm that a communication from your organization is legitimate. This infrastructure needs to exist before it is needed, not assembled in the middle of an incident.

Map your stakeholders to AI-specific scenarios

The audiences that need to hear from you during an AI-enabled fraud event, and the messages that will matter to each of them, are not the same across scenarios. A voice-clone impersonating your CEO to a financial partner triggers a different set of relationship management considerations than a phishing campaign targeting your customers. A deepfake circulating externally requires a different response than one used in an internal business email compromise. Pre-mapping stakeholder responses to specific scenarios, with draft messaging prepared in advance, is the difference between a contained incident and a prolonged credibility crisis.

Treat your communications team as a fraud awareness asset

Communications professionals are often the first to notice when something about a story, a media request, or an inbound message does not feel right. That instinct has practical value. It should be trained, documented, and built into how your organization detects and responds to threats, not treated as an informal observation made after the fact. Including communications staff in fraud awareness training and in the early stages of threat identification creates an additional layer of detection that most organizations are leaving unused.

Prepare executives to respond when their identity is the weapon

When a deepfake video, voice clone or spoofed communication uses a specific leader's identity, that leader becomes part of the public story whether they choose to be or not. Most executives have no prepared language for that scenario, and improvising under pressure rarely goes well. Communications teams should work with senior leadership in advance to establish three things: how they will personally and publicly authenticate themselves in the event of an impersonation attack, what they will say in a first statement, and how quickly a verified response can realistically get out. An executive who responds clearly and quickly when their voice is cloned communicates control. One who goes silent or appears caught off guard makes the story considerably worse. This preparation takes an hour to build and is nearly impossible to recover without it.

A Question Worth Asking

Security teams at most large Canadian organizations have been stress-testing their AI response protocols for two years. Ask your communications counterparts when they last ran one. The answer will tell you a great deal about where your organization's real exposure sits.

Ultimately, the standard for communications readiness in the AI era is straightforward: if your organization's most senior leaders cannot clearly and quickly authenticate themselves when their identity is used against you, your response plan has a gap. The five steps above are a starting point. The organizations that work through them before an incident will be in a significantly different position than those that discover the gaps while one is underway.

‍