Thesis title: When the phisher gets smarter: Redesigning prevention campaigns in the age of AI

Abstract

Phishing attacks are becoming increasingly sophisticated thanks to Generative Artificial Intelligence (Gen-AI), which can create realistic, personalized, and error-free messages. This eliminates traditional warning signs such as spelling errors or messy layouts, making phishing harder to detect. This study examines how financial institutions are adapting their consumer-facing phishing prevention campaigns in response to this evolving threat. The aim of the research is to understand how prevention strategies are changing as phishing becomes more sophisticated due to Gen-AI. To investigate this, eleven semi-structured interviews were conducted with employees involved in fraud prevention and communication at a large Dutch financial institution. The findings show that while the financial institution is aware of the growing impact of AI-driven phishing, this awareness is only partially translated into updated prevention campaigns. Communication continues to focus on short, behaviourally targeted messages across multiple channels, with a continued emphasis on remaining sings such as urgency or unknown senders. However, Gen-AI is rarely explicitly mentioned in external communications, due to concerns about scaring customers. This study also exposes a tension between commercial interests and the need to inform consumers, calling for better internal coordination to ensure campaigns remain effective as Gen-AI-based threats continue to evolve.