The defining feature of cyber crime in 2026 is that the attacker no longer needs to break your systems, they manufacture your trust. Generative AI has collapsed the cost of a convincing lie. In the UAE, security analysts now attribute the overwhelming majority of corporate breaches to AI-assisted social engineering rather than technical intrusion, with phishing volumes rising sharply through the first quarter of the year. The malware still matters, but the decisive weapon is a synthetic voice, face or message that a human being believes.
The clearest example is executive impersonation, the 'boss scam' or CEO-fraud, rebuilt around deepfakes. A finance employee receives a call, or even a video call, from someone who looks and sounds exactly like their CEO or the company's external lawyer, instructing an urgent, confidential wire transfer for an acquisition or a regulatory matter. The pressure script is always the same: urgency, secrecy, and a plausible reason you cannot verify through normal channels. In one widely reported case, a syndicate used voice cloning together with legitimate-looking DocuSign requests to extract roughly USD 129 million from companies before indictments followed in the US and Europe.
In India, the same objective is being achieved through a parallel technique: hijacking the conversation itself. Victims, often in finance roles, receive a compressed archive over WhatsApp, email or SMS with an innocuous name such as 'Statement of Account.zip' or 'RBI.zip'. Opening it sideloads a Trojan that seizes the active WhatsApp Web session, allowing the attacker to post inside genuine chat threads and even save a mule's number under the CEO's name, so that every subsequent instruction appears to come from a trusted contact. India's I4C has flagged these campaigns through its CERT-In channel and dedicated SMS alert header, but the attacks continue to evolve week to week.
The third dominant pattern is investment fraud at industrial scale, the schemes popularly called 'pig butchering'. Victims are cultivated for weeks over messaging apps and dating platforms, shown fabricated trading or crypto 'profits', and encouraged to deposit steadily larger sums into platforms engineered to block withdrawal. These are not lone operators; they are run from organised compounds. In April 2026, a Dubai-Police-led international operation dismantled nine crypto-investment scam centres and arrested 276 suspects, a scale that tells you how structured this economy has become.
A connected and especially cruel variant is the 'digital arrest' scam, in which fraudsters posing as police, customs or central-bank officials place a victim under a fake, hours-long 'investigation' by video call, freezing them psychologically while they drain accounts. The Supreme Court of India has begun pressing messaging intermediaries to build preventive measures, and has signalled that banks may bear liability where they fail to exercise reasonable diligence against such frauds, a direction of travel that boards everywhere should watch.
Regulators in the UAE have moved quickly. Dubai Police has stood up a dedicated department to investigate AI-related crime and strengthen digital forensics for manipulated audio and video, and the Dubai Electronic Security Centre has released tooling to analyse video content frame-by-frame for deepfake signatures. For a general counsel, the practical takeaway is that the authorities now expect organisations to have anticipated these techniques, the 'we were deceived by a perfect fake' defence is wearing thin.
The legal exposure runs in two directions at once. Internally, a company that pays out on a deepfaked instruction faces not only the direct loss but questions about the adequacy of its controls, its duties to shareholders, and, where personal data was accessed, breach-notification obligations under the UAE PDPL's effective 72-hour window. Externally, the conduct is squarely criminal: the UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021) penalises online fraud and related offences, and provides the basis for an e-Crime complaint and cross-border cooperation.
When an incident lands, the first hours decide the outcome. The priorities are simple and must run in parallel: stop any further payments and freeze what can be frozen; preserve evidence unaltered, call recordings, the deepfaked media, email headers, chat exports, transaction records and wallet addresses; engage counsel so that forensic work is scoped under privilege; and report, to the bank for recall or chargeback, to Dubai Police eCrime at ecrime.ae or the Ministry of Interior, and to the relevant regulator. For cross-border losses, early on-chain tracing and coordinated complaints in each affected jurisdiction are what make recovery realistic.
The controls that actually work are unglamorous and behavioural, not merely technical. Mandate call-back verification to a previously known number before any high-value or unusual transfer, and never treat a voice or video call as verification in itself. Require dual authorisation for payments above a defined threshold. Agree a private 'safe word' for emergency financial requests among executives and finance staff. Regularly audit and log out of WhatsApp Web sessions, block execution of unknown .exe and .dll files from user profiles, and never share OTPs or install remote-access apps at a caller's request. These measures cost little and defeat most of what we see.
The uncomfortable truth is that detection technology will always trail generation technology, the fake will usually look good enough. That is why resilience in 2026 is built on process and verified human judgement rather than on spotting the forgery. Organisations that internalise this, that assume the voice and the video can be faked and design their payment and data controls accordingly, are the ones not calling us at 2am. Those still relying on 'it looked legitimate' are, increasingly, the case studies.