AI Email Fraud: Monaco's Wake-Up Call

October 2026 was the month Monaco's institutions stopped treating email fraud as an IT footnote. On 6 October, the Chambre Monégasque du Numérique brought the Agence Monégasque de Sécurité Numérique (AMSN), the APDP and the Direction de la Sûreté Publique onto one stage at the Yacht Club under the title "Cybersécurité : tous concernés". The Assises de la Cybersécurité followed from 7 to 10 October. Then, on 20 October, the Digital FlashUP session at the Novotel Monte-Carlo delivered the message in its plainest form: artificial intelligence is making fraudulent emails convincing enough that the old tells no longer work.

This article is for the owner or manager who was not in the room. Here is what was said, why it matters more in November and December than at any other time of year, and what to change this month.

What changed: the clumsy scam is gone

For a decade, staff were trained to spot phishing by its mistakes. Odd grammar, a wrong logo, a greeting that did not match the sender. Generative AI removes all of that. A scammer can now produce a flawless French, English or Italian email in the house style of a specific bank, supplier or law firm in seconds, using nothing more than the target's public website and LinkedIn page.

The 20 October session covered the consequences: phishing that reads like a genuine colleague, deepfake voice and video used to "confirm" a request, identity usurpation of executives, and the quieter risk of "Shadow AI", meaning employees pasting confidential data into public AI tools without anyone having decided whether that is allowed. The advice given was not exotic. Strengthen the basics, learn the new warning signs, and verify before acting. The difficulty is that most Monaco SMEs have not actually done the basics.

Why the next eight weeks are the dangerous ones

Invoice fraud and "CEO fraud" peak when finance teams are busy and decision-makers are travelling. Year-end closing, supplier settlements, bonus runs and holiday cover create exactly the conditions scammers want: urgency, absent approvers and junior staff anxious to be helpful.

The typical sequence in Monaco is depressingly consistent. A supplier's mailbox is compromised, or simply imitated with a look-alike domain. A polite email arrives announcing "new bank details" for an outstanding invoice. Everything else about the invoice is correct, because the scammer has read the real thread. The payment goes out. The real supplier calls three weeks later. Monaco's small, high-trust business community makes this easier, not harder, because people are used to settling matters quickly on a first name basis.

Four controls that stop most of it

None of these require a security budget. They require a decision.

• A callback rule for any change to payment details. No bank account change, new payee or unusual urgent transfer is actioned on the strength of an email alone. Someone phones the supplier on a number already on file, never a number in the email. Write it down, tell every supplier, and make it a rule nobody can override, including the managing director.
• Multi-factor authentication on email and banking, with no exceptions. Most compromised mailboxes in small firms were protected by a password and nothing else. Passkeys or an authenticator app close the door that most of these attacks walk through.
• Email authentication on your own domain. SPF, DKIM and DMARC records tell receiving mail servers which servers may send email in your name. Without them, anyone can send mail "from" your company, including to your own clients. This is a configuration task, not a product purchase, and it also protects your email marketing and CRM deliverability.
• A written AI usage policy. One page. Which tools are approved, what may never be pasted into them (client names, contracts, financial data, personal data), and who to ask. The Shadow AI risk raised on 20 October is solved by clarity, not by banning tools.

The legal layer most owners forget

A successful phishing attack is rarely only a financial loss. If the compromised mailbox contained client correspondence, it is almost certainly a personal data breach under Law No. 1.565 of 3 December 2024. Article 32 of that law requires the controller to notify the APDP without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the people concerned. Where the risk to individuals is high, those individuals must be informed too.

Seventy-two hours includes weekends, and the clock starts when you become aware, not when you finish investigating. That is why the APDP's presence at the 6 October conference mattered. Breach response and cyber hygiene are the same project. If you have not mapped what personal data sits in your mailboxes and shared drives, a data protection review is the natural starting point, and it tends to surface the mailbox-security gaps at the same time.

Monaco is not an EU member state and is not under the GDPR. Its own law applies, with its own authority. If you have any doubt about your obligations after an incident, take professional legal advice promptly rather than waiting for the forensic picture to be complete.

What to do with your website and systems

Attackers increasingly use a company's own website as the research source for the attack: staff names, email formats, supplier logos, event dates. Two practical points follow.

First, keep the site patched. An out-of-date WordPress plugin is one of the commonest ways a small firm's web server, and sometimes its email, is quietly taken over and used to send fraud in its name. A website maintenance arrangement with monthly updates and monitoring is cheaper than a single fraudulent transfer.

Second, decide what you publish. Full staff directories with direct email addresses and role titles are a gift to a scammer composing a "message from the CFO". Publish a role-based contact route instead, and route enquiries through a managed form.

If you are introducing AI automation into customer service or back-office processes, build the same discipline in from the start: which data the assistant can see, what it may send, and where a human signs off. Automation that can trigger payments or share client data without a check is a new attack surface, not a saving.

The follow-on session and what to bring to it

The Digital FlashUP programme continues this autumn, with a session on cloud migration announced from 12 November; confirm dates and registration on monentreprise.gouv.mc. If you attend, bring three specific questions about your own set-up rather than general curiosity. The 45-minute format rewards people who arrive knowing what they want to fix.

If you would rather have someone look at your website, your email configuration and your AI usage before the year-end rush, get in touch. We can turn around a focused review within days.