The tools that help a Kingston entrepreneur write her marketing copy also help criminals write phishing emails with no spelling mistakes, clone an executive's voice from a YouTube clip and rewrite malware until antivirus stops recognising it. I have spent fifteen years building AI systems at StarApple AI and training Jamaicans to use them, and I sit on Jamaica's National AI Task Force. Most of the business owners I speak to have not yet heard of deepfake voice fraud.
This guide covers the four AI-assisted attacks Jamaican businesses are most likely to meet, the defensive tools worth paying for, where the country's defences stand, and a baseline any firm can put in place in a month.
Four AI-assisted attacks to plan for
Phishing without the typos
The old advice to look for bad spelling no longer works. A language model can read a target's LinkedIn profile and company website, then write an email that mentions a real project, a real colleague or a recent transaction. It can produce thousands of these, each one different, in minutes.
An accountant who receives a message that appears to come from her bank, names her account type and refers to last week's payments has little reason to doubt it. The defence has to be procedural: check the request through a channel you already trust.
Cloned voices and faked video calls
A few seconds of audio from a TV interview or conference talk can be enough to clone a voice, including a Jamaican accent. In early 2024 an employee of the engineering firm Arup in Hong Kong transferred about US$25 million after a video call in which the "CFO" and other colleagues were deepfakes.
Jamaican business runs on phone calls and personal relationships, which makes a convincing call from "the boss" dangerous. Poor connections on Caribbean video calls also hide the visual glitches that might give a fake away. Seeing a face on a call is not proof of who you are talking to.
Social engineering built from your own posts
An attacker can feed a target's Facebook, Instagram, LinkedIn and X posts into a model and get back a profile of who they trust and what they are worried about. Take an HR manager who posts that payroll is a headache this month. A week later she receives a polished email from a "payroll software company" offering to fix that exact problem, with a link to a fake login page.
Malware that changes its own code
AI helps attackers generate malware variants that alter their code on each deployment, which defeats antivirus that matches known signatures. The free or consumer antivirus on many Jamaican office PCs works this way. Behaviour-based tools that watch what a program does are the replacement.
Defensive tools worth paying for, with prices
Prices below are published list prices at the time of writing; check the vendor's site before you budget.
| Layer | Examples | What it does | Typical cost |
|---|---|---|---|
| Email security | Microsoft Defender for Office 365, Google Workspace security, Proofpoint, Abnormal Security | Flags impersonation, malicious links and attachments | Often included in Microsoft 365 or Workspace plans |
| Endpoint detection (EDR) | Bitdefender GravityZone, SentinelOne, CrowdStrike, Microsoft Defender for Business | Blocks programs that behave like ransomware or reach suspicious servers | About US$3–10 per device per month; GravityZone from about US$6, so roughly J$4,650 a month for five PCs |
| Network monitoring | Darktrace, Arctic Wolf | Spots data leaving the network or attackers moving between machines | Several hundred US dollars a month and up; aimed at mid-sized firms |
| Phishing training | KnowBe4 | Sends realistic fake phishing to staff and trains those who click | From about US$18 per user per year |
The most common gap I see is configuration. Firms pay for Microsoft 365 or Google Workspace and never switch on or configure the security features they already have. For a small firm, a business-grade router firewall plus EDR on every machine gives reasonable visibility without a dedicated monitoring service.
Where Jamaica's defences stand
In place: the Cybercrimes Act 2015 for prosecuting offences; the Data Protection Act 2020, in force since December 2023, for handling personal data; the national Cyber Incident Response Team (JaCIRT) for coordinating responses; and Bank of Jamaica cybersecurity requirements for regulated financial institutions. Several Caribbean states have fewer of these pieces.
Missing: enough trained security staff; incident response plans at most SMEs; and awareness of AI-specific attacks among business leaders. Enforcement of the Data Protection Act is still new, and compliance among smaller firms is low.
Banks such as NCB, Scotiabank Jamaica and JMMB run fraud detection and dedicated security teams, partly because the Bank of Jamaica requires it. Their customers are the weaker point, since a phished customer hands over credentials the bank's systems will accept.
Government agencies vary widely. Some run modern controls; others run old systems with little security budget. Each new online service adds another system attackers can probe.
A baseline any Jamaican business can set up in a month
- Turn on multi-factor authentication for email, banking, social media and cloud storage. Use an authenticator app such as Microsoft or Google Authenticator in place of SMS codes, which can be stolen through a SIM swap. Cost: nothing.
- Give every employee a password manager. Bitwarden Teams is about US$4 per user per month; 1Password also has business plans. This ends password reuse across accounts.
- Configure the email security you already pay for in Microsoft 365 or Google Workspace. If your provider has no phishing filter, move to one that does.
- Automate backups and test a restore. Keep a copy separate from your main systems. The backup in your office suite will do, or a service such as Backblaze (about US$9 per computer per month). A backup you have never restored from is untested.
- Replace consumer antivirus with business EDR on every computer, at US$3 to US$10 per device per month.
- Write a payment verification rule. No payment above a set amount goes out on the strength of an email, call or video call alone. Call back on a number from your own records, and require a second person to approve. This rule would have stopped the Arup transfer.
- Train the team for an hour. Cover phishing, deepfake calls, passwords and who to tell when something looks wrong. An AI assistant can draft the outline for your industry; add KnowBe4 later if you want ongoing simulations.
Risks by sector
Financial services are the main target. Move from rule-based fraud checks to behavioural transaction monitoring, and do not rely on voice recognition alone for phone transactions now that voices can be cloned. Train call-centre and branch staff on impersonation scripts.
Tourism and hospitality hold card numbers and passport details for overseas guests, so the main risk is data theft and the reputational damage that follows. Keep payment systems PCI DSS compliant, monitor booking systems, and train front desk and reservations staff.
Healthcare records sell well on criminal markets. Encrypt patient records, restrict access by role and log who opens what. Health data is sensitive personal data under the Data Protection Act, which carries stricter handling rules.
Government agencies should design security into new digital services from the start and run training every year, since staff turnover erodes awareness.
BPO operators handle client data under contract, and one breach can hurt the whole sector's reputation with overseas buyers. Most large clients expect SOC 2 or ISO 27001 evidence and regular audits.
Staff habits matter more than software
The best email filter fails if an executive forwards a flagged message to himself because he thinks the filter got it wrong. Jamaican business relationships help, because people can check an odd request with someone they know. The same trust helps an attacker who has done the research.
Make it normal to question an unusual request, to verify identity before sharing anything sensitive and to report a suspicious email without being made to feel foolish. At StarApple AI, the security features we build for financial institutions include alerts that explain in plain language why something was flagged, because staff ignore warnings they do not understand.
Preparation is cheaper than recovery, and it starts today.
Prompts to build your own security documents
I run a [type of business] in Jamaica with [number] employees. We use [email provider, accounting software, other systems]. Write a security checklist for my business, marking each item essential, important or optional, with estimated costs in USD and JMD. Put protections against deepfake fraud, AI phishing and new malware first.
Write a one-hour security training session for a Jamaican team of [number] non-technical staff in [industry]. Cover AI-written phishing (with examples), deepfake voice and video calls, passwords, multi-factor authentication and how to report an incident. Keep the tone serious and calm.
Write an incident response plan for a Jamaican small business covering ransomware, a customer data breach, a fraudulent payment after email compromise, and a deepfake impersonation of an executive. Include JaCIRT, the JCF's cybercrime unit and the Office of the Information Commissioner as contacts. Write it as numbered steps a non-technical manager can follow under pressure.
Write a payment verification policy for a [size] Jamaican business: approval thresholds, callback procedures using numbers on file, two-person approval for large payments, and what staff should do if they suspect a caller is a deepfake.
What to do next
- Owner or managing director, this week: set the payment verification rule in writing, with a threshold (for example J$500,000) above which a callback and a second approver are required. Tell your bank and your finance staff.
- Whoever runs IT, this week: turn on app-based multi-factor authentication for every email account, starting with finance and management. Check the security settings in Microsoft 365 or Google Workspace the same day.
- IT, within 30 days: install business EDR on every computer and set up an automatic backup. Restore one folder from backup to prove it works, and put a date in the calendar to repeat that every quarter.
- Office manager, within 30 days: run the one-hour training session and agree who staff should call when an email or call feels wrong.
- Owner, within 90 days: write a one-page incident plan listing JaCIRT, the JCF's cybercrime unit, your bank's fraud line and the Office of the Information Commissioner, and pin it where staff can find it.
Frequently Asked Questions
Do I have to report a data breach in Jamaica?
Yes, if personal data is involved. The Data Protection Act requires a data controller to notify the Information Commissioner of a security breach affecting personal data within 72 hours of becoming aware of it, and affected people may also need to be told. Check the Office of the Information Commissioner's current guidance for the notification format, and keep a written record of what happened and what you did.
Will cyber insurance pay out if staff are tricked into sending money?
Often not under a standard policy. Many cyber and crime policies exclude payments an employee made voluntarily, even if they were deceived, unless the policy has a social engineering or funds transfer fraud extension. Ask your broker in writing whether a deepfake or email impersonation loss is covered, and what verification steps the insurer expects you to have followed.
How do I stop criminals sending email that looks like it comes from my domain?
Publish SPF, DKIM and DMARC records for your domain. These tell receiving mail servers which servers may send on your behalf and what to do with mail that fails the check. Your email provider or web host can set them up in under an hour, and free online DMARC checkers will confirm they are working.
Is SMS two-factor authentication good enough?
It is far better than a password alone, but it is the weakest form of two-factor authentication. Criminals can take over your number through a SIM swap and receive your codes. Use an authenticator app or a passkey for email and banking, and ask your mobile carrier whether it offers a port-out or SIM-change PIN on your account.
Who do I contact first if my business is attacked?
Disconnect affected machines from the network, then call your bank's fraud line at once if money has moved, because a transfer can sometimes be recalled within hours. Report the incident to JaCIRT and to the Jamaica Constabulary Force's cybercrime unit. Keep logs, emails and affected files unchanged, since investigators and insurers will need them.
Can a family or office code word stop voice-clone scams?
It helps, and it costs nothing. Agree a word or question that is never written in email or posted online, and ask for it whenever someone calls asking for money or passwords in a hurry. Change it if anyone leaves the business, and combine it with a callback to a number you already have on file.