Halloween brings plenty of monsters into neighborhoods around Quincy, Adams County, and West Central Illinois. Most are children in costumes looking for candy. The real threats to local government are less obvious.
Cybercriminals are using AI to create polished emails, realistic voice messages, convincing videos, and believable requests. These attacks may look like they came from a vendor, department head, elected official, grant partner, utility customer, or another public agency.
The good news is that your municipality, county office, library, parks department, utility department, public works team, or economic development organization does not need to become an expert at spotting every AI-generated message. You need clear security rules that protect citizen data, public services, and taxpayer resources even when a message looks legitimate.
AI shapeshifters: Sounding right is not enough
Voice calls and video messages used to provide some confidence that you were dealing with a real person. That is no longer enough. AI can help scammers copy a voice, create a realistic video, or write a message that sounds exactly like someone your staff knows.
A finance clerk may receive a message that appears to come from a department director. A utility office may get a request that looks like it came from a trusted contractor. A city employee may hear a voicemail that sounds like an administrator approving an urgent payment. These situations are no longer science fiction.
Government employees may be fooled even when they are careful. AI-generated content is improving quickly, and many old warning signs are already outdated.
That is why sensitive requests need a verification process. Require a second form of confirmation before sending money, changing vendor banking information, sharing protected public records, resetting accounts, approving unusual purchases, or changing access to critical government systems. Use a known phone number or another trusted communication method. Do not rely on the contact information included in the message.
Multi-factor authentication also adds an important layer of protection, especially in Microsoft 365 environments where email, files, calendars, and department communication often live. A convincing message may fool someone, but it cannot bypass a strong process as easily.
AI mummies: Old scams with better disguises
Phishing emails used to be easier to spot. Poor spelling, awkward grammar, generic greetings, and strange formatting often gave them away.
AI has changed that. A phishing message can now be clear, professional, and personalized. It may include accurate details about your city, county, department, board meeting, public project, local vendor, or recent grant application. Good writing does not make a request safe.
That matters for public agencies in Quincy, Camp Point, Payson, Liberty, Mendon, Pittsfield, Carthage, Macomb, Canton, and the communities in between. Smaller government teams often know their vendors and residents well, which can create a false sense of comfort when a message sounds familiar.
Train your team to evaluate the request instead of only evaluating the message. Is someone asking for a payment change? Is a staff member requesting citizen information from a personal account? Is a vendor pressuring the office to skip the normal approval process? Is someone asking for Microsoft 365 credentials, remote access, payroll changes, or utility account data?
Those questions matter more than perfect punctuation. A scam can be well written and still be a scam.
AI vampires: Do not invite them inside
Unapproved AI tools create another risk. Government employees may use free or public AI services to summarize reports, write emails, analyze spreadsheets, organize meeting notes, or draft public communications. This can be helpful, but it can also expose confidential or regulated information.
Before using an AI tool with government information, your team should know where the data goes, how it is stored, who can access it, and whether the provider uses it to improve its service. If no one can answer those questions, the tool should not receive protected information.
Create a simple approved tools list and give employees clear examples of what they can and cannot enter into an AI system. Your policy should address citizen data, utility billing information, personnel records, police or public safety information, legal documents, contracts, financial data, passwords, infrastructure details, and other sensitive material.
This is not about slowing people down. It is about protecting public trust and making sure technology supports government operations instead of creating new risk.
The best defense against AI threats is a better process
AI has made scams cheaper to create, faster to launch, and harder to recognize. Your best defense is not asking every clerk, supervisor, director, trustee, or elected official to become a technology expert. It is building simple habits that protect the organization even when a message looks completely legitimate.
Start with multi-factor authentication. Use password managers. Keep systems and devices updated. Back up important data. Train employees to question unusual requests. Require verification for financial and account changes. Review who has access to sensitive information. Make sure Microsoft 365 security settings match the risk level of your public agency.
For local government, technology planning should also include continuity of services. If email goes down, can departments still communicate? If files are encrypted by ransomware, can payroll, utility billing, permits, public works, library services, or parks operations continue? If a key employee is targeted, does the process protect the agency from one person making a rushed decision?
These steps may not feel as dramatic as fighting a monster, but they can prevent a costly incident and protect taxpayer resources. At Tigerhawk, we help local organizations put practical cybersecurity rules and technology in place without making daily work harder.
Need help protecting your public agency from AI powered scams? Schedule time with Tigerhawk to talk through your next steps.
Questions Quincy-area public agencies are asking
How can a Quincy, Illinois city office verify urgent payment or vendor change requests?
Use a written approval process and a separate verification step. Call a known phone number already on file, not the number in the email. Require two approvals for banking changes, large payments, or unusual purchases. Document the verification inside your finance workflow so staff have a clear rule to follow under pressure.
What should Adams County and West Central Illinois agencies avoid putting into public AI tools?
Do not enter citizen records, utility billing data, personnel files, public safety information, passwords, legal documents, infrastructure details, or confidential financial information into unapproved AI tools. If your agency cannot confirm where the data is stored, who can access it, and how it may be used, the tool should not receive protected government information.
Does Microsoft 365 need special cybersecurity planning for local government departments?
Yes. Microsoft 365 often holds email, files, calendars, Teams messages, and public records, so it needs more than default settings. Local government departments should use multi-factor authentication, secure sharing rules, account monitoring, backup planning, and access reviews. Those controls help protect public information and keep services running if an account is compromised.