AI Scams Targeting Small Businesses
AI scams targeting small businesses are on the rise. Small businesses are attractive targets for fraud because they have money, handle payments quickly and rarely have a dedicated security team. AI has made scams more convincing: emails with perfect language, cloned voices on the phone, fake invoices that match real suppliers and impersonation of owners or clients. The good news is that most losses can be prevented with a few simple, consistent controls rather than expensive software. This guide describes the most common AI-assisted scams aimed at small businesses, the warning signs, practical controls for payments and accounts, how to train staff and what to do if you have been scammed.
Common scam patterns
- Fake invoices and changed bank details: a message that appears to come from a regular supplier says that their bank account has changed, or sends an invoice for work you did not order.
- Boss or client impersonation: an urgent email or message that seems to come from the owner or manager asks an employee to buy gift cards or make a quick transfer.
- Voice cloning calls: a caller who sounds like a known person requests a payment, a password or a change in procedure; see deepfakes and voice cloning: protect your family.
- Fake video calls: in rare but serious cases, criminals use manipulated video to pose as executives or partners; see how to fact-check deepfake videos.
- Phishing for logins: messages that lead to fake login pages for email, banking or cloud accounts; see AI phishing emails: how to recognize them in 2026.
- Fake customers and orders: overpayment scams, stolen cards and suspicious bulk orders.
- Fake reviews and reputation attacks: waves of false negative reviews followed by offers to remove them for a fee.
- Fake support and tools: messages pretending to be from software providers asking you to install remote access tools or verify an account.
Warning signs
- Pressure to act immediately, or to keep the request secret.
- A change in how you normally pay or communicate.
- An email address, phone number or website that is slightly different from the usual.
- Requests for unusual payment methods, such as gift cards or cryptocurrency.
- Attachments or links you did not expect.
- A story that sounds plausible but cannot be confirmed through a known contact.
Controls that stop most losses
- Verify bank detail changes by phone. Call the supplier on a number you already have, not the one in the email. Require a second person to approve any change.
- Use two-person approval for payments above a set amount, and for new payees.
- Set a call-back rule for urgent requests. Anyone who asks for urgent money or access is called back on a known number.
- Turn on multi-factor authentication for email, banking, accounting and cloud tools. This blocks many account takeovers.
- Use a password manager and unique passwords.
- Limit access. Give staff only the permissions they need, and remove access when people leave; see zero trust security: a beginner guide.
- Keep software updated and use email filtering.
- Match invoices to orders. Pay only invoices that match a purchase order or delivery. If you automate invoice handling, keep checks in place, as described in automate invoices and receipts with AI.
- Agree a code word for sensitive phone requests among the owners and key staff.
- Back up data and test restoring it.
Train staff in short sessions
Hold a fifteen-minute meeting every quarter with real examples. Show the typical pattern, such as urgent request plus secrecy plus unusual payment, and practise the call-back rule. Make it clear that anyone can pause a request and that nobody will be blamed for asking for verification, even when the request seems to come from the boss. Share news of attempted scams, so people stay alert. New employees need this training on day one.
Protect your reputation and customers
Scammers may impersonate your business to defraud your customers. Publish how you will contact customers and what you will never ask for, such as passwords or payment by gift card. Monitor your name on social media and review sites, and report fake profiles. If you face a wave of fake negative reviews, document them and report them to the platform; see AI and online reputation: responding to reviews.
If you have been scammed
- Contact your bank immediately to try to stop or recall the payment.
- Change passwords for affected accounts, and turn on multi-factor authentication.
- Disconnect compromised devices, and scan them.
- Report the incident to the police or your national fraud reporting service, and notify your insurer if you have cover.
- Warn your staff, suppliers and customers if their data may be involved.
- Review what happened, and update your controls.
Quick action improves the chance of recovering funds. For wider background, see data breaches and AI: how attackers use automation and top cybersecurity threats.
A worked example
A small printing company receives an email that looks like it comes from its paper supplier, saying that its bank account has changed and attaching a new invoice. The office manager notices that the address has an extra letter and the email asks for payment that day. Following the company rule, she calls the supplier on the number in her records. The supplier confirms that no change was made. She reports the email, and the owner reminds everyone of the call-back policy. The simple rule saved several thousand dollars.
Frequently asked questions
Do I need expensive security tools?
Not to start. Procedures, multi-factor authentication and training prevent many losses.
Can I trust a caller who sounds like my colleague?
Not for urgent money requests. Hang up and call back on a known number.
Should I pay a ransom or a fee to remove fake reviews?
No. Report the issue to authorities and the platform, and seek professional advice.
