AI Scam Prevention: A Practical Plan for Small Businesses

AI scams can imitate a familiar voice, write a convincing email, or create a fake video call. Small businesses can reduce the risk by verifying unusual requests through a second, trusted channel and requiring approval for payments and account changes.

These safeguards do not depend on detecting whether a message was made with AI. They give your team a clear process to follow when a request feels urgent or unusual.

Key takeaways

• AI-generated messages and voices can make impersonation attempts more convincing.
• Never approve a payment or change supplier bank details based only on an email, call, or video meeting.
• Verify requests using contact details you already trust, not details supplied in the request.
• Use two-person approval, multi-factor authentication, and a simple incident plan.
• Teach staff to pause and report suspicious requests without blame.

Why AI scams matter to small businesses

AI tools can help people create natural-sounding text, images, audio, and video. Scammers may use these tools to impersonate a business owner, staff member, supplier, or customer. A message might mention real company details gathered from public websites or social media.

The danger is not that every odd email is a deepfake. It is that a familiar name, voice, or face can make people feel they must act quickly. That pressure can lead to rushed transfers, password sharing, or changes to account details.

The U.S. Federal Trade Commission has warned that voice cloning can make requests for money or sensitive information seem more believable. Its consumer guidance recommends contacting the person through a number you already know rather than trusting the incoming call. The same principle works for business requests.

AI scams are also part of a wider online safety challenge. Review your website and customer communication processes alongside your staff procedures. For related planning, see our guide to AI search for small businesses.

Common AI scam warning signs

A convincing message may still contain clues. Look for requests that break normal routines, even when the sender appears familiar.

• Urgent payment demands: Someone says a transfer must happen immediately or a deal will fail.
• New payment details: A supplier asks you to use a different bank account or payment channel.
• Unexpected secrecy: The person asks you not to check with colleagues or follow the usual approval steps.
• Requests for credentials: Someone asks for a password, one-time code, or access to a business account.
• Unusual contact methods: A familiar person contacts you through a new number or personal account.
• Video-call pressure: A caller discourages you from ending the call to verify their identity separately.

Do not rely on spelling errors or strange phrasing alone. AI can produce polished language, while genuine people can make mistakes. Treat a high-impact request as something to verify, not as proof of identity.

AI scam prevention: a practical verification process

Make verification part of the way your business works. A short, repeatable process is more useful than asking staff to guess whether a voice or video is genuine.

1. Pause and identify what is being requested

Before taking action, write down the request. Is someone asking for money, confidential information, a password reset, or a change to supplier records? These actions deserve extra checks, even when they seem to come from a manager or trusted partner.

2. Contact the person through a known channel

Use a saved phone number, an established messaging account, or a contact method from your business records. Do not reply to the suspicious email or call back the number that contacted you. Ask the person to confirm the exact request and relevant details.

For a supplier bank change, call a number already on file. Do not use a new number included in the change request. If you cannot reach the person, wait before changing the account details.

3. Require a second approval for sensitive actions

Set a rule that one person cannot both request and approve a high-value payment or supplier change. The second approver should check the request independently. This creates a useful pause when a scammer is trying to rush one employee.

4. Record what happened

Keep a brief record of unusual requests, who verified them, and what action followed. A simple log helps your team spot repeated attempts and improves your response if a payment or account is affected.

Build a simple AI scam prevention plan

Write a one-page procedure that staff can find quickly. It should explain which requests require verification, who can approve them, and how to report a suspicious message. Keep the instructions short enough to use during a busy workday.

Protect access to important accounts

Enable multi-factor authentication for email, banking, hosting, and other critical services. Multi-factor authentication asks for an additional proof of identity beyond a password. Use unique passwords and avoid sharing accounts where individual access can be provided.

Review who can access business accounts and remove access when someone no longer needs it. Keep software and devices updated, and maintain backups of important business information. These steps do not stop impersonation by themselves, but they reduce the damage that may follow a compromised account.

Train staff with realistic examples

Show employees examples of requests that would require a pause: an unexpected transfer, a rushed invoice, a password request, or a supplier account change. Make clear that reporting a suspicious request is helpful, even if it later turns out to be legitimate.

Consider a shared verification phrase for urgent requests from leadership, but do not treat it as your only safeguard. A phrase can be exposed or repeated. Independent confirmation through a trusted channel and a second approver remain important.

If your business relies on a website to collect enquiries or customer details, protect that process too. A well-maintained site and clear contact channels can make it easier for customers and staff to check what is genuine. Learn about website maintenance and technical support or website design and development.

What to do after a suspicious request or payment

If a request seems suspicious, do not click links, open unexpected attachments, share codes, or send money while you investigate. Save the message and report it using your internal process. Contact the person or organisation being impersonated through a separate, trusted channel.

If money has been sent, contact your bank or payment provider immediately and ask whether the transaction can be stopped or recalled. If an account may be compromised, change its password from a trusted device, revoke unfamiliar sessions where possible, and review account activity. Tell affected staff what happened so they can watch for follow-up attempts.

Keep evidence such as emails, numbers, timestamps, and payment records. Report the incident to the appropriate local authorities or relevant service providers. The FTC offers general guidance on responding to harmful voice-cloning scams; reporting options differ by country, so use the channels relevant to your location.

Frequently asked questions

Can you identify an AI-generated voice by listening?

Not reliably in every case. Audio quality, editing, and the recording environment can affect how a voice sounds. Verify the request through a trusted channel instead of relying on your ear.

Should a small business use a secret code word?

A code word can add a check for urgent requests, but it should not replace call-backs or approval rules. Keep it private and change it if it may have been exposed.

What should I do if a supplier emails new bank details?

Do not update the records from the email alone. Call the supplier using a number already in your records, confirm the change, and follow your normal approval process.

Do small businesses need a written response plan?

Yes. A short plan tells staff whom to contact, which actions to pause, and how to report a suspicious request. Keep it accessible and review it when your payment or account procedures change.

Make verification part of everyday business

AI scam prevention is less about spotting a perfect fake and more about slowing down risky requests. Verify through a known channel, require another person to approve sensitive actions, and make reporting easy for your team. If you need help building or maintaining a business website that supports clear customer communication, get in touch with Herby Design.