Home / Guides / For small business owners

Protect Your Small Business From AI-Powered Scams

Scammers use AI to write convincing emails and copy voices. A few written rules in your business can stop most of them.

Step by step

  1. Verify every payment change. If a vendor sends new bank details, call a number you already have before paying.
  2. Use a two-person rule. For large payments, require a second person or a pause.
  3. Create a code word. Share a family and staff code word for emergency money requests.
  4. Check the sender address. Look for lookalike domains such as an extra letter.
  5. Report quickly. Tell your bank at once and report at ReportFraud.ftc.gov.

What to expect

Expect a simple set of rules for payments, vendors and requests.

Mistakes to avoid

Do not rely on caller ID. Avoid rushing payments.

A good next step

Write the rules down and share them with staff.

Scams aimed at small businesses

  • Fake invoices that look like a real supplier.
  • Messages from a "boss" or "owner" asking for gift cards or an urgent transfer.
  • Cloned voices on the phone asking for payments.
  • Fake listing and directory renewals.
  • Phony tech support pop-ups.

Protect the business, step by step

  1. Agree on a payment rule. Any change to bank details must be confirmed by calling a known number.
  2. Use a second approver. Require two people for larger payments.
  3. Use strong passwords and two-step sign-in. Especially for email and banking.
  4. Train your team. Share examples and review them every few months.
  5. Keep a call list. Have verified numbers for banks and key suppliers.

A scenario to practice

  1. The message. An email from "your supplier" says their bank details have changed and the next invoice of $8,400 must be sent to a new account.
  2. The warning signs. Urgency, a changed bank account and an email address that is slightly different.
  3. The right response. Call the supplier at the number you already have. Do not reply to the email. Confirm in writing through a known channel.
  4. The policy that prevents it. Any bank change needs a call back and a second person's approval.

A small-business security checklist

  • Two-step sign-in on email, bank, payroll and social accounts.
  • A password manager for the team.
  • A written rule for approving payments and changing vendor details.
  • Updated software on every computer and phone.
  • Backups that are tested.
  • A short list of who to call if something goes wrong, including your bank.

Training your team

  • Show real examples every few months.
  • Make it safe to report a mistake quickly.
  • Remind people that voices and videos can be faked, so confirm unusual requests another way.
  • Review who has access to what when someone leaves.

A prompt you can copy

Type this into ChatGPT, Claude or Gemini

Here is an email I received asking me to pay an invoice to new bank details: [paste, with account numbers removed]. List the warning signs and tell me how to verify it safely.

Good to know. No real tax agency or bank will demand payment by gift card, wire or crypto.

Want help using AI in your business?

Join a free live class on Zoom. Small group, no experience needed, no sign-up fee.

Reserve a free seat

Common questions

Can AI really clone a voice?

Yes, from a short recording. Do not trust a voice alone when money is involved.

What if I already paid?

Call your bank immediately and ask about a recall. Then report it to the FTC and local police.

Can scammers fake voices?

Yes. Confirm unusual requests through a second channel.

What if we paid a fake invoice?

Call your bank immediately and report it to the FTC and local police.

Do I need insurance?

Ask your insurance agent about cyber coverage.

Does a small business really get targeted?

Yes. Small businesses are common targets because they often have fewer checks.

What should I do first?

Turn on two-step sign-in everywhere and set the call-back rule for payments.

More guides