A voice message from your “boss” asking for an urgent payment. A video call where the “client” looks and sounds real. A perfectly written email from your “bank”. AI has made scams cheaper, faster and far more convincing. Small businesses are attractive targets because they often lack dedicated security teams. This guide explains the most common AI scams hitting businesses in 2026 and the simple controls that stop most of them.
The AI scams businesses face most
Voice cloning and fake phone calls
A few seconds of audio from a video or voicemail can be enough to clone a voice. Scammers use it to impersonate owners, managers or suppliers and request urgent transfers or gift cards.
Deepfake video calls
Fake video participants are now used to “confirm” payments or approve changes. The video may be slightly off, but under time pressure people miss the signs.
AI-written phishing
The old spelling mistakes are gone. AI writes polished, personalized emails using details scraped from LinkedIn and your website.
Invoice and supplier fraud
Fake invoices or “updated bank details” from what looks like a real supplier, often sent from a lookalike domain.
Fake reviews and impersonation
AI-generated reviews can attack your reputation, and fake social profiles or websites may impersonate your brand to scam your customers.
Spam through website forms
Bots now submit realistic-looking enquiries to waste time or push links and malicious offers. If your contact form receives odd “partnership” or “SEO” messages, this is likely the source.
Warning signs to train your team on
- Urgency and secrecy: “Do this now, don’t tell anyone.”
- Requests to change payment details or pay in an unusual way
- A familiar voice on an unknown number
- Small inconsistencies: odd timing, unusual wording, a slightly different email domain
- Pressure to skip normal approval steps
Simple controls that stop most AI scams
- Call back on a known number. Never confirm a payment request using the contact details in the message itself.
- Use a code word for urgent financial requests between owners and staff.
- Require two people to approve new payees or changes to bank details.
- Turn on multi-factor authentication for email, banking, your website and your CRM.
- Protect your domain. Set up SPF, DKIM and DMARC so others cannot easily spoof your email.
- Secure your website forms with spam filtering, honeypot fields and rate limits.
- Limit what you publish. Org charts, direct phone numbers and long voice recordings make impersonation easier.
- Run a short training every six months with real examples.
Protecting your website and customers
Keep WordPress, plugins and themes updated, use strong admin passwords with MFA, and monitor for lookalike domains. If your site has already been compromised, my WordPress malware removal service can clean it, and ongoing WordPress maintenance helps prevent repeat problems. Also make sure your own AI tools are clearly labeled, as required under the EU AI Act in Europe, so customers can tell your real assistant from an impostor.
If you think you have been scammed
- Contact your bank immediately to try to stop or recall the payment.
- Change passwords and check email forwarding rules.
- Report it to the relevant authority in your country.
- Warn staff, and customers if your brand was impersonated.
- Write down what happened to improve your process.
FAQ
What is an AI scam?
An AI scam uses tools like voice cloning, deepfake video or AI-written messages to impersonate trusted people and trick victims into paying or sharing data.
How can I tell if a voice is AI-generated?
It can be very hard. Rather than relying on detection, verify requests by calling back on a known number or using a code word.
Are small businesses targeted by deepfakes?
Yes. Small businesses are often targeted because they have fewer approval steps and less security training.
How do I stop spam on my website contact form?
Use honeypot fields, spam filtering such as reCAPTCHA or Akismet, rate limits and blocklists for common spam keywords.
What is the most effective defense?
A simple rule: no payment or data change without verification through a separate, trusted channel and a second approver.
