AI Scams Targeting Small Businesses: How to Protect Yours

AI scams are not a brand-new kind of crime. They are the same old tricks aimed at small businesses, such as fake invoices, “urgent” requests from the boss, and imposters using a trusted name, made cheaper, faster, and far more convincing by AI. Recent reports show online scams overtaking classic phishing: AI-written emails without the typos people used to watch for, and imposters faking caller ID and even staging video calls. The practical answer for owners: don’t rely on spotting the fake. Set a few simple rules that work even when the fake looks real, such as verifying money requests on a number you already have, requiring two people for payment changes, and training your team to slow down and speak up.

Quick take:

• Scams are scaling up. One security company says online scam detections roughly doubled, passing traditional phishing for the first time in early 2026.
• The old warning signs are fading. AI-written emails are fluent, personal and different for every recipient.
• Caller ID and video calls can be faked. The FBI warned on Nov. 2 about scammers spoofing official phone numbers and staging a video call in a fake office.
• Imposters use real brand names in ads. The FTC is asking the public to weigh in, through Nov. 30, on how to stop imposter ads online.
• Many small businesses aren’t ready yet. In one survey, 31% of small and mid-market owners said they had been targeted by an AI-enabled scam in the past year, and only 35% had an up-to-date incident response plan.

What’s New: Scams Are Getting Cheaper, Faster and Harder to Spot

For years, the advice was to watch for bad spelling, strange wording, and generic greetings. That advice is wearing out, because generative AI can write a polished, personal message in seconds. Two recent reports show what that looks like:

• Akamai (Oct. 29). In its 2026 fraud and abuse report, Akamai said online scams, such as fake retail sites and spoofed event pages, roughly doubled from about 3.2 million to about 6.4 million detections and passed traditional phishing for the first time in the first quarter of 2026. The average phishing attack’s lifespan fell from 48 days in late 2025 to 22 days in the second quarter of 2026, so fake sites appear and vanish quickly. Nearly 70% of the phishing threats it tracked impersonated technology, financial services and commerce brands.
• Proofpoint (Oct. 21). As reported by The Hacker News, the email security company described one scammer who contacted more than 30 real estate agents at a single company, each from a different account and in different words, and ended every conversation with the same request: join a video meeting. Proofpoint said the pattern can target any business that depends on hearing from strangers, such as clinics taking new patients or firms signing new clients. The same article cites FBI figures for 2025: more than 22,000 AI-related complaints, with nearly $900 million in reported losses, and 24,768 business email compromise complaints with about $3.05 billion in reported losses.

A message that looks normal no longer proves it is real. What still gives a scam away is what it asks you to do.

The AI Scams Small Businesses Are Most Likely to See

Most AI scams fall into a few familiar patterns:

1. Imposter ads and look-alike sites. Scammers pay for ads in social feeds, search results, and shopping platforms that use the names of well-known businesses and government agencies. On Nov. 2, the FTC asked the public to comment on whether platforms should vet advertisers, give people a way to report imposter ads, and remove scams. Comments are open until Nov. 30, 2026. This cuts both ways: customers can be fooled by a fake version of you, and your team can be fooled by a fake supplier or software company.
2. Fake invoices and bank-detail changes. A “vendor” emails to say its bank account has changed, or sends an invoice that looks exactly right. One Proofpoint example was a single email with a made-up thread in which a fake vendor and one of the company’s executives appear to agree on an invoice, ending with a request to pay that day.
3. Fake email threads and stranger inquiries. AI can write both sides of a believable conversation, or a string of ordinary questions that ends with one ask: click this link, open this file, or join this call.
4. Rushed, secret requests. A text or email “from the owner” asks someone to send money, buy gift cards, or share a password right away, and to keep it quiet.
5. Faked voices, faces, and caller ID. Voice-cloning tools can imitate a familiar voice from recordings, and scammers can spoof caller ID. In a Nov. 2 warning, FBI Honolulu said scammers posing as federal agents spoofed the real phone numbers of law enforcement offices, and in one report, a scammer appeared on a video meeting with a background staged to look like a federal office. The FBI’s advice: look up the agency’s publicly listed number yourself and call back, rather than using contact details the caller gives you.

We covered how these scams touch your money in more depth in AI in finance for small businesses.

Many Small Businesses Aren’t Ready Yet

The gap is less about technology and more about habits. In Nationwide’s 2026 cybersecurity survey of small and mid-market business owners (conducted by Edelman Intelligence in July and released in September):

• 31% said their company had been targeted by a scam or fraud attempt using generative AI in the past 12 months.
• 88% said AI-enabled attacks had become more sophisticated over the past year.
• Only 35% said they have an up-to-date incident response plan.
• Only 36% have written policies on how employees use AI, and only 27% have rules on what company or customer information employees can enter into AI tools.
• 82% said they need more information and resources to protect their businesses from AI-enabled attacks.

That last number is encouraging: most owners know this matters. They need a short, practical plan.

How to Protect Your Business: 5 Simple Safeguards

None of these steps requires expensive software. They work because they don’t depend on anyone spotting a fake.

1. Verify on a number you already have. Confirm any request to send money, change bank details, or share a password by calling a number from your own records, never one in the message or given on the call. For urgent requests from the owner or a manager, agree on a code word or question that a scammer wouldn’t know.
2. Two people approve money changes. New payees, changed bank details, and payments above a set amount need a second person’s OK. A phone call or email isn’t approval.
3. Write down the normal process. When your team knows how payments, refunds, and password resets normally work, out-of-pattern requests stand out. Put it on one page.
4. Train your team and make reporting easy. The FTC says a business’s best defense against scammers is an informed workforce, and it marked National Veterans Small Business Week with free small business scam videos and a guide covering fake invoices, tech support scams, and business and government imposters. Share real examples, and make clear that nobody gets in trouble for flagging a suspicious message, even after clicking.
5. Lock down your accounts. Turn on multifactor sign-in for email, banking, payroll, and your website. Some fake invoice scams start with a hacked mailbox, so protecting email helps protect your money.

One rule ties them together: when a request is urgent, secret, or new, slow down and check.

When Scammers Pretend to Be You

AI also makes it easier for scammers to copy your business. A few habits help customers tell the real you from a fake:

• Tell customers how you will and won’t contact them. For example, “We will never ask for payment by gift card.” Put it on your website and invoices.
• Keep your official details consistent. Your website, Google Business Profile, and social pages should show the same name, phone number, and web address. Our guide to SEO and AEO for small businesses explains why accurate listings matter for search, and AI answers too.
• Search for your own name regularly. Look for look-alike sites, fake profiles, or ads using your brand, and report them to the platform.
• Be careful what AI tools see. Set simple rules on what customer and company information employees can paste into AI tools. We covered safe everyday use, why AI matters for small businesses, and generative AI for small business marketing.

If You Think You’ve Been Targeted

Act quickly and calmly:

1. Stop all contact with the sender or caller.
2. If money moved, call your bank right away using the number on your card or statement and ask about stopping or recalling the payment.
3. Change passwords on any exposed accounts, starting with email.
4. Save screenshots, emails, and phone numbers.
5. Report it to the FBI’s Internet Crime Complaint Center at ic3.gov and to the FTC at ReportFraud.ftc.gov, and tell your team so they can watch for the same trick.

FAQ

Q: What are AI scams?
A: Scams that use AI tools to make fake messages, voices, videos, websites, or ads more convincing. Most are familiar frauds, like fake invoices and imposters, but faster and more polished.

Q: Can I spot a cloned voice or a deepfake video?
A: Sometimes, but don’t count on it. A safer approach is to treat any voice or video request for money or passwords as unverified until you confirm it on a number or channel you already trust.

Q: Do I need special software to protect my business?
A: Not to start. The biggest wins come from process: callback checks, two-person approval, multifactor sign-in, and a team that feels safe reporting. Security tools can add a layer later.

Q: Should my business stop using AI because of scams?
A: No. AI can still save your team time. Use it with clear rules, keep a person in charge of money and customer data, and verify anything unusual. Our post on agentic AI for small businesses covers how to start safely.

Put AI to Work Without Handing Scammers the Keys

AMN Consulting helps small business owners use AI in practical, safe ways. Through our Intelligent System Solutions service, we help you identify routine work AI can support, set simple rules for how your team uses AI tools, and keep people in charge of approvals and customer data. We can also help keep your search presence accurate and consistent, so customers can find the real you. No hype, and no promise that any tool makes you scam-proof.

Call (346) 970-7883 (Mon to Fri, 9:00 AM to 5:00 PM) or book a free consultation. There is no obligation.

Sources

• Akamai, “Akamai Report: AI-Driven Digital Deception Is Escalating Enterprise Fraud and Shrinking Phishing Lifespans,” State of the Internet report “AI-Driven Digital Deception: The Fraud and Abuse Report 2026,” Oct. 29, 2026 (based on attacks seen across Akamai’s network) (linked above)
• The Hacker News, “Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports,” Oct. 21, 2026 (includes FBI Internet Crime Complaint Center 2025 figures) (linked above)
• Federal Trade Commission, “Tell the FTC about imposter ads online,” consumer alert, Nov. 2, 2026 (linked above)
• FBI Honolulu, “FBI Honolulu Issues Warning About Law Enforcement Impersonation Scam Targeting Hawaii Residents,” Nov. 2, 2026 (linked above)
• Nationwide, “Nationwide Survey: Businesses Are Using AI Faster Than They Are Managing Its Risks,” 2026 Nationwide Cybersecurity Survey, conducted online by Edelman Intelligence July 10 to 26, 2026 (linked above)
• Federal Trade Commission, “Help veteran-owned small businesses avoid scams during National Veterans Small Business Week,” consumer alert, Nov. 5, 2026 (linked above)

 

AMN Consulting is not affiliated with or endorsed by Akamai, Proofpoint, The Hacker News, Nationwide, Edelman, the FTC, or the FBI, and companies and agencies are named as news, not endorsements.