AI Scams Are Getting Better. Your Payment Process Needs a Verification Rule.

Small-business scams used to be easier to spot. The email sounded odd. The logo looked wrong. The wording felt rushed or clumsy. That is becoming less reliable. AI tools can help criminals write cleaner messages, imitate a familiar tone, translate more naturally, and produce fake requests that look professional enough to pass a quick glance.

The practical risk is not only a strange link in an inbox. It is the ordinary business request that looks normal: a supplier asking to change bank details, a customer requesting a refund, a manager asking for an urgent payment, or a platform asking someone to reset access. If money, access, or customer data changes hands, the business needs a verification step outside the message itself.

What you should take away

Do not verify high-risk requests inside the same email, text, chat, or invoice that raised the request. Use a trusted contact method you already had before the request arrived, and record who approved the change.

The rule

Use one rule across the business: if a request changes money, system access, customer data, or supplier details, pause and verify it through a separate trusted channel before acting.

A separate trusted channel means a phone number, email address, portal, or contact record you already know is genuine. It does not mean replying to the suspicious email. It does not mean calling the phone number inside the new invoice. It does not mean clicking the link that arrived with the request.

Requests that should trigger verification

Train staff to stop when they see any of these:

• A supplier asks to change bank account details.
• An invoice is urgent, unexpected, or higher than usual.
• A customer asks for a refund to a different payment method.
• Someone requests a password reset, MFA reset, or new admin access.
• A message asks for customer lists, payroll details, invoices, or identity documents.
• A familiar person asks for secrecy, speed, or a process exception.

None of these requests are automatically fake. That is the point. They are normal enough to deserve a process, not a guess.

A simple verification script

Use this when something feels urgent or financial:

• Pause: do not click, pay, upload, reset, or reply yet.
• Check: compare the request with previous invoices, known contacts, account records, and expected timing.
• Contact: use a trusted phone number, supplier portal, or saved contact, not the details in the new message.
• Confirm: ask exactly what changed, why it changed, and who authorised it.
• Record: write down who verified it, when, and what was approved.
• Act: only then make the payment, access change, refund, or data share.

This does not need expensive software. A shared checklist, accounting note, task comment, or approval email can be enough for a very small team, as long as everyone follows the same rule.

Set the rule before the emergency

Scams work because they create pressure. The request is urgent. The supplier is waiting. The owner is unavailable. The deal will expire. The account will close. If the rule is only discussed during a stressful moment, people are more likely to improvise.

Write the rule now. Decide who can approve new payees, supplier bank changes, refunds, admin access, and customer data exports. Make it clear that staff will not get in trouble for slowing down a risky request. A two-minute verification call is cheaper than an avoidable mistake.

Five controls worth checking this week

• Turn on multi-factor authentication for email, accounting, banking, website admin, and password manager accounts where available.
• Limit admin access to people who need it for their role.
• Keep a saved supplier contact list that staff can use for verification.
• Require a second approval for new payees or changed bank details.
• Keep backups of important business and website data so one compromised account is less damaging.

These steps are general risk-reduction practices, not a guarantee. If a request involves legal, tax, privacy, payroll, banking, or high-value financial decisions, get advice from a qualified professional or your trusted technology provider.

Takeaway

AI makes fake business messages harder to judge by appearance alone. The answer is not panic or suspicion of every message. The answer is a clear verification rule for the few requests that can hurt the business: money, access, customer data, and supplier details.

Source note: This article was informed by public Australian cyber safety guidance and recent technology-newsletter signals about AI-enabled risk. It is original general information for small-business owners, not legal, financial, or cybersecurity advice.

Further reading: See the Australian Cyber Security Centre's AI guidance for small business, small business cyber security guide, and business.gov.au's scam-spotting tips.