It’s Cyber Security Awareness Month, and there’s one topic we keep coming back to… AI scams.
Not long ago, a dodgy email was easy to spot. Odd spelling, clumsy wording, a “Dear Sir/Madam” that gave the game away. Those days are fading, fast. Artificial intelligence (AI) tools are now able to let cyber criminals write increasingly polished messages, copy voices and create fake (high quality) documents in minutes, and they don’t need to be technical geniuses to do it.
The good news? You don’t need to be a security expert to protect your business. At sfG Software we help businesses like yours stay one step ahead, and in this guide, we’ll explain what’s changed, what to look out for, and the simple steps that can help to make a real difference.
Jargon buster: AI (artificial intelligence):
Software that can learn patterns and produce things like text, images or speech that look like they were made by a person. Tools like ChatGPT and Claude are examples that are commonly used. And used well, they’re helpful. Used by scammers? Not so much.
Why AI scams are different
Scams have always relied on tricking people, and not necessarily breaking technology. What AI changes is speed, quality and scale.
- Speed: A convincing scam email used to take some effort. Now it takes seconds.
- Quality: The grammar mistakes that used to be a warning sign have largely disappeared.
- Personalisation: AI can pull details from your website, LinkedIn or social media to make a message feel like it was written just for you.
- Scale: Criminals can send thousands of tailored messages at once.
In short, scams now look and sound more believable, and that’s why awareness matters more than ever.
-
Deepfake voice and video calls
This is the one that tends to make people sit up.
Jargon buster: deepfake. A fake audio recording, image or video made using AI to copy a real person’s voice or face. With just a short clip of someone speaking (say, from a video on social media), software can create a voice that sounds uncannily like them.
How it plays out:
Your finance person gets a phone call or voice note that sounds exactly like the managing director. They’re travelling, it’s urgent, and a supplier needs paying today. The voice sounds just like them, the pressure is real, but the person isn’t.
This isn’t just theory. A widely reported case in 2024 saw a multinational company in Hong Kong lose around £20 million after an employee joined a video call where several “colleagues” turned out to be deepfakes. Criminals go where the money is, but smaller businesses are targeted too, often because they have fewer checks in place.
What to look out for:
- Unusual urgency (“I need this done in the next hour”)
- Requests to keep things secret or bypass normal approval – possibly alongside the urgency messaging, for example “No need to tell XYZ, we need to move fast”.
- A change in how someone normally contacts you – would they normally call, email or text?
- Slight oddities, such as odd pauses, flat tone, or a video that glitches around the mouth.
-
Phishing emails that actually read well
Jargon buster: phishing. When a scammer sends a message pretending to be someone you trust (a bank, a supplier, a colleague) to trick you into clicking a link, sharing a password or handing over money. Think of it as fishing: they cast the bait and wait for someone to bite.
AI-written phishing emails are cleaner, more natural and better matched to your business. They may reference real projects, mimic your boss’s writing style, or arrive at the exact moment you’d expect an email like it, such as a “shared document” request just after a meeting.
The old advice (“look for spelling mistakes”) is no longer enough. Instead, focus on:
- The sender’s actual address, not just the display name. “Tina Jones” might be hiding behind an unusual email address tina@random-address.com.
- Unexpected requests, even from familiar names.
- Links that don’t match where they claim to go. Hover over a link before you click.
- Pressure and fear: account “suspended”, payment “overdue”, “act now”. Once again, hackers rely on urgency to cause panic to throw people off course and act quickly without the usual thought.
-
Fake invoices and payment-change requests
This is one of the most expensive scams for small and medium businesses, and AI makes it much easier to pull off.
Jargon buster: business email compromise (BEC). When a criminal gets into, or convincingly imitates, a genuine business email account to trick someone into sending money. It’s less about hacking and more about impersonation.
How it plays out:
You receive an invoice that looks identical to one from a regular supplier: right logo, right layout, right tone. The only change? The bank details. Or a supplier “emails to say they’ve changed banks”. Payment goes out, and by the time the real supplier chases you, the money has gone.
AI can now produce realistic invoices, copy branding and even write a believable email chain in moments.\
-
Smarter scams on every channel
It’s not just email. Across the board we are now seeing AI-assisted scams through:
- Text messages (known as smishing)
- WhatsApp and social media messages
- QR codes placed on emails, posters or parking meters (known as quishing)
Jargon buster: smishing and quishing. Smishing is phishing by SMS text message. Quishing is phishing using a QR code, which sends you to a fake website when scanned.
What your business can do about it
The reassuring part: most protection comes from simple habits and clear processes, not expensive technology.
Build a “pause and verify” culture
Make it normal, even encouraged, to double-check. If anyone asks for money, bank detail changes or sensitive information, confirm it using a different channel. Ring the person on a number you already have, not one from the message. Staff should never feel awkward about checking with the boss.
Agree a payment-change process
Write down a simple rule such as: “Any change to supplier bank details must be verified by phone with a known contact and approved by a second person.” It takes minutes to set up and can save thousands.
Use multi-factor authentication everywhere
Jargon buster: multi-factor authentication (MFA). A second check when you log in, like a code on your phone, on top of your password. Even if a scammer steals your password, they’re stuck without that second step.
Switch it on for email, banking, accounting software and cloud storage. It’s one of the single most effective steps you can take.
Consider a family-style “safe word” for urgent requests
For high-risk requests such as payments, some businesses agree a code word or verification question that only genuine team members would know. Simple, low-tech, effective against voice cloning.
Train your team regularly
Your people are your best defence, but only if they know what today’s scams look like. Short, regular awareness sessions and simulated phishing tests (safe, practice phishing emails sent to your own staff) help build confidence and spot weak points before criminals do.
Jargon buster: simulated phishing. A harmless fake scam email sent by your IT partner to see who clicks. No one’s in trouble; it’s a safe way to learn. At sfG Software we offer phishing tests which are sent out to your business and staff – those who click on links are not made to feel silly or embarrassed, rather it is used as a training opportunity.
Keep your tech up to date
Keep software, devices and email filters updated, and make sure you have good, tested backups. Updates close the gaps scammers try to use, and backups mean you can recover if something does go wrong.
Know what to do if it happens
If you think you’ve been caught out, act quickly: tell your IT team, contact your bank immediately if money is involved, change affected passwords, and report it to Action Fraud (or Police Scotland if you’re in Scotland) and the NCSC(National Cyber Security Centre). Speed really does matter, and there’s no shame in reporting. It happens to smart people every single day.
Quick checklist: spotting AI scams
- Is this request unexpected or unusually urgent?
- Does it ask for money, passwords or a change in bank details?
- Can I confirm it another way, such as a call to a known number?
- Does the sender’s address or link look slightly off?
- Would I normally be asked this way, by this person?
If something feels off, trust your instincts and pause.
The bottom line
AI scams are getting harder to spot, but they still depend on one thing: rushing you into a decision. Slow down, verify, and put simple processes in place, and you take away most of the criminals’ advantage.
Not sure how well your business would cope with a convincing scam? We can help. sfG offers friendly, jargon-free cyber security training, phishing simulations and security health checks for businesses just like yours.
Ready to give your team the confidence to spot the scams? Get in touch for a free, no-obligation security chat or find out more about our cyber security training.
