Scams aimed at small businesses aren’t new. What’s new is how convincing they’ve become. In its 2025 Internet Crime Report, the FBI gave AI scams their own section for the first time: 22,364 complaints mentioned AI, with reported losses of $893 million. Business email compromise, the fake invoice and payment-change scam, cost victims more than $3 billion. North Carolina ranked 9th in the country for complaints, with 25,940 reports and $431.6 million in losses.
AI doesn’t invent new tricks so much as it removes the old warning signs. The emails have no typos, the caller sounds like your boss, and the video call looks real. This guide covers the AI scams small businesses are seeing, the simple controls that stop most of them, and what to do if money has already gone out.
How AI scams target small businesses
Most of these are old frauds with better tools:
- Fake invoices and payment changes. A message that looks like it’s from a real vendor says their bank details have changed. In these AI scams, the writing matches the vendor’s style, and the message often comes from a hacked email account.
- Urgent requests from “the owner.” A text, email or call asks someone to wire money, buy gift cards or pay a new vendor right away, and to keep it quiet.
- Polished phishing. The FBI has warned that criminals use AI to write targeted phishing messages without the spelling and grammar mistakes that used to give them away.
- Spoofed official calls. In May 2026, North Carolina Attorney General Jeff Jackson warned licensed professionals about callers posing as state licensing boards. They use public license details, fake caller ID and threats of criminal investigation.
Voice cloning and deepfake scams
The same FBI warning describes criminals using AI to clone voices and create video of trusted people, like coworkers and business partners. The best-known business case is Arup, the global engineering firm. In early 2024, an employee in its Hong Kong office transferred about US$25 million after a video conference with people posing as senior company officers. Arup confirmed the incident and said its internal systems weren’t compromised. The deepfake scam worked on a person, not a computer.
For a small business, voice cloning scams usually look smaller and more ordinary: a voicemail that sounds like the owner asking for a quick payment. The defense is the same either way. Don’t rely on recognizing a voice or a face.
Controls that stop most AI scams
None of these defenses against AI scams require new software:
- A call-back rule. Any change to bank details, and any urgent request for money, gets verified by calling a number you already have on file. Never use the number in the message.
- Two people for money. New payees, changed bank details and wires above a set amount need a second person’s approval.
- A code word. Owners and managers agree on a word that has to come up in any urgent request by phone or text.
- Multifactor authentication on email. Many fake invoice scams start with a hacked mailbox. The FBI recommends multifactor authentication to make that harder.
- Email authentication for your domain. Setting up SPF, DKIM and DMARC makes it harder for criminals to send email that looks like it came from you. Google requires all three for anyone sending more than 5,000 messages a day to Gmail accounts.
- Bank-level protections. Ask your bank what it offers, like alerts for new payees and fraud filters on outgoing payments.
- Short, regular training. Fifteen minutes each quarter with real examples of AI scams does more than one long annual session.
Our guide on whether ChatGPT is safe for business data covers the other side of the coin: keeping your own information out of the wrong AI tools.
A simple payment verification policy
Here’s an example policy against AI scams that a small business could adopt as written:
| Request | Rule |
|---|---|
| A vendor changes bank details | Call the vendor at the number on file, and wait one business day before paying the new account |
| An urgent payment request from the owner or a manager | Confirm by phone at a known number and use the code word |
| A new payee over $1,000 | Second person approves before payment |
| Gift card or crypto payment requests | Never. No legitimate vendor or manager asks for these |
| A call from a “government agency” demanding payment | Hang up and call the agency’s official number |
Put it in writing, add it to your AI use policy or employee handbook, and make sure the owner follows it too. AI scams count on people making exceptions for the boss.
If you’ve been hit
If an AI scam gets through, speed matters, especially for wire transfers:
- Call your bank right away and ask them to recall the payment. The FBI’s report says to contact your financial institution immediately.
- File a complaint with the FBI at ic3.gov.
- Report it in North Carolina through the NC Department of Justice online form or at 1-877-5-NO-SCAM.
- Secure your email. Change passwords, turn on multifactor authentication, and check for forwarding rules you didn’t create.
- Check whether customer data was exposed. North Carolina’s Identity Theft Protection Act requires notice after certain breaches. Talk to your attorney.
Getting help in Asheville and across North Carolina
Good People Technologies helps with AI implementation for small businesses in Asheville, Western North Carolina and across the state. That includes the unglamorous security work that stops AI scams: multifactor authentication, email authentication and payment approval steps in QuickBooks Online and your other systems. To talk it through, start with a free 15-minute operations and technology audit.
Frequently asked questions
Can voice cloning scams fool employees who know the voice?
Yes. AI can produce a convincing copy of someone’s voice from recordings, which is why your rule should be to verify through a known number, not to trust a familiar voice.
What should we do if we already sent money?
If you lost money to AI fraud, call your bank immediately and ask for a recall, then file a complaint at ic3.gov. The faster the bank acts, the better the chance of stopping the transfer.
Does insurance cover AI fraud?
It depends on your policy. Many policies treat social engineering fraud separately from other cyber coverage, sometimes with lower limits. Ask your agent what yours covers before you need it.
How can we spot a deepfake video call?
Don’t count on spotting it. Deepfake scams keep improving. Treat any unusual request for money or data as unverified until you confirm it through a separate channel.
Sources, checked November 2026: the FBI’s 2025 IC3 report, the FBI’s warning on AI-enabled crime, the NC Department of Justice, Construction Briefing on the Arup case and Google’s email sender guidelines.
Hi, I’m Benji, founder and CTO of Good People Technologies in Asheville, NC. We help small and mid-sized businesses put AI to work safely and connect it to the systems they already run, from QuickBooks to NetSuite.
For over a decade, we’ve helped businesses solve complex operations and technology problems. When not working, I’m hiking or enjoying rivers in western North Carolina with my wife and two dogs.
