Guides / AI scams

Guide · Trust & Data

AI Scams: Deepfake Calls, Cloned Voices and Fake Invoices

01Why small businesses are in the firing line

Scammers have always targeted small businesses for the same reason: fewer people, fewer checks, and an owner who can authorise a payment from their phone. What AI has changed is the quality of the bait. The tell-tale signs we were all taught — clumsy spelling, odd grammar, a voice that doesn't sound quite right — are disappearing.

That's the uncomfortable bit. The reassuring bit is that you don't need to out-spot the technology. You need processes that don't rely on spotting it at all.

02The four scams to know about

• The cloned voice. A phone call or voicemail that sounds exactly like you, a director or a regular supplier, asking for an urgent payment or a "quick favour". A short clip from a video, voicemail greeting or social media post can be enough to copy a voice.
• The deepfake video call. Rarer, but real: in one widely reported 2024 case, an employee at the engineering firm Arup transferred around $25 million after a video call in which every other "colleague" was AI-generated.
• The fake invoice or changed bank details. The most common and most costly for small businesses. An email — sometimes from a supplier's genuinely hacked account — says their bank details have changed, or sends an invoice that looks exactly like the real thing. AI now writes these in perfect, on-brand English.
• Flawless phishing. Emails and texts tailored to you using details scraped from your website and LinkedIn — mentioning real jobs, real staff names and real suppliers — designed to get a password or a click.

03The pattern behind all of them

Strip away the technology and these scams follow the same script. Learn to recognise the script rather than the fake:

• Urgency — it has to happen today, before the deadline, before the deal falls through.
• Secrecy or a broken routine — "don't mention this to anyone yet", "I'm in a meeting so just email me", "use this new account".
• Money or access — a payment, a change of bank details, gift cards, a password or a code.

When all three turn up together, stop. It doesn't matter how real the voice sounds.

04Five rules that stop almost all of it

1. Verify every change of bank details by phone — on a number you already have. Never the number in the email asking for the change. This single rule defeats most invoice fraud.
2. Two people for new payees and large payments. Set a threshold. Above it, or for anyone being paid for the first time, a second person approves. Scammers rely on one person acting alone under pressure.
3. Agree a code word for urgent requests. A simple word or question known only to the people who can authorise payments. If "the boss" calls in a panic and can't give it, the call ends.
4. Watch the Confirmation of Payee check. When your bank says the name doesn't match the account, treat it as a red flag, not a glitch.
5. Turn on two-step verification for email, banking and accounts software. Many invoice scams start with a hacked mailbox — yours or your supplier's.

Write these down, share them with anyone who handles money, and make it explicitly safe to delay a payment to check. The person who rings back to verify should be thanked, even when the request was genuine.

05Reduce what scammers have to work with

You can't vanish from the internet, but you can be thoughtful. Long videos of senior staff speaking, detailed organisation charts and named finance contacts on your website all make a scammer's job easier. Keep public material useful to customers, not a briefing pack for fraudsters — and remind the team that a familiar voice on the phone is no longer proof of who's speaking.

06If it happens

1. Call your bank immediately — the faster they act, the better the chance of stopping or recovering the payment. Dialling 159 connects you to most major UK banks' fraud lines.
2. Report it. In Scotland, report to Police Scotland on 101. In England, Wales and Northern Ireland, use Report Fraud (the service that replaced Action Fraud) at reportfraud.police.uk or on 0300 123 2040.
3. Forward the evidence. Suspicious emails go to report@phishing.gov.uk; scam texts can be forwarded to 7726.
4. Secure your accounts — change passwords, check email forwarding rules, and warn customers or suppliers if your mailbox may have been used.
5. Check whether it's a data breach. If personal data was exposed, you may need to report it to the ICO within 72 hours.

And don't let embarrassment slow you down. These scams fool careful, intelligent people every day — that's what they're built to do.