AI Scams in 2026: 9 Tricks Aimed at Small Businesses and How to Spot Each One

The voice on the phone is your supplier's. Same accent, same joke about the weather. He says the firm has changed banks and reads out new account details for this month's invoice. You pay it. He never called.

That is what AI scams look like now: no spelling mistakes, no strange accents, nothing that feels wrong until the money has gone. UK Finance counted £1.28 billion lost to payment fraud in 2025, and the government's own survey found that 43% of UK businesses identified a cyber breach or attack in a year. This guide covers the nine tricks aimed at small firms, the tell for each one, and the three habits that stop most of them. Figures were checked on 4 October 2026.

How we checked this guide

1. Losses from UK Finance. Fraud figures come from the UK Finance Annual Fraud Report 2026, which covers 2025.
2. Business attacks from government data. The breach figures are from the Cyber Security Breaches Survey 2025/2026, published on 30 April 2026.
3. Refund rules from the regulator. Reimbursement limits and deadlines are from the Payment Systems Regulator.
4. Named cases only where the victim confirmed them. The Arup case below was confirmed by the company in May 2024.
5. No invented statistics. Where nobody publishes a reliable number, we describe the scam and leave the number out.

The 9 AI scams at a glance

The four that take the most money

The deepfake video call

In January 2024 a finance worker at the Hong Kong office of the engineering firm Arup joined a video call with the chief financial officer and several colleagues. All of them were fakes, built from public footage. The worker sent about HK$200 million, roughly £20 million, to five accounts. Arup confirmed it that May.

You do not need to be a multinational. Anyone whose face and voice are online can be copied. The tell is never the picture. It is the request: urgent, confidential, and outside the normal process. The defence is to hang up and call the person on a number you already hold.

The cloned voice

Starling Bank found in 2024 that 28% of UK adults believed they had been targeted by a voice cloning scam in the previous year, and that 46% had never heard of the idea. The bank says a voice can be copied from as little as three seconds of audio, which a voicemail greeting or a social media video provides.

The tell is a voice you trust asking for money, a code or a change of details. The defence is a safe phrase agreed in advance with family, partners and anyone who can move money, plus the same call back rule.

The supplier whose bank details have changed

UK Finance calls this an invoice and mandate scam: a criminal intercepts or imitates a real supplier and redirects a real payment. In 2025 it cost £41.3 million across 2,305 cases, and 68% of the money, £28 million, came from business accounts. The report explains why: businesses make large genuine payments so often that one false one is hard to see.

AI makes the forged invoice and the email thread around it perfect. The tell is any message that changes where money goes. The defence is simple and dull: before the first payment to new details, phone the supplier on the number from an old invoice, not the one in the email.

The urgent request from the boss

Chief executive fraud was the rarest authorised scam in 2025, with 197 cases, yet it had the highest average loss of all eight types: just over £28,000 a case. Only 20% of the money was returned to victims. The email arrives when the owner is on a flight, asks for a quick transfer, and sounds exactly like them because a model has read their public posts.

The defence is a rule that two people approve any transfer above a set amount, and that no payment is ever approved by email alone.

The five that take time, logins and reputation

The flawless phishing email

Phishing was the most common attack in the government survey, reported by 38% of all businesses, and the one most often described as the most disruptive. The old advice was to look for bad grammar. That advice is finished. Look at what the message wants instead: a login, a payment, a download. Go to the site by typing its address, never through the link.

The fake customer

A new company places a large order, pays by a method that can be reversed, overpays by mistake and asks for the difference back. The website, the staff photos and the references were generated in an afternoon. Wait for cleared funds, and be wary of any refund to a different account from the one that paid.

Review blackmail

A message warns that a wave of one-star reviews is coming unless you pay. Do not pay. Report the reviews to the platform as fake, keep the message as evidence and report the threat. Posting or commissioning fake reviews has been banned in the UK since 6 April 2025 under the Digital Markets, Competition and Consumers Act.

The QR code that leads to a fake login

A sticker over the code on a parking machine, or a code in an email about a missed delivery, opens a copy of a payment page. On a phone the address bar is small and easy to ignore. Read it before you enter anything.

The fake AI tool

Adverts and app listings imitate well-known AI products and offer a free premium version. The download steals saved passwords. Install tools only from the maker's own site, and give staff an approved list. A password manager from our list of password and privacy tools limits the damage if one login is taken.

Three rules that stop most AI scams

1. Call back on a number you already have. Any request that involves money, bank details, passwords or codes gets a phone call to a number from your own records.
2. Two people for payments. Set an amount above which a second person must approve. For a sole trader, the second person can be a rule: wait one hour and re-read the request.
3. Changes are never accepted by message. New bank details, a new delivery address or a new contact are confirmed by voice.

Write the three rules on one page and give it to everyone who can pay an invoice, including the bookkeeper and family members who help out.

If you have already paid: the first hour

• Ring your bank at once, using the number on your card. Ask them to stop or recall the payment.
• Report it. In England, Wales and Northern Ireland use Report Fraud, the service that replaced Action Fraud in December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland call Police Scotland on 101.
• Ask about reimbursement. Since 7 October 2024 banks must reimburse victims of authorised push payment fraud sent by Faster Payments or CHAPS, up to £85,000. The rule covers individuals, charities and the smallest businesses, which the regulator calls microenterprises. You have 13 months to claim, and the bank should normally decide within five business days. Larger firms are not covered, which is one more reason for the two-person rule.
• Change passwords on email first, then banking, then everything else.
• Tell the real supplier or colleague so they can warn others.

In 2025 banks returned 61% of authorised push payment losses overall, so reporting quickly is worth it.

How an AI agent helps you defend

ChatGPT, Claude, Gemini, Microsoft Copilot, Manus and Meta's Muse will all explain a suspicious email if you paste the text with names removed. An agent can do the preparation for you.

• Writes your payment rules. One page, in your words, with your limits and your approvers.
• Builds a staff quiz. Ten realistic examples, half genuine and half fake, with the tells explained.
• Audits what is public. It lists where your voice, your staff names and your supplier names appear online, so you know what a criminal can copy.
• Checks supplier details. It compares bank details on new invoices with the ones on file and flags any change.
• Drafts the awkward emails. The note to customers after an incident, and the reply to a supplier asking them to confirm by phone.

On Jobbit the agent works with a network of vetted people as well, so a security professional can review what it produces. If you are new to these tools, start with 12 jobs an AI agent can do for your business.

Your plan for this week

• Today: agree the call back rule and a safe phrase with anyone who can move money.
• Tomorrow: phone your five biggest suppliers and confirm the bank details you hold.
• Day 3: set the two-person limit with your bank if it offers one.
• Day 4: send staff the one-page rules.
• Day 5: check that your invoices carry your details clearly, using our free invoice template, so customers can spot a forgery of yours.

Frequently asked questions

What is an AI scam?

It is an old fraud made more convincing with new tools: a cloned voice, a fake video call, a forged invoice or a perfectly written email. The aim is the same as before, to make you send money or hand over a login.

How do I spot a deepfake video call?

Do not rely on the picture. Judge the request. If someone asks for an urgent or secret payment on a call, end it and ring them back on a number you already hold.

Are small businesses really targeted by AI scams?

Yes. The Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in a year, and UK Finance reports that 68% of invoice scam losses in 2025 came from business accounts.

Can a business get its money back after a scam?

Sometimes. The mandatory reimbursement rule covers individuals, charities and microenterprises for payments by Faster Payments or CHAPS, up to £85,000, claimed within 13 months. Larger businesses depend on their bank's own decision and on insurance.

Where do I report fraud in the UK?

Tell your bank first. Then use Report Fraud at reportfraud.police.uk or 0300 123 2040 in England, Wales and Northern Ireland, or Police Scotland on 101.

Is it safe to use AI tools at work at all?

Yes, with a few settings and rules. Our guide to whether AI is safe to use covers your data and the settings to change.

How can AI help protect my business from AI scams?

By doing the preparation nobody has time for: the payment rules, the supplier check and the staff training. Ask an agent on Jobbit to draft all three, free with 100 credits a day and no card.