Scams are more sophisticated than ever. AI has raised the stakes by giving cybercriminals tools to generate logos, imitate human voices, and craft genuine-looking emails. But while the quality has improved, the basics of how to spot a scam haven’t changed. By knowing the telltale signs of a scam, small businesses can protect themselves against AI-powered scams.
How AI has changed cyber scams
AI has helped cybercriminals refine how they trick businesses and people. Before, they would spear-phish a target by gathering information themselves and writing messages designed to trick victims into revealing private information — a strategy called “social engineering”. Now? Cybercriminals can use AI to scrape a victim’s social media and create messages tailored to the target, at a larger scale and faster.
What AI hasn’t changed
AI has improved the quality of scams, but the tactics are still functionally the same. Scammers tend to trick their victims in four key ways:
- Creating a sense of urgency
- Using names, numbers, and links that almost look real
- Proposing alternative payment methods
- Locking the channel so you can only communicate one way
Most scams get sent en masse to hundreds, if not thousands, of potential victims, so you can foil most by taking a moment to verify details, such as calling your bank yourself or comparing website URLs. So before acting on a time-sensitive request that you received out of the blue, ask yourself, “Would a legitimate person or business ever ask me these things?”
Scam examples: Marty’s Cafe
Marty owns a cafe and has recently been targeted by cyber scams — some against his staff, and some against him personally. Let’s identify the red flags that reveal the scams.
Using our widget example is easy; click through each scenario and find the red flags. Cycle between examples to see the difference between each scam and the tactics that never change.
Marty's coffee supplier emails asking him to update their payment details before his next order is due.
Hi Marty, just a heads up, we've updated our banking details. Please use the new account below for your next payment, due this Friday. We're finalising this ahead of your next order, so please update as soon as possible to avoid delay.
New BSB: 063-000
New Account: 1122 3344
Let us know once it's updated, no need to call, just reply to this email.
Sarah, Accounts Team
Reply-to: s.accounts@wbc-payments.co
Marty's coffee supplier emails asking him to update their payment details before his next order is due.
Hi Marty, just a heads up, we've updated our banking details. Please use the new account below for your next payment, due this Friday. We're finalising this ahead of your next order, so please update as soon as possible to avoid delay.
New BSB: 063-000
New Account: 1122 3344
Let us know once it's updated, no need to call, just reply to this email.
Sarah, Accounts Team
Reply-to: s.accounts@wbc-payments.co
Since July 2026, any business or government agency sending SMS under a branded name has had to register that sender ID with the ACMA. An unregistered sender now shows as "Unverified" instead of a name, which makes this one of the easiest tells to catch once you know to check for it.
A refund of $874.60 is ready for processing. Confirm your details within 24hrs to receive payment: bit.ly/ato-refund2026. Failure to respond will cancel your refund. A small verification fee of $2.99 applies.
This one doesn't land with Marty. It lands with his staff, and asks them to act fast before anyone thinks to check.
All three scams had classic red flags, such as pushing you to act quickly. Also, it’s worth noting the new SMS rules for businesses. If a company or organisation hasn’t registered with its telco, any messages it sends to customers will be labelled as an “unverified user”.
How to protect yourself from scams
Every scam essentially uses the same four tactics, no matter the style: creating urgency, imitating real things, pushing payments, and controlling how you communicate. If you see any of these red flags in a message, verify. Check your phone contacts or the official website, never the number or link the message gave you. A quick call to the official number should reveal a scam before it’s too late.
