Artificial intelligence is making scams more convincing. A fake invoice, supplier message, voice call or payment request can now look and sound more like normal business communication, even when the request is controlled by a criminal.
For Australian small and medium businesses, the safest response is not to distrust every technology tool. It is to make payment verification a clear process that does not rely on one email, one phone number or one familiar-looking voice.
Why AI changes the scam risk
ASD guidance warns that AI can help criminals create convincing phishing emails, fake invoices, impersonation messages, fake images and cloned voices. This makes visual polish and a familiar writing style weaker evidence than they used to be.
A practical verify-before-pay checklist
- Pause unusual requests. Treat new bank details, urgent payments, secrecy requests and changes to normal approval steps as high risk.
- Use a trusted callback. Call the supplier or manager using a number already held in your records, not the number in the message.
- Separate duties. The person who receives or enters an invoice should not be the only person who approves payment.
- Check the source system. Compare the request with the supplier record, purchase order, contract and recent account history.
- Protect AI inputs. Do not paste confidential invoices, customer records, passwords or financial details into public AI tools.
- Record exceptions. Keep a short note of who verified the request, how they verified it and what changed.
Start with one payment workflow
Choose a common payment process and write down its trusted contacts, approval limits, callback method and escalation path. Train staff to stop when a request feels urgent or unusual. A short pause is cheaper than recovering from a fraudulent transfer.
Sources
- ASD ACSC: Using AI securely in your business
- ASD ACSC: Small business cyber security handbook
- ASD ACSC: Cyber Health Check Tool
Leave a comment