How AI is making scams harder to spot for small businesses

Scam emails used to give themselves away. The spelling was off, the tone was wrong, and the request made little sense for your business. AI has removed most of those signs. A scammer can now write an email that reads like your supplier, your client or your boss, and send thousands of them in an afternoon.

Each one that works is expensive. In its Annual Cyber Threat Report 2025–26, the Australian Signals Directorate put the average cost of a cybercrime reported by a small business at $55,400. For a medium business the figure was $141,300, up 45% on the year before.

What AI has changed

Phishing emails now arrive with perfect spelling and a tone that matches the person they claim to come from. Fake invoices and “our bank details have changed” requests are written to fit the real relationship between two businesses. Voices can be cloned from a short recording: in 2024 a scammer used a fake of then Queensland Premier Steven Miles’s voice to push a Bitcoin investment.

The people behind these attacks have changed as well. We call them vibercriminals. They have no coding or hacking skills, and they let an AI tool build the attack and handle the logistics.

The pace has picked up too. In October 2026 an attacker working with AI tools took control of 25 Palo Alto Networks firewalls in the United States and Asia by chaining together newly found software flaws. AI tools help attackers turn a new flaw into a working attack quickly, so updates need to go on as soon as the vendor releases them.

The story of Little Red

Little Red Bookkeeping is a fictional firm in regional Queensland, but the scam in this story happens to real businesses. Jenny owns the firm, and Shaun runs the pay runs for its sixty clients. One of those clients is Henderson Building, with a crew of eighteen.

Easy, the scammer, cannot write code. He has a laptop, a coffee and an AI tool he found on the internet. The AI checks the email security of every bookkeeper in Queensland it can find and picks out the ones where anyone could send email using the firm’s domain. Little Red is one of them. The AI then reads Little Red’s website and social media, works out who pays the wages and who signs off, and writes an email from Jenny to Shaun. It writes a thousand more for other targets the same morning.

One morning Shaun receives an email from Jenny’s address: Henderson Building has a new bank account and the pay run has to go today. Shaun updates the details and approves $38,400, and within minutes the money is gone. Little Red finds out when Henderson calls to say the crew has not been paid, and loses both the money and the client.

Why the email looked real

Easy never broke into Little Red’s email. The message showed Jenny’s real address because Little Red’s domain was missing the settings that let other mail servers check whether an email really came from Little Red.

Three records in your domain’s public settings do that job. SPF lists the mail servers allowed to send on your behalf. DKIM adds a tamper-evident seal to each message. DMARC tells receiving mail servers what to do with an email that fails those checks. If DMARC is missing or only set to monitor, a scammer can send email as your business and it will often land in the inbox.

The gap is common. In November 2026, 70% of the 43,000 Australian domains tracked by DmarcDkim.com had no effective protection against this kind of email spoofing.

What to do this week

Check your email domain protection. Ask your IT provider, or use the free scan below, to make sure the right protections are in place. The change costs little and closes the gap Easy used against Little Red.

Verify changes to bank details. Any request to change bank details gets a phone call on a number you already have on file before any money moves. Shaun’s approval would have stopped at that call.

Train your team to spot scams. Regular cyber security awareness training teaches staff the pattern behind these scams: a new bank account, a payment that has to go today and a manager who cannot be reached. Make sure whoever handles payments in your business has done it recently.

The rest of the basics

Email protection and a call-back rule stop this scam. The rest of the basics, from multi-factor authentication and a password manager to tested backups and a printed incident plan, stop most of the other attacks, and most of them cost little or nothing. How many can you tick today?

Check your domain for free

Cyber People will check your domain’s email records for free. You send us your business email domain, we read its public records within five business days, and we go through the results with you on a 15-minute Teams call. You get an A to F grade, the current setting of each record, and the changes to make first, written so your IT provider can act on them. The scan only reads public records. We do not access your systems or send any email.

Sources: Australian Signals Directorate, Annual Cyber Threat Report 2025–26 (October 2026); DmarcDkim.com, DMARC Adoption in Australia (November 2026); Cybersecurity Dive, Palo Alto Networks firewalls compromised in chained attacks (23 October 2026); news.com.au reporting on the Steven Miles voice scam (2024).