When AI makes business scams harder to spotIn partnership withHere’s how Australian businesses can recognise the warning signs and protect themselves.Staff writerFor Australian businesses asking, “How can I protect my business from AI scams?”, the answer is increasingly less about knowing how to spot artificial intelligence and more about changing how identity and trust are verified.A polished email, familiar voice, convincing website or professional-looking profile can no longer be taken as proof someone is who they claim to be. Westpac head of fraud prevention Ben Young said generative AI can produce personalised messages, highly convincing phishing emails, and voice deepfakes, making scams faster to create and harder to distinguish from legitimate communication.“The scale of it is so much greater,” he said. “I don’t think there are more dishonest people in the world, but the small number of dishonest people have such greater reach now.”It means businesses can no longer rely on how convincing something looks or sounds when deciding whether to trust it. For Mr Young, assuming you will always recognise a scam is a risk in itself.“You’d be wildly overconfident if you think it’s impossible for you to fall for a scam these days.”Westpac head of fraud prevention Ben Young says AI is making impersonation scams increasingly sophisticated.Why small and medium businesses are attractive targetsSmall businesses can be particularly exposed because they often run on speed, trust and thin margins for error, with owners and staff juggling customers, suppliers, invoices and administration. Scammers exploit this pressure with urgent emails, familiar-looking invoices and messages appearing to come from trusted organisations – a risk Mr Young said businesses should not underestimate. “You’d be wildly overconfident if you think it’s impossible for you to fall for a scam these days,” he said. In 2025, small businesses made 2,228 reports to Scamwatch, with 287 involving financial losses totalling $9.5 million.Scams are increasingly sophisticatedBusiness email compromise, phishing, payment redirection, fake invoices and impersonation remain among the most significant threats. AI does not necessarily create an entirely new category of crime – it makes established scams more convincing and easier for scammers to execute.Maddy Avery, founder of Birdcage Group, received an invitation through Apple’s TestFlight platform for what appeared to be a ChatGPT–Meta advertising integration. “Everything followed the legitimate pathways you would normally expect,” she said. She downloaded the app to her computer and phone and entered her Meta credentials. Nothing much happened. The next day, however, a client alerted her to thousands of dollars in unexpected advertising spend. Ms Avery discovered she had lost access to parts of her Meta Business account, and whoever had gained access was connecting other Facebook pages to advertising accounts linked to her business and clients.“They hooked up their Facebook pages to my clients’ and my ad accounts, which had credit cards connected, and they started spending thousands of dollars on scam ads designed to draw in more victims,” she said.Her own credit card was charged about $8000. Ms Avery said one client had about $6000 taken, another about $12,000, while several smaller clients were charged hundreds of dollars.“I started noticing signs that recordings may have been happening on my phone, so I had to go through everything with a cybersecurity specialist,” she said. “In the end, I changed all my passwords, replaced my bank cards and bought a new phone because I just didn’t feel confident it was safe anymore.”The immediate financial hit was only part of it.Campaigns were disrupted while accounts were restricted, some assets and years of associated data were lost, and one client ended its relationship with Ms Avery’s agency.“We’re still dealing with the fallout. There are assets in Meta we still can’t access, we’ve lost years of data, and my accounting team is still trying to reconcile charges because changing all the cards and accounts created this huge flow-on effect.”The experience has also changed how Ms Avery approaches app development and security. She has since undertaken extensive re-education on app testing, submission processes, and the risks associated with third-party access. What unsettled Ms Avery most was how ordinary the beginning of the scam felt.“As someone who has worked in this space for 20 years, now, there are times where I really do have to question if something is legitimate or not,” she said. “Whereas before, I would have known instantly.”When a legitimate-looking business is not legitimateThe problem extends beyond emails and telephone calls.Melbourne entrepreneur Svetlana Foox lost about $20,000 after hiring developers to build a beauty-service membership platform.“They appeared legitimate partly because they were on such a well-known platform,” Ms Foox said.Ms Foox had businesses ready to join her platform, so, keen to meet her launch deadline, paid the cost upfront.“I was completely ghosted,” she said.VainishPerks founder Sveta Foox lost thousands after engaging developers she believed were legitimate.Months later, Ms Foox discovered her Shopify store had been shut down because the developers had used a pirated theme – an unauthorised copy of a website template used without a valid licence.She had also been unable to arrange a video meeting with the people completing the work.“Looking back, that was a huge red flag.”How can businesses protect themselves from AI scams?The strongest defence is increasingly procedural.Mr Young said technology will continue to make the deception more sophisticated, but the fundamental defence remains straightforward.“The good news is the best defence hasn’t changed. Pause before you pay and verify who you’re dealing with.”Any unexpected request involving money, account access or changes to supplier details should be independently verified through a channel already known to the business. New payees and significant transfers can require a second approval. Access to financial, email and advertising systems should be limited to employees who need it and protected with multi-factor authentication. Urgent requests should be treated as potential deepfake or phishing attempts.Businesses can also strengthen their defences against email impersonation by using established authentication measures. The Australian Signals Directorate recommends controls including Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC), which work together to help organisations verify legitimate senders and identify messages that fail authentication checks.But technology cannot remove the human component.“Companies also need employees to feel comfortable questioning something apparently sent by a chief executive, finance director, bank or important supplier. A verification process is of little value if workplace culture makes people reluctant to use it,” Mr Young said.For finance teams in particular, pause, verify, confirm is becoming an increasingly useful operating principle: stop when something changes, verify through an independent channel and confirm before releasing money or sensitive information.Lastly, limit who – and what – has accessAs businesses race to adopt AI tools, the security question is no longer simply whether the technology itself can be trusted. It’s also who has access to it, what information they can feed into it and how much visibility a business has over the third parties building and managing its digital systems.The Australian government’s Cyber Security Centre warns AI tools may require access to sensitive customer, employee or financial information, creating the potential for data leaks and privacy breaches if those systems are poorly governed. It recommends identifying and securing sensitive information, defining what data staff are permitted to upload to AI platforms and restricting system access according to employees’ roles. The ACSC identifies third-party and supply-chain vulnerabilities as a particular risk as businesses increasingly rely on cloud-based AI services. Australian businesses are being encouraged to strengthen verification processes as impersonation scams become more sophisticated.Ms Avery said businesses are rapidly adopting tools they may not fully understand, and this could leave them vulnerable to cyber attacks and scammers.She points to the rise of “vibe coding” – a term used to describe building websites, apps or software largely by prompting AI to generate code, sometimes without the person creating it having deep programming expertise or fully understanding the security implications.“AI is probably helping the scammers work faster and (become) more sophisticated,” she said. “But where I see the bigger problem is unqualified people undertaking services for businesses without understanding the repercussions.”Access to websites, customer databases, advertising accounts, and other critical systems should be limited to those who require it, and businesses should understand what permissions external contractors have and revoke them when they are no longer needed.“My biggest advice is to make sure that whoever is working with you on your digital infrastructure knows what they’re doing,” Ms Avery said. “Be really wary of who’s helping you with your online work, and (make sure) it is all secure.”Five ways to protect a business from AI scamsVerify changes independently. Confirm new bank details, payment instructions and unusual requests using contact information already held by the business.Use dual approval. Require another authorised person to approve new payees and significant transfers.Implement ongoing training. Educate staff on recognising sophisticated phishing attempts and deepfake risks. Treat identity and instructions separately. A message may appear to come from someone you know while the request itself is unusual. Verify the request, not simply the name attached to it.Make questioning part of the culture. Employees should know delaying a transaction to verify it is good risk management, not an inconvenience.Act quickly if something goes wrong. The very first thing you should do is contact your bank immediately. Every second counts.As technology evolves, so too do the scammers. Westpac is urging Australians to stop, check and protect to stay safe from scammers. To find out more about the latest scams and how to stay safe, visit Westpac Security Hub.