The badly spelled "Nigerian prince" email is dead. What's replaced it is phishing written by AI that reads like your actual suppliers, cloned voices that sound like your actual boss, and video calls with people who don't exist. RTÉ recently called it "an industrial revolution in fraud". Small businesses are right in the firing line, because criminals know you don't have a security team.
The five cons doing the rounds
1. The cloned-voice phone call. Thirty seconds of audio from a voicemail or social video is enough to clone a voice. The call sounds exactly like the boss: "I'm stuck in a meeting, I need you to pay this invoice now."
2. The perfect-English invoice switch. A supplier's email thread gets compromised, and mid-conversation a message arrives with the same tone and the same signature, saying the bank details have changed. AI copies the writing style well enough that nothing looks off.
3. The deepfake video call. Rarer, but no longer science fiction. A payment instruction on a video call is not verification.
4. The AI "customer" with an attachment. A plausible enquiry ("can you quote for this? spec attached") where the attachment is the payload. A machine writes it for your exact industry in seconds.
5. The fake-tool trap. Ads for "free AI tools" that are just malware in a trench coat. Staff download them at work, and the malware gets in with admin rights.
Three quick tests
The defence costs almost nothing
- A verification rule: any change of bank details or urgent payment request gets confirmed on a known phone number. Never by replying to the message, and never on the same call.
- A family/office password: a codeword no scammer can know, for any "it's me, I'm in trouble" call.
- MFA everywhere. It stops most credential theft even after someone falls for a phish.
- Report it: in Ireland, forward scam texts and report fraud attempts to your bank and FraudSMART.
AI made these scams cheap. A ten-minute chat with your staff about the verification rule is what makes them fail. I'd have it this week.
