AI Invoice Fraud: How Small Businesses Can Stop Fake Payment Requests
Fake bank-change emails and cloned voices are hitting small businesses. Five simple payment rules that stop most invoice fraud.
Many small-business losses don't start with a hacker breaking in. They start with a convincing email, call or video asking someone to pay an invoice or change where payments go. AI makes those requests sound more real: a cloned voice of the owner, or an email that reads exactly like a vendor's. The FBI warned in December 2024 that criminals use AI to make fraud more believable and to impersonate people their victims know.
The three requests to watch for
- "Our bank details changed." A vendor asks you to send future payments to a new account.
- "Pay this today, I'll explain later." The boss, by email, text or a call that sounds right, asks for an urgent payment or gift cards.
- "Can you send me the payroll file?" A request for employee or customer data from someone who seems to be inside the company.
Five rules that stop most of it
- Verify bank changes by phone, using a number you already have on file. Never use the number in the email asking for the change.
- Two people approve any new payee or bank change. Even in a three-person business.
- A rush is a reason to slow down. Make "I'll call you back to confirm" normal for every money request.
- No payments by gift card. Ever. Tell your team this in writing.
- Turn on two-step login for email, banking and your bookkeeping software. Most invoice scams start from a taken-over email account.
Give your team a code phrase
The same idea as a family safe word works at work. Agree on a phrase that must come with any unusual payment request made by phone or video. If the caller can't give it, hang up and call back on a known number.
If a payment already went out
Call your bank immediately and ask them to recall the transfer. Then report it at ic3.gov. Acting quickly makes it more likely the money can be stopped.
The AI Scam Shield has a Small-Business Add-On with invoice-fraud and bookkeeper checks, payment approval rules and team login setup.
Sources: FBI Internet Crime Complaint Center, Alert I-120324-PSA (December 3, 2024).