AI-Powered Scams Are Outpacing Small Business Defences: How Australian SMEs Can Fight Back

Australians lost $2.18 billion to scams in 2025, up 7.8% on the year before, and the ACCC's latest Targeting Scams report points to AI as a driver of growing sophistication. For small businesses, the most dangerous change is not a new type of scam. It is that the old ones now arrive with flawless grammar, cloned voices and invoices that look exactly like the real thing.

The numbers worth knowing

• Payment redirection scams cost Australians $166.8 million in 2025, the second-largest loss category. These scams mainly target businesses.
• The average self-reported cost of a cybercrime incident for a small business is now $56,571, up 14% in a year, according to the Australian Signals Directorate's Annual Cyber Threat Report.
• Business email compromise, where a criminal impersonates a supplier or colleague to redirect a payment, remains one of the top three cybercrimes reported by Australian businesses.
• The ASD warns that criminals now use generative AI to produce fake voices, videos and targeted phishing emails "at a larger scale and at a faster rate".

What AI changed

Five years ago, most scam emails gave themselves away. Odd phrasing, broken English, a formatting mess. AI removed those tells. Three versions of the same trick are now doing the rounds:

The email that sounds like your supplier. A criminal gets into (or convincingly spoofs) a supplier's email account, watches how they write, then sends you a routine invoice with new bank details. AI drafts the message in the supplier's exact tone.

The call that sounds like your boss. Voice cloning needs only a short sample of someone speaking, easily lifted from a voicemail greeting or a video on social media. Staff have transferred money because a voice they trusted told them it was urgent.

The invoice that looks real. Same logo, same layout, same ABN. Only the BSB and account number are different. Nobody reads those closely.

Six defences you can set up this week

None of these cost much. Together they block the vast majority of attacks.

1. The callback rule. Any request to change bank details, from anyone, gets verified with a phone call to a number you already have on file. Never the number in the email or on the invoice. This one habit defeats most payment redirection scams outright.

2. Two sets of eyes on payments. Set a dollar threshold above which no single person can approve a transfer. Urgency plus a lone approver is exactly what these scams rely on.

3. Multi-factor authentication everywhere. Email, banking, accounting software. Most redirection scams start with a compromised inbox, and MFA is the cheapest way to keep criminals out of yours.

4. Treat urgency as the red flag. AI can fake a voice and a writing style. It cannot remove the scammer's need to rush you. "It has to happen today" is your cue to slow down.

5. Train the team. The person most likely to be targeted is whoever pays the bills, not you. Cyber Wardens offers free, plain-English training built for small businesses.

6. Report fast if it happens. Call your bank first; funds reported within hours can sometimes be recalled. Then report to Scamwatch and ReportCyber.

Where AI helps the defence

It is not all one-way traffic. Modern email filters use AI to catch impersonation attempts, and banks' fraud detection has improved measurably. But tools only narrow the gap. Process closes it, and the callback rule is the single best process there is. If you are weighing up which AI tools are safe to bring into your business in the first place, our guide to AI risks for Australian SMEs covers the other side of this coin, and our list of tasks you should never hand to AI includes payments for exactly this reason.

If you want a second pair of eyes on your setup, that is part of what we do. SMEC AI's 45-minute consultations are funded by the Australian Government and free for eligible SMEs, and scam-resilient payment processes come up in most of them. You can book a session here or read more about our AI risk and governance work.

Frequently asked questions

What is a payment redirection scam?

A criminal impersonates a supplier, employee or executive and asks for a legitimate payment to be sent to a new account. The invoice or request is real in every detail except the bank account. Australians lost $166.8 million to these scams in 2025.

How do I verify a suspicious invoice?

Call the supplier on a number you already have from previous dealings, not one printed on the invoice or included in the email. Confirm the BSB and account number verbally before paying.

Where do I report a scam in Australia?

Contact your bank immediately, then report to Scamwatch (scamwatch.gov.au) and ReportCyber (cyber.gov.au). Speed matters most with the bank, which may be able to recall recent transfers.

Does insurance cover scam losses?

Sometimes. Many cyber insurance policies exclude or cap losses from social engineering, which is what most AI-enabled scams are. Check your policy wording for "social engineering fraud" cover specifically, not just "cybercrime".