What has changed
Traditional scam emails were often easy to spot: odd grammar, generic greetings, strange formatting. AI writing tools have removed most of those clues. A scammer can now produce a message in fluent New Zealand English that copies the tone of a real supplier's previous emails, references a real project and arrives at a believable moment, such as the end of the month.
Voice and video have changed too. Software can imitate a person's voice from a short sample taken from a social media video, a podcast or a voicemail greeting. Video deepfakes are less common against small businesses but have been reported overseas, including a widely reported case where an employee was persuaded to transfer large sums after a video call in which the other participants were fakes.
How the scams usually play out
A typical attack on a small business combines methods. An email that appears to come from a regular supplier says their bank account has changed and attaches an invoice that looks exactly right. Or the accounts person receives a call that sounds like the owner, who is travelling, asking for an urgent payment to secure a deal and saying they cannot talk long. A follow-up email provides the bank details. Some attacks start with a real compromised mailbox, so the email genuinely comes from the supplier's account. Others use a lookalike domain differing by one letter. Either way, the scammer relies on urgency, authority and the reluctance of staff to question someone senior or delay a payment.
The rule that stops most of them
Agree in writing that no change to bank details, and no unusual or urgent payment, is made on the strength of an email, text, voice call or video call alone. Every such request is checked by calling the person or company on a number already on file, not one supplied in the message. For internal requests from managers, the same applies: a quick call back to their known mobile, or a word in person.
Make it clear that senior people expect and welcome this check, and that nobody will be in trouble for delaying a payment to verify it. Scammers rely on staff feeling they cannot question the boss. Removing that pressure in advance is the most effective control you have. Put the rule in writing, repeat it at team meetings and have the owner say it out loud, so it becomes part of how the business works.
Extra checks that help
Use a code word or verification question for urgent requests between owners and finance staff, known only to them and never written in email. Require two people to approve new payees or changed bank details in your banking platform, where it offers dual authorisation. Ask your bank about payee name checking, which NZ banks have been introducing to compare the account name with the account number, and take any reported mismatch seriously. Reduce the raw material available to attackers too. Think about how much voice and video of senior staff is public, and keep voicemail greetings generic. Limit what out-of-office replies reveal about who is away and who to contact for payments.
Train for the new style of scam
Staff training based on spotting spelling mistakes is now out of date. Focus instead on the situation: an unexpected request involving money, data or credentials, urgency, secrecy, and a reason the normal process cannot be followed. Those signs remain even when the message itself is flawless. Run a short practical session every six months, using realistic examples relevant to your business, and include voice scenarios. Make reporting easy, so a staff member who receives a suspicious call can tell someone quickly without embarrassment.
If you have already paid
Contact your bank immediately, as quickly recovering or freezing funds is sometimes possible if they act early. Report the incident to the National Cyber Security Centre and the police, and secure any email accounts that might have been compromised by resetting passwords and checking for forwarding rules. If personal information may have been exposed, consider your obligations under the Privacy Act 2020. Then review how the request got through and tighten the process rather than blaming the individual.
Tell the supplier or person who was impersonated as well. If their mailbox was compromised, other customers may be receiving the same fake invoices, and they need to secure their systems. Keep a written timeline of what happened, which helps your bank, the police and any insurer, and makes the follow-up review far easier.
In short
- AI has removed the spelling and grammar clues that used to reveal scams.
- Voices and video can be faked from short public clips.
- Verify every bank change or unusual payment by calling a known number.
- Use dual approval, payee name checks and code words for urgent requests.