Hey there,
This one isn’t a productivity tip — it’s a warning I’d want a friend to give me. The same AI that helps you write emails and answer calls is now being used against small businesses, and it’s frighteningly good.
Scammers can clone a voice from a few seconds of audio, fake a video call, and send phishing messages that use your real name, your vendor’s name, and details pulled from your website. Small businesses are targeted on purpose — criminals know most owners don’t have a fraud department. The scams that used to be easy to spot (“Dear customer, kindly wire funds”) now sound exactly like your bookkeeper, your bank, or you. Here’s how to protect yourself and your team without becoming paranoid.
THE THREE SCAMS HITTING SMALL BUSINESSES NOW
The voice-clone emergency. You get a call — it sounds like your business partner, a family member, or a vendor — urgently needing money or a password “right now.” The voice is fake, generated from a clip scraped off social media.
The hyper-personalized phishing email. It knows your name, your company, maybe a real invoice number. It asks you to click a link, “update payment details,” or approve a transfer. It looks legitimate because AI wrote it using real details about you.
The fake job candidate (or fake employer). Deepfaked video interviews are now a thing on both sides — fake applicants using cloned faces to get hired, and fake “recruiters” tricking your job-seekers into handing over data.
THE ONE HABIT THAT STOPS MOST OF THEM
Verify on a second channel. This is the whole game. If a call, text, or email asks for money, credentials, or sensitive data — stop and confirm through a different, known channel. Got an urgent voice call from your “vendor”? Hang up and call the number you already have on file. Got an email from your “bank”? Don’t click — log in the way you normally do, or call the number on your card.
A voice or a video is no longer proof of who someone is. A second channel is. Say it to your team until it’s a reflex.
BUILD A FEW SIMPLE DEFENSES
Set a money rule. Any payment change, wire, or new vendor bank detail requires a verbal confirmation on a known number — no exceptions, no matter how urgent it “feels.” Urgency is the scammer’s favorite weapon.
Turn on phishing-resistant login. Use multi-factor authentication everywhere, and where you can, upgrade to passkeys or security keys. They’re designed to defeat exactly these fake-login attacks.
Train your team in ten minutes. Walk them through the three scams above and the “verify on a second channel” rule. Your newest employee is the target — make sure they know they’ll never be in trouble for pausing to verify.
USE AI TO HELP YOU PREPARE
Ask AI to build your defenses: “Write a simple, one-page fraud-prevention checklist for my small business and a short script my team can use to politely verify any unusual money or data request. Keep it plain and non-technical.”
THE GUARDRAILS
Slow down when you feel rushed. Every one of these scams relies on panic and urgency. “Let me call you right back on your usual number” defeats almost all of them.
Never approve money or share credentials off a single voice, text, or email. Ever. Make that your unbreakable rule.
Don’t be embarrassed to verify. Real vendors and real banks expect it. Anyone who pressures you not to check is the scam.
YOUR ACTION PLAN THIS WEEK
Set one money rule today: no payment or banking change without a callback to a known number. Then take ten minutes to walk your team through the three scams and the second-channel habit. That single conversation can save you from a five-figure mistake.
This is the kind of email that genuinely protects people. Please forward it to another owner — especially anyone whose team handles invoices or payments. You might save them from a very bad day.
Talk soon,
Dave
The AI Playbook
