AI-Powered Scams: How Small Businesses Can Verify Urgent Payment Requests
A message from a manager asks for an urgent transfer. A supplier sends new bank details. A familiar voice calls with an unusual request. These situations have always required care; AI tools can make fake messages and voices more convincing. The practical response is not to guess whether something sounds real. Build a simple verification routine that works even when a message feels urgent.
Requests that deserve a second check
Pause when a request involves an unexpected payment, a last-minute change to supplier account details, gift cards or airtime, a password reset, or a request to share a one-time code. Be especially careful when the sender insists on secrecy, bypassing normal approval, or acting immediately.
A familiar name, profile photo, writing style, or voice is not proof of identity. Treat the payment instructions as unverified until you confirm them through a channel you already trust.
Use a known number, not the number in the message
Call the person or supplier using a number saved in your records or obtained from a trusted source. Do not use a callback number supplied in the suspicious message. For a bank-detail change, speak to an existing contact at the supplier and confirm the account name and details before updating your records.
If the request came by voice note or phone call, end the call and call back on the known number. A second channel, such as an already established business email or an in-person confirmation, can provide another check.
Make payment approval a process
- Require a second approver for payments above a limit your business chooses.
- Separate the person who creates a supplier or changes bank details from the person who approves the change.
- Record who verified the request, when they did it, and which known contact they used.
- Never approve a payment solely because a message claims to come from the owner or a senior manager.
These controls can be lightweight. A small team can agree on one verification number, a payment threshold, and a clear rule that supplier banking changes always need a callback.
Protect accounts and devices
Use unique passwords and enable multi-factor authentication on email, banking, and business software. Never share a one-time code with someone who calls or messages you. Limit staff access to the systems and payment functions each person needs, and keep devices and software updated.
For business email, ask your IT provider or hosting company to configure SPF, DKIM, and DMARC for your domain. These settings help receiving mail systems identify messages that are not authorized to send as your business; they complement, but do not replace, staff verification and payment controls.
If a suspicious payment has already been sent
Contact your bank immediately and ask whether the transfer can be stopped or recalled. Notify the affected supplier or account owner using a trusted contact method. Change credentials if an account may be compromised, preserve emails and message details, and alert your IT support provider. Keep a record of what happened and follow your bank's and relevant authorities' reporting instructions.
A simple rule to share with your team
Urgency is a reason to verify, not a reason to skip verification. Agree on a known callback process before the next unusual request arrives, and make sure every employee knows that asking for confirmation is expected.
Good security is a set of workable habits, not one expensive product. Mbayom IT-Point can help review business email, user access, backups, and payment workflows to identify practical next steps.