The Top 10 Business Scams in the Age of AI
The old scams did not disappear. They got better. Here are the payment requests, fake employees, hijacked accounts and impersonation schemes a small business is most likely to regret trusting.
The scammer can learn how your company works before asking for a dollar
The most important development is not deepfake video. It is the combination of stolen access, automation and AI-assisted reconnaissance.
Microsoft’s September 2026 disruption of the cybercrime service known as EvilTokens showed what that looks like. Once criminals gained access to an email account, the service could use AI to search the inbox for financial conversations, identify employees who moved money, locate vendor invoices, map trusted relationships and suggest who the criminal should impersonate.
Microsoft said the platform was linked within months to more than 12,000 compromised inboxes across more than 10,000 organizations.
10 scams every employee who touches money or data should recognize
CEO / Executive Payment Impersonation
The owner, CEO, CFO or president appears to ask an employee to send money, approve an ACH, buy something urgently or handle a confidential transaction.
Microsoft documented a 2026 campaign that impersonated company executives and attempted to push finance employees into ACH payments approaching $50,000. The campaign combined fake executive approval, a fabricated invoice and a manufactured forwarded conversation.
Vendor Invoice & Bank-Change Fraud
A real vendor appears to send a normal invoice but says its bank details have changed. In the best versions, the criminal may already know the vendor, typical invoice size and who normally approves payment.
The FTC issued another small-business warning in May 2026 specifically about fraudulent invoices. Microsoft separately documented AI-assisted vendor impersonation using professional-looking fabricated invoices.
Payroll Direct-Deposit Diversion
An employee supposedly emails HR asking to change the bank account for the next paycheck. Sometimes the employee mailbox itself has been compromised, making the message genuinely come from the correct account.
Microsoft observed a June 2026 automated BEC campaign that reached more than 67,000 users at over 42,000 organizations in less than three hours. One of its main lures impersonated CEOs or presidents to redirect payroll payments.
Fake IT Support & Help-Desk Calls
Someone claiming to be internal IT, Microsoft support or an outside technology vendor calls an employee and talks them through a “security fix,” password reset, remote-support session or authentication step.
Google’s Mandiant team reported that from January through May 2026, a financially motivated group targeted dozens of U.S. organizations in professional, legal and financial services using voice phishing. The callers posed as IT support and persuaded targets to launch screen-sharing sessions and install legitimate remote-management tools.
The Legitimate Login Page Trap
The employee is sent to what appears to be a legitimate Microsoft or cloud sign-in flow and is asked to enter a code or approve access. The page may actually be legitimate — but the employee is authorizing the criminal’s session.
Microsoft has documented device-code phishing and OAuth abuse that can give an attacker cloud access without simply stealing a traditional password. In one 2026 case, a document-sharing lure initiated a legitimate device-code sign-in process before attempted payroll fraud.
Fake ChatGPT / Copilot / Claude Tools
Employees looking for a new AI feature, desktop app, plug-in or account upgrade land on an imitation site, malicious advertisement or fake download.
Microsoft reported 2026 campaigns impersonating ChatGPT, Copilot, Claude and DeepSeek. One ChatGPT-themed campaign sent as many as 100,000 phishing emails in a single day. Other campaigns used fake AI installers to distribute credential-stealing malware.
The Employee Who Is Not Who He Says He Is
A remote applicant presents a polished résumé, professional photo, believable portfolio and strong interview performance — but the identity, location or background is false.
The FBI has warned U.S. companies that fraudulent remote IT workers have used stolen identities, AI-generated profile material, face-swapping technology and voice manipulation. The FBI’s 2025 report recorded almost $13 million in losses tied to AI-involved employment scams.
Government, Regulator & Utility Impersonation
A caller or message claims the company owes taxes, faces license suspension, missed a filing, has a utility shutoff pending or must respond immediately to a government investigation.
The FBI reported nearly 61,000 complaints and more than $1.6 billion in losses from law-enforcement or government impersonation schemes between January 2025 and July 2026. The FBI specifically noted that scammers are using AI to increase the apparent legitimacy of impersonation, including video calls.
Fake Customer & Overpayment Fraud
A new customer wants to place an attractive order, book a service or hire the company. Then a check arrives for too much money and the customer asks you to refund the difference, pay a third party or forward part of the funds.
The check may appear in the account before the bank ultimately determines it is fraudulent. The business sends real money out and later discovers the incoming money was never real.
Business Identity & Shipment Hijacking
A criminal impersonates a legitimate carrier, broker, supplier or customer and redirects a shipment, changes pickup details or takes over an established business account.
The FBI warned in June 2026 that estimated U.S. and Canadian cargo-theft losses reached nearly $725 million in 2025, up about 60%, while confirmed incidents rose 18%. Current schemes use phishing, compromised accounts, fake business identities and fraudulent load postings.
Business Email Compromise is still the monster in the room
| 2025 FBI IC3 category | Complaints | Adjusted losses |
|---|---|---|
| Business Email Compromise | 24,768 | $3.047 billion |
| Tech / Customer Support | 47,794 | $2.135 billion |
| Government Impersonation | 32,424 | $797.9 million |
| Employment | 24,688 | $362.9 million |
| Phishing / Spoofing | 191,561 | $215.8 million |
| Overpayment | 2,194 | $22.9 million |
| AI-related descriptor | 22,364 | $893.3 million |
The AI figure should not be read as “AI caused $893 million in fraud.” IC3 treats AI as a descriptor that can overlap other crime categories. It is better read as a visible slice of reported fraud in which complainants recognized an AI connection.
Training people to “spot the fake” is no longer enough
The old checklist — bad spelling, strange grammar, funny logo — still catches sloppy attempts. It should not be the core defense.
Weak controls
- “The email looked legitimate.”
- “It came from his account.”
- “The invoice looked normal.”
- “I recognized the voice.”
- “The login page was Microsoft.”
- “The applicant looked fine on video.”
Stronger controls
- Bank changes require independent callback.
- Payroll changes require authenticated verification.
- Unusual executive requests require a second channel.
- IT never requests remote access unexpectedly.
- Software comes only from approved sources.
- Remote hires pass independent identity checks.
You do not need enterprise security software to stop a surprising number of these
| Control | Stops or reduces |
|---|---|
| Independent callback for bank changes | Vendor fraud, fake invoices, executive payment fraud |
| Two-person approval for unusual payments | BEC, CEO fraud, large ACH/wire loss |
| Authenticated payroll-change process | Direct-deposit diversion |
| Company-controlled software installation | Fake AI apps, malware, remote-support scams |
| Identity verification for remote hires | Fake applicants, fraudulent remote workers |
| Employees allowed to stop unusual requests | Almost every social-engineering scam on this list |
Speed beats certainty
If a company discovers that money may have been redirected fraudulently, the FBI recommends contacting the financial institution immediately and requesting recall or recovery action. Do not wait for an internal investigation to establish every detail first.
First
- Call the bank or payment provider.
- Request recall / recovery action.
- Preserve emails, headers and payment records.
- Secure compromised accounts and revoke sessions.
Then
- Notify appropriate law enforcement / IC3.
- Check for inbox forwarding rules.
- Review other vendor and payroll changes.
- Determine what data the attacker could access.
How many of these doors are still open?
Check every statement that is true at your company today.
Check what applies
Your business scam exposure score will appear here.
This quick tool is a management screening exercise, not a security certification or guarantee against fraud.
