Not what you heard. Not what you saw.

For years, we’ve told Michigan small business owners to watch out for the obvious signs of a scam: bad spelling, weird formatting, or suspicious sender addresses.

Unfortunately, those telltale signs are disappearing. With the rise of artificial intelligence, cybercriminals can now craft perfect emails, clone voices from social media videos in under three seconds, and target small businesses with frightening precision. Scammers know small businesses usually don’t have entire IT departments watching their back, making them prime targets.

What’s happening? AI has given scammers a massive upgrade:

Voice cloning: If you have videos on Instagram, Facebook, or TikTok, a scammer only needs three seconds of your audio to copy your voice. They then call an employee pretending to be you, asking them to urgently wire funds or buy gift cards.This isn’t sci-fi, it’s happening now. In one well-documented case, scammers cloned the voice, accent, and speech cadence of a CEO to trick an employee into wiring over $200,000 to a fake supplier. Security experts at the FTC warn that scammers only need a few seconds of public audio from a TikTok, podcast, or voicemail greeting to build a convincing replica of your voice.
Hyper-personalized emails: AI reads your website, LinkedIn, and local news to write emails that mention real projects, real staff members, and real vendors. The typos are gone, and the tone sounds completely natural.

What you can do: You don’t need an expensive IT setup to protect your business. Simple, smart habits can prevent this from happening to your business.

Set up a phrase only your team knows: Create a secret company “safe word.” If someone calls asking for an urgent transfer or bank change, even if it sounds exactly like the boss, the employee must ask for the safe word first.
Hang up and call back: Received an urgent request to update vendor banking details? Don’t hit reply or use the number in the email. Hang up and call your primary contact at a number you already have saved. Do not call back the number that just called you.
Require two sets of eyes: Establish a rule that any payout or transfer over a certain amount (like $500 or $1,000) requires sign-off from two separate people.
Two-channel verification: If you get an urgent email, verify it via text or Slack. If you get a text, verify it via phone.
Audit Public Media: Review what audio and video of leadership is accessible online. Ensure finance staff know that public audio can be cloned and weaponized.

To safeguard your business, stop training your employees to spot fake messages. Start training them to verify every financial request.

Need help securing your business? Cybersecurity doesn’t have to break the bank or take over your workday. Connect with a Michigan SBDC business consultant or check out our Cyber Security resources for no-cost security guides and webinars.

Lizz Hellinga
Assistant State Director, Technology, Strategy & Operations
Michigan SBDC Leadership Team

Funded in part through a Cooperative Agreement with the U.S. Small Business Administration. All opinions, conclusions and/or recommendations expressed herein are those of the author and do not necessarily reflect the views of the SBA.