AI Scams: How to Help Employees Verify Fraudulent Requests Before Sending Money or Sharing Access

AI gives familiar scams a better disguise

For years, businesses taught employees to watch for spelling mistakes, awkward wording, and messages that didn’t sound right. Those clues are still useful, but professional writing doesn’t prove a request is legitimate.

Microsoft’s Digital Defense Report, released October 1, describes attackers using AI to make social engineering more targeted and efficient. The FBI has also documented criminals using generated text, cloned voices, and fabricated video to make fraud more believable.

AI can improve impersonation. A compromised email account can provide real context, including existing conversations. Together (or separately), those tools can make a fraudulent request feel like ordinary business. Business email compromise can originate from a legitimate account, so checking the sender’s address won’t always resolve the question.

Your employees shouldn’t need to determine whether a message was written by AI before deciding how to handle it. They need a reliable procedure for requests that change where money goes or who gets access.

Would your team feel comfortable questioning you?

Imagine an employee receives an urgent payment request bearing your name. It sounds reasonable, and you’ve asked them to handle last-minute payments before.

Would they verify it… or worry that calling you would make them look difficult?

That’s a question every owner should consider. If your business rewards people for responding immediately, but treats verification as an inconvenience, employees receive conflicting instructions.

A written policy won’t carry much weight if the boss routinely bypasses it.

Tell your team that requests from you follow the same approval process as everyone else’s. Then support employees when they pause to check, including when the request turns out to be legitimate.

Give them language they can use without making an accusation:

“We verify changes to payment instructions using the contact information already in our records. I’ll complete that check before updating anything.”

That makes verification a normal part of doing the job. Employees shouldn’t have to decide whether they trust you enough to skip it.

Verify the change, even when the invoice is real

Let’s return to the supplier scenario. The vendor, invoice amount, and payment deadline could all be correct. The detail requiring verification is the new bank account.

An expected payment can still come with fraudulent instructions.

This is where “Does it look suspicious?” becomes a weak test. A more useful question is: “What is this request asking us to change?”

New vendor banking details, a different payroll account, or an exception to the usual payment process should trigger verification, no matter how familiar the message looks.

Use a trusted contact method that existed before the request arrived. We recommend confirming payment requests outside the email conversation, using a known phone number rather than one supplied in the message.

Be specific when you call: “We received new banking instructions for invoice 1842. Did your company authorize that change?”

If an incoming call sounds like someone you know, you can still end the call and contact them through an established number. Recognizing a voice shouldn’t replace verification.

Decide in advance what happens when the usual contact is unavailable. Keep the change pending until someone can confirm it.

Make the second approval count

A second approver helps only if they check something meaningful.

If two employees read the same convincing email and agree it looks legitimate, both can reach the same wrong conclusion.

Give each person a defined responsibility. One independently confirms the requested change and records how they verified it. The other checks that confirmation against the proposed payment details before approving the transaction.

For a small office, this can be a short, documented step. Include a backup for when the usual approver is away so a vacation or busy afternoon doesn’t become a reason to skip it.

Give your process technical backup

Email protection, multifactor authentication, and monitoring for unusual account activity help reduce opportunities for criminals. Pair those protections with clear approval procedures and regular staff training.

Your IT provider and the person responsible for payments should know how to respond together. Employees need a clear way to report a questionable request and someone with authority to hold the payment while it’s checked.

If money has already been sent to a suspected scammer, contact your financial institution and IT provider immediately, preserve the messages, and report the incident at IC3.gov.

Executive Takeaway: Ask this at your next staff meeting

“A regular supplier emails new bank details for an invoice we expected. What happens next?”

Walk through the actual steps.

• Who makes the call?
• Where does the phone number come from?
• Who approves the change?
• What happens if that person is out?

If the answer depends entirely on one careful employee remembering to check, give that person a process and a backup.

Scammers will keep improving the costume. Your team can still require verification before the money moves.

*P.S. —  Would your email protections and payment procedures hold up against a convincing impersonation?

BrownCOW Technology helps Cincinnati-area businesses strengthen cybersecurity and give employees clearer ways to handle suspicious requests. Schedule an IT Strategy Call to review where your business could use stronger protection.

Related Resources:

• Before You Delete That Employee’s Microsoft 365 Account…
• How to Use AI at Work Without Risking Company Data
  
• Hackers Aren’t Breaking In Anymore—They’re Logging In
• Cyberattacks in Cincinnati — and the Security Gaps They Exposed
• How Cincinnati SMBs Can Use AI Safely—and Actually See ROI
• RAM Price Surge and What It Means for Cincinnati IT Budgets
• Penetration Testing Services for Compliance, Regulation, and Cyber Insurance