When Scammers Use AI: Why Verification Matters More Than Ever
How small businesses and nonprofits can protect themselves from increasingly convincing scams without having to become experts in artificial intelligence.
Imagine receiving a phone call from your executive director asking you to make an urgent payment. You recognize the person's voice. The request sounds reasonable. The caller even mentions a project your organization is currently working on.
Would you authorize the payment? What if the voice wasn't actually your executive director's?
Artificial intelligence (AI) is making it easier for cybercriminals to impersonate people we know and trust. Scammers can now generate realistic voices, create convincing videos, and write professional-looking messages designed to deceive their victims.
For small businesses and nonprofits, these developments present an important challenge.
But here's the good news: You don't have to become an expert at recognizing AI-generated content to protect your organization.
Instead, you can establish straightforward verification procedures that help protect your organization regardless of how convincing a scam may appear.
AI Is Making Familiar Scams More Convincing
Cybercriminals have impersonated business owners, executives, vendors, and other trusted individuals for decades.
One common technique is known as business email compromise (BEC). In these scams, criminals impersonate someone with authority or an established business relationship to trick an employee into transferring money or revealing sensitive information. Artificial intelligence has introduced new capabilities that can make these traditional scams more convincing.
For example, criminals may use AI to:
Write professional, personalized emails without the spelling and grammatical mistakes often associated with phishing.
Generate realistic voices that sound like executives, managers, pastors, or other trusted individuals.
Create deceptive videos that appear to show a real person making a request.
Analyze stolen business correspondence to identify financial transactions, business relationships, and potential targets.
Produce convincing invoices, payment instructions, and other fraudulent documents.
These capabilities are no longer simply theoretical. According to the FBI's 2025 Internet Crime Report, complaints referencing artificial intelligence were associated with approximately $893 million in reported losses across various types of fraud. These figures are not limited to small businesses or nonprofits, and not every reported use of AI was independently verified. Nevertheless, they demonstrate the growing importance of AI in financial fraud.
The lesson is not that every suspicious message is AI-generated. Rather, it is that familiar signs of authenticity can no longer be relied upon as proof that a request is legitimate.
A Real-World Example: AI Analyzing Business Emails
In September 2026, Microsoft disclosed an investigation involving a cybercriminal operation known as EvilTokens. The operation provided criminals with tools that could analyze compromised email accounts and help identify opportunities for financial fraud.
Instead of manually reviewing hundreds of messages, criminals could use AI to identify important contacts, financial conversations, invoices, and potential payment opportunities.
Consider what this might mean for a small organization. A criminal gains unauthorized access to an employee's email account. By examining existing correspondence, the criminal discovers that the organization is expecting an invoice from a familiar vendor.
The criminal then sends a message requesting that payment be directed to a different bank account. Because the request refers to a real vendor and an actual transaction, the recipient may have little reason to become suspicious.
The fraudulent message may contain accurate information. That does not make the request legitimate.
This example illustrates why organizations should avoid relying solely on an email's appearance, accuracy, or familiarity when making financial decisions.
Source: Microsoft, "Disrupting EvilTokens: The AI Chatbot Built for Cybercrime," September 22, 2026.
A Familiar Voice Is No Longer Proof of Identity
Imagine a church treasurer receiving a phone call that sounds exactly like the senior pastor. The caller explains that a family in the congregation is experiencing an emergency and urgently needs financial assistance. The request seems consistent with the church's mission. The voice sounds familiar, and the situation feels urgent. But the caller could be a criminal using AI-generated audio.
Voice cloning technology can produce synthetic speech resembling a particular individual. Publicly available recordings, such as interviews, speeches, and online videos, may provide material that criminals can exploit.
For churches and other nonprofit organizations, this is a particularly relevant concern. Many religious leaders regularly publish sermons, livestream services, and share messages on social media. Those activities are valuable forms of outreach, but publicly available information can also be misused by scammers.
In January 2026, WIRED reported on criminals using AI-generated impersonations of religious leaders in deceptive online content and donation-related schemes.
The appropriate response is not to stop publishing sermons, remove every video, or become suspicious of every telephone call. Instead, organizations should establish clear rules for verifying unusual financial requests.
Even if a request appears to come from someone you trust, verify it before acting.
Stop Trying to Guess Whether Something Is AI-Generated
Much of the public discussion about AI scams focuses on teaching people to recognize synthetic content. You may have seen advice suggesting that AI-generated videos can be identified through unnatural blinking, unusual facial movements, or inconsistencies between speech and lip movements. These clues may sometimes reveal manipulated content, but they're not dependable security controls.
AI-generated content continues to improve, and even authentic-looking communications can be fraudulent for reasons unrelated to AI.
The same principle applies to email. A message containing spelling mistakes might be suspicious. But a message written in flawless English is not necessarily trustworthy.
Likewise, hearing a familiar voice does not guarantee that the person speaking is who they claim to be. Rather than placing the burden on employees and volunteers to determine whether content is authentic, organizations should adopt procedures that work even when an impersonation cannot be detected.
The question shouldn't be:
"Does this email, voice, or video seem real?"
The better question is:
"Have we independently verified this request through an established, trusted process?"
That change in thinking can make an enormous difference.
Seven Practical Steps to Protect Your Organization
Fortunately, small businesses and nonprofits don't necessarily need expensive technologies or dedicated cybersecurity departments to reduce their exposure to these scams. Many of the most effective safeguards involve clear procedures, responsible financial controls, and employee awareness.
Independently Verify Requests Involving Money
Before transferring money, changing banking information, or making an unusual payment, contact the requester using an established communication channel. For example, if you receive an email from a vendor announcing new banking details, call the vendor using a phone number already in your records. Don't rely on the phone number provided in the suspicious message. The goal is to verify the request independently, rather than simply responding through the same potentially compromised channel.
Require a Second Person to Approve Significant Transactions
Consider requiring two authorized individuals to review and approve significant or unusual financial transactions. This creates an additional opportunity to identify mistakes, misunderstandings, or fraudulent requests before money leaves the organization. For smaller organizations, the procedure can be straightforward. For example, a treasurer might prepare a payment while an executive director or another authorized officer independently approves it. The appropriate threshold will depend on the organization's size, financial resources, and operations.
Establish a Procedure for Changes to Vendor Banking Information
Requests to change banking details deserve particular attention. Even when such requests appear to come from established vendors, verify the changes through contact information already on file. Consider delaying payment until the change has been confirmed and documented. A simple procedure can help prevent a convincing fraudulent email from redirecting legitimate payments into a criminal's account.
Protect Email Accounts With Strong Authentication
Business email accounts often contain valuable information about employees, vendors, donors, and financial transactions. Protect these accounts with strong, unique passwords and multifactor authentication (MFA). Where feasible, phishing-resistant authentication provides additional protection against certain account takeover techniques. Remember that MFA is an important safeguard, but it doesn't eliminate every possible method of compromising an account.
Establish Official Donation and Fundraising Procedures
Nonprofit organizations and churches should clearly communicate how they accept donations and authorize fundraising campaigns. If an unexpected request for donations appears to come from a pastor, board member, or executive director, supporters should know how to verify its legitimacy. Organizations can also establish policies governing emergency fundraising requests, changes to donation instructions, and the use of personal payment accounts. The goal is to make legitimate fundraising procedures predictable and easy to verify.
Train Employees and Volunteers to Recognize Risky Requests
Cybersecurity awareness training should focus on situations employees and volunteers are likely to encounter.
Examples include:
An urgent payment request supposedly from an executive director.
A vendor announcing a change in banking information.
A telephone call that appears to come from a familiar leader.
A message asking for confidential employee, donor, or financial information.
A request to bypass normal approval procedures because of an alleged emergency.
Training should reinforce a simple principle: A request can look and sound legitimate while still being fraudulent. Employees and volunteers should feel comfortable questioning unusual requests, regardless of who appears to be making them.
Have a Plan for Suspected Fraud
Even well-prepared organizations can encounter scams. Establish a simple response plan identifying who should be notified when suspicious activity is discovered. If a fraudulent financial transfer has occurred, immediately contact the financial institution to request assistance and determine whether the transaction can be recalled. Incidents involving internet-enabled fraud can also be reported to the FBI's Internet Crime Complaint Center at www.ic3.gov. Acting quickly may improve the chances of recovering transferred funds.
Good Cybersecurity Does Not Have to Be Complicated
Artificial intelligence will continue to evolve, and cybercriminals will undoubtedly look for additional ways to exploit it. But the fundamental principles of sound cybersecurity remain remarkably consistent.
Verify unusual requests.
Protect important accounts.
Separate financial responsibilities.
Establish clear procedures.
Encourage employees and volunteers to ask questions.
These practices can help protect an organization against many types of scams, whether or not artificial intelligence is involved. Most importantly, they reduce the need for employees to make difficult judgments about whether a message, voice, or video is real.
A well-designed verification process should work even when the deception is convincing.
Sample Financial Request Verification Checklist
Before sending money or changing payment information, take a moment to verify.
Confirm the request
Do I understand exactly what is being requested, who is requesting it, and why?
Verify independently
Have I contacted the requester using a trusted phone number or other previously established communication channel?
Check payment information
If banking or payment details have changed, have I verified the new information with the intended recipient?
Follow approval procedures
Have the required individuals reviewed and approved this transaction?
Question unusual urgency
Is someone pressuring me to act immediately, keep the transaction secret, or bypass normal procedures?
Document the verification
Have I recorded who verified the request, how it was verified, and when approval was given?
Our Final Thoughts
AI may make it harder to distinguish legitimate communications from fraudulent ones, but it doesn't make organizations powerless. Small businesses, nonprofits, and churches can take meaningful steps to reduce their risk without investing in complex systems or becoming experts in artificial intelligence.
The most effective defense is often not learning how to recognize every new scam. It is establishing procedures that prevent suspicious or unverified requests from causing harm in the first place. That is a lesson worth remembering, regardless of how sophisticated AI becomes.
Sources and Further Reading
Federal Bureau of Investigation: 2025 Internet Crime Report (2026); https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
Microsoft: Disrupting EvilTokens: The AI Chatbot Built for Cybercrime (September 22, 2026); https://blogs.microsoft.com/on-the-issues/2026/09/22/disrupting-eviltokens-the-ai-chatbot-built-for-cybercrime/
Federal Bureau of Investigation: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (December 3, 2024); https://www.ic3.gov/psa/2024/psa241203
WIRED: AI Deepfakes Are Impersonating Pastors to Try and Scam Their Congregations (January 2026); https://www.wired.com/story/ai-deepfakes-are-impersonating-pastors-to-try-and-scam-their-congregations/
Federal Trade Commission: Scams and Your Small Business; https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business
