AI Phishing: The New Threat to Small Businesses
13th February 2026
The Day Passwords Started Dying
6th March 2026
Show all

The £17,000 Phone Call

It started with a perfectly normal Tuesday.

One of the directors of a small Midlands manufacturing firm received a call from his “Managing Director”. The voice was unmistakable. Same tone. Same pace. Same slightly impatient way of saying, “Can we just get this sorted?”

The request was urgent. A supplier payment needs to be released immediately to secure stock before a price increase. The bank details had changed. It had to go now.

£17,000 left the account within the hour. There was just one problem. The Managing Director hadn’t made the call.

Welcome to 2026 — where AI voice cloning scams have moved from Hollywood plotlines to very real threats for small businesses across Worcestershire and Warwickshire.

This isn’t theory. It’s happening.

And if you’re a small business owner, you are exactly the kind of target criminals are looking for.

What’s Actually Going On?

AI voice cloning technology has advanced dramatically over the past 18 months. With as little as 30 seconds of publicly available audio — think a LinkedIn video, podcast clip, website introduction, or awards interview — criminals can generate a convincing synthetic version of someone’s voice.

Not robotic.
Not obvious.
Not cartoonish.

Convincing.

They then use that cloned voice to call finance managers, operations staff, bookkeepers or fellow directors and request urgent payments.

It’s often called “CEO fraud” or “Authorised Push Payment fraud”, but AI has taken it to another level. Previously, scams relied on spoofed emails. Now they rely on human instinct — and trust.

And trust is exactly what makes small businesses vulnerable.

Why Local SMEs Are Prime Targets

Large corporations tend to have layered financial controls. Multiple authorisations. Segregation of duties. Fraud teams.

Most SMEs in Redditch, Bromsgrove or Worcester might have:

  • One finance person
  • One bookkeeper
  • A small leadership team
  • Fast decision-making
  • Close working relationships

That closeness is your strength.

It’s also what attackers exploit.

If your accounts manager has spoken to you on the phone hundreds of times, and “you” call asking for a same-day transfer because you’re in a meeting and can’t email — they are far more likely to act.

Especially if the tone, phrasing and personality match.

The Psychology Behind the Scam

These scams work because they combine three pressure triggers:

  1. Authority – The caller sounds like the boss.
  2. Urgency – “This has to happen now.”
  3. Secrecy – “I’ll explain later. Just handle it.”

That trio bypasses rational checks.

No one wants to be the person who delays a deal, misses a discount, or questions the MD unnecessarily.

Criminals understand workplace dynamics better than most managers do.

The Simple Controls That Stop This Dead

Here’s the good news.

This threat sounds sophisticated, but the prevention isn’t.

You don’t need enterprise software or a cybersecurity department.

You need a process.

Introduce a “Second Channel” Rule

Any request to:

  • Change bank details
  • Make urgent one-off payments
  • Transfer large sums

Must be verified via a completely separate communication method.

If the request comes by phone, verify by calling back on a known number from your records.
If it comes by email, verify by phone.

Not the number in the message.
The number you already have.

This single rule prevents the majority of financial fraud attempts.

Create a Safe Challenge Culture

Your team must feel psychologically safe to question you.

Say it explicitly in a team meeting:

“If I ever ask for urgent payment changes, you must verify it — even if I sound annoyed.”

That sentence removes fear.

Tighten Payment Thresholds

Introduce approval tiers. For example:

  • Over £5,000 = two directors sign-off
  • Bank detail changes = mandatory written confirmation from supplier letterhead + phone verification

Small tweaks. Big impact.

Audit Your Public Audio Footprint

This is where things get interesting.

Many business owners now publish:

  • Video content
  • Podcasts
  • Social clips
  • Event recordings

None of that is wrong. Visibility is good.

But be aware that you are providing training data.

You don’t need to remove content. Just assume it can be used and build safeguards accordingly.

Review Your Cyber Insurance Policy

Check whether it covers social engineering fraud and authorised push payment scams.

Some policies don’t.

And insurers increasingly require documented financial controls before paying out.

The Wider Trend: AI Is Lowering the Barrier to Crime

What used to require technical expertise now requires a subscription.

AI tools are becoming more accessible, faster and cheaper. That’s brilliant for productivity. But it also democratises criminal capability.

We’re entering a period where:

  • Deepfake video will follow voice
  • Real-time impersonation will improve
  • Scams will become more personalised

The question isn’t “Will this affect big corporations?”

It’s “Are small businesses prepared?”

A Practical 30-Minute Action Plan

If you run a business in Worcestershire or Warwickshire, here’s what you can do this week:

  1. Email your finance lead today outlining the second-channel rule.
  2. Add dual approval for payments above an agreed threshold.
  3. Confirm your supplier bank verification process in writing.
  4. Check your cyber insurance wording.
  5. Brief your leadership team on AI voice scams so they’re aware.

Thirty minutes. That’s it. You don’t need to panic. You need clarity.

Final Thought

The businesses that suffer from these scams aren’t careless.

They’re busy.
They’re growing.
They trust their teams.

AI hasn’t changed human nature. It’s just found a new way to exploit it.

The strongest defence for small businesses in our region isn’t expensive software.

It’s structured trust.

Clear processes. Defined verification.

A culture where questioning urgency is seen as professionalism — not insubordination.

Because the next £17,000 phone call won’t sound suspicious.

It’ll sound exactly like you.

Gavin Moorhouse is the CEO of Lucid Computer Solutions, a leading Worcestershire-based IT Services business. Give them a call on 01527 908646.

Comments are closed.