AI scam checklist for small business is a practical phrase for 2026 because scams are getting faster, more polished, and harder to spot at a glance. The good news is that most local businesses do not need a complicated security program to lower their risk today. They need a few clear habits before anyone pays an invoice, clicks a link, shares a code, or grants account access.

Google’s Threat Intelligence Group recently reported that attackers are using AI for vulnerability research, malware development, social engineering, and other parts of cyber operations. The FTC is also continuing to run small-business scam and cybersecurity education, including a July 27 webinar for veteran business owners. For CodeForce clients in New England, the useful takeaway is simple: treat unexpected digital requests with a little more structure.

AI scam checklist for small business owners

Use this checklist when a message, call, invoice, login alert, file, or support request feels urgent. It is especially helpful for small teams, nonprofits, family-run shops, solo service providers, and community programs where one busy person may handle money, email, website updates, and customer messages.

1. Slow down any urgent payment request

Scams often work because they interrupt a normal workday. A fake invoice, vendor email, government notice, utility warning, or “your website is down” message may look routine enough to approve quickly.

Before paying, changing bank details, buying gift cards, sending a wire, or moving money through a new payment link, use a second channel. Call the vendor from a saved number, not the number in the email. If the request claims to come from an employee, client, board member, or relative, verify it outside the message thread.

2. Do not trust voice, video, or writing style by itself

AI can make messages sound more polished. It can also help scammers imitate tone, create realistic scripts, and prepare better social engineering. A message can sound like a real person and still be fake.

For money, passwords, payroll, tax forms, customer files, or website admin access, create a rule: familiar tone is not proof. Require a known callback, a shared internal phrase, or a second approval before acting.

3. Check the actual sender and destination

Look past the display name. Check the full email address, website domain, and link destination. Scammers often use lookalike domains, extra words, missing letters, or URLs that send people through tracking links before reaching a fake login page.

If the message is about Google Business Profile, Microsoft, QuickBooks, WordPress, Facebook, Amazon, your bank, or your web host, open a new browser tab and type the known website yourself. Do not sign in from a surprise link.

4. Treat one-time codes like passwords

A one-time code can open the door to email, banking, social media, domain registration, hosting, or WordPress. If someone calls or messages asking for a code, assume it is a scam unless you initiated the support session and you know exactly why the code is needed.

Turn on multifactor authentication for important accounts, but also train your team not to approve prompts they did not request. CISA’s small-business guidance continues to emphasize strong authentication, software updates, and practical security habits.

5. Keep WordPress, plugins, and devices updated

AI-assisted attacks are one more reason to stop postponing updates. Attackers move quickly when software flaws become public. Small businesses do not need to follow every technical alert, but they do need a routine for WordPress core updates, plugin updates, theme updates, device updates, and backups.

If your WordPress dashboard has many old plugins, unknown admin users, no backup plan, or a site that breaks when updates run, that is a good time to book WordPress site recovery help or a monthly website care plan before a small issue becomes expensive.

Where small businesses should focus first

Security advice can get overwhelming fast. Start with the accounts and systems that would hurt the most if they were stolen, locked, or misused.

• Email accounts, especially the owner’s account and shared inboxes.
• Banking, payroll, accounting, and payment processor logins.
• Domain, hosting, DNS, and WordPress administrator access.
• Google Business Profile, Facebook, Instagram, and ad accounts.
• Customer lists, donor lists, student records, or client files.

For each one, write down who has access, whether multifactor authentication is turned on, where backup codes are stored, and who can approve changes. This does not have to be fancy. A one-page access list is better than guessing during a stressful incident.

A simple 20-minute team conversation

If you have staff, volunteers, family members, seasonal help, or board members touching business accounts, use this short agenda this week.

• Show one example of a fake invoice or phishing email.
• Agree that no urgent payment gets approved from email alone.
• Pick the person who verifies vendor bank changes.
• Remind everyone that one-time codes are private.
• Decide who to call if someone clicks the wrong thing.

This kind of conversation matters because a scam response plan only works if people know it before the message arrives. The FTC’s small-business materials are useful here because they focus on common risks like phishing, ransomware, business email imposters, vendor security, and tech support scams.

When to get help

Ask for help sooner if money moved, a password was shared, a computer downloaded something suspicious, a WordPress admin account appeared unexpectedly, customers received strange messages, or your website started redirecting visitors.

CodeForce can help with business tech services, patient tech help, websites and hosting, and booking a focused support session. The goal is not to scare anyone. The goal is to make the next right step clear.

Recent sources worth reading

• Google Threat Intelligence Group on AI-assisted cyber threats
• FTC July 2026 small-business scams and cybersecurity webinar
• FTC Cybersecurity for Small Business
• FTC guide to scams and your small business
• CISA secure your business guidance

FAQ

Does AI mean every small business needs expensive cybersecurity tools?

No. Better tools can help, but the first wins are still practical: multifactor authentication, software updates, backups, password managers, payment verification, and staff training.

What should we do if someone clicked a suspicious link?

Change the affected password from a clean device, turn on multifactor authentication if it was not already enabled, alert the team, watch for related messages, and contact your bank or platform support if money or account access may be involved.

How often should we review account access?

For most small businesses, a quick monthly review is realistic. Also review access when an employee, contractor, volunteer, or vendor relationship changes.

If you want a calm second set of eyes on your accounts, website, or business tech setup, book CodeForce for a focused review.