The scammers are using AI too. Here is what small business owners need to know.
The same AI tools helping you draft a quicker email are helping scammers draft a more convincing one too, and the numbers out this week make that hard to ignore.
The Australian Signals Directorate released its Annual Cyber Threat Report 2025-26 this week. Businesses self-reported an average cybercrime cost of $93,500 over the year, more than 82,000 cybercrime reports came in, which works out to roughly one every six minutes, and medium sized businesses saw their average loss jump 45 per cent to $141,300. Small businesses are not spared either. Industry reporting on the same data puts the small business average at around $55,400.
The part that should worry small business owners more than the dollar figures is the why behind them. The agency's warning is plain: AI is lowering the skill needed to run a decent scam. It helps criminals do their homework on a target faster, and it helps them write phishing emails, fake invoices and impersonation messages that read like they came from a real person at a real business, because in a sense, a very good copy of one wrote them.
Here is the part that is actually good news. Most of what stops these attacks has nothing to do with AI at all. It comes down to a handful of basics that most small businesses have simply never gotten around to.
A short checklist worth doing this week
Turn on multi factor authentication, or passkeys where they are offered, on your email and any accounting or banking software. This one change blocks the majority of account takeovers, because a stolen password on its own stops being enough.
Check your email's DMARC setting if you know where to look, or ask whoever manages your website or email to check it for you. A lot of small businesses have this set to monitor only, which means a fake email pretending to be from your business can still land in someone's inbox.
Have a look through your own inbox for forwarding rules you did not set up. This is one of the oldest tricks in the book and one of the easiest to miss, because it runs quietly in the background once it is in place.
Never change bank details or pay an invoice on the strength of an email alone, especially one that asks you to do it quickly. A short phone call to a known number is the whole defence here.
Keep your website and any software you use up to date. Old, unpatched systems are still one of the easiest ways in, and this year's report found attackers exploiting a vulnerability first identified back in 2008.
None of this takes an IT department or a big budget. It takes maybe 20 minutes and the willingness to actually do it rather than file it under later. Christmas trading is coming up, which is exactly when scam activity tends to pick up, so later is not really an option here.
This is not something you need to sort out alone, and it is not something I would try to talk you through myself either. That is a job for an IT or cyber security provider, not a business consultant. If you do not already have one you trust, let me know and I am happy to point you toward a few good options.
Source: AAP via Newcastle Herald, "Cyber security threats rise as AI menace gathers pace", 26–27 October 2026 — newcastleherald.com.au; small business figure from Cyber Daily, 21 October 2026 — cyberdaily.au
