Listen to this lesson
If you run a small business, work in accounts, or handle payments for anyone, this lesson is directly relevant to you.
Business scams have always existed, but AI has made them significantly more dangerous. The messages are now grammatically perfect. The voices can sound like your actual boss. The fake invoices look identical to the real ones. And New Zealand's small-to-medium businesses are actively being targeted.
Business Email Compromise — often shortened to BEC — is when a scammer impersonates someone inside or connected to your business in order to redirect money.
The most common version looks like this: someone in accounts receives an email that appears to come from the CEO, a director, or a senior manager. The email requests an urgent payment — to a new supplier, a different bank account, or to settle a deal that is time-sensitive. The tone is authoritative. The email looks legitimate. The payment is made.
The money goes to the scammer.
AI makes these emails convincing because it can generate professional, context-aware writing instantly. Scammers also research their targets first — finding out the names of real executives, suppliers, and staff from LinkedIn and company websites — so the emails feel specific and credible.
Red flags:
A related scam targets businesses with fake invoices. A supplier you already deal with appears to send an updated invoice — often with new bank account details — asking you to redirect future payments. The email arrives from what looks like the supplier's address, written in natural English, with the right logo and formatting.
In reality, the supplier's email has been compromised, or the scammer has set up a convincing lookalike address. The payments go to the scammer's account. By the time the real supplier chases the overdue invoice, the money is gone.
This is the more sophisticated version of BEC. Instead of — or in addition to — a spoofed email, the scammer uses voice cloning or deepfake video to impersonate a senior executive directly.
A finance manager receives a voice message that sounds exactly like the CEO, instructing them to process an urgent transfer. Or a video call is arranged in which a convincing deepfake version of the CFO walks through the payment details.
This has happened to companies around the world, including in the Asia-Pacific region. NZ businesses are not immune.
Smaller businesses typically have less formal financial controls than large corporates. There may be no two-person approval requirement for payments. Staff know and trust each other, which makes an urgent personal request from the boss feel entirely normal. There is less dedicated IT security. And the amounts involved — tens of thousands of dollars — are significant enough to be worth targeting but small enough to fly under the radar.
None of this is a criticism. It is simply the reality of how small businesses operate. The good news is that the protections are straightforward.
If your business has been targeted or affected by BEC or a fake invoice scam, report it to CERT NZ at cert.govt.nz. They can provide advice and track patterns across NZ businesses.

Visual overview