Skip to content

For the trades

The AI scams
now aimed at trades.

Here is how it goes. A materials invoice arrives from your merchant’s real email address — their account, not a lookalike — with a note that they’ve changed banks. You pay it. A month later the merchant rings asking where the money is. That scam is twenty years old. What’s new is that the email is now word-perfect, the follow-up phone call can be in a voice you recognise, and one criminal can run it against every firm in the county at once. Here’s what it looks like, and the two habits that beat it.

Three scams are aimed squarely at building trades: a supplier’s ‘new bank details’ email that diverts a real payment, a cloned voice of the owner or a family member asking for an urgent transfer, and a fake customer or supplier set up to extract a deposit or goods. AI has made all three convincing. Two habits stop nearly all of it: verify any bank-detail change by ringing a number you already had, and agree a safe word for any urgent money request by phone.

Mick Stevenson Forty years across trades, construction, property and plant hire before software. RPII-registered Operational Inspector. Builds and secures AI tools for Cornish trades.

Published

On this page

  1. 01 The three scams aimed at trades
  2. 02 Invoice and bank-detail fraud: the one that costs most
  3. 03 The cloned voice
  4. 04 The fake customer and the fake supplier
  5. 05 Two habits that stop nearly all of it
  6. 06 If it’s already happened

The three scams aimed at trades

None of these is new. All three have been transformed by AI in the last two years, because the thing that used to give them away — bad English, a generic email, a voice that wasn’t quite right — is gone.

Invoice and bank-detail fraud

A real invoice, a real supplier, a changed account number. Highest losses by a distance.

The cloned voice

A call from “you”, or your partner, or your site manager, needing money moved now.

The fake customer or supplier

A job that doesn’t exist, or a merchant that doesn’t, set up to take a deposit or goods.

Invoice and bank-detail fraud: the one that costs most

The National Crime Agency calls this payment diversion fraud, and Action Fraud’s figures for a single month — September 2025 — were £3.9 million lost across 83 reported cases. That’s an average of more than £47,000 each, and the NCA says it is one of the most common and costly crimes against business. It works like this:

  1. 01

    The criminal gets into an email account — yours, your supplier’s, or a subbie’s. Usually through a password reused from somewhere that leaked. They read quietly for weeks.

  2. 02

    They wait for a real invoice. They know the job, the amount, the names, the tone. AI writes the follow-up in the supplier’s exact style: “Just to let you know we’ve changed banks — new details below for this and future payments.”

  3. 03

    Sometimes there’s a phone call to “confirm” — from a number that looks right, in a voice that sounds right. There’s always a reason it’s a bit urgent.

  4. 04

    You pay the real invoice to the wrong account. The money is gone within the hour. The supplier chases you for payment a month later, and that’s when you find out.

The giveaway isn’t in the email any more. It’s in the one fact that never changes: the bank details moved. That is the only thing you need to notice, and the only thing you need to check.

The cloned voice

National Trading Standards issued a warning in February 2026 about AI-driven phone scams using cloned voices. The technology needs a few seconds of someone speaking, and most trades have handed that over already — the video on the Facebook page, the voicemail greeting, the YouTube walkthrough of the extension. From that, software can make the voice say anything, live, on a call.

For a trade it turns up in three shapes:

  • The boss to the office: “I’m on site, no signal for email, I need you to pay this supplier before four or we lose the delivery slot.” The office does what the boss says.
  • The family member: “Dad, I’ve had an accident, I need money for the garage, don’t tell Mum.” Aimed at you personally, using a voice from your own posts.
  • The supplier’s accounts person ringing to confirm the “new bank details” email — the voice makes the email credible, and the email makes the voice credible.

You cannot beat this by listening harder. The voice is right. You beat it by asking something the voice can’t know, which is what the safe word is for — more on that below.

The fake customer and the fake supplier

Smaller amounts, higher volume, and AI makes them look real. The fake customer sends an enquiry for a big job — a barn conversion, a full re-roof — with a plausible address and a plausible story, then overpays a deposit by “mistake” from a stolen card or cheque and asks for the difference back. The refund is real money; the deposit bounces a fortnight later.

The fake supplier is a website that didn’t exist three weeks ago, offering slate or timber or a mini digger at a price you can’t get elsewhere, pro-forma invoice, pay up front. AI builds the website, writes the reviews on it, and answers the emails. The goods never come.

Both have the same tell: money has to move in an unusual direction, quickly. A refund to a new customer. A full payment to a new supplier before delivery. Unusual plus quick is the pattern, every time.

Two habits that stop nearly all of it

No software, no subscription. Agreed once, with everyone in the firm who can move money, and with your family.

01

Any change to bank details gets a phone call — to a number you already had

Not the number in the email. Not the number the caller gives you. The one on the last invoice you paid, or in your phone from last year. Ring it, speak to someone you know, confirm the change. Every time, no exceptions, however busy, however urgent. This one habit defeats the most expensive scam there is, and it takes two minutes.

02

A safe word for any urgent money request by phone

Pick a word. Agree it in person with the office, with your partner, with your kids. Never write it down online. Any call that needs money moved now — from anyone, in any voice — gets asked for it. A clone doesn’t know it. A real person won’t mind being asked. If the caller gets annoyed at the question, you have your answer.

Three smaller things that help round the edges:

  • Two-step sign-in on your email, today. Most of these start with a read email account.
  • Use your bank’s “confirmation of payee” check and stop if the name doesn’t match. It isn’t foolproof, but it catches the crude ones.
  • No refunds of overpayments to anyone until the original payment has cleared — properly cleared, not “showing”.

If it’s already happened

  1. 01

    Ring your bank now, on the number on the back of the card. Minutes matter — a fast recall sometimes gets some of it back.

  2. 02

    Ring the real supplier, on a known number, so they know their email may be compromised.

  3. 03

    Change your email password and turn on two-step sign-in, because the most likely way in was your inbox.

  4. 04

    Report it to Action Fraud, online or on 0300 123 2040. It feels pointless. It isn’t — it’s how the pattern gets seen.

  5. 05

    Tell the firm, and tell your trade mates. The same crew will be working through every roofer in the county this month. Embarrassment is how they get away with it.

Where this comes from

This is plain-English guidance for small businesses, not formal legal advice. Where something genuinely needs a solicitor or a data-protection specialist, I'll tell you straight.

Straight answers

Why would anyone target a small building firm?
Because you move real money in lumps, you pay suppliers and subbies on invoice, your email address and your suppliers’ names are on your website, and there’s no finance department between the inbox and the bank. One diverted payment on a kitchen job is a better day’s work for a fraudster than a hundred phishing emails to a bank.
What’s actually new about AI here?
The scams are old — invoice fraud, bogus supplier, fake boss. What AI changed is the quality and the volume. The email now reads like your supplier wrote it, the voice on the phone can be a clone of your partner’s from a thirty-second video on your own Facebook page, and one person can run a thousand of these at once instead of ten.
How much is being lost?
Action Fraud figures published by the National Crime Agency show invoice fraud alone cost UK victims around £3.9 million in September 2025, across 83 reported cases — an average of more than £47,000 each. Most cases are never reported.
Will my bank refund me?
Sometimes, partly, and don’t count on it. Business payments are outside most of the consumer reimbursement protections, and where you authorised the payment yourself the bank will usually say you did. Prevention is the only reliable protection.
What’s a safe word and does it really work?
A word or phrase only you and your family or key staff know, agreed in person, never written down anywhere online. If a call comes in claiming to be one of you with an urgent money request, you ask for it. A cloned voice doesn’t know it. It works because it moves the check from “does this sound like them” — which AI has beaten — to “do they know something only they would know”.
Is there a tool that stops this?
Not really, and be wary of anyone selling one. The two habits in this guide — verify every bank-detail change on a known number, and a safe word for urgent money requests — stop almost all of it, and they cost nothing. Technology helps round the edges: two-factor on your email, and a payment process that needs two people for anything over a threshold.

Read next

Using ChatGPT for quotes and customer emails: what never goes in

Names and addresses, key-safe codes, photos of someone’s kitchen. What a trade can safely paste into an AI tool, what it can’t, and the ten-minute fix.

A one-page staff AI policy you can actually use

Free template. What staff may and may not put into AI tools, which tools are approved, who checks the output. Prevents most incidents before they happen.

AI for tradespeople: what is worth your time

Written by someone who spent forty years on the tools. What genuinely helps a working trade, and what is sales patter.

Want someone to look at how money moves in your firm?

The boring bit matters most: who can change a supplier’s bank details, who signs off a payment, what happens when the owner’s on holiday. An hour talking that through is cheaper than one diverted invoice.

Talk to Mick