AI Scams and Deepfake Phishing: How Sri Lanka SMEs Can Protect Their Business

Also on bkdevops.lk: https://bkdevops.lk/ai-scams-deepfake-phishing-sri-lanka-smes/

AI scams are no longer something that only happens to big companies overseas. Today, a criminal can copy a voice from a short video, write a perfect email in seconds, and even fake a live video call. For a small business in Kurunegala, Kandy or Colombo, where most payments are approved over WhatsApp or a quick phone call, that is a real risk.

The good news: you do not need expensive tools to stay safe. Most AI scams still depend on one thing: getting someone to act quickly without checking. This guide explains how these scams work, the warning signs, and simple habits that protect your money, your accounts and your customers. It is general guidance, not legal advice.

What are AI scams and deepfake phishing?

Phishing is when a criminal pretends to be someone you trust (your bank, a supplier, your boss) to get money, passwords or one-time codes (OTPs). Deepfakes are fake audio, video or images made with AI so that a person appears to say or do something they never did.

Put the two together and you get AI scams that are much harder to spot. In a public warning from the FBI, the agency explains that criminals use generative AI to write believable messages without spelling mistakes, create fake profile photos and documents, clone voices, and even join real-time video calls pretending to be company executives.

This is not theory. In 2024, the engineering firm Arup confirmed that an employee in its Hong Kong office was tricked into sending about US$25 million to fraudsters after a video call in which the "senior managers" were fake. The company told CNN that "fake voices and images were used". If it can happen to a global firm, a small team that trusts every voice note is an easy target.

Common AI scams Sri Lanka SMEs should watch for

These are the patterns most likely to reach a small business:

• The fake boss voice note: a WhatsApp voice message that sounds exactly like the owner, asking a staff member to urgently transfer money or buy gift cards "for a client".
• The changed bank details email: a supplier "updates" their bank account by email. The message looks real, uses the right names and has no spelling mistakes, because AI wrote it.
• The deepfake video call: a short, low-quality video call where a "director" or "foreign buyer" pressures you to pay or share documents, then claims the connection is bad.
• The fake bank or courier call: a caller who knows your name and business asks for an OTP, PIN or card details to "stop a fraud" or "release a parcel".
• The fake customer payment slip: an edited or AI-made bank transfer receipt sent before goods are collected.
• Copycat pages of your business: a fake Facebook page or website using your logo and photos to take orders and payments from your customers.

Warning signs of AI scams

AI makes messages look polished, so do not rely on spelling mistakes any more. Instead, look for pressure and unusual requests:

• Urgency or secrecy: "Do it now", "Don't tell anyone", "I'm in a meeting, just send it"
• A new phone number, a new email address or a new bank account
• Requests for OTPs, PINs, passwords or remote access to a computer
• A voice or video that sounds right but avoids simple questions, or a call that keeps "dropping"
• Payment requested by gift card, cryptocurrency or to a personal account

The FBI's advice is simple: hang up, find the real contact number yourself, and call back.

Step 1: Make a call-back rule for every payment change

This single habit stops most AI scams. Write it down and share it with everyone who handles money:

1. No payment, refund or bank detail change is approved from a voice note, email or video call alone.
2. Always call back on a number you already have saved, not the number in the message.
3. For larger amounts, a second person must approve.
4. Agree on a secret code word for urgent requests between owners and senior staff (the FBI suggests the same idea for families).
5. Nobody in the business ever shares an OTP, even with "the bank".

A real boss or supplier will not mind a two-minute check. A scammer will.

Step 2: Lock down WhatsApp, email and social accounts

Many AI scams start with a hijacked account, because a message from a real account is far more convincing.

• Turn on two-step verification in WhatsApp for every business and staff phone.
• Turn on two-factor authentication for business email, Facebook, Instagram and your website admin. Our guide on why 2FA is non-negotiable explains how.
• Use a password manager and a different password for each account.
• Remove old staff from shared accounts and pages as soon as they leave.

Step 3: Protect your customers from fake versions of you

Many AI scams copy small businesses, because customers trust them. Make it easy to know what is real:

• Publish your official phone numbers, WhatsApp number and bank account on your website, and say clearly that you will never change bank details by message.
• Report fake pages quickly through the platform's own reporting tools, and warn customers on your real page.
• Keep your website secure and updated, so criminals cannot add fake payment pages to it.
• If you use a website chatbot, make sure it never asks customers for card details or OTPs. Our guide to adding an AI chatbot to your website covers safe set-up.

Step 4: Train your team in 15 minutes

Most staff have never heard a cloned voice, and AI scams rely on that. A short monthly chat helps more than any software:

• Share one real example (like the Arup case) and the call-back rule
• Show what an OTP request looks like and remind everyone it is always a scam
• Make it clear that nobody gets in trouble for double-checking, even with the owner
• Agree who to tell immediately if something feels wrong

Step 5: Look after customer data

Scammers make AI scams more convincing with stolen details such as names, order history and phone numbers. Sri Lanka's Personal Data Protection Act, No. 9 of 2022, is overseen by the Data Protection Authority, and it expects businesses to handle personal data responsibly. Collect only what you need, limit who can see customer lists, and do not keep spreadsheets of customer details on personal phones. For your exact obligations, get proper advice or check the DPA website.

What to do if you are targeted by AI scams

Act fast. Speed matters more than anything once money has moved.

1. Call your bank immediately and ask them to stop or hold the transfer.
2. Report it to Sri Lanka CERT on the 101 hotline or +94 11 269 1692, or through the incident reporting portal on the Sri Lanka CERT website. CERT asks that scams and social media incidents go through the portal.
3. Make a police complaint with the Computer Crime Investigation Division (CCID) of the CID: 011 238 1045 or dir.ccid@police.gov.lk (contacts listed on the Hithawathi help page). In an emergency, call 119.
4. Keep the evidence: screenshots, phone numbers, emails, links and transaction references. Do not delete the chat.
5. Change passwords on any account that may be affected and warn your customers if your name was used.

Quick checklist against AI scams

• Call-back rule written down and shared
• Two people approve larger payments
• Code word agreed for urgent requests
• WhatsApp two-step verification on every business phone
• 2FA on email, social media and website admin
• Official bank details and contact numbers published on your website
• Staff know an OTP request is always a scam
• Customer data limited to the people who need it
• Bank, CERT and CCID numbers saved in every manager's phone

How BK DevOps can help

AI scams are getting smarter, but a few simple habits and a secure website go a long way. BK DevOps helps Sri Lanka SMEs with secure WordPress websites, business email set-up, hosting, 2FA and regular maintenance. If you would like a practical security check of your website and email, see our services or contact us.