Fewer scams, bigger losses: why capability is your best defence

Scams Awareness Week 2026 runs from Monday 24th to Friday 28th August. This year the national figures carry an uncomfortable message for small and medium businesses: the money lost to scams keeps climbing, even as the number of scams levels off.

In 2025, Australians reported $2.18 billion lost to scams, up 7.8% on the year before, while the number of reports held broadly steady (National Anti-Scam Centre, Targeting Scams Report 2025). Phishing tells the story in miniature: reports fell by a third, yet the average loss per phishing incident more than doubled. Fewer attempts, more damage per hit.

For a business, the takeaway is blunt. Scammers are working with more precision, often with artificial intelligence (AI) doing the heavy lifting, so the scam that gets through is now far more likely to be the expensive one.

Why awareness alone no longer covers you

For years the advice was to watch for bad spelling, odd formatting and dodgy links. That advice has quietly stopped working. The scams landing now are built with AI: cloned voices, deepfake video calls, and phishing emails written cleanly enough to pass a second glance.

Awareness still matters. Stop. Check. Protect. is a message every business should reinforce this week. But awareness helps your people catch the obvious. When the threat itself is AI-powered, catching it takes more than a wary eye. It takes capability, and that capability sits in specific parts of your business.

The scam that gets through has a department in mind

AI-powered scams are not landing at random. They target the functions that move money, hold sensitive data, and make the calls, and each one needs its people equipped for what is now aimed at them.

Your finance team is where the expensive business scams land. The single biggest category nationally is investment scams, at $837.7 million in 2025, but those overwhelmingly target individuals, not businesses. The scam that targets businesses most is payment redirection, the second-costliest type overall at $166.8 million, together with false billing, the category that captures business email compromise (BEC).

Both do the same thing: a scammer impersonates a supplier or an executive and asks you to pay an invoice or change the bank details on file, and for small businesses false billing is the most commonly reported scam of all. Upskilling here means your people can spot a lookalike domain, question a redirected payment, and treat “urgent, confidential, pay today” as the warning sign it is.

Your HR and recruitment team is now a frontline target, not a back office. Reports of job and employment scams more than doubled in 2025, up 102.4%, with more than $19 million lost through online job scams.

Hiring means exchanging exactly what scammers want: identity documents, bank details, and a way into your systems under a fake candidate or recruiter identity. The people handling that data need to recognise when a “candidate” is really an attack.

Your leaders own the decision that sits above all of it: how AI gets used across the business, and where the guardrails go. That is a governance call, not an IT setting, and it needs leaders who understand the technology well enough to make it.

Growing that capability from within

This is the work we help organisations do. For 20 years, MCBI has helped businesses build the capability and resilience they need through practical, globally recognised certification, matched to the people who need it:

•      ISO/IEC 27001 to certify your finance and operations people in information security foundations

•      ISO/IEC 42001 to certify your team in AI management foundations

•      CAIM, the Certified AI Manager credential, for the leaders governing how AI is used across the business

The certifications are self-paced and completed online, so each part of your team builds real capability without downing tools for a week of training. The result is resilience that stays in your business, rather than a one-off fix that leaves the moment the consultant does.

This week, and after it

Scams Awareness Week is a good prompt to check your controls: verify new or changed bank details by phone using a number you already hold, require two-person sign-off on unusual payments, and make it safe for staff to flag something that feels off. Do those things this week.

Then think about the year ahead. The businesses that stay ahead of AI-powered scams will be the ones that grew the capability to handle them from within.

If you are weighing up where your AI and cyber capability gaps sit, we would be glad to talk it through.