Artificial intelligence is transforming digital business operations while enabling cybercriminals to deploy sophisticated scams targeting SMEs.
Artificial intelligence is reshaping the digital economy, including the digital construction sector where data-driven workflows, connected platforms and digital collaboration tools underpin daily operations. However, the same technology transforming productivity is also accelerating the evolution of cybercrime.
Across the UK, small and medium-sized enterprises (SMEs) are facing an increase in AI-driven cyber fraud. As organisations adopt artificial intelligence tools, cloud platforms and digital communication systems, cybercriminals are exploiting these technologies to launch sophisticated online scams at scale.
The UK’s National Cyber Security Centre has recently urged organisations to strengthen cyber resilience amid heightened geopolitical tensions linked to the conflict in the Middle East. Against this backdrop, cybersecurity experts warn that businesses must recognise the growing threat of AI-enabled fraud.
Karim Salama, founder of digital marketing and technology agency E-Innovate, says organisations should view the emergence of “AI scams 2.0” as a structural shift in the cyber threat landscape.
“AI has fundamentally changed the scale and realism of online fraud,” Karim explains. “Criminals can now generate convincing messages, fake identities and automated campaigns in seconds. For many SMEs, these scams look indistinguishable from legitimate communications at first sight.”
The evolution of AI-driven cyber fraud
Traditional online scams required significant manual effort. Cybercriminals often relied on individually written phishing emails, cloned websites or labour-intensive social engineering tactics.
Generative artificial intelligence has dramatically lowered the barrier to entry for fraud. Attackers can now automate much of the process, producing large volumes of convincing communications within seconds.
AI-powered tools enable fraudsters to generate realistic emails, create synthetic identities and build automated chatbots capable of interacting with victims. More advanced tactics include voice cloning and deepfake video technology, which allow attackers to impersonate executives, suppliers or clients with high levels of accuracy.
For digital construction firms and SMEs handling financial data, supplier payments and project information, these developments increase exposure to cyber risk. Many smaller organisations operate without dedicated cybersecurity teams, making them particularly vulnerable to targeted attacks.
Emerging attack vectors beyond phishing emails
Although phishing emails remain a common cyber threat, the channels used to distribute malware and online scams are evolving.
Recent research indicates that programmatic advertising has overtaken email as the leading vector for malware delivery. Advertising channels now account for more than 60 per cent of observed malware and phishing campaigns, with incidents increasing by 45 per cent year-on-year.
The complexity of the digital advertising ecosystem allows malicious actors to embed harmful code within automated advertising networks. These attacks can appear through legitimate websites or online platforms, making them harder to detect.
AI tools also allow cybercriminals to conduct highly personalised attacks. By analysing publicly available data about businesses, employees and supply chains, fraudsters can craft targeted messages designed to bypass traditional security awareness.
Karim warns that many organisations underestimate where cyber threats originate.
“Many business owners assume scams arrive via obvious phishing emails, but attackers are increasingly exploiting ad networks, social media platforms and compromised websites,” he says. “The sophistication of these campaigns means SMEs must rethink where online risks originate.”
AI scams 2.0: New tactics targeting businesses
The next generation of cybercrime is increasingly characterised by AI-enabled fraud techniques designed to mimic legitimate business activity.
Deepfake impersonation is one emerging threat. Using AI voice cloning or synthetic video, attackers can pose as senior executives and request urgent payments or sensitive data from employees. These interactions can appear credible enough to bypass standard verification processes.
AI-generated phishing campaigns are also becoming more effective. Generative AI systems can replicate the tone, formatting and branding of genuine organisations, producing emails that appear highly professional and difficult to distinguish from authentic communications.
Another common tactic involves AI-generated fake invoice scams. By analysing publicly available information about supplier relationships or purchasing activity, cybercriminals can produce realistic invoices or payment requests that appear legitimate.
AI-assisted account takeover attacks are also increasing. Automated tools enable criminals to test stolen credentials or weak passwords across multiple platforms, allowing them to gain access to business email accounts or marketing systems before launching further scams internally.
Cybersecurity measures for SMEs and digital construction businesses
Despite the growing sophistication of AI-driven cybercrime, many scams still display subtle warning signs. Businesses can reduce exposure by implementing practical cybersecurity measures and strengthening internal verification processes.
Karim highlights several key indicators organisations should treat with caution:
- Unexpected payment requests, particularly those marked as urgent
- Changes to supplier bank details without prior confirmation
- Emails with unusual tone or grammar despite professional formatting
- Requests for sensitive information via messaging apps or social media
- Suspicious online adverts or pop-ups directing users to unfamiliar websites
For SMEs operating within the digital construction ecosystem, these risks intersect with increasingly connected project platforms, cloud software and digital supply chains.
Karim emphasises that strong cybersecurity does not necessarily require large financial investment. “Use multi-factor authentication across all email, payment systems and marketing platforms,” he advises.
Employee awareness also plays a critical role. “Ensure staff understand how AI scams work and how to recognise suspicious communications.”
Businesses should also establish formal verification procedures for financial transactions. “Introduce internal procedures requiring secondary verification for payments or supplier changes,” Karim says.
Additional steps include monitoring digital advertising campaigns and web assets for suspicious activity, as well as maintaining up-to-date software systems across all platforms. Outdated software remains a common entry point for attackers, particularly when organisations rely on interconnected digital tools.
AI-driven cyber fraud is evolving rapidly, creating new risks for SMEs and digital construction firms. Organisations that combine staff awareness, verification procedures and basic cybersecurity safeguards will strengthen resilience against emerging AI scams.
Read next: Low-carbon concrete for structural construction – Build in Digital
Are you a building professional? Sign up for a FREE MEMBERSHIP to upload news stories, post job vacancies, and connect with colleagues on our secure social feed.
