Editorial review: 11 November 2026. Unsupported regional loss figures and absolute protection claims have been removed. The original publication date is retained.
A supplier asks you to change its bank details. The message reads well, refers to an actual order and arrives when the invoice is due. Your decision should depend on how the request is verified, not how convincing it sounds.
The FBI’s December 2024 advisory describes criminals using generated text, cloned voices and synthetic video to support fraud. That establishes a reason to prepare. It does not establish how many Caribbean businesses have been targeted or how much they have lost to AI-enabled attacks.
This guide sets out checks a small business can adapt with its bank and IT provider. It is general educational guidance, not a security audit or a determination of local legal obligations.
Country-specific guidance
Use the local guides to identify business context and questions for your advisers. They are not evidence of a particular fraud incident:
What AI changes, and what it does not
AI can help a criminal draft persuasive messages and imitate a familiar voice or face. Poor grammar was never a dependable authentication test. A correct accent, logo or invoice reference is not proof that the person making a request has authority.
Business email compromise also works without AI. The FBI’s BEC guidance describes spoofed addresses, stolen account access and misuse of genuine billing conversations. The practical question is whether an unauthorised instruction can become a payment, account change or disclosure.
Three situations deserve attention:
- A changed payee. Someone asks for an invoice to be paid into a different account.
- An exception for a senior person. A supposed executive asks staff to bypass the usual checks because a transaction is urgent or confidential.
- A request for access. A caller or message asks for a password, one-time code or approval of a sign-in the employee did not initiate.
These are training scenarios, not reports of specific Caribbean incidents. A suspicious request may be fraudulent whether or not AI was involved.
Read the statistics with their scope attached
Two widely cited figures need careful interpretation:
- IBM’s 2025 report put the global average cost of a data breach at US$4.44 million, down from US$4.88 million in 2024. This is a data-breach benchmark, not the expected cost of deepfake fraud at a Caribbean SME. IBM’s explanation of its 2025 findings.
- Deloitte’s May 2024 analysis projected that generative AI could enable US$40 billion in fraud losses in the United States by 2027. It is a forecast for the US, not an observed global or Caribbean total. Deloitte’s analysis and assumptions.
This article does not establish a comparable regional AI-fraud loss series. Do not relabel total banking fraud, all cybercrime or a foreign forecast as Caribbean deepfake losses. Budget decisions should also consider your own payment limits, account permissions and ability to recover essential records.
Start with payment and account controls
Choose a named owner for each change and check that it works in your actual systems. The timing below is a suggested work plan, not a promise that every business can complete it at the same cost or speed.
First: verify requests and protect access
- Verify payment changes independently. Contact the supplier or colleague using an established number obtained outside the suspicious request. Check the payee, account and purpose. If the person cannot be reached or details conflict, hold the change.
- Separate approval from entry. Where staffing and bank facilities allow, use a second authorised person for new payees and consequential transfers. Give that reviewer the underlying invoice and verification record.
- Enable MFA. Prioritise email, banking and administrator accounts. Prefer phishing-resistant FIDO/WebAuthn options where supported. Authenticator codes and SMS codes can still be phished; use available MFA while planning an appropriate upgrade. NIST’s MFA guidance.
- Review access and recovery. Remove access that is no longer needed and protect recovery methods. Never ask staff to send passwords or one-time codes as part of a training exercise.
A shared phrase may be an additional check, but should not by itself authorise a payment. Treat a disclosed or replayed phrase as compromised. A familiar voice does not override a failed callback or the bank’s approval process.
Next: maintain systems and practise the response
- Ask your IT provider to review email authentication and filtering, device protection and unsupported software. Check legitimate business mail before tightening blocking rules. Email filtering does not prove that a payment request is genuine.
- Apply security updates promptly, prioritising actively exploited vulnerabilities and supplier instructions rather than waiting for an arbitrary seven-day deadline.
- Keep protected backups of essential records and test restoration. Confirm what work can continue if email or the main business account is unavailable.
- Practise with approved synthetic messages. Use consenting participants and synthetic voices for impersonation exercises. Measure whether staff stopped, verified and reported the request, rather than treating a click rate as a complete readiness score.
- Write down who can stop a payment, restrict an account and contact the bank, IT responder and relevant authorities. Keep a copy accessible if your normal systems are down.
NIST’s small-business quick-start guide provides a broader way to organise cybersecurity responsibilities and priorities. Adapt technical work to the systems and skills you actually have.
Then: decide where specialist help is needed
Ask a qualified provider to assess gaps you cannot check internally. Agree the scope and permission for any penetration test before it begins. Buying a product described as “AI-powered” is not evidence that it suits your business or will detect every attack.
If considering cyber insurance, ask the broker or insurer to explain relevant exclusions, conditions, notification duties and limits for social-engineering and payment fraud. Record the answer against the policy wording. Neither insurance nor a bank recall guarantees recovery.
What policymakers can support
Practical priorities include accessible incident-reporting routes, affordable advice for small businesses and staff training that reaches people who approve payments. Comparable reporting would help distinguish attempted fraud, realised losses, recoveries and confirmed AI involvement. These are recommendations, not findings that every Caribbean jurisdiction has the same gaps or legal duties.
Test the procedure before relying on it
Use a fictional supplier change and follow it from receipt to approval. Can the employee find a trusted contact? Can the approver see what was checked? What happens if the contact is unavailable or the owner is the person being impersonated?
Fix the weak step and repeat the exercise. A successful rehearsal supports that procedure under the conditions tested. It does not certify the business as secure.
Frequently asked questions
Can we tell whether a message was written by AI? Not reliably from polished wording alone. Verify the sender and requested action. You do not need to prove AI use before stopping a suspicious transaction.
Which control should we start with? For a business making supplier payments, start by testing independent verification of payee changes and securing the accounts used to approve them. Priorities may differ where sensitive records or operational systems are the main exposure.
Should we stop using AI tools? Review each use. Restrict what data staff may enter and what actions tools may take. Use approved services and human review where an error could affect a customer, employee or financial commitment.
Where can we get help? Use your bank’s verified fraud contact for payments and your service provider for account security. Check official local channels for police reports and technical incident assistance. Jamaica’s CIRT reporting page and Trinidad and Tobago’s CSIRT reporting page are starting points in those jurisdictions. Confirm eligibility and required information before submitting sensitive records.
Does reporting to a CIRT satisfy our legal duties? Do not assume so. Ask a locally qualified adviser which regulator, affected-person, contractual or insurer notifications apply to your incident, and when they are required.
Part of the AI Playbook for Caribbean and LATAM Micro and Small Businesses. Created by Adrian Dunkley, MaestrosAI. Educational resource, fair use.