When a Fake Message Looks Like It Came From Your Business

You may already have a process for handling suspicious emails, WhatsApp messages and phone calls. But when your business is busy, a message that appears to come from a supplier, customer, bank or delivery platform can slip through quickly.

The danger is not limited to large companies. A Malaysian SME with a small team may depend on a few people to approve payments, manage orders, respond to customers and access important accounts. If one person trusts a convincing fake message, the impact can spread across the whole business.

Amazon is addressing this problem with an AI assistant feature that can check whether an email, text message or phone call genuinely came from Amazon. The assistant compares the message with a record of messages Amazon has sent, while also examining its content, formatting and sender. Source: The Verge

TL;DR

AI can help identify impersonation attempts by comparing suspicious messages with verified communication records.

For your SME, the practical lesson is to combine automated checking with clear verification steps, especially for payment requests, login codes, supplier changes and urgent instructions.

What This Means

Amazon’s feature, available through Alexa for Shopping, allows a customer to ask whether a message came from Amazon. The assistant analyses several signals, including the wording, layout, sender and whether the message matches records of genuine messages previously sent by Amazon. Source: The Verge

The system is designed to confirm a message only when it is “completely certain”. If it cannot establish that the message is genuine, the customer is directed to check orders through the official Amazon application and contact Amazon support directly. Source: The Verge

This is important because a good security tool does not simply answer “yes” or “no”. It also guides the user towards a safer next action. That approach is more useful than asking your staff to identify every scam from appearance alone.

The safest message is not the one that looks genuine; it is the one you verify through a trusted channel.

Why Impersonation Scams Are Difficult to Spot

Scammers do not always use obvious spelling mistakes or strange designs. They may copy your supplier’s email signature, use a familiar name, refer to a real order or create urgency around a genuine business activity.

A fake message may claim that a bank account has changed, a parcel is being held, an account requires verification or an employee must share a one-time password. It may even arrive during a busy period when your team expects several operational messages.

Phone calls and messaging applications create another challenge. A caller can sound professional, while a WhatsApp account can display a familiar profile photo. Your staff may also feel uncomfortable delaying a request when it appears to come from the owner, finance manager or a major customer.

How This Applies to Malaysian SMEs

For wholesalers and distributors, supplier bank-account changes deserve extra checks. A scammer may pretend to be a regular supplier and send new payment details just before an invoice is due. You can require staff to verify the change using an existing phone number from your internal records, not the number included in the new message. An automation system can also flag payment instructions that differ from the supplier’s established details.

For online sellers, delivery and marketplace messages need careful handling. Your team may receive alerts relating to orders, account access, refunds or courier collection. A fake message could direct someone to a lookalike login page or request an OTP. Create a simple rule: staff must open the official marketplace or courier application independently instead of clicking a link in an unexpected message.

For service businesses, customer and management impersonation can create operational confusion. A fake customer may request an urgent refund, while a fake manager may ask an employee to disclose account information. A shared workflow can require approval from a second person whenever a request involves sensitive data, unusual refunds or changes to customer records.

For SMEs using WhatsApp as a main business channel, verification should be built into daily work. WhatsApp is convenient, but convenience can make informal requests appear trustworthy. Record approved contact numbers for suppliers, landlords, logistics partners and key customers. If a message requests an unusual action, call the known number or start a new conversation rather than replying to the suspicious message.

A Simple Verification Structure

Message type	Warning sign	Safer response
Payment instruction	New bank details or urgent approval	Confirm through a known contact and require second-person approval
Login or OTP request	Unexpected code, link or request to share the code	Open the official application directly and never share the OTP
Supplier message	Different email address, writing style or attachment	Compare with previous records and call the supplier using stored details
Customer refund request	Pressure to bypass normal process	Use your documented refund workflow and obtain approval
Phone call	Caller demands immediate action or secrecy	End the call and return it using a verified number

Practical Takeaways

• Create a verification rule: Any request involving payment details, passwords, OTPs, refunds or sensitive records must be checked through a separate trusted channel.
• Keep contact records updated: Store supplier and partner phone numbers in a shared business system rather than relying on personal contact lists.
• Use official applications directly: Do not ask staff to validate an account through a link contained in a suspicious email or message.
• Set approval levels: A second person should review unusual or high-risk requests before action is taken.
• Record normal communication patterns: Keep examples of regular invoices, order updates and supplier emails so unusual messages are easier to recognise.
• Train through realistic examples: Show your team fake payment changes, delivery alerts and login requests, then practise the correct response.
• Use automation for consistency: Your workflow can flag unfamiliar senders, changed payment details, duplicate requests or messages containing urgent instructions.
• Make reporting easy: Give staff one clear place to forward suspicious messages without fear of blame.

What AI Can and Cannot Do

AI can compare messages against known patterns and help reduce the burden on busy employees. It may identify unusual language, sender information, formatting or requests that do not match previous communications.

However, AI should support your business process rather than replace judgement. A genuine message can still contain an error, and a sophisticated fake may resemble a real message closely. Your staff should know what the system can verify and when a human approval is still required.

Do not paste confidential customer information, passwords or access codes into an unfamiliar AI tool. Choose systems with clear privacy controls, limit access by role and keep a record of how sensitive information is handled.

The Bigger Picture

Amazon’s approach points to a broader direction for business communication: verified messages may become more useful than messages that merely look professional. Instead of expecting users to judge every email or call, companies can maintain trusted records and use software to compare new communications against them.

For your SME, this does not mean waiting for a large technology provider to solve the problem. You can begin with a basic communication register, approval workflow and verification checklist. Over time, automation can check sender details, compare payment information and route questionable requests for review.

The strongest protection is usually a combination of technology and habits. Your team needs tools that identify unusual activity, but it also needs permission to pause an urgent request and verify it properly.

If you build that habit now, your business becomes less dependent on one employee’s memory or ability to recognise a scam. Every important request follows a clear path, every exception receives attention and suspicious messages are less likely to become expensive operational mistakes.

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →