Small Business Groups Urge Canberra to Help Counter AI Scam Wave

Australian small enterprise groups have urged the federal government to reinstate dedicated cyber safety initiatives, warning that artificial intelligence is supercharging online scams while prompting dangerous data-sharing habits inside smaller workplaces.

In submissions to a parliamentary inquiry examining the cyber security readiness of small and medium enterprises, the Council of Small Business Organisations Australia pointed to two growing threats. First, digital scammers are exploiting generative AI to produce far more convincing, sophisticated attacks. Second, smaller organisations frequently misuse new tools, with nearly a third of surveyed small firms conceding they have input sensitive internal or client information directly into generative AI systems.

Business Chamber Queensland echoed the warnings, describing artificial intelligence scams as the most rapidly expanding threat facing its members. The risks come alongside climbing operational consequences: data from the Australian Signals Directorate shows the average expense of an SME cyber incident jumped 14 per cent to reach $56,600 during the 2024–25 financial year, while overall scam losses nationwide topped hundreds of millions of dollars.

Industry leaders want policymakers to deliver urgent, plain-English guidance and restore public backing for practical workforce education. Earlier free training initiatives, like the Cyber Wardens program, lapsed after government funding ended, leaving resource-strapped business owners without structured digital literacy support.

What this means for Australian businesses

For local business owners, the findings highlight that modern AI adoption requires strict guardrails rather than casual experimentation.

• Establish clear AI input policies: Make sure all staff understand never to paste client details, financial figures, or commercial IP into public AI chatbots. Check privacy terms on enterprise software to ensure proprietary data is excluded from model training.
• Treat payment requests with extra scrutiny: AI enables scammers to craft convincing tone-of-voice impersonations and spoofed vendor emails. Set up mandatory secondary checks, such as an direct phone call on a known number, before changing bank details or paying unusual invoices.
• Provide basic staff training: You do not need an enterprise IT budget to raise awareness. Brief your team regularly on spot-checks for AI phishing and encourage employees to report suspicious messages immediately without fear of blame.
• Budget for protection, not just incidents: With clean-up costs averaging tens of thousands of dollars, investing small amounts in credential management, multi-factor authentication, and safe workflow automation remains far cheaper than resolving a breach.