By Alex Wolfram
A text shows up from a number you do not recognize. It uses the name of someone you know, asks how your business is going, and when you hesitate, it keeps nudging you to reply. That is an AI impersonation text scam, and one just landed on the phone of a friend of our own CEO.
We work in cybersecurity every day, and this one still got our attention. It was polite, patient, personal, and almost certainly automated. If it can target people connected to an IT company, it can target your office manager, your bookkeeper, or your best client.
Why this matters now
Scammers used to send the same clumsy message to thousands of people and hope a few bit. That has changed. Low-cost AI tools now let one scammer run hundreds of separate conversations at once, each one tailored, friendly, and tireless.
The fuel for those conversations is personal data. Names, phone numbers, job titles, family members, and business connections are bought and sold by data brokers and scraped from social profiles. Put that data together with an AI chat tool and you get a message that sounds like it came from someone you actually know.
What a real AI impersonation text scam looks like
Here is what happened, with names left out. A friend of our CEO, who works in real estate, received a text from an out-of-state number. It opened with a warm good morning, used our CEO's full name, and asked how real estate was going.
She did the right thing and asked whether this was his new number. The reply came back fast: yes, and his old number had been hacked. Then came a string of short follow-ups, each one designed to pull a response:
- How have you been?
- Remember me?
- It has been a while.
- Being shy?
Notice what was missing. There was no request for money, no link, no attachment. That is deliberate. The first goal is simply to get you talking. The ask comes later, once you feel comfortable.
How these scams work, step by step
Step 1: Build a profile
The scammer starts with a name and a phone number, then fills in the details. Data broker sites, LinkedIn connections, company websites, and leaked contact lists from breached apps all help them map out who knows whom and what each person does for a living.
Step 2: Open with familiarity
The first message uses a real name and a real detail about your life or work. The new number gets explained away with a believable story, such as a hacked phone, a lost phone, or a new work line.
Step 3: Keep pushing
Because the conversation is automated, the scammer never gets bored. Silence triggers another message, then another. Light guilt, like asking if you are being shy, is a common tactic to make ignoring the text feel rude.
Step 4: Make the ask
Once you are engaged, the request arrives. Common versions include:
- Buying gift cards for a client or an emergency
- Sending money through a payment app
- Paying an invoice or updating banking details for a vendor
- Clicking a link to view a document or a deal
- Reading back a verification code that was just sent to your phone
That last one is especially dangerous. A verification code lets the scammer take over your email, your payment app, or even your phone number.
Warning signs to watch for
- A new number with a story. Hacked, lost, or switched phones are the most common excuses.
- An unfamiliar area code. If someone local suddenly texts from another state, treat it as a red flag.
- Pressure to reply. Rapid follow-ups, guilt, or urgency are signs of a script, not a friend.
- Vague familiarity. Remember me questions instead of specific shared memories.
- Any request involving money, links, or codes. This is where the real damage happens.
Why you cannot just warn everyone
When your name is being used, your first instinct may be to text every contact in your phone. That is not realistic, and it can look like spam itself. A better approach is targeted and simple:
- Post once on LinkedIn or Facebook letting people know scammers are using your name from new numbers, and state your only real number.
- Add a short line to your email signature for a few weeks.
- Personally contact the people who matter most, such as clients, vendors, family, and anyone who handles money with you.
The real protection is not the warning. It is shrinking what scammers know and building habits that make their messages useless.
Shrink your digital footprint
Remove your data from broker sites
Data brokers are where most of the personal details in these scams come from. Removing yourself by hand means finding and filing requests with dozens of sites, then repeating the process when they relist you.
A removal service does that work for you. I have used DeleteMe myself for a while now, and I have walked members of our own team through setting it up. It submits removal requests on your behalf, keeps checking for new listings, and sends regular reports showing what it found and removed. Optery and Incogni are other services that do similar work.
One honest caveat: removal reduces your exposure going forward, but it cannot pull back data that was already copied. That is why the habits below matter just as much.
Hide your LinkedIn connections
Your public connections list is a ready-made target list for this exact scam. In LinkedIn visibility settings, set your connections so only you can see them.
Review app permissions
Check which apps on your phone have access to your contacts. If an app does not clearly need them, turn that access off. A breached app with contact access can leak your whole address book.
Lock down your phone number
The hacked number story is usually a lie, but number theft is real. In a SIM swap or port-out attack, a criminal moves your number to their device and starts receiving your calls and verification codes.
- Set a port-out PIN with your carrier.
- Turn on your carrier's number lock feature. Verizon calls it Number Lock, T-Mobile calls it Account Takeover Protection, and AT&T calls it Wireless Account Lock.
- Where possible, use an authenticator app instead of text message codes for important accounts.
Build a verification habit across your team
Technology helps, but the strongest defense is a simple rule everyone follows. Here is what we recommend for every business we support.
Always verify on a known number
If anyone texts from a new number, or makes an unusual request, call them back on the number you already have on file. Never verify by replying in the same thread. The scammer controls that thread.
No money moves by text
Gift card purchases, payments, wire transfers, and changes to banking details should never be approved by text, email, or voicemail alone. Require a callback to a known number every time.
Set a code word
AI can now clone a voice from a short audio clip, so a call that sounds right is no longer proof. A private code word for your leadership team, and for your family, gives you a quick way to confirm identity.
Use the filters you already have
On iPhone, turn on Filter Unknown Senders in Messages settings so texts from unknown numbers land in a separate list. Apple also offers Contact Key Verification for iMessage, which helps confirm you are messaging the real person.
Remember that it is not only texts
The same impersonation tricks show up in email, Microsoft Teams, and phone calls. Restricting outside access to your collaboration tools and training staff to spot impersonation are part of strong IT security for any small business.
Your quick checklist
If you receive a suspicious text claiming to be someone you know:
- Do not reply, click links, or share any codes.
- Call the person on the number you already have saved.
- Forward the message to 7726, which spells SPAM, to report it to your carrier.
- Block the number.
- Report it to the FTC at ReportFraud.ftc.gov.
- If money was sent, contact your bank right away and file a report with the FBI at ic3.gov.
- Let the person being impersonated know so they can warn their own circle.
To protect yourself and your team ahead of time:
- Enroll in a data broker removal service such as DeleteMe.
- Hide your LinkedIn connections and review app contact permissions.
- Add a port-out PIN and number lock with your carrier.
- Adopt a callback rule for any request involving mon