A Mahidol University criminologist says scams work by triggering emotion, not by beating the victim's intelligence. AI now makes fake faces, voices and identities more convincing, and one phishing message can reach many people at once. Scammers often pose as police, government agencies, banks or phone operators, and use urgency such as a 24-hour deadline. For a small business, set a rule that any urgent payment or change of bank details is confirmed by calling back on a known number, not the one that contacted you. Also tell staff not to engage with unknown callers, since a recorded voice can be reused.