Use AI on suspicious orders and scam messages
- Check the order in your provider account before deciding what ships.
- Use chat to organize questions, not to approve an order or payment.
- Take out card numbers, codes, passwords and customer details first.
- Check urgent requests through a contact you already know.
- You decide what ships, changes or gets paid.
Use AI to make a checklist of questions about a suspicious order, then check it in your provider account before deciding what ships.
In this made-up example, Order #1043 for $84.00 has a high-risk label from the payment provider. The parcel is still here, and you haven't shipped it.
The assistant can sort your questions, but it can't decide whether the order ships. You still make the call. If a detail matters and isn't in your message, ask it to ask you before it drafts.
Take out card numbers, codes, passwords and customer details first.
Before using software to accept, decline, refund or hold an order, check current law. This isn't legal advice.
My order says high risk. What should I check?
The practice order is still on the packing table. You'd like another set of eyes, but you don't want a guess. First, check why the provider gave it that label.
Prompt
I'm practicing with a made-up online shop order. Order #1043 is $84.00. Customer J. asks when it will ship. The provider marked it high risk, but these notes give no reason. I haven't shipped it. Make a checklist of questions for me to check in my provider account. Separate facts I gave you from questions I still need to answer. Ask me up to three questions about missing non-private facts before making the checklist. Don't decide whether I should ship or cancel. Don't ask for card or customer details.
Ready for your own case? Swap the made-up details for yours:
I'm checking order [your order number] for [amount]. The customer says [what the customer says]. The provider marked it high risk but gave no reason. I haven't shipped it. Make a checklist of questions for me to check in my provider account. Separate facts from questions I still need to answer. Ask me up to three questions about missing non-private facts. Don't decide whether I should ship or cancel. Don't ask for card or customer details. Use a made-up order number, a made-up or rounded amount, and a short paraphrase with private details removed.
Check it: Start with the order and shipping notes you already have. Ask your provider what the high-risk label means and which steps apply to this order. On Shopify, use Should I fulfill this order? in the first-week setup. Elsewhere, use Manual Review to organize a human review.
Why did so many payments fail overnight?
Your shop usually sees five failed payments in an hour. This made-up example has 80. You don't know why yet, so ask your provider to review the activity before you change a payment setting.
The chat can help you write a clear note. It can't tell what happened from one total. Nor should it choose a rule that blocks payments. Your provider can review the activity, and you can decide what to do next.
Prompt
I'm practicing with made-up totals only. My online shop had 80 failed payment attempts in one hour. The usual count is five. Write a short message asking my provider to review the activity. List the safe totals I could collect next. Say possible card testing only as a question, not a diagnosis. Don't give me a blocking rule.
Check it: Compare the failed-payment total with your usual count and order records. Ask your provider to inspect its actual logs and explain any account requirements. If it's still happening, follow Bots keep trying cards in the attack playbook. Read Card Testing to learn the term, and Rule Anatomy to see what a rule describes. Don't copy its sample cutoffs into live settings.
Is this payout email really from my provider?
An email says your payout will stop today unless you sign in through its link. It feels urgent, but you haven't clicked. Describe what it asks you to do in your own words.
The chat can help list questions. It can't prove who sent the message. Keep it simple.
A familiar logo or voice can be copied. The FBI warns that criminals use AI to make targeted impersonation more convincing, but that warning doesn't tell you who sent this message, why they sent it, or whether it was made with AI. Pause and check through a contact you already trust.
Prompt
Made-up example: an email says my online shop's payout stops today unless I sign in. I haven't clicked anything. Give me three ways to check the request through contact details I already have. Don't ask for the link, password or a code. Don't decide that the message is genuine.
Check it: Keep the message and check notices in your provider account. Open it through your saved app or type its address yourself. Ask a known contact about any deadline or account requirement. The FTC small-business scam guide covers independent checks. BEC and Phishing gives the provider-message checks. Already signed in through the link? Lock the account and check the payout bank.
My supplier changed bank details. What now?
Your bakery's supplier calls with new bank details for today's invoice. You don't know whether anything really changed. Hold the payment for a moment.
The chat can help you write a callback script. It can't confirm who's calling or approve the transfer. You'll check that yourself.
Prompt
I'm practicing with a made-up bakery. A supplier called and asked us to change payment details for today's invoice. I haven't changed anything. Draft a short callback script for the supplier's number already on file and a checklist of what to confirm. Don't ask for bank details or approve a payment.
Check it: Compare the request with the invoice and payment details in your own records. Call the supplier using a number already on file and follow your own approval steps. Then use BEC and Phishing for background on vendor-payment messages, not to decide whether this caller is real.
Sources
| Source | What it supports | Accessed |
|---|---|---|
| FTC: Scams Your Small Business | Small-business advice about unexpected links, impersonation, and checking requests through a trusted channel. | 2026-10-22 |
| FBI: AI and cyber-criminal impersonation | Warning about AI-assisted impersonation and requests for money or sensitive information. It doesn't prove any particular message used AI. | 2026-10-22 |