ManMark Insights

AI Scams and Website Security

A convincing invoice and a polished website can both hide a problem. Small businesses need a way to verify payment requests, check who they hire, and review what goes live on their systems.

Scams Are Getting Easier to Produce

Fraudsters can use generative AI to write convincing messages at scale and create synthetic images, voices, or videos to impersonate people. A request that sounds like your supplier or manager can still be fraudulent. If a message changes bank details, asks for a login code, or pushes for an urgent payment, verify it through a phone number or channel you already trust. FBI guidance on AI-enabled fraud

A Working Demo Can Hide a Security Flaw

Vibe coding uses prompts to build software quickly. That can help a team prototype, but a working demo may still expose private records, place an API key in browser code, or accept requests without checking what the user is allowed to do. A code generator can also produce tests that miss the same assumptions as the code. OWASP guidance on secure AI-assisted coding

Verify Who You Hire Before You Pay

Before hiring a freelancer or agency to build a website or app, verify who will do the work and who will support it after launch. A legitimate provider should be able to explain who they are, show completed work, and say who will be accountable if the site goes down, a security issue is found, or the original developer becomes unavailable.

• Confirm their identity and business details. Ask for the legal name on the contract and invoice. If they claim to be a registered company, check the relevant business registry where available. If they work independently, verify their identity and references. Registration alone does not establish technical skill or reliability.
• Ask for a portfolio you can verify. Request two or three relevant projects they can show you now. Open live examples where available, ask what the provider actually built and maintained, and confirm their role with a client reference. For confidential work, ask for a redacted walkthrough or a reference they have permission to share.
• Keep control of your accounts. Register the domain, hosting, and key software accounts in your business's name. Give the provider only the access needed for the work.
• Put the handoff and support in writing. Agree on deliverables, payment milestones, ownership or licensing of the code, access to backups, and who handles maintenance and urgent fixes.

Four Checks Before You Launch

1. Name an owner. Assign someone who can explain the code, review changes, and take responsibility for maintenance after launch.
2. Test who can see what. Try the site signed out and as a regular user. Check that private files, customer records, and admin actions require the right permissions on the server.
3. Keep secrets out of the browser. Store API keys and email credentials in server-side secret settings. Use sample records while testing.
4. Plan for the first incident. Know who can revoke access, restore a backup, update dependencies, and tell affected people what happened.

Give Your Team a Process They Can Follow

If your website handles inquiries, customer records, or orders, agree on who reviews changes and who keeps the system running. ManMark can help you define the workflow, build the system around it, and train the people who will use it.

Discuss Your Website or Workflow