Two things happened the same week, both real, both involving people I actually know. I want to put them next to each other because the contrast is the whole point.
The bad one
A company got a call. Someone claiming to be from the bank's fraud department, saying they needed to stop or move some payments right away.
The owner didn't panic and didn't hand over anything. He said, "Here, call our CFO instead," and gave them the number.
They called the CFO. And somehow, on that call, they got him to move the money out of the account. A little over $200,000, gone, the same week the business was having one of its best years on record.
Nobody knows exactly how they got in, but AI was almost certainly involved somewhere in making the call convincing enough to work. And the part worth sitting with isn't the technology. It's that this business had been hacked before, and still wasn't sure if it had cyber insurance. If you've been targeted once, the second time isn't a surprise anymore. It's a known risk you chose not to close.
The actual defense here is almost insultingly simple: when a call sounds urgent, you hang up and call the number you already had on file, not one they gave you. That single habit would have stopped this. It's not a technology problem. It's a "we never wrote down what to do when this happens" problem.
The good one
Same week, a family member was translating books professionally. About 150 pages a run, arriving by email, needing to go out again once finished.
He was doing it the slow way: download the pages, manually split them into groups of five because the tool he used online couldn't handle more at once, upload, translate, check, download, repeat. Ten batches of that for one 150-page job. Five to ten hours, every time.
The fix wasn't a different AI model. It was moving him from typing into a browser window to Claude Code, connected directly to his email folder, told once to split the incoming pages into batches of five itself. Same underlying work. What used to take five to ten hours now takes thirty minutes to an hour, because the tedious admin part, the splitting and re-uploading, is gone.
He hasn't gone back to the cheaper plan since. The math was obvious the first time he ran it.
Same tool, opposite outcome
It's tempting to file the first story under "AI is dangerous" and the second under "AI is great" and leave it there. That's not quite right.
AI didn't decide either outcome. It amplified what was already true on each side. A scammer with bad intentions got a more convincing script. A translator with a real, tedious, well-defined problem got hours back. The tool didn't pick a side. It just made whatever was already happening faster and more effective, for better or worse, depending entirely on who was holding it and what they were trying to do.
That's not a comforting fact if you're hoping technology will sort itself out. It's actually the opposite of comforting, because it means the responsibility for which outcome you get sits entirely with the humans involved, not with the model.
What actually protects a small business
Not a ban on AI, and not blind trust in it either. A short list of concrete habits, decided in advance:
Verify urgency the old-fashioned way. A request that creates pressure to act immediately, especially around money, gets a callback to a number you already had, not one you were just given.
Get the insurance before you need it, not after. If you've been targeted once, that's the moment to close the gap, not a data point to feel uneasy about and move past.
Look for the boring, well-defined, repetitive task first. The translation win wasn't a clever prompt. It was recognizing that splitting pages into batches of five was pure mechanical overhead with zero judgment involved, which is exactly the kind of task worth automating first.
Same technology, same week, two very different businesses. The variable was never the AI.