This week in one paragraph
AI is changing how customers find businesses, while AI-powered scams are making it harder to know who you're dealing with. This week: getting found in ChatGPT, deepfake scams costing New Zealanders millions, measuring your AI spend, and the latest SME cyber-security numbers.
In this issue
Your customers are asking AI, too
Deepfake scams cost NZ $265 million with no law to stop them
ChatGPT Work now shows what AI actually costs you
NCSC says 43% of NZ SMEs feel vulnerable to cyber attack
Your customers are asking AI, too
What changed. McKinsey analysis warns businesses may see a 20–50% decline in traffic from traditional search as AI chatbots replace search engines.1 Google search traffic to news publishers has already declined by a third globally. A Kiwi startup is helping businesses get discovered by AI systems. It notes that average AI queries run to 30 or more words, compared with six or seven for Google. That gives businesses more opportunity to be noticed, but only if their content is structured for AI consumption.1
What it means. A potential customer who asks ChatGPT or Gemini for the best accounting software for a New Zealand small business is increasingly asking AI, not just Googling it. Every business with a website faces the same shift. Clear, factual pages that answer specific questions in plain language perform better in AI-era search than pages stuffed with keywords.
Do this. Look at your five most important website pages. On each one, answer the questions a customer would type into ChatGPT: what you sell, who it is for, where you operate, how much it costs, what makes you different, and what the alternatives are.
Deepfake scams cost NZ $265 million with no law to stop them
What changed. The Financial Markets Authority flagged 110 fraudulent investment ads using AI deepfakes of New Zealand bank chief executives and politicians on Meta platforms in a single day in April 2026.2 Cross-bank fraud losses hit $265 million in the 12 months to November 2025. With MBIE estimating only one in five scams are reported, real losses could be near $1 billion.2 New Zealand has no equivalent to Australia's Scams Prevention Framework Act 2025, which carries fines up to A$50 million.2
What it means. More than half of organisations surveyed across New Zealand, Australia and the United States reported AI-generated identity fraud. Your accounts payable team, your contract signing process, and any workflow that relies on verifying who someone is have all become targets. Publicly visible executives are especially at risk of fake invoice approvals using their likeness.
Do this. Rule of thumb: if someone asks you to move money, verify the request using a different communication channel. Call back on a known number, not the one in the message. Train your team on this today.2
ChatGPT Work now shows what AI actually costs you
What changed. OpenAI added analytics to the ChatGPT Admin Console on 16 September that combine usage, spend, task insights and outcome metrics across ChatGPT Work and Codex.3 You can see which users and teams are burning credits, what tasks AI is being used for, and how much merged code Codex contributed. The Admin plugin can even turn the monthly numbers into a report deck. It answers the AI bill shock worry flagged by Datacom's index and by New Zealand firms moving to metered pricing.3
What it means. Don't measure AI by how much you use it. Measure whether the work it replaces is worth more than the AI costs. Small businesses often object that they cannot tell if paid AI is saving them anything. The dashboard shows whoever administers your seats what each task costs, in plain language, so seat renewals and prompts become budget decisions. For a New Zealand business running on thin margins, that means dropping an unused seat before the renewal invoice arrives.
Do this. If you have a ChatGPT Work seat, log into the Admin console, open the analytics, and pick the single most expensive task. Try trimming the model or reasoning setting on it for a week and see if quality holds.3
NCSC says 43% of NZ SMEs feel vulnerable to cyber attack
What changed. The National Cyber Security Centre's SME Cyber Security Behaviour Tracker 2026 found 43% of SMEs believe they are vulnerable to cyber attack, up from 34% last year.4 Among medium-sized businesses with 20 to 49 employees, 76% experienced a cyber threat in the past six months, and 44% reported moderate to severe impact. AI-enabled threats are now the fourth most common cyber concern, with businesses worried about AI-generated scams, deepfakes and more sophisticated phishing. One in three SMEs still do no staff cyber training at all.4
What it means. Businesses that have not updated their security practices since last year are falling further behind as AI-powered attacks grow. One in three still trains no staff.
Do this. Cyber Smart Week runs 5 to 11 October 2026. Register for the free supporter toolkit at Own Your Online and use it to run a one-hour staff session on recognising AI-generated phishing. If you do nothing else this quarter, turn on multi-factor authentication on every business account that supports it.4
One thing to do this week: test your AI discoverability and lock down one account.
Spend ten minutes asking an AI chatbot about your own business. If it cannot find you, rewrite your website's key pages so they answer specific questions in plain language. Then pick the one business account that would hurt most if it were compromised and turn on multi-factor authentication today.