BBC Wales investigation found AI‑powered scammers targeting UK food festival traders with convincing fake emails. Dozens of small businesses lost money after multiple realistic exchanges that included personal details and festival‑specific knowledge. Abergavenny Food Festival warned AI accessibility enables more believable scams at scale. Published September 18, 2026.
What Happened
Harriet Thomas, who runs knitting workshops across south Wales, received an email offering a stand at Abergavenny Food Festival. She had applied in previous years and felt genuine excitement. The message looked completely legitimate, right down to the sender address.
Unlike typical phishing attempts, this one used a JotForm with correct fonts and branding. Thomas filled it out without hesitation. What followed were multiple email exchanges that addressed her by name and referenced specific site facilities. The sender demonstrated detailed knowledge of the festival layout.
Only after Thomas paid for a pitch and announced her participation on Facebook did the deception surface. Her heart sank when she realized the money was gone. She told BBC Wales she spots scams regularly, but this time nothing sparked a red flag.
Abergavenny Food Festival confirmed the accessibility of AI tools allows scammers to reach more people with schemes that look far more believable.
What This Means For You
If you run a small food or craft business applying to festivals, your inbox is now a high‑risk channel. Scammers no longer rely on poor grammar or generic templates. They craft multi‑step conversations that mimic legitimate organizers, complete with personal details and insider knowledge.
Verify every payment request through a separate, trusted channel. Call the festival office using a number from their official website — not one provided in the email. Check whether the festival actually uses the payment platform referenced. Most established events have secure portals on their own domains.
Train any staff who handle bookings to treat unsolicited “opportunity” emails as suspicious by default. The old rule — “if it looks too good to be true” — no longer applies. These scams look exactly right because AI generates them from real festival data scraped from public sites.
Consider setting up a simple internal protocol: any new vendor opportunity requires a second‑person verification before money moves. A five‑minute phone call prevents a five‑figure loss.
Why It Matters
This case illustrates a broader shift. Generative AI has lowered the cost of producing convincing social engineering attacks to near zero. Scammers can now automate the research phase — scraping festival websites, vendor lists, and past correspondence — then generate personalized outreach at scale.
Small businesses lack the security infrastructure of larger firms. They rarely have dedicated IT staff or phishing simulation programmes. They operate on trust and personal relationships, which makes them ideal targets for AI‑enhanced impersonation.
The festival ecosystem relies on email communication between organisers and hundreds of independent traders. That trust fabric is now exploitable. When one trader falls victim, the reputational damage ripples to the festival brand itself.
Expect this pattern to expand beyond food festivals. Any industry where small vendors apply to events — craft fairs, trade shows, markets — faces the same vulnerability. The technology is general‑purpose; the targeting is a choice.
Key Takeaway
- AI‑generated scams now replicate legitimate multi‑email conversations with personal details and insider knowledge.
- Verify all payment requests through official festival channels — never trust email‑only instructions.
- Small businesses are disproportionately targeted because they lack security resources but handle real transactions.
- Festival organisers must publish clear communication policies so traders can distinguish real outreach from fakes.
Frequently Asked Questions
How can I tell if a festival email is fake?
Check the sender domain against the festival’s official website. Look for subtle variations (e.g., “abergavennyfoodfestival.com” vs “abergavenny-food-festival.org”). Contact the festival directly using published contact info before sending money.
What should I do if I already paid a scammer?
Report it immediately to your bank’s fraud team and to Action Fraud UK. Alert the real festival organisers so they can warn other traders. Document every email and transaction for investigators.
Leave a Reply