Scams aimed at small businesses

Nearly every scam on this page ends the same way: a payment sent somewhere new, or a bill paid that nobody owes. Before either one, call a number you already had.

If it’s happening now

An email says a vendor’s bank details changed. Don’t reply, and don’t call the number in it. Call the vendor at the number in your records: an old invoice, the contract, your vendor file. Hold the payment until you’ve talked to someone you know.

The boss texts, emails, or calls for gift cards, a wire, or a rush payment. Call them on the number saved in your phone, or walk over. A voice or video call that seems to be them proves nothing. “I’m stuck in a meeting, just text me” is part of the script.

An employee emails to change their direct deposit. Confirm it in person or at the phone number in their file before payroll runs.

A caller says your Google listing, your power, or your website is about to be shut off. Hang up. No real utility or company asks for gift cards or a Bitcoin ATM to stop a shutoff. Sign in to your Business Profile yourself, call the number on your utility bill, or sign in where you bought your domain.

Someone is on your computer. Hold the power button until it shuts off, then use another device. Someone is on the line or on my screen right now.

What to say

• Our policy is to confirm bank changes by calling a number we already have. I'll call you back.

• Hi, this is [name] at [business]. We got an email saying your bank details changed. Before we pay anything, did you send it?

• I need to report a fraudulent wire from our business account. Please send a recall now and contact the receiving bank's fraud team. What paperwork do you need from me, and can I get a case number?

• Can you put that decision in writing for me?

If something already left your hands

Money went by wire or bank transfer

1. Stop replying to the thread.
2. Call your bank’s fraud line now, at the number on your statement or in online banking. Ask them to recall the payment (try to pull it back) and contact the receiving bank; for a regular bank transfer (ACH) or bill pay, ask whether it can still be stopped. Ask what paperwork they need and send it the same day. Write down the case number.
3. Alongside the call, file at ic3.gov, whatever the amount, with the full transaction details. The FBI’s Recovery Asset Team uses those reports to ask banks to freeze money. In 2025 it froze $679 million of the $1.16 billion it went after.

Be ready for a no. Regulation E, the federal rule on unauthorized transfers, covers personal accounts only, and doesn’t cover wires. For a business account, your account agreement and state law decide what the bank owes. If someone at your business sent the payment, the bank may treat it as authorized and often won’t pay it back. Keep pushing the recall, and get the decision in writing. If it came from a personal account and the bank says no, file a complaint at consumerfinance.gov/complaint. If you have business insurance, ask your agent today whether this is covered.

A paycheck went to someone else’s account

Call your payroll provider and your bank the same day and ask them to try to pull it back. If the change came through the employee’s own payroll login, that login may have been phished: reset it, and turn on an authenticator app or passkey if the system offers one. Write “payroll diversion” in your IC3 complaint.

Gift cards or a card payment

Gift cards: call the card company now. I paid with gift cards. A card charge for a fake renewal, listing, or invoice: call the number on the card today and dispute it. The 60-day dispute rule for personal credit cards doesn’t cover business cards, and Regulation E doesn’t cover business debit accounts, so the card company’s own terms set how long you have. I paid with a credit or debit card.

Someone was in your email, or your vendor’s

If the request came from a real mailbox, someone may be in it. If it’s yours: from a device you trust, change the password, sign out other sessions, and delete forwarding or filter rules you didn’t set. The FBI has seen criminals add rules that hide alerts from the owner. Turn on a passkey or an authenticator app. If invoices went out from your mailbox, warn customers by phone or in an email with no links. If it’s your vendor’s, call them. Someone got into my account.

Then

Keep the original emails and don’t delete them: an investigator may ask for them. Save the invoices, bank letters, and a log of your calls. Report it at ReportFraud.ftc.gov too. If someone later offers to get the money back for a fee, including someone who says they’re the FBI, IC3, the FTC, or a lawyer, that’s a second scam. Someone offers to get my money back.

What it looks like

Tuesday, 4:52 p.m. An email from the flour supplier you've paid every month for two years, in the same thread as last month's invoice.

RE: Invoice 20417 - Laurel & Pine Bakery

D

Dana Whitfield <[email protected]>

To: [email protected]

Tue 4:52 PM

Hi Jordan,

Hope your week's going well. Quick heads-up before you send payment on invoice 20417 ($8,316.40). Following our annual audit we've moved our business banking, so please update your records and send this and all future payments to the account below. The old account stops accepting deposits on Friday.

Bank: Fernmont Bank
Routing: 071926183
Account: 004418273365

Our updated bank letter is attached. Just reply once it's updated so I can let our AR team know.

Thanks so much,
Dana Whitfield
Accounts Receivable, Kestrel Mill Supply
(503) 555-0187

The address matches every email Dana has ever sent you. What do you do before paying invoice 20417?

• Reply in the thread and ask Dana to confirm the new account
• Call the number in Dana's signature
• Call Kestrel at the number in your vendor file or on an old invoice, and hold the payment until you reach someone you know
• Pay invoice 20417 to the old account as usual

Show the answers

• Wrong move Reply in the thread and ask Dana to confirm the new account If someone is in her mailbox, they'll answer for her. A reply only goes back to whoever wrote this.
• Wrong move Call the number in Dana's signature That number came with the email. It might be hers, or it might be the sender's. You can't tell from here.
• Best move Call Kestrel at the number in your vendor file or on an old invoice, and hold the payment until you reach someone you know The FBI says these scams often run through real, hacked email accounts. A number from your own records reaches the real Kestrel.
• Okay Pay invoice 20417 to the old account as usual Safe from this email. But if the change is real, you'll find out the slow way. Call first.

A real address and a real thread only prove the email came from Dana's mailbox. Someone else may be using it. Bank changes get confirmed by a call you place to a number you already had.

You applied in August for a variance to put up a larger sign at the bakery. Your hearing before the planning commission is Wednesday, October 14.

Case VAR-26-0418: Outstanding fees prior to Planning Commission hearing

C

City of Fernmont Planning Division <[email protected]>

To: [email protected]

Mon 9:06 AM

Good morning,

This is a courtesy notice regarding application VAR-26-0418 for 1140 Alder Street. Our records show the following fees remain outstanding prior to review by the Planning Commission on October 14, 2026:

Public notice and mailing fee: $385.00
Variance review fee: $240.00
Total due: $625.00

The itemized invoice is attached. To keep a complete record for your application file, please request payment instructions by replying to this email rather than calling the office. Payment must be received five business days before the hearing, or the item will be removed from the agenda.

Regards,
Marisol Vega
Senior Planner, City of Fernmont

The case number, the address, the hearing date, and the planner's name are all correct. What do you do?

• Reply and ask for the payment instructions. Nobody else would know the case number
• Call the planning office at the number on the city's own website and ask what you owe
• Ignore it. Cities don't bill fees by email

Show the answers

• Wrong move Reply and ask for the payment instructions. Nobody else would know the case number Permit information is public. The FBI warned in 2026 that these emails use real case numbers, real addresses, and the names of real officials, then ask for a wire, a payment app, or crypto.
• Best move Call the planning office at the number on the city's own website and ask what you owe That's the FBI's advice for emails like this. The FBI says the attached invoices tell you to ask for payment instructions by email instead of calling, to deter you from checking with the office.
• Okay Ignore it. Cities don't bill fees by email Safe from this one. But permit fees are real, and you won't know whether you owe one until you ask.

Accurate details come from public records. A fee is real when the office says so on a call you placed to the number on its own website.

Tuesday, 10:20 a.m. The bakery phone rings.

(650) 555-0119

Incoming call · 10:20 AM

1. Caller Hi, I'm calling from Google Maps to check your business hours. This is an automated call, and it's recorded.
2. Caller Will Laurel and Pine Bakery be open on Thanksgiving Day, Thursday, November 26?
3. Caller You can say open, closed, or special hours.

What do you do?

• Say "Closed"
• Hang up. Google doesn't call businesses
• Hang up and report the number to the FTC as a Google impersonator

Show the answers

• Best move Say "Closed" Google says it makes automated calls like this to check hours, and that it won't ask for payment, card details, or passwords. This one asks for what you'd tape to the door anyway.
• Okay Hang up. Google doesn't call businesses Safe, and all you lose is the update. But Google does make these calls. You can set holiday hours yourself in your Business Profile.
• Okay Hang up and report the number to the FTC as a Google impersonator Harmless, apart from losing the update. Google says to report suspicious calls to the FTC, but this one is real: it matches Google's own example call. The fake ones ask for money or promise you a special spot.

Google does call businesses to check their hours. It says it won't ask for money, card details, or passwords. If a call that says it's Google asks for money or promises you a top spot, hang up.

What they’ll ask for

“We’ve changed banks. Please update our remittance details before you pay the next invoice.” Call the vendor at the number in your records, not the one in the email or the bank letter.

“Are you at your desk? I need a quick favor. Keep it between us for now.” Then comes the ask: gift cards, a wire, a new vendor paid today. Call the boss’s saved number.

“This is Google. Your listing will be suspended unless you verify today.” Hang up, and don’t press any buttons even if a recording says to. Google says a caller asking for money to keep you on Google isn’t Google.

“Your domain expires in 3 days.” From a company you don’t pay. Sign in where you bought the domain, check the date there, and renew only there.

An invoice for supplies, ads, or a directory listing nobody remembers ordering. Before anyone pays, find out who ordered it. The FTC says you can keep merchandise you didn’t order, free.

A PayPal invoice for something you didn’t buy, with a number to call “to cancel.” It really did come through PayPal; the scammer wrote the note. Don’t pay it or call the number. Sign in to PayPal yourself and report it there.

“Annual report due.” “Certificate of good standing.” “Labor law posters required.” File only on your state’s own business filing site (in most states, the Secretary of State). Private mailers can look official and charge more than the state does. Federal workplace posters are free from the Department of Labor.

“Beneficial ownership (BOI) report required.” U.S. companies don’t file these anymore. FinCEN, the Treasury office that collected them, never charged a fee and doesn’t send letters asking for payment.

“Your trademark renewal is due.” Look up your trademark on uspto.gov yourself (search “TSDR”). The Patent and Trademark Office posts every real letter asking for payment in your file there. If it isn’t there, it isn’t from them.

“Pay us, or the one-star reviews keep coming.” Don’t pay or reply. Screenshot the demands and the reviews, then use Google’s review extortion report. Google says paying doesn’t guarantee the reviews come down.

“A complaint has been filed against your business. See attached.” Don’t open it. Go to the site or agency it names yourself.

A payment policy to print

Give it to whoever pays the bills.

1. A change to a vendor’s bank details gets a phone call to a number already on file.
2. A payroll change gets confirmed in person or at a saved number.
3. Payments over $______, and anything marked urgent, need a second person to approve.
4. Nobody buys gift cards because of an email or a text.
5. Nobody gets in trouble for slowing down a payment to check.

Then lock down the accounts the money moves through. Business email, online banking, and payroll should sign in with a passkey or an authenticator app; text-message codes are better than nothing. Nobody reads a code to anyone who contacts them.