One of the most expensive scams aimed at small businesses involves no virus at all. It is an email that looks like it came from a vendor, a client or your own boss, asking for a payment or a change to bank details. Once the money is wired, it is often gone for good.
How these scams usually work
- The changed bank details: a “vendor” emails to say their bank account has changed and asks you to update it before the next payment.
- The urgent request: an email that appears to come from an owner or manager asks for a quick wire or gift cards, often while they are “in a meeting.”
- The real conversation, hijacked: a criminal who has broken into someone’s email account replies inside a genuine thread, so everything looks normal.
Warning signs to watch for
- Any request to change payment or bank details
- Urgency, secrecy or pressure to skip the normal process
- A sender address that is slightly different from the usual one
- Requests for gift cards or unusual payment methods
- A tone or signature that does not quite match the real person
Habits that stop payment fraud
- Verify by phone. Confirm any change to bank details by calling a number you already have on file, never one from the email.
- Use two people for large payments. A second approval catches mistakes and scams.
- Slow down urgent requests. Real emergencies can survive a five-minute phone call.
- Turn on multi-factor login. It makes it much harder for criminals to take over email accounts in the first place.
Training makes the difference
These scams target people, not computers, so the best defense is a team that recognizes them. Short, regular training and realistic practice emails build the habit of pausing before paying.
Our security awareness training covers payment fraud, phishing and password habits in short, practical lessons. Start with a free IT and security checkup to see where your business stands.
