The scam does not always come in wearing a mask.
Sometimes it comes in wearing a logo.
A bank logo.
A vendor signature.
A government-looking notice.
A “support team” email from software your business actually uses.
That is the part that makes imposter scams so slippery. They do not always feel like fraud when they first show up. They feel like another annoying thing to deal with.
A problem with the bank.
A payment that failed.
A login that needs attention.
A vendor who suddenly needs something.
Nothing dramatic. Nothing that screams, “Call the police.”
Just one more item in the inbox.
And that is usually where the trail starts.
According to the FTC, people reported losing $3.5 billion to imposter scams in 2025. Nearly one in three fraud reports involved an imposter scam. Business impersonators accounted for almost $1 billion in reported losses.
That is not pocket change.
That is a crime scene with a lot of small businesses standing around wondering how the money got out the door.
The answer is usually not complicated.
Someone trusted the wrong message.
The First Clue: It Looks Familiar
Most business owners are watching for the obvious scam.
The weird email.
The misspelled subject line.
The strange request from someone they have never heard of.
But that is not always what shows up anymore.
The better scams look familiar.
They use a company name you recognize. They copy the tone of a real alert. They borrow just enough details to make you pause and think, “This might be real.”
That is the hook.
The scammer does not need you to love the message. They just need you to believe it long enough to click, call, reply, or pay.
A fake bank alert does not need to be perfect. It only needs to make the owner worried.
A fake vendor email does not need to win an award. It only needs to land on the day bills are being paid.
A fake software notice does not need to fool everyone. It only needs one busy person to type in a password.
Fraud does not need a wide-open door.
Sometimes it just needs one unlocked side entrance.
How the Setup Usually Works
The details change, but the bones of the scam are usually the same.
First, there is a problem.
Your bank account has suspicious activity.
Your payroll did not process.
Your payment failed.
Your account is frozen.
Your tax payment is overdue.
Your vendor changed bank accounts.
Your package cannot be delivered.
Then comes the costume.
The bank.
The IRS.
The vendor.
The payroll company.
The software provider.
The delivery company.
The payment processor.
Then comes the order.
Click this link.
Call this number.
Confirm this code.
Reset your password.
Update the payment information.
Move the money.
Let us remote into your computer.
And then comes the pressure.
Do it now.
Do not wait.
Your account may close.
Your funds may freeze.
You could be penalized.
You could lose access.
That is when the magnifying glass needs to come out.
Because pressure is not just a sales tactic in these scams. It is evidence.
The scammer wants the business moving faster than its own process. They want the employee thinking about the emergency, not the source. They want the owner worried about the account being frozen, not whether the phone number is real.
That is the trick.
Create panic.
Borrow authority.
Push action.
Disappear.
The Fake Bank Alert
One of the ugliest versions starts with a bank alert.
The message says there is suspicious activity. It looks official enough. Maybe it even has the bank’s name and a phone number.
So the owner calls.
That feels responsible. That feels like the right thing to do.
But the number in the message does not go to the bank.
It goes to the person pretending to be the bank.
Now the scammer has the owner on the phone. They sound calm. They sound trained. They may say all the right things.
Then they say the account is at risk and the money needs to be moved to keep it safe.
That sentence is the smoking gun.
Move the money to keep it safe.
No.
That is not a security procedure.
That is the heist.
The criminal does not have to hack the account if they can convince the owner to transfer the money voluntarily. No broken password. No complicated system breach. Just a believable voice, a fake emergency, and a rushed decision.
That is why this kind of fraud is so dangerous.
The crime can happen while the victim thinks they are preventing one.
Why Small Businesses End Up in the Crosshairs
Small businesses are built on trust and speed.
That is good for business.
It is also good for scammers.
Think about a normal day inside a small business. Bills are waiting. Payroll has a deadline. Customers need answers. The owner is pulled in five directions. The office manager is juggling ten different things. The bookkeeper is trying to close the month. Someone is always asking, “Can you handle this real quick?”
That “real quick” is where fraud likes to hide.
The scammer is not counting on you being foolish.
They are counting on you being busy.
They know most small businesses do not have a fraud department. There is no security team reviewing every message. No committee checking every payment change. No investigator sitting in the corner with a flashlight and a notebook.
Usually, it is one person trying to make the problem go away so they can get back to work.
That is exactly the person the scam is written for.
The Clues Your Team Should Not Ignore
Every scam leaves clues.
The trick is teaching your team to notice them before the money moves.
A message says money must be moved to keep it safe.
Clue.
A vendor suddenly changes payment instructions.
Clue.
Someone asks for a login code, password reset, authentication code, or remote access.
Clue.
The sender says not to tell anyone.
Big clue.
A bank, vendor, or agency gives you a special link or phone number and tells you to use only that.
Clue.
There is a threat of immediate penalties, account closure, legal action, suspension, or frozen funds.
Clue.
The payment method feels strange. Wire transfer. Gift cards. Crypto. Payment app. A portal nobody has used before.
Clue.
One clue does not always prove fraud.
But it does mean you stop treating the message like a normal errand.
Now it is a suspect.
And suspects get verified.
“Be Careful” Is Not Enough
A lot of small businesses think they have a fraud plan because they told everyone to be careful.
That is not a plan.
That is a wish.
“Be careful” breaks down the second someone is rushed, tired, behind, or scared. And let’s be honest, that is most business days.
One employee thinks careful means reading the email again.
Another thinks it means clicking the link but not entering anything.
Another thinks it means forwarding the message to the owner with, “Is this okay?”
That is not control.
That is everybody making up their own rule in the moment.
Fraud prevention has to be boring enough to follow and clear enough to remember.
Build a Trusted Contact List
Start with the basics.
Make a list of the real phone numbers and websites your business uses.
Your bank.
Payroll provider.
Insurance company.
Tax professional.
Main vendors.
Payment processor.
Software platforms.
Then make one rule:
If an urgent message comes in, do not use the contact information inside that message.
Use the list.
Not the link in the email.
Not the phone number in the text.
Not the number the caller gives you.
The list.
That one habit can ruin the scammer’s whole plan.
Because if the message is fake, the scammer needs you to stay inside their little fake world. Their link. Their phone number. Their instructions. Their timeline.
The minute you step outside of that and call the real number, the story starts falling apart.
Treat Payment Changes Like Evidence
A request to change bank information should never be treated like a normal email.
It should be treated like evidence.
Maybe it is real.
Maybe it is not.
But nobody should move money based on an email thread alone.
If a vendor sends new ACH instructions, call the contact already on file. If someone asks for a wire, verify it outside the email. If payment details change, slow the whole thing down.
Yes, it takes extra time.
So does trying to recover stolen money.
And one of those is a lot cheaper than the other.
Add a Second Set of Eyes
Scammers like isolation.
One person.
One message.
One rushed decision.
Break that pattern.
The person who receives a payment-change request should not be the only person approving it. Before money moves, someone else should look at it and ask the boring question that saves businesses:
“Did we verify this using a known number?”
That is it.
Not complicated. Not fancy.
Just enough friction to keep panic from turning into a payment.
Make This Rule Non-Negotiable
No one gets to tell your business to move money to “protect it.”
Not a caller.
Not an email.
Not a text.
Not someone who sounds official.
If someone says funds need to be transferred to keep them safe, treat that as fraud until proven otherwise.
Real banks do not need you to move your money into a mystery account for safekeeping.
That is not fraud prevention.
That is the getaway car pulling up to the curb.
Report the Attempt
If your business loses money, report it.
If the scam almost worked, report it.
If someone is impersonating your bank, vendor, or business, report it.
The FTC directs consumers and businesses to ReportFraud.ftc.gov for fraud, scams, and bad business practices.
Will one report solve everything? Probably not.
But reports create a trail. And trails matter.
That is how investigators connect one victim to another. It is how patterns show up. It is how the same scam stops looking like a one-off and starts looking like the operation it really is.
The Detect-A-Fraud Takeaway
Imposter scams work because they steal trust before they steal money.
They borrow a name.
They create a problem.
They add pressure.
Then they try to move the victim before anyone has time to check the facts.
So check the facts.
When the message feels urgent, slow down.
When payment instructions change, verify.
When someone says not to tell anyone, tell someone.
When money is about to move, get another set of eyes on it.
The scammer wants you inside the panic.
Your job is to step outside the message and follow the trail.
Call the known number.
Use the official website.
Ask one more question.
Make one more check.
That is not overreacting.
That is how you keep the money from walking out the door with a fake badge.
