Small Business Tech Scams
A library of scams that target small businesses—fake invoices, domain notices, AI impersonation—and what to do next.
Business identity theft
Someone uses a real company’s stolen identity to place orders, then may impersonate you too.
Verify new or unusually large orders through a known contact at the company. Watch for sudden address changes, new credit applications, or customers who say they never placed an order.
Domain and trademark “protection” scams
Notices that scare you into paying to “protect” a domain or trademark you already own.
Renew domains only through the registrar you already use. For trademarks, go directly to the USPTO—not a company that mailed you a surprise invoice.
Fake funding offers and predatory MCAs
An upfront fee to “qualify,” or a merchant cash advance that is legal on paper and devastating in practice.
Never pay an upfront fee to qualify for funding. If a cash-advance offer arrives, read the effective cost in dollars before you sign, and talk with an advisor you already trust.
Fake government and compliance mail
Official-looking notices that target new business registrations while filings are still public and fresh.
Ignore a demand to pay a filing fee from a name you do not already work with. Confirm real requirements on the government site you already trust, not from a QR code or phone number on the mailer.
Google review extortion
A wave of fake one-star reviews, followed by a WhatsApp or Telegram demand for money to take them down.
Do not pay. Capture screenshots of the reviews and the demand, then use Google’s extortion report form. Tell customers the truth briefly, and keep talking through a channel you already control.
Labor law poster shakedowns
Mailers stamped “FINAL NOTICE” that warn of huge fines unless you buy workplace posters.
Do not pay. Download the current posters from your state labor department or the U.S. DOL, then recycle the “final notice.”
Ransomware and the data you didn’t know you had
A lock on your files, plus a reminder that most small firms have no specialist watching the door.
Keep backups you can restore without the live computer, turn on multi-factor authentication, and delay any payment decision until you have spoken with someone who does this work. Report the incident to IC3.
The deepfake job candidate
A polished applicant who can pass a video interview and still not be a real person.
Do not make an offer from a video call alone. Confirm identity on a second live call, ask for work samples you can verify, and use a known number rather than a link the candidate just sent.
The fake invoice pile
Unfamiliar bills for tech support, domain registration, or SEO that nobody ordered, often stamped “past due.”
Decide who in your office is allowed to pay a bill. If nobody ordered the work, do not pay it—even if the notice looks overdue.
Vendor payment redirect fraud
The single most expensive thing that can happen to a small business: a look-alike invoice quietly changes where the money goes.
Call the vendor at a number you already had on file. Never use a phone number, link, or “updated banking details” printed in the suspicious message.
Voice-cloned CEO calls
A cloned voice of a founder or manager asking for a rushed payment or a gift-card “emergency.”
Agree on a spoken safe phrase, then call back on a number you already know. Do not follow payment instructions given during an unexpected call or video.
