Scams Aimed at Businesses

Business email compromise, or BEC, is fraud in which a criminal uses a real or fake business email identity to trick someone into sending money or sensitive data. It is the headline number, but it is only one of the ways a small firm gets hit. The same FBI report lists 47,794 tech support fraud complaints with $2,134,675,818 in losses, 32,424 government impersonation complaints with $797,943,193, and 3,611 ransomware complaints with more than $32 million in reported losses. The FBI notes that the ransomware figure leaves out lost business, time, wages, files, equipment and the cost of cleanup, so the true cost is higher. All figures here are as of October 2026 and come from the report released in April 2026.

The trend is up. The 2024 report showed 21,442 BEC complaints and $2,770,151,146 in losses. The 2025 figure of $3,046,598,558 is about 10 percent higher. Total reported losses across all crime types went from $16.6 billion to $20.877 billion over the same two years.

The FTC tracks a different set of reports, mostly from consumers and some from businesses. Its June 2026 release said people reported losing about $3.5 billion to imposter scams in 2025, with reported losses to business impersonation near $1 billion, and government impersonation about $920 million. Those figures count people who reported to the FTC. They show the scale of the problem and not the exact loss to any one kind of firm.

The pattern behind every business scam

The scams below look different on the surface. Underneath they borrow the same levers. Learn to feel them and you will spot ones that have not been invented yet.

• A name you trust. The owner, a long-time supplier, the bank, Microsoft, the state, the IRS, an SBA loan officer.
• A deadline. "Today," "before the wire cutoff," "your account will be suspended," "past due."
• Secrecy or isolation. "Keep this between us," "I am in a meeting and can't talk, just text," "do not tell accounting."
• An unusual way to pay. Wire transfer, a changed bank account, gift cards, cryptocurrency, a payment app, or a QR code. The FTC's small business guide puts it plainly: scammers pretend to be someone you trust, create urgency or fear, and ask you to pay by wire transfer, cryptocurrency or gift card, and the FTC says not to pay anyone who demands payment this way.

Any request that pulls two or more of those levers at once goes to the callback procedure. No exceptions for how real it looks.

Tool one: the verification callback

A verification callback means phoning the person who supposedly sent the request, on a number you already had, to confirm it. The FBI's advice in its BEC announcements is to confirm requests to change account details through a separate channel from the one the request came in on. A callback is the cheapest version of that advice. It costs about five minutes.

The weak point is the phone number. If you call the number in the email, you reach the criminal. Write the procedure down so nobody has to improvise under pressure.

1. Stop and do not reply. Do not answer the email, text or voicemail. Do not click anything in it. Replying can send your question to the criminal, who will happily confirm himself.
2. Pick the number from a trusted source. Use the vendor record you created when you first set them up, the number on an earlier paid invoice or contract, or the number on the company's official website that you typed in yourself. For a person inside the company, use the staff directory or their saved mobile number. Never use a number from the request, from the email signature of the request, or from the caller ID of a call or text that just arrived.
3. Call and ask a question the email cannot answer. "Can you confirm the last invoice number we paid you and the amount?" or "Which contact at your company does your bank details on file with us?" Pick a detail a criminal reading one email would not know.
4. Read the new details back, aloud. Say the account number, routing number and payee name from the request and have the real person confirm each. Do not accept "just trust the email."
5. Write it down. Record the date and time, who you spoke to, the number you used, and where that number came from. Put it with the payment record. This takes one minute and gives the auditor, the bank and the insurer something solid.
6. Get a second approval before anything changes. See the dual-approval rule below. The person who confirmed by phone should not be the only person who approves.
7. If the number does not work, or the person is unreachable, wait. A real vendor will call back. A missed payment by a day costs a late fee. A wrong payment can cost the invoice. The FTC's advice on invoices is the same in spirit: have staff check all invoices carefully and set clear procedures for approving purchases and invoices from vendors you actually use.

Tool two: the dual-approval rule

Dual approval means two different people must approve a payment, or a change to where a payment goes, before it takes effect. One person alone is the weak point in nearly every story in this lesson. The bookkeeper trusted an email. The assistant trusted the boss. The owner was traveling and approved from a phone. A second person who sees the request fresh, with the callback notes in front of them, catches what the first person missed.

Here is a version that fits an office of 5 to 50. The dollar thresholds are examples. The owner sets the real ones based on what a single loss would do to the business.

These details make the rule work.

• The requester cannot be the approver. If the assistant enters the payment, the owner or a second staff member approves it. If the owner makes the request, someone else approves.
• It applies to the owner. A criminal who pretends to be the owner is borrowing the rule's blind spot. If the owner is exempt, the scam works. The owner should say, in writing and out loud, that the rule covers everyone and that staff who pause a request from the owner are doing the right thing.
• Use the bank's tools if they exist. Many business banks offer dual authorization for online payments, payment limits, alerts, and filters on incoming ACH debits and checks. Which ones your bank has, the setup and the fees differ, so ask your banker for the list and a written quote. Turn on alerts for every outgoing wire and every new payee.
• Keep a change log. One spreadsheet or a page in the accounting system: date, what changed, who asked, who called whom at what number, who approved. When a fraud happens anyway, the log shows what went wrong, and the bank and the insurer will want it.

Scam by scam: how it works, the tell, the control

Business email compromise and email-borne payment fraud

How it works. The FBI describes BEC as criminals taking over legitimate business or personal email accounts, or faking them, to cause unauthorized transfers of money or to request employee information or W-2 forms. It happens by takeover or by faking. In the first, a criminal takes over a real mailbox, often yours or a vendor's, after stealing the password with a phishing page. They read the mail for weeks, learn who pays whom and when, and then insert a message into a real thread: "Our bank has changed, please use these details." In the second, they set up a lookalike address, such as accounts@cobaltcreekprlnting.example with an l in place of the i, and write to one person in your office.

The tell. A change of payment method or account that arrives by email. A sender address that looks right at a glance but differs by a character, or a Reply-To address that does not match the From address. Urgent wording and a request to keep it quiet. Slightly off tone from a sender you know. On a phone, the display name shows and the address does not, so the FBI advises configuring email clients to show full addresses, especially on mobile devices.

The control. Money details never change on the strength of an email. The callback and the dual-approval rule handle this one. Add multi-factor authentication on every mailbox (lesson 02), because it stops the first kind of attack, and check for hidden forwarding rules (lesson 05). If your own mailbox is taken over, vendors may get fake bank-change emails from you, so tell them to expect callbacks on your side as well.

Fake invoices and vendor bank-change fraud

How it works. The first form is the bank-change request above, aimed at a real invoice you owe. The second form is an invoice for something you never ordered. The FTC's small business guide and its May 14, 2026 consumer alert describe invoices for products or services the business never ordered, such as tech support, domain registration or search engine optimization, some marked "past due" to create urgency, and note that some arrive as phishing emails meant to get at a business's data and network.

The tell. A vendor name you have no record of. A total slightly below your approval threshold. A bank account in another state or a different name from the vendor. A purchase that no one remembers requesting. A "free" listing or offer that suddenly has a bill.

The control. Match every invoice to a purchase order, a contract or a work order before paying. No match, no payment. The FTC says you may keep unordered merchandise and that staff should research unfamiliar companies, searching the company name with words like "review," "scam" or "complaint" before paying. Keep an approved vendor list in the accounting system. A name that is not on the list gets a callback and a second approver.

The boss request, gift cards and "are you at your desk?"

How it works. A text or email arrives that appears to come from the owner or a manager: "Are you available? I'm in a meeting. I need gift cards for clients, buy ten and send me the codes, I'll pay you back." Or it asks for a wire, or for a copy of the employee list. The sender knows names and roles because that information is on your website and on social media. The text comes from a number you have never seen, using the owner's name.

The tell. A new number or address. A request that bypasses normal channels. Gift cards, wire, cryptocurrency or "just handle it and don't mention it." Short messages with some urgency and no detail. The FTC's guide advises training employees not to send passwords or sensitive information by email even when the request seems to come from a manager, and not to trust caller ID.

The control. The owner announces, in a staff meeting and in writing, that they will never ask for gift cards or an urgent payment by text or email, and that any such request is to be ignored. Staff call the owner on the saved number. The dual-approval table treats gift cards as never. Lesson 07 covers the phone side of this scam.

Payroll diversion and W-2 requests

How it works. The FBI's BEC announcement of September 2019 describes payroll diversion: spoofed emails that appear to come from an employee ask HR or payroll to change the direct deposit details, often to a prepaid card account. Some start with a phishing email that captured the employee's login, so the request really does come from that person's mailbox. A related variant asks HR to send W-2 forms or employee lists, with no money transfer at all. The stolen data then feeds tax and identity fraud, and lesson 09 covers the records side.

The tell. A change of deposit account sent by email shortly before payday. A new account at an online bank or prepaid card. An employee who "cannot talk" and asks that it happen before the cutoff. A request for many employees' data at once.

The control. Payroll changes happen through the payroll system's employee portal, with the employee signed in and two-step sign-in on, or in person with ID. If the change comes by email, call the employee on the saved number and have a second person approve. Never email W-2 batches, and never send them to anyone who asks without a callback to the real requester.

Tech support and Microsoft impersonation

How it works. According to the FTC, scammers use fake pop-ups that imitate well-known brands and urge you to call a number. They may call or text while posing as technicians, or buy search ads so that their number appears when you look for help. Once connected, they ask for remote access, claim to find malware and offer to remove it for a fee, payable by gift card, wire, cryptocurrency or payment app. Others send fake renewal notices for security or "Geek Squad" style subscriptions and then claim you were overpaid and ask you to send back the difference. The FBI's 2025 report counts 47,794 tech support complaints and $2,134,675,818 in losses.

The tell. The FTC says real security pop-up warnings will never ask you to call a phone number, and that legitimate tech companies do not contact you by phone, email or text to report a computer problem. A browser tab that will not close and plays an alarm is the usual setup.

The control. Staff close the browser (or power off if it will not close), do not call the number, and tell the office manager. If someone already gave remote access, disconnect the computer from the network and follow the playbook below. Your real IT provider, or the vendor whose support number you already hold, is the only place to get help. Lesson 05 covers remote support sessions and lesson 06 covers remote access tools.

Fake domain renewals, directory listings and "compliance" mailings

How it works. A letter or email looks like an invoice from a registry or the state: "Your domain expires," "Annual directory listing," "Compliance filing required." The amounts run from $50 to several hundred dollars. The FTC guide warns about "free" listings that turn into large bills and calls to "confirm" your information, which can be recorded and played back as proof that you agreed. It also lists threats to your website URL, fake federal Patent and Trademark Office fee demands, and overpriced "required" labor-law posters that are free from the U.S. Department of Labor. In Idaho, the Attorney General and Secretary of State warned on April 13, 2023 about mailings that advertise business compliance filings such as certificates of existence or UCC statements, resemble government forms, demand large fees and carry deadlines. The release said Idaho businesses rarely, if ever, need the advertised documents.

The tell. A company you do not know presenting a "notice" with a deadline. Language such as "final notice," a payment address that is a drop box, and a form that resembles a state filing. For a domain, a renewal notice from a company that is not the registrar where you bought it.

The control. Keep a short list of what you actually have: the registrar for your domain, the renewal date, and the person who gets those notices. Log in directly to the registrar to see the real date. For state filings, go directly to the Secretary of State's website for annual reports and official documents, as the 2023 release advises. Anything else gets filed in the "scam" folder. If you lost money to one, file a complaint with the Idaho AG's office.

QR codes and quishing

How it works. Quishing is phishing that uses a QR code, the square barcode a phone camera reads. The code leads to a fake sign-in or payment page, and a QR code in an email image gets past some filters that only scan text links. The FBI's January 2022 announcement warns that criminals tamper with both digital and physical QR codes, swapping in malicious ones, and that they can replace a business's payment QR code so that customers' payments go to the criminal. Its advice includes checking the URL after scanning, inspecting physical codes for stickers or overlays, not downloading apps from QR codes, and calling a company on a number from a trusted source if it says a payment failed and you can only pay by QR code.

The tell. A code in an unexpected email about a "security update," "document to sign" or "voicemail." A sticker over a printed code on a parking meter, a table tent or your own counter sign. A short, odd web address after scanning.

The control. Treat a QR code in an email the same as a link in an email: do not scan it. Type the address yourself. Check your own counter and window QR codes weekly for stickers. If you take payments by QR code, print the code on something that is hard to cover and check it as part of the opening routine.

Fake invoices from payment and accounting services

How it works. Criminals send real-looking invoices or payment requests through a payment service, so the email genuinely comes from that service, or they send a copy of one by regular email. PayPal's help page says fraudsters send invoices or money requests, sometimes for items you never ordered, and that some invoice notes urge you to call a fake customer service number to collect personal or financial details. The same pattern shows up in accounting and invoicing tools that let anyone send a bill.

The tell. An invoice for something nobody ordered. A note in the invoice telling you to call a number right now. A request to pay in cryptocurrency.

The control. PayPal's advice is not to call phone numbers in the invoice note or open suspicious links. Sign in directly through the website or app to check whether the invoice is real. Do not pay a suspicious invoice, report it inside the account, and forward suspicious emails to phishing@paypal.com, then delete them. The same rule applies to any service: log in the usual way, do not follow the link in the message. Match the invoice to a purchase order before paying.

Ransomware extortion

How it works. Ransomware is malicious software that locks your files and demands payment to restore access. CISA's #StopRansomware guide also says attackers may threaten to release stolen data to pressure victims. The usual way in is a phishing email, a stolen password, or an exposed remote-access service. Lesson 03 covers backups and prevention in detail, and lesson 10 covers the response.

The tell. Files that suddenly will not open, with a note on the screen. A second wave: an email to the owner claiming that data was stolen and will be posted unless paid. Sometimes the "stolen data" email is a bluff sent to many firms.

The control. CISA's guide lists the controls that matter most: keep offline, encrypted backups and test them; require phishing-resistant multi-factor authentication, especially on email and remote access; patch internet-facing systems quickly and do not expose remote desktop to the internet; use least privilege and separate admin accounts; train staff to spot and report phishing. On payment, the guide does not make a recommendation but says to consult federal law enforcement before deciding. Report to CISA, your local FBI field office or IC3, or the Secret Service. CISA's number is 1-844-729-2472.

SEO, Google Business Profile and "your listing is suspended" calls

How it works. A caller says they work "with Google" or "for Google" and warns that your business listing will be removed, marked closed, or pushed down unless you pay or verify now. Or an agency promises first-page ranking for a monthly fee and then delivers nothing. Google's help page for Business Profile says that Google will never ask you for private or sensitive information, will not ask for payment information over the phone, will not guarantee a special spot, and will not ask you to sign up for a service or pay money. It lists "with Google" and "for Google" callers as red flags.

The tell. A cold call or text about your listing, ranking or reviews. Pressure to pay today. Promises of a guaranteed position. Offers to delete bad reviews or post good ones, which the FTC guide says is both a scam and illegal.

The control. Hang up without pressing any buttons, as Google advises. Manage your listing by signing in to your own Google account. Before you hire any marketing firm, ask for client references you contact yourself and read the contract for what is actually delivered. Report the call to the FTC at ReportFraud.ftc.gov or to donotcall.gov, and send details to Google through its Business Profile complaint form.

Fake government: tax agencies, state offices and SBA loans

How it works. A caller or letter claims to be from the IRS, a state agency, the Secretary of State or the Small Business Administration. It threatens suspension of a license, a penalty or a lawsuit, or it offers a grant or a loan approval that needs a fee first. The FBI's 2025 report counts 32,424 government impersonation complaints with $797,943,193 in losses. The FTC guide lists fake utility shutoff notices, fake government threats to suspend licenses or sue, and fake grants. The SBA's inspector general page says the SBA only sends email from addresses ending in @sba.gov, never charges applicants for disaster assistance, inspections or help with applications, and that any offer to approve a loan that requires payment up front is a warning sign. The FTC's tech support page adds that government agencies will not tell you to move money to protect it or put it in a "federal safety locker."

The tell. Payment demanded by gift card, wire or crypto. Threats and short deadlines. An email address that is not .gov or @sba.gov. A "grant" you did not apply for.

The control. Real agencies do not demand payment by gift card, and they will accept you hanging up and finding their number yourself. Look up the agency's number on its own website, call it, and ask whether the notice is real. Report SBA fraud to the SBA Office of Inspector General hotline and everything else to the FTC.

Voice clones and deepfake video requests

How it works. A deepfake is a video or audio clip made or altered with AI so that a person seems to say or do something they did not. The FBI said in December 2024 that criminals use generative AI to make fake social media profiles, forged IDs, cloned voices of relatives and fabricated videos of executives or officials, and that generative AI reduces the time and effort needed to deceive targets. In May 2025 the FBI described a campaign, active since April 2025, using text and AI-generated voice messages to impersonate senior U.S. officials. The 2025 IC3 report counted 22,364 AI-related complaints with $893,346,472 in losses, including over $30 million in BEC losses with AI involved. In a widely reported 2024 case, Hong Kong police said a finance worker at a multinational firm joined a video call with people who looked and sounded like colleagues, all of them fakes, and transferred about US$25.6 million (HK$200 million).

The tell. A voice or video request for money or secrets, from someone who cannot be reached another way, with a deadline. The FBI says to listen for unnatural tone or word choice, and to look for distorted hands, odd teeth or eyes and inconsistent shadows in video. Do not rely on these. The fakes improve every year.

The control. Do not treat a familiar voice or face as proof. The FBI's advice is to hang up and call back on a number you find independently, and to agree on a secret word or phrase with family members. Offices can do the same: choose a code phrase with the owner and finance contact that is never written in email, and ask for it on any unusual money request. The callback rule and the dual-approval rule apply to calls and video meetings exactly as they do to email. A video call is not a second approver.

Supply-chain compromise and fake job applicants

How it works. Quieter versions exist too. In the first, a vendor you trust has its own email taken over, and the bank-change request or the infected attachment comes from their real address. In the second, a person applies for a remote job using a false identity. The FBI said in January 2025 that North Korean IT workers had moved from getting hired under false identities to data extortion, holding stolen proprietary data and code for ransom. It noted that these workers have used AI and face-swapping technology in video interviews and have reused phone numbers and email addresses across applicants. Its advice to employers includes verifying identity during interviews, onboarding and employment, cross-checking applicants for duplicate resume content or contact information, watching for changes to addresses or payment platforms during onboarding, asking soft questions about location and education, auditing third-party staffing firms, and conducting hiring and onboarding in person wherever possible.

The tell. A vendor whose email suddenly includes odd attachments or new payment steps. A remote candidate who will not appear on camera cleanly, who changes the mailing address or payment platform during onboarding, or whose references and phone numbers recur across other applications.

The control. Any vendor change still goes through the callback. For hiring, confirm identity against a government ID in person or on a live video with a document check, call references on numbers you look up, and give new hires only the access they need at first (lesson 02, least privilege). Mail company laptops to the address on the verified ID and not to a changed one.

At a glance: scam, tell, control

The admin assistant playbook

In a small office, the person who opens the mail, reads the shared inbox, answers the phone and pays the bills is the target. Criminals research who that is. This is the part of the lesson to print and keep at the desk. It is written to that person, but the owner should read it too, because most of it depends on the owner backing it up.

What the owner gives you first

• A written line that says: "Any person in this office may pause any payment, account change or request for data to verify it, and no one will be blamed for the delay, including when the request appears to come from me."
• The dual-approval table, signed and posted.
• A list of phone numbers for the bank's business fraud line, the outside IT provider, the cyber insurer's hotline if there is one, and the owner's mobile number, all kept on paper at your desk and in the password manager.
• A named backup person for when you are out. Criminals call when the regular person is on vacation.

Your daily habits

1. Read the full sender address, not the name. On a phone, tap the name to show the address. Check the part after the @ sign, character by character, when money or data is involved.
2. Do not use links or numbers in the message. Open the bank, vendor portal or accounting tool by your own bookmark or by typing the address.
3. Keep the vendor file clean. Each vendor record has the real contact, the number you call, the bank details and the date you last verified them. Re-verify once a year.
4. Match before you pay. Invoice, purchase order and delivery or work done. If any of the three is missing, hold it.
5. Watch the mailbox for odd rules. Once a month, look at the mail rules in your email settings for anything forwarding or deleting messages that you did not create. Lesson 05 shows how.
6. Keep a fraud-attempt log. One line per attempt: date, what it was, what you did. Review it with the owner quarterly. The pattern teaches the whole office what is coming.

Scripts for the moment

Under pressure, nobody thinks of the right words. Keep these where you can see them.

If you already clicked, paid or gave access

It happens to careful people. What matters is the first fifteen minutes, and blame costs you minutes. The owner should have said in advance that you will not be punished for reporting at once.

1. If money moved, call the bank first. Use the business fraud line, not email. Say "this is a business email compromise, I need a wire or ACH recall," give the amount, the time, the receiving bank and account number, and ask them to contact the receiving bank. The FBI advises contacting your financial institution immediately to request a recall of funds. In 2025 the FBI's Financial Fraud Kill Chain handled 3,900 incidents with $1,163,919,846 in attempted theft and froze $679,013,183, a success rate of 58 percent. Speed is the variable you control.
2. Tell the owner by phone. Then the outside IT provider.
3. If you entered a password, change it from a different, clean device, starting with email, then banking, then payroll. Sign out all other sessions.
4. If someone had remote access to your computer, unplug it from the network (pull the cable or turn Wi-Fi off). Do not wipe it. Your IT provider needs it as it is. Change passwords from another device.
5. Keep the evidence. Do not delete the email, text or voicemail. Take screenshots, save the full email headers if you know how, and note times. Write down every account number, name and phone number used.
6. Call your cyber insurer's hotline if you have a policy. Many policies set time limits on notice.
7. File the reports listed in the Reporting angle below, and log the incident.
8. Tell the vendor or employee being impersonated using a trusted number, so they can secure their own accounts.

Lesson 10 has the full first-hour, first-day and first-week checklists and a one-page incident card.

Do this this week

Who does what

Questions and answers

How much does the callback add to a normal payment?

Five to ten minutes, and only on the cases that matter: account changes, new payees, wires and anything urgent. Routine payments to existing vendors with unchanged details do not need a call.

What if the vendor's only phone number is the one in the email?

Then you do not have a verified number yet. Find the company's number through its website, typed in by you, or through a contact you already know, and ask to speak to someone in accounts receivable. For a brand new vendor, take extra time before the first payment, and pay by a method you can reverse, such as a card, until you have a history.

Does the dual-approval rule work in a five-person office?

Yes. In a five-person office the second approver is usually the owner or the other person who handles money. If both of them are out, the payment waits. For a one-person office with no staff, use the bank's tools: alerts, limits and a trusted outside person, such as an outside bookkeeper, who sees every new payee.

Which payment methods are safest against these scams?

A card payment can often be disputed. A wire is almost impossible to pull back unless the bank acts within hours. ACH is in between. Gift cards, cryptocurrency and payment apps used to send to a stranger are the scammers' favorites, because money is hard to get back. The FTC says to not pay anyone who demands payment by wire, cryptocurrency or gift card.

How do I check whether an email is a lookalike?

Expand the sender address and compare it, letter by letter, to the address in your records. Watch for swapped letters (rn for m), added words (billing-example.com) and different endings (.co for .com). Your email provider may add a warning banner for external senders or for new senders. Turn that setting on.

Should we pay a ransom?

CISA's guide does not recommend for or against. It says to consult federal law enforcement and report the incident. Lesson 10 lays out the facts to weigh. The cheapest answer is tested offline backups made before the attack.

How do we handle a request for a W-2 or the staff list?

Call the person who supposedly asked, on a saved number. Get a second approval. Send the data through a secure channel and not plain email. If the request is from outside the company, such as an accountant, confirm it with the accountant's office on a number you already hold.

Are small payments safe?

No. Many fraud crews stay under thresholds on purpose. Small unfamiliar charges, such as a $79 renewal, add up across a year and across a customer list. Match every invoice to an order, whatever the size.

What should I do with an email that I think is a scam but did not act on?

Report it. Forward phishing to the Anti-Phishing Working Group at reportphishing@apwg.org, as the FTC advises, and report fake invoices and scams at ReportFraud.ftc.gov. Tell your coworkers the details of the pitch, because the same crew often emails several people. Then delete it.

Do we need a special policy for deepfakes?

No new policy. Extend the existing rule: a voice or video request never replaces the callback and the second approval. Add the code phrase for the highest-risk requests, and decide who is authorized to ask for money by phone at all.

Hard questions

"Calling our vendors back will insult them."

Real vendors expect it. Their own banks teach them that account changes are a favorite fraud, and many have a published procedure. A vendor who pushes back on a callback to a number you hold is telling you something. Start with a short note on your invoices and purchase orders: "We confirm all bank changes by phone to a number on file."

"The owner will override the rule when he is in a hurry."

That is the most common failure. Put the rule in writing and have the owner sign it. Then give the owner something easier than overriding: a one-tap approval on a phone through the bank's tool, so the second approval takes thirty seconds. If the owner still overrides, the staff member logs it in the change log. An override with no record is how the fraud gets approved.

"We have caller ID, and it matched the vendor's number."

Caller ID can be faked, which is why the FTC advises not to trust it. A call from the right number is not proof. Hang up and dial the number from your own records.

"We bought cyber insurance, so a payment fraud loss is covered."

Maybe, maybe not. Some policies limit or exclude losses where an employee was tricked into sending money, or cap them at a small sublimit, and some require the insurer to be told within a short time. Read the policy's wording on funds transfer fraud or social engineering and the notice requirement, and ask the agent or insurer to confirm in writing how your controls (callback, dual approval) affect coverage and the application. Lesson 11 covers the application questions.

"Training won't stop a determined scammer. Why bother?"

A process stops what training cannot. Even a well-trained bookkeeper has bad days. The callback and the second approver do not depend on anyone's mood. Training teaches people to notice, and the process gives them an action to take that does not rely on being right about whether the message looks real.

"We pay everything by check and mail, so email fraud cannot hit us."

Fake invoices, fake vendors and check washing still happen, and checks can be altered. Ask your bank about check-fraud filters, review the register monthly, and match invoices to orders. Payroll and customer-data requests also arrive by email whatever your payment method.