Fraudsters don’t need inside access to learn about your business. Your website, social media, employee profiles, and even job postings can provide details they can use to make a fake email, invoice, or payment request more believable.
The goal isn’t to pull your business offline or worry about every piece of information you share. It’s to close some of the easy openings and put simple safeguards in place that make your business a much less attractive target.
Here are eight practical steps you can take to reduce what scammers can learn about your business and make it harder for them to turn that information into fraud.
#1: Search Online for Your Business (Like a Scammer Would)
Let’s start with a quick 15-minute exercise. Search your company name. Then search the names of the owner, office manager, bookkeeper, and anyone who handles money. Look at your website, LinkedIn, Facebook, Instagram, and other public profiles. Ask yourself the following questions:
- Can you identify who handles the finances?
- Can you find direct mail addresses?
- Can you determine when the owner is traveling (even if it’s you)?
- Can you identify your vendors, software providers, or financial partners?
You don’t need to remove everything. But if information doesn’t need to be public, consider taking it down. For example, instead of publishing direct employee email addresses, consider using general addresses such as accounting@company.com or contact@company.com when appropriate.
Smart move: Every few months, review what your website, social accounts and employee profiles reveal about your business. Pay particular attention after staffing changes, website updates or new vendor relationships. If a detail could help someone impersonate an employee, vendor or business partner, ask whether it really needs to be public.
#2: Don’t Announce When Decision-Makers Are Away
Posting that you’re headed to a conference, sharing vacation photos in real time, or tagging your location at a business event may seem harmless. But those posts can also tell someone that the person who normally approves payments or makes key decisions is away from the office.
And that information can make an impersonation attempt much more believable. For example, an employee might receive a message that says, “I’m at the conference and can’t talk. I need this paid before 3:00. Can you take care of it?” When the employee already knows the owner is traveling, the request may not immediately raise a red flag.
Smart move: Consider posting conference updates or vacation photos after the fact, and make sure employees know that normal payment and verification procedures still apply when someone is out of the office.
#3: Change Your Out-of-Office Message
An automatic out-of-office reply can share more information than you realize. Listing the exact dates you’ll be away, why you’re gone, and who is handling invoices or payments gives anyone who emails you useful details about your business. A message such as, “I’ll be out August 12–18. For invoices, contact Jamie Smith,” confirms that you’re unavailable and identifies the person a scammer may want to target next.
Keep automatic replies simple and limit details about your absence. Avoid identifying employees who handle payments or other sensitive responsibilities unless it’s necessary. If you need to provide an alternate contact, consider whether that information needs to be included in an automatic response sent to everyone who emails you.
Smart move: Check whether your email system allows you to create separate out-of-office messages for coworkers and people outside your organization. You can give employees the details they need while keeping the external message brief and general.
#4: Create a “Never by Email Alone” Rule
Some requests should never be completed based solely on an email, text, or direct message, no matter who appears to have sent it, including:
- Changes to vendor bank accounts or payment instructions.
- Wire or ACH requests outside your normal process.
- Requests to purchase gift cards.
- Changes to employee direct deposit information.
- Requests for passwords or verification codes.
- Unexpected requests for sensitive employee or customer information.
Always verify these requests through a second, trusted method. For example, if a vendor emails new payment instructions, call the vendor using the phone number already in your records, not the number provided in the email.
Smart move: Create a short list of transactions that always require independent verification and make sure every employee who handles money knows the rule.
#5: Make Sure One Person Can’t Do Everything
In a small business, it’s common for one trusted employee to handle multiple financial responsibilities. While that may be efficient, it can also create risk if that employee’s account is compromised or they receive a convincing fraudulent request. Consider requiring a second person to approve larger or unusual transactions, payments to new recipients, or changes to existing payment information. It adds an extra layer of protection without adding a complicated process.
Smart move: Set a clear dollar amount that requires a second approval, and require two-person approval anytime money is being sent to a new recipient, regardless of the amount.
#6: Clean Up Your Vendor List
Fake invoices can look surprisingly legitimate, making them easy to mistake for a bill your business actually owes. Maintain a current list of approved vendors, including trusted contact and payment information, and verify any new vendor or change in payment instructions before sending money. An invoice showing up in your inbox doesn’t mean it should automatically be paid.
Smart move: Require invoices to be matched to an approved purchase or confirmed with the employee who ordered the product or service before payment is made.
#7: Protect the Accounts a Criminal Would Want Most
Identify the accounts that would cause the most damage if compromised, including business email, online banking, payroll, accounting software and cloud storage. Protect them with unique passwords and multifactor authentication, and regularly review who has access. Remove former employees, vendors and contractors as soon as they no longer need it.
Smart move: Make account access part of your employee exit checklist so passwords, permissions and system access are addressed immediately.
#8: Give Employees a Number to Call
Telling employees to “be careful” isn’t enough. Give them a clear process to follow when a request seems unusual or unexpected: Don’t click. Don’t reply. Don’t pay. Verify. Make sure they know exactly who to contact with questions and reinforce that taking a few extra minutes to verify a request is always the right move.
Smart move: Practice the process. Occasionally share a suspicious email or realistic scam example with employees and ask, “What would you do next?” It’s an easy way to make fraud prevention part of the routine.
Make Your Business a Frustrating Target
You can’t prevent fraudsters from finding your business, but you can make it much harder for them to succeed. Strong account security, clear payment procedures, and thoughtful decisions about the information you share can all reduce opportunities for fraud.
The goal isn’t to turn your business into Fort Knox. It’s to build smart safeguards into the way you operate so that when a scammer goes looking for an easy target, your business doesn’t look like one.
