When you think of a cyberattack, you picture a hooded figure in a basement trying to break into a bank. The reality is much more boring — and much more effective.
The people running these scams don't target banks. They target businesses like yours: 10 people or fewer, no dedicated IT staff, one person juggling the books, the inbox, and the schedule. You're not a hard target. You're the perfect target.
And the numbers back it up. The FBI's Internet Crime Complaint Center (IC3) logged more than a million complaints in 2025, with losses topping $20 billion. A large share of that lands on small businesses — the ones without a security team to stand in the way.
Here are the four scams that actually get small businesses, what the real data says, and the fix for each.
Scam #1: The Fake Invoice (Business Email Compromise)
A vendor you actually work with emails you an invoice. It looks right. The amount looks right. The only difference is the bank account number on the payment instructions.
That's business email compromise (BEC). The attacker got into the vendor's email — or just guessed your relationship — and is quietly rerouting payments to their own account. It's not rare, and it isn't small: the FBI reported $3.04 billion in BEC losses in 2025 alone, up from $2.77 billion the year before. And it's the kind of scam that bites small businesses hardest, because the average stolen amount is money you can't afford to lose.
The fix: Never pay an invoice on the email alone. If the payment details changed, or the amount is unusual, pick up the phone and call the number you have on file — not the number in the email. A 60-second phone call stops the single most expensive scam in small business.
Scam #2: The Call From "The Government"
Your phone rings. The caller ID says it's the IRS, the Social Security Administration, or your state's revenue department. The person on the other end knows your name and your business, and they're telling you there's a warrant, a frozen bank account, or an audit — and that you need to pay right now to fix it.
This is government impersonation, and it's exploding. The FBI reported 32,424 complaints and $797.9 million in losses in 2025 — nearly double the year before. Caller ID is trivially easy to spoof, so the call actually looks official. And because it feels urgent and official, business owners often reach for their wallet before they think to hang up.
The fix: Real government agencies don't call you out of the blue demanding money, and they never take payment by wire transfer, gift card, or cryptocurrency. If someone claims to be from a government agency and asks you to pay over the phone, hang up and call the agency back using the number on their official website — not the one on your caller ID.
Scam #3: The Email That Looks Like It's From You
An employee gets an email that appears to come from you: "I'm in a meeting, need you to buy $500 in gift cards for a client, here's the card number to send the codes to." Or a login page that looks exactly like your bank's — but it's not.
These are phishing attacks. They work because they don't try to be clever. They try to be urgent. Urgency is what makes people bypass their better judgment. Phishing losses roughly tripled in a single year — the FBI reported $215.8 million in losses in 2025, up 208% from the year before — even though the number of attacks barely moved. Scammers got better at landing a single convincing email, not at sending more of them.
The fix: Turn on multi-factor authentication (MFA) everywhere — email, banking, payroll, anything that touches money or client data. MFA is the single highest-impact security change a small business can make, and it stops the vast majority of these attacks cold. Even if someone hands over their password, the attacker can't get in without the second factor. And make a simple rule: no money moves based on an email or text alone. Ever.
Scam #4: The "Free" Tool That Isn't Free
A pop-up says your computer is infected. A "tech support" agent calls and says there's a problem with your Microsoft license. A free PDF reader you downloaded is quietly logging your keystrokes.
Fake tech support and malicious downloads are how attackers get a foothold on your actual machine — not just your inbox. Once they're in, they can hold your files for ransom, watch your screen, or steal every password you type. Ransomware complaints rose 18% in 2025, and the files-encrypted version is the one that can take a small business offline for days.
The fix: Real companies don't call you out of the blue about a problem you never reported. Hang up. Download software only from official sites. And keep an eye on the one thing that catches most of this: if your computer starts acting slow or doing things on its own, get it looked at before it becomes a bigger problem.
Why It's Always a Small Business
Large companies have security teams and insurance requirements. You have a business to run. Attackers know that — which is why they aim at you, not at the bank.
The good news: you don't need a security team to stop most of it. You need three habits — verify payment changes by phone, hang up on any 'official' caller demanding money, and skepticism toward anything urgent or unsolicited. Those three habits, plus MFA everywhere, stop the overwhelming majority of attacks that actually succeed.
Worried your business might already be exposed? Let's talk. I'll take a look at how your business handles email, payments, and passwords, show you exactly where the risk is, and fix it — before someone finds it for you. No jargon, no fear-mongering. Just the honest picture of where you stand.
Ben is the owner of Spruce IT, a technology support and advisory service for small businesses and individuals in the Harleysville, PA area.