How to Spot a Scam Targeting your Business
Don't let a spoofed call or fake bank message put your business at risk - learn the warning signs and stay one step ahead of scammers.
Scam activity aimed at small businesses is growing, especially for those that received Paycheck Protection Program (PPP) loans. If your business was part of the program, it’s a good idea to be on alert. Knowing what these scams look like can help you avoid them and protect your business.
How the Scam Works
Scammers are using publicly available information to find businesses that received PPP loans. From there, they launch convincing attacks that can appear legitimate at first—but are designed to trick you.
Common Tactics to Watch for
- Spoofed Bank Phone Calls
Scammers use spoof call technology to make their number appear as if it’s coming from your bank. Even if the caller ID looks real, banks will never ask you for a password, security/verification code, or token code.
- Direct Calls to Business Lines
These fake phone calls from the bank are often directed to main office lines, with the caller asking for specific employees by name.
- Requests to “Verify” Transactions
They may claim they need to confirm a wire or ACH transaction, pressuring employees to share credentials or approve transfers.
- Impersonation of Bank Staff
The caller may pretend to be someone from Treasury Management or ACH Operations, using insider terms to sound credible.
- Fake Security Messages
Scammers also use text messages that look like they're from your bank. One example uses a made-up term— “client credentials termination process”—to create urgency.
A fraudulent message might look like this:
Keeping your information secure is our top priority. We’re always looking for new ways to protect you and your business. One of our security measures is the client credentials termination process.
<FAKE URL>
Reply STOP to opt out
This message is not legitimate. Banks do not use processes like this or ask customers to act through external websites. Even if it sounds official, do not click any links or enter your credentials.
How to Protect your Business
- Don’t Trust Caller ID
A spoofed bank phone call can look like it’s from your bank, but scammers can manipulate caller ID to display any number. - Never Click Suspicious Links
Never click on an unexpected link sent via text or email. Always log in through your official Business Online Banking portal. - Never Share Credentials
No legitimate bank associate will ask for your password, security/verification code, or token code. - Verify Requests
If a call seems off, hang up and call your local branch or known bank contact directly. - Educate Your Employees
Share this information with employees so they know how to spot a scam and what to do if they receive a suspicious call or message.
