A longtime vendor emails with new payment instructions. An employee gets a message that appears to be from the owner asking for an urgent wire. A familiar login screen asks for a password.
None of these situations may look suspicious at first. That’s what can make them effective. Fraudsters often rely on familiar names, routine requests and a sense of urgency to get employees to act before they stop and verify what they’re being asked to do.
Here are a few ways to make it harder for scammers to succeed.
Verify changes before money moves
Be especially cautious when someone asks you to change where or how a payment is sent. Even if the email comes from a vendor you’ve worked with for years, confirm the request using contact information you already have on file, not the phone number or other contact details included in the message.
Build that extra check into your normal payment process. For higher-risk transactions such as wire transfers, consider requiring a second employee to review and approve the payment before it goes out.
Make it harder to get into your accounts
Passwords alone shouldn’t stand between a criminal and your business accounts. Use a different, strong password for each account and enable multifactor authentication wherever it’s available. That way, a stolen password by itself may not be enough to gain access.
Don’t put off software updates, either. Turn on automatic updates for operating systems, browsers and other frequently used software when possible so important security fixes are installed promptly.
Give employees permission to question a request
Your employees don’t need to be cybersecurity experts, but they should know when to stop and ask questions.
Make sure everyone knows the warning signs that deserve a second look, such as an unexpected password reset, a last-minute change to a vendor’s bank account or an urgent request to send money. If something doesn’t seem right, employees should verify the request another way instead of replying to the original message.
Regularly back up important business files and keep those backups separate from your network. If your systems are compromised, having a clean backup can make it easier to get back up and running.
If something goes wrong, don’t wait
If you believe money was sent to a fraudster, contact your bank immediately. Ask whether the transaction can be stopped or the funds recalled. You should also report the incident to the FBI’s Internet Crime Complaint Center at IC3.gov.
You don’t have to overhaul your cybersecurity overnight. Start with one process that can make an immediate difference.