30 minutes · US small business owners and staff

The Small Business Kit

Simple checks for the messages that ask your business to pay.

US checklist. Allow 30 minutes to set the rules and brief staff. Finish account changes with each person.

Print this checklist

• [ ] Keep verified phone numbers for vendors, staff, the owner and the bank somewhere accessible without business email.
• [ ] Call before changing payment details or acting on an unusual payment request. Use the number already on file. A reply email does not count.
• [ ] Require a second person to approve payment-detail changes and unusual transfers. The owner follows the same rule. Working alone? Pause and verify independently.
• [ ] Match invoices to an approved order and delivered work or goods. Check new vendors independently before paying.
• [ ] Check domain renewals through the existing provider’s saved website. Require an approved order for directory listings or advertising.
• [ ] Set a clear rule: no gift card purchases or code sharing in response to an unexpected “boss” message.
• [ ] Pause overpayments. Do not send the extra money onward. Ask the bank or payment processor to investigate.
• [ ] Require two-step sign-in for owners and staff. Start with email, banking and payroll. Use individual logins and unique passwords.
• [ ] Verify payroll changes with the employee using a known number or in person. Review changed bank details before each pay run.
• [ ] Check email recovery details, sign-in alerts and forwarding rules. Name the person who can recover a compromised account.
• [ ] Run the 15-minute briefing below. Make it safe to report a suspicious message, a click or a payment immediately.
• [ ] If money went out, call the bank now. Request a recall or reversal and contact with the receiving bank. Then report to IC3.

Person handling reports: __________ Phone: __________
Backup: ________ **Bank frd number: __________klzzwxh:000Email recovery contact: __________

Anyone may pause a payment while it is checked.

Why these steps help

A familiar email can contain a false request

Business email compromise means someone uses an impersonated or compromised account to get money or information. A message can arrive inside a real invoice conversation. Correct names, familiar writing and an existing thread do not prove that payment instructions are genuine. FBI business email compromise guidance.

For changed bank details, payment destinations or unusual requests:

1. Pause the payment.
2. Call the contact using a number saved before the request.
3. Confirm the invoice, amount and destination.
4. Record who confirmed it and when.
5. Get the required second approval.

Do not use a new number supplied in the message, attachment or revised invoice. If the contact is unavailable, the payment waits. Apply this process even when the request comes from the owner. IC3 payment verification and approval guidance.

Check the purchase behind the invoice

Before paying, establish who ordered it, what was supplied and whether the amount matches. A logo and invoice number are easy to copy.

For a new vendor, verify the business and contact details independently. A small invoice still needs an approved purchase behind it.

Directory scams may begin with a call to “confirm” a free listing. A later bill does not establish that anyone agreed to buy advertising. Check your records before paying. FTC small business scam guide.

For a domain renewal, open the saved account for the company that manages your domain. Check the domain, expiry date and amount there. Keep the provider name and renewal date in your business records. Avoid paying through an unexpected renewal link. Official domain renewal phishing guidance.

Give staff a ready answer to “the boss”

A common request says the owner is busy and needs gift cards bought immediately. The next request is for photos or card codes.

Use this response:

“I’ll call your saved number before buying anything.”

Set a standing rule that staff never send gift card codes in response to an unexpected message. Any genuine staff gift purchase follows the usual approval process. FBI examples of executive impersonation.

An available balance does not prove a check is good

A fake customer may overpay, then ask you to send the difference to a shipping company or another person. The deposited money may appear available before the bank discovers the check is bad.

Do not send a separate payment to fix a suspicious overpayment. Ask your bank or processor to investigate and explain the proper reversal process. FTC fake check and overpayment guidance.

Protect email and payroll together

Require two-step sign-in for everyone, including owners and administrators. Enable it for email, banking, payroll and the domain account wherever offered.

Use an authenticator app where supported. If text codes are the only option, use them. Never share sign-in codes or approve a prompt you did not initiate. Keep recovery codes securely outside the email account they recover. FTC two-step sign-in guidance.

Payroll diversion can start with a fake employee message or a stolen payroll login. Verify bank-detail changes with the employee in person or through a number already on record. Review changes before releasing payroll, including changes made through employee self-service. IC3 payroll diversion guidance.

If the business email account is taken over

Signs include unexpected sign-in alerts, missing messages, unfamiliar forwarding rules or customers receiving payment requests you did not send.

Use a trusted device and contact your email administrator or provider through a known route. Have them:

• Block the attacker’s access and sign out active sessions.
• Reset the password and check two-step sign-in methods.
• Remove unknown recovery details and connected applications.
• Preserve relevant logs, then remove malicious forwarding and inbox rules.
• Review sent and deleted messages for altered payment instructions.

A password change alone may leave other ways back into the account. Call affected customers and vendors using known numbers to check pending payments. Official email administrator recovery steps.

The 15-minute staff briefing

Read each short passage. Use the rest of that time block for the exercise.

Minutes 0 to 3: Make checking normal

“Anyone here can pause a payment. That includes a request from me. You will not be criticized for checking. If you clicked, shared a code or sent money, tell us immediately. We can act faster when we know.”

Point to the reporting contact and backup on the checklist. Have everyone locate the numbers.

Minutes 3 to 6: Practice a payment change

“A supplier writes: ‘Our bank details changed. Please use the attached account today.’ The invoice is real. The email is in an old conversation. What happens next?”

Expected answer: pause, call the saved vendor number, confirm the details and get the required approval.

Have one person practice the call. Ask another to identify where the trusted number comes from.

Minutes 6 to 9: Practice boss and payroll requests

“A message from me says: ‘I’m in a meeting. Buy gift cards and send the codes.’ You call my saved number. You do not send codes.”

“An employee asks to change their pay account. You verify with that employee through an existing number or in person.”

Practice saying:

“We check every change this way. I’ll call you back.”

Minutes 9 to 12: Check three ordinary-looking bills

“A customer overpays and asks us to send the difference elsewhere. We pause and call the bank.”

“A domain renewal arrives. We check our existing provider’s account.”

“A directory sends an invoice. We look for an approved order.”

Ask someone to find the business’s domain provider and another to explain how invoices are approved.

Minutes 12 to 15: Practice reporting

“If money went out, we call the bank immediately. We save the messages and payment details. Then we report to IC3. If an account was exposed, we secure it too.”

Have each person say who they would contact. Confirm that owners and staff have two-step sign-in enabled, or assign someone to finish setup.

The briefing turns official payment verification, staff training and payroll guidance into a repeatable routine. FTC staff training guidance, IC3 verification guidance.

If money went out

Call the sending bank’s fraud team immediately. Use the number in your existing records.

Say:

“We sent a payment after fraudulent instructions. Please try to stop or recall it now. Please contact the receiving bank’s fraud team and tell us what information you need.”

Ask about a recall or reversal and any documents needed to support it. Give the amount, date, time, recipient details and transaction reference. Ask for a case number. A recall request does not guarantee recovery. IC3 bank response instructions.

Report promptly to the FBI’s Internet Crime Complaint Center, IC3. Include the business name, contact details, sending and receiving bank information, account details, payment references, dates, amounts and a description of the deception. Identify business email compromise or payroll diversion when relevant. Save the complaint confirmation.

Preserve original emails, attachments, invoices and payment records. Have the email administrator preserve logs. Check whether other payments or payroll changes are pending. Do not delay the bank call while collecting evidence or completing a report. IC3 reporting and evidence guidance.

If the payment used a card, gift card or payment service, contact that issuer or provider immediately as well. Ask what can be stopped or recovered. Official guidance checked November 3, 2026. FTC steps after a scam.