Phone Scams That Target Small Businesses

The phone scams that hit small businesses most often are fake invoices for supplies you never ordered, bogus directory or advertising listings, callers impersonating government agencies, utilities, banks or vendors, tech support calls, and fake-check overpayment schemes. The defense is the same for all of them: a written rule that no payment, password or account change is ever approved on the strength of a phone call alone.

The FTC publishes a guide to scams aimed at small businesses, and the patterns it describes are remarkably stable. Scammers rely on urgency and on employees who want to be helpful. This guide lists the common scams, the warning signs, and the exact words to give your team.

The common scams

Scam	How it starts on the phone	What they want
Fake invoice or unordered merchandise	"Just confirming your toner order" or "following up on the invoice we sent"	Payment for goods you didn't order
Listing and advertising	"Renewing your directory listing" or "confirming your ad placement"	A verbal "yes" they later call an agreement
Government impersonation	Caller says unpaid taxes, licensing or a fine will lead to penalties	Immediate payment, often by unusual methods
Utility shutoff	"Your power will be disconnected in an hour unless you pay"	Instant payment by gift card or app
Bank or vendor impersonation	"We noticed fraud, please confirm the code we just sent"	One-time codes, account access, changed payment details
Tech support	"Your computer is sending us error messages"	Remote access, payment for fake repairs
Fake check overpayment	Customer "accidentally" overpays by check and asks for a refund of the difference	Your real money before their check bounces
Business coaching or "opportunity"	Promises of fast growth, with testimonials	Upfront fees

The FTC's guide warns specifically about fake checks: the check will be fake, even though it might show up as cleared.

Warning signs

Train every person who answers the phone to notice these:

• Urgency. A deadline in minutes or hours.
• Unusual payment. Gift cards, wire transfers, cryptocurrency or payment apps. The FCC is blunt: if a caller asks you to pay with gift cards, it's a scam.
• Requests for codes. Nobody legitimate needs the one-time code just texted to you.
• "Just confirm." Scammers try to get a recorded "yes" or a confirmation of details.
• Pressure to skip normal steps. "Don't bother your manager" or "This has to be handled now."
• Familiar caller ID. The FCC notes that caller ID can be spoofed; a real company name on screen proves nothing.
• Payment detail changes. A vendor "updating bank details" by phone.

Scripts for your team

Anyone asking to confirm an order, listing or invoice

"I'm not able to confirm orders or listings by phone. Please send it in writing to [email], and our [owner/bookkeeper] will review it."

Then do not say "yes" to anything else on the call.

Anyone claiming to be a bank, government agency, utility or vendor

"Thanks. I'll call [organization] back directly on the number we have on file."

Then hang up and do exactly that. The FCC's advice is to hang up and call back using an official number from an account statement or the organization's website.

Tech support calls you didn't request

"We don't take unsolicited tech support calls. Goodbye."

Never install software or allow remote access because someone called you.

Overpayment refund requests

"We'll issue any refund once the original payment has fully cleared with our bank, and only back to the original payment method."

Rules to write down

Post these where anyone who answers the phone can see them:

1. No payments of any kind are approved by phone alone.
2. No gift cards, wires or crypto because of a phone call. Ever.
3. No passwords, PINs or one-time codes shared by phone.
4. Vendor bank detail changes require a call back to a number already on file, plus a second person's sign-off.
5. Invoices are paid only against a purchase order or written agreement.
6. Anyone can hang up on any caller who pressures them, without needing permission.
7. Suspected scam calls are reported to the owner the same day.

Rule six matters. Employees who fear being rude to a "real" bank or agency are the ones who comply. Give them explicit permission to end the call.

If someone falls for it

Speed matters more than blame.

• Tell the owner or manager immediately
• Call your bank or card issuer to stop or reverse the payment
• If gift cards were used, contact the card issuer right away
• Change any password, PIN or code that was shared, and check for new account access
• If remote access was granted, disconnect the device and have it checked
• Report at ReportFraud.ftc.gov; for unwanted calls, also file at fcc.gov/complaints
• Brief the whole team on what happened, without naming and shaming

Make it part of training

Add a 10-minute scam session to new-hire phone training and repeat it twice a year. Play out two or three of the scripts above. Pair it with our phone training checklist for new hires and the general approach in handling spam calls.

Keep a running log of scam attempts your business receives. Patterns repeat, and a shared list of "calls we've had" is the most persuasive training material you have.

Protect your own number's reputation

Scammers sometimes spoof real business numbers. If customers tell you they got strange calls "from you," note the dates and report it to the FCC. If your legitimate outbound calls start being labeled as spam, see why business calls show Spam Likely.

Text and email versions of the same scams

Many of these scams arrive by text or email as well as by phone, often in combination: an email invoice followed by a "reminder" call, or a call followed by a text with a payment link. The FCC advises not responding to texts or clicking links from numbers you don't recognize. Apply the same rule across channels: verify through a contact method you already trust.

How Callata helps your team stay careful

Callata keeps every business call and voicemail on the business's record rather than scattered across personal phones, so a manager can see who called and when if a suspicious call comes in. If you turn on call recording, Callata plays a recording notice and each recorded call is transcribed and summarized, which gives you a record of exactly what a caller asked for. Voicemails are transcribed, so a "final notice" robocall can be read and dismissed in seconds.

Everything is on one plan at $99 a month, with five users included. Set up Callata.