Cyber scams every business owner should know

Manny Tocco: Head of Business Banking Strategy

Business scams are becoming harder to recognize as criminals use AI, compromised accounts and other technology to impersonate people and businesses their targets trust. Among the threats businesses should understand are AI-powered phishing, business email compromise, ransomware and extortion, deepfake fraud and vendor and supply-chain attacks.

Cyber scams targeting businesses now

Scams and cybersecurity attacks have threatened businesses for years, but new technology is making them more difficult to detect. A recent Citizens survey found that 31% of businesses have experienced a cybersecurity attack in the past year.¹

AI helps criminals personalize messages, imitate someone's voice and create realistic-looking business documents. A compromised email account or stolen password could also allow a criminal to send a fake invoice or payment request from an address employees recognize or at a time that makes sense for the business.

Understanding how today’s scams work is a key part of business cybersecurity and helps businesses recognize emerging threats.

Here are 5 scams I recommend small and midsize businesses know about now.

1. AI-powered phishing and social engineering

Phishing scams attempt to persuade someone to reveal sensitive information, click a malicious link, provide login credentials or take another action that gives a criminal access to money, information or systems. Criminals may use information available online to craft emails that appear to come from customers, vendors or colleagues.

Phishing is not a new scam, but AI has made it easier for criminals to create personalized and convincing messages without some of the spelling and grammatical mistakes that once made phishing emails easier to spot. AI also makes it easier to create fraudulent text messages, QR codes or highly targeted messages designed around someone's role or responsibilities. Close to 10% of businesses have experienced AI-enabled fraud or impersonation in the last year.²

As AI makes these scams more convincing, knowing how to detect phishing and other fraud attempts matters, because appearance alone may no longer be enough to determine whether a communication is legitimate.

2. Business email compromise

Business email compromise (BEC) typically involves impersonating someone to obtain or redirect a payment. A criminal impersonates a trusted person or takes control of a legitimate business email account, then uses that identity to persuade someone to send money or change payment information. For example, a vendor's real email account might be compromised and used to send new wiring instructions for an invoice.

More than 10% of businesses³ say they have been victims of financial fraud.

A common BEC scam involves a fraudster posing as an owner who requests an urgent payment. In other cases, an email that appears to come from a longtime vendor may request that future payments go to a new bank account.

BEC may be particularly difficult to recognize because the request may fit naturally into someone's normal responsibilities and appear to come from a person or email address the business knows.

Understanding how employee actions create risk may also help businesses prevent a convincing fraud attempt from succeeding

3. Ransomware and extortion

Ransomware traditionally involved criminals encrypting a business' data or systems and demanding payment to restore access. What's changed is that attackers may now also steal information and threaten to release it, adding another form of pressure on the business.

Backups are still important, but they may not address every risk. Even if a business restores its systems, stolen customer, employee or business information could still be in a criminal's possession.

For a business, the disruption itself may be significant to financial health and reputation. An attack may interfere with the ability to process payments, access customer information, communicate with employees or conduct other day-to-day operations. This downtime is costly, and damage to a business' reputation may be difficult to repair.

4. Deepfake voice and video fraud

AI allows criminals to create increasingly realistic voice and video imitations, making impersonation scams harder to detect. According to the FBI's 2025 Internet Crime Report,⁴ fraudsters are using AI-generated voices and videos of CEOs and other trusted figures to make scams more convincing.

A call might sound like the business owner asking for an urgent transfer. A criminal could also use a deepfake during a video call to impersonate an executive, vendor or other trusted person.

Recognizing someone's voice or appearance may no longer be enough to confirm that a request actually came from that person.

5. Vendor and supply-chain attacks

Businesses rely on outside vendors and service providers for technology, payments and other operations. That reliance may put a business at risk when a third party experiences a cyberattack or security breach.

Criminals may exploit vulnerabilities in software provided by a vendor, steal credentials that provide access through a third-party system or compromise a service provider that holds sensitive business or customer information. A single attack on a widely used provider may affect many of its business customers.

I see vendor security becoming a bigger consideration as businesses become more connected to outside providers. That includes evaluating vendors' security practices and understanding which systems and information they can access.

How to spot 5 common business scams and cyber threats

Even as scams become more difficult to spot, I advise businesses to know the warning signs as one way to help protect against fraud.

Verification matters as scams become more convincing

As scams become more sophisticated, businesses may need safeguards that go beyond determining whether a communication looks legitimate, including steps to protect business financial information.

• Verify sensitive requests. Confirm unusual payment requests, account changes and requests for sensitive data through a known phone number or other established contact method.
• Monitor for suspicious activity. Automated alerts could help businesses quickly identify unusual transactions. Citizens found that 41%⁵ of businesses that have not experienced financial fraud use automated alerts for suspicious transaction activity.
• Protect access to accounts and systems. Multifactor authentication is one way to protect a business account from unauthorized access.

Staying alert to these threats can help businesses spot scams before they cause harm.

Staying ahead of changing scams

Cybercriminals continue to change their tactics as technology evolves. Understanding the latest threats, recognizing the warning signs and verifying suspicious requests can help businesses avoid financial loss and other harm.

Check out these business fraud resources or schedule time with a Citizens Business Banker to discuss ways you can protect against financial fraud.

Explore Fraud Resources

Frequently asked questions

What should a business do if it suspects a fraudulent payment has been made?

Contact the financial institution involved as quickly as possible to determine whether the transaction could be stopped or recovered. Businesses may also need to secure affected accounts and preserve relevant records.

Who should have access to sensitive business systems and financial accounts?

Access should generally be limited to employees who need it for their roles. Businesses should regularly review access privileges, particularly when responsibilities change or employees leave the business, and remove access that is no longer needed.

Why are small businesses targeted by cybercriminals?

Smaller businesses may handle significant payments, customer information and other valuable data while having fewer cybersecurity resources than larger organizations. Fraudsters may also exploit close working relationships where requests from owners, employees, vendors and other trusted contacts may be handled quickly.