Phishing and scams that target small businesses
Phishing and scams reach small businesses through every channel they use: email, text messages, phone calls, and QR codes. Most of them do not need to break a password. They ask someone to click, to pay, or to read out a code, and they work because they look like a routine request from a supplier, a bank, a delivery company, or the boss.
How to recognize the scams aimed at small businesses
A strong password and a second factor protect your logins, but some of the most expensive attacks never try to log in. They send an invoice with new bank details, a text from “the boss” asking for gift cards, or a call from “Microsoft support.” Recognizing them is step four of our plan for protecting your accounts from hackers, and the numbers show why it matters: in the UK government’s Cyber Security Breaches Survey 2025/2026, phishing was by far the most common type of attack, reported by 38% of businesses.
This guide explains what these scams have in common, how each channel is used, and where to report them in your country.
What the official figures show
Each country counts scams differently, so the figures below cannot be compared with one another. They all point the same way: phishing and payment fraud are the everyday threats, far more common than the dramatic attacks that make headlines.
| Country | Source | What it reports |
|---|---|---|
| US | FBI Internet Crime Complaint Center, 2025 | Phishing and spoofing were the most common complaint type (191,561); business email compromise caused about $3 billion in reported losses |
| US | FTC Consumer Sentinel, 2025 | Three million fraud reports and $15.9 billion in reported losses; impostor scams alone, over one million reports |
| UK | Cyber Security Breaches Survey 2025/2026 | Phishing affected 38% of businesses; ransomware, 1% |
| Canada | Canadian Anti-Fraud Centre, 2025 | Over 112,000 reports and over CA$704 million lost; spear phishing, CA$67.9 million |
| Australia | ACCC, Targeting Scams 2025 | A$2.18 billion lost; phishing the most reported type to Scamwatch; payment redirection, A$166.8 million |
Sources: FBI IC3, 2025 Internet Crime Report; FTC; UK Department for Science, Innovation and Technology; Canadian Anti-Fraud Centre; ACCC. All figures are reported losses, which understate the real total.
What the scams have in common
The channel changes, but the method rarely does. Almost every scam in this guide combines three ingredients:
- A familiar sender: your bank, a supplier, a delivery company, a government agency, your boss, or a member of your family.
- A reason to hurry: an unpaid invoice, a blocked account, a parcel waiting, a deal that closes today.
- A request to break routine: pay a new account, buy gift cards, read out a code, install an app, or sign in through a link.
The defense is the same for all of them: stop, and confirm through a channel you already trust. Call the supplier on the number in your own records, not the one in the message. Open your bank’s app yourself instead of following the link. Ask the boss in person or on a number you know.
Phishing emails
Email is still the main channel, and the messages have improved: fewer spelling mistakes, real logos, and sometimes a reply in an existing conversation. The FBI’s 2025 report counted 22,364 complaints that mentioned artificial intelligence, with reported losses of about $893 million. Our guide to the signs of a phishing email that still work focuses on the checks that do not depend on spotting bad grammar.
Text messages
Fake delivery notices, bank alerts, and short “are you busy?” texts from someone posing as the boss arrive on the same phone you use for work. See how delivery, bank, and boss texts work and what to do with them.
Fake invoices and changed bank details
For a small business, this is often the most expensive scam: a real-looking invoice, or a message from a known supplier saying its bank details have changed. Read how payment redirection scams catch small firms and the one habit that stops them.
Business email compromise
When the scammer writes from a real, hacked mailbox, or from an address that looks almost identical, the usual warning signs disappear. The page on business email compromise and CEO fraud explains how these attacks unfold and which controls work.
Phone calls and cloned voices
Fake technical support calls are an old trick, and AI voice cloning makes impersonation easier. Our guide to phone scams, from fake support to cloned voices covers what real companies never ask for.
QR codes
A sticker on a parking meter or a QR code in an email can lead to a fake payment page. See how QR code scams work and how to check a code.
Reporting
Reporting helps the authorities warn others, and sometimes recover money if you act fast. The agencies differ by country: see where to report phishing and scams in the US, UK, Canada, and Australia.
More on securing your accounts
Scams are easier to survive when your accounts are already protected. If you have not done it yet, start with a password manager for yourself or your team, then add a second factor or a passkey to your most important accounts. If a scam has already worked, recovering a hacked account starts with the right steps in the right order, and securing your team’s accounts turns these habits into rules for everyone.