Why You Shouldn't Trust Everything

Running a business means trusting a lot of moving parts. Your email, your vendors, your payment systems, and the people who reach out claiming to represent them. Scammers know that trust is the fastest way in, and they take advantage of that trust by imitating the things you already expect to see.

The FBI's Internet Crime Complaint Center logged more than one million complaints in 2025 and $20.8 billion in reported losses, a 26% jump over the year before. Business email compromise alone accounted for just over $3 billion. At ConnectOne, we believe protecting our clients means more than protecting their balance. It means supporting you should something go wrong.

Here is a practical guide to what today's scams look like, what to do in the first 24 hours should you suspect fraud or business compromise.

What Attacks Look Like Today

Cyberattacks on businesses rarely look like a movie hacking scene. They usually look like a routine request from someone you know. Common tactics include:

• Business Email Compromise (BEC): A scammer gains access to an email account, watches your conversations quietly, and then jumps in at the right moment with updated wire or invoice instructions. It works because nothing about the request looks unusual until the money is gone. BEC was the second most costly crime type reported to the FBI in 2025, with more than $3 billion in losses.

• AI-Assisted Impersonation: Voice cloning and AI-written emails have made impersonation cheap and convincing. The FBI tracked 22,364 AI-related complaints in 2025 and roughly $893 million in losses, the first year artificial intelligence appeared as its own category in the report. A phone call in your CFO's voice is no longer a hypothetical. It is essential to always call back a known, trusted number to verify. 

• Credential and Code Theft: Instead of breaking your security, scammers talk their way past it. They call posing as your bank or your IT provider and ask for the one-time code that just landed on your phone, which is the last thing standing between them and your account.

• Ransomware: Files get locked and a payment is demanded. The FBI notes that reported ransomware losses do not include business disruption, equipment, or third-party remediation costs, which is where most of the real damage lands.

How to Verify a Message From Your Bank

A common theme for business fraud today involves receiving a message that looks like it came from your bank. Knowing how to verify these interactions in the moment is the single most useful habit you can build.

• When in doubt, hang up. End the call and dial the bank yourself using a number you already know and trust, like the one on your statement or the back of your card. Never use a callback number stated in an email, text or call.

• Know which codes are shareable and which are not. Your bank may use a verbal passcode to confirm who you are during a phone call. That is normal. A one-time code texted or emailed to you to gain account access, is a different thing entirely—those exist to log you in or authorize a transaction, and no one from your bank will ever ask you to read one out loud.

• Read the whole message, not just the digits. Scammers count on you seeing six numbers and nothing else. The text itself tells you what the code is for, including whether it is about to move money. Pay attention to the details mentioned in a passcode text or email. If it says “NEVER SHARE THIS CODE”, take that literally.

• Slow the conversation down. Urgency is the tool, not a side effect. Anyone pushing you to bypass a verification step is telling you something. Two extra minutes can save you thousands of dollars.

Your First 24 Hours

The moments after you realize something is wrong are the ones that matter most. Move in this order:

• Contain it. Take affected computers and devices offline. Unplug network cables and turn off Wi-Fi. This stops malware from spreading and cuts off anyone still inside your system.

• Call your bank immediately. Speed matters more than certainty. If a potential fraudulent wire or transfer went out, there is a narrow window to attempt a recall. Do not wait until you have the full picture. Call your banker. 

• Reset credentials from a clean device. Change passwords for email, banking, payroll, and cloud services. Then check for user accounts or permissions you do not recognize, including your email or text messages for a possible notification regarding an attempted login—creating a new account is a common way for scammers to gain access after you lock the front door.

• Write everything down. Screenshot the emails, texts, and transaction confirmations. Note when you were first contacted, when the transaction occurred, and when you discovered it. Your bank, your insurer, and law enforcement will ask for this timeline.

• Report it. File with the FBI's Internet Crime Complaint Center at ic3.gov, the FTC at ReportFraud.ftc.gov, and file a local police report. Banks and insurance carriers often require a formal report.

After the Dust Settles

• Turn on multi-factor authentication everywhere. It is still the single most effective control available to a small business, and the FTC's Safeguards Rule requires it for anyone accessing customer information at a covered financial institution.

• Scan and rebuild carefully. Run a full malware scan on isolated systems before reconnecting anything. If the breach was significant, bring in a cybersecurity firm to confirm the threat is actually gone.

• Debrief your team. Walk through what happened and how it was caught. Naming the tactic out loud makes it far easier for someone to recognize the next one.

• Watch for the second wave. After you report fraud, you may hear from "recovery specialists" promising to get your money back for a fee. The FTC warns that these scammers buy lists of people who have already been scammed and that no legitimate organization asks for payment upfront to recover your money. Real recovery only ever comes through your bank or law enforcement.

At ConnectOne, we would rather help you prevent a loss than help you recover from one. If something about a call, text, or email feels off, contact us directly. We will always take the extra two minutes with you.

Visit our Security Center for additional resources and tips.