Common Scams Targeting Entrepreneurs and Small Businesses

Be suspicious of people with a sense of urgency, threatening fines or violations of laws and implying a need to act

Scams are usually not very complicated, and once you recognize a few you can protect yourself from others. A hallmark of most scams is a sense of urgency or need to act quickly, threats of fines or government action, or need to maintain compliance with the law. If any of these things pop up in an email, phone call, in person or in a direct mail letter to you, BE SUSPICIOUS!

Get a password manager

The number one way you can protect yourself from scams is a password manager. We use the free version of LastPass to run our whole business, and we can’t stress enough how much this can protect you.

First, by only having to remember one master password, you can avoid reusing passwords. So when your bank or favorite app suffers a password leak (and they will), none of your other logins are at risk.

Second, it can protect you from some phishing attacks. Your password manager can autofill your password into the sites you have set up. If a fake email arrives and succeeds into getting you to click their link to a fake login screen, your password manager won’t fill it in. Then warning signs should go off in your brain telling you something is wrong.

Never pay in gift cards: a recurring element of some scams is the scammer wanting you to send them gift cards. This is because gift cards are hard to trace, easily sold and can be used across the world. If anyone, ANYONE, tries to have you send them money in the form of a gift card it is a scam. ALWAYS A SCAM. No, your nephew is not in jail, your back taxes are not due, no one is going to show up and arrest you, your social security number will not be suspended, and you won’t be deported.

Someone contacts you wanting to buy something, retain your services, pay for products or even send you money before you have finalized a contract. Variations involving you winning a sweepstakes, an award or any reason to send you money.

The easiest to recognize feature of this scam is that you always need to send money onward. Always, always always be suspicious of money coming out of your bank account. After all, this is business. People should be paying you!

The hallmarks of the scam are usually that they are offering you a good deal, a willingness to pay full price or extra, or to send payment before you’ve even gotten to know them (and will pay for rush on everything). They also usually ask “what forms of payment do you take?” since they need a check or credit card. That’s a dead giveaway.

They then send you a check for more than the amount agreed upon. Claiming a “mistake,” they ask for some of the money back. A common variation is that you need to send it on to a third party that they are also working with and related to your business.

The reason for sending extra money can be anything, like it was an accident, to pay for any extra taxes, they’re stuck in a different country, or that you need to send part of it on to someone else, who, for reasons unclear, can’t be paid by the client. Often times they will give you a “fee” for helping them out sending it on to someone else.

The credit card version of this is similar, they pay with a (stolen) card, and need you to send some part of the payment onward to a third party who mysteriously can’t accept credit cards or who is having an emergency of some kind.

This scam is easy to recognize because they will always need you to send money back to them or on to someone else. Spoiler alert: If you’re the one supposed to getting paid for something, money should never be leaving your bank account for any reason! So if you get a check and need to send part of it to someone else, it’s a scam. Always a scam. No, you’re not just lucky, it’s scam. No, the person doesn’t have cancer or any troubles accepting credit cards, it’s a scam!

Some of these scams are very well thought out and tailored to your business. They will mention what you do and the “third party” will have a title of someone related to your industry. For example, you’re a wedding venue. They send you extra money and need you to send part of it on to their “florist” or “planner” who can’t accept credit cards right now. Scaaaaaammmm!

How it works: The check is fake, but most banks deposit it anyways while waiting for it to clear (as a service to you so your money is available quicker). Then you send the scammer the money, and when the check turns out to be fake you’ve just lost your money. On top of that, you’ll probably have to pay a bad check fee to your bank! If using a card, the card is stolen but the scammer is planning on the card owner not recognizing the charge until after you have sent them the money.

Takeaway? Don’t ever accept a check for more than the selling price or from someone you don’t know for something you didn’t earn. Don’t ever send money onward. And always be suspicious of people in a hurry.

For a fun description of this scam using actual text, see this blog post from Wave, which covered a period where scammers targeted web developers a lot.

This scam impersonates a government official (such as the IRS). It can take place by mail by sending you official-looking documentation that says it’s not actually from the government in very tiny print, or it can take place over the phone.

The ones using mail try and get you to sign up for some service and hope you don’t notice the bill on your credit card.

The ones over the phone are more vicious, often claiming that the IRS is seizing your bank accounts for back taxes, you’re about to be arrested or deported, they need your bank account information, or someone you know has been arrested and needs bail money.

For the most part, these are easy to recognize because government agencies don’t call people, they send you letters. If you’re getting called, it’s fake. Every government agency has a website, just Google it if you’re worried and call the number there. If you can’t even find the “agency” the person on the phone claimed to be from, well, now you know it’s fake.

No government agency demands payment immediately over the phone, and definitely not in the form of gift cards. They don’t call people with arrest warrants (why would they?), and they won’t be publicizing your name in the paper if you’re late on taxes.

If you ever get a call like this, be aware the scammers are very good, it’s what they do for a living. However, if you’ve read our website you will recognize the hallmarks of a scam: a sense of urgency, threats and unusual payment methods. The first two are present in almost every scam.

When you register a corporation or LLC, your information is released to the public. Companies buy your mailing address and start sending you notices (often official looking or downright claiming to be from the government) that claim you need to put up labor posters or face fines. They will send you these posters for a fee.

They often claim urgency, fines, violations of laws and a need to act (typical hallmarks of a scam). Sometimes they show up in person, usually to places like a restaurant with lots of employees and claim to “inspect” your current posters, which they then declare “out of date.” If they show up in person, threatening fines and spouting off sections of labor law are usually involved.

Why is this a scam?

Unless you have actual employees, you don’t need labor posters. Most states will allow you to download and print them off their website for free, or will send them to you. Many times your accountant, payroll provider or tax person will send them to you for free as well. You can find out more information about U.S. federal labor posters and if you need them here.

Takeaway? Don’t ever buy a labor poster

This one targets existing businesses with a physical location or new residences. Typically they target new stores. Someone claiming to be from a utility company shows up and says that they will cut off your power/internet/phone/water unless you pay them an outstanding balance from the previous tenant. Sometimes they call. Either way, they will create a sense of urgency or need to act quickly with threats of getting cut off or bad credit. For existing stores, they will change it to say you’re past due or they never received your payments.

How it works: They “accept” payments to get you up to date.

If anyone tried this, just say thanks and call your company on its own if you are worried. Or just sign into your account online. It’s unlikely to be true. For fun, tell anyone who tries it that you will pay it through your online utility portal with the account you have already set up and watch them squirm as they try and convince you to pay through them instead. The urgency will go through the roof! Also, if they do it in person, call the cops on them, because they will just continue down the street until they find a sucker.

Takeaway: you’re almost never going to have to pay the last tenant’s utilities and no one will show up asking for past due fees when they can just send you an email.

Also: don’t give your account details to anyone in person either. They can do a lot of things like surreptitiously sign you up for a middleman service, charge you extra and still pay your bills, which means you’ll never know.

Scammers will send false invoices for common payments to companies that handle a lot of invoices.

How it works: they just mass send invoices, counting that a busy bookkeeper will pay one. They are usually disguised as advertising fees, office supplies or other things purchased a lot.

The only way to protect yourself is to have good accounting procedures and a list of approved vendors. This is one of the reasons a company uses purchase orders, because they can be matched up to vendors. If they don’t match, then something funny is going on.

This one targets consumers often. They call or send a bogus expiration notice claiming your vehicle warranty is up and you need to renew it or they offer to extend it. The letters are often branded with your car make and model and are intended to look like they came from the car maker themselves or a dealer. If you sign up for the service you will get essentially nothing and won’t be able to actually get a claim through.

They can get your name and match up makes and models through DMV records and start sending them out when they notice how many years your auto loan has been active on your credit report.

How to avoid it: don’t ever call the number on the card or buy a vehicle warranty from someone over the phone. More info from the Feds here.

You get a letter, often disguised as a tax notice or other official looking document, offering to renew your domain name or hosting. As always, they try and create a sense of urgency. Since they can’t actually renew your domain name, which is hopefully associated with your account, they instead sign you up for a “directory” for a fee (which is buried in the small print).

If you’ve followed our guide and used a password manager and a good host, you won’t need to worry about this one too much, since most good hosts have privacy protections that prevent your name being exposed. You can also log into your host and see when it expires and set up renewal emails.

Takeaway: your domain name or hosting provider will never pay to send you something in the mail when they can just email you for free. Duh. Ignore every single thing that comes in the mail.

Many states require that you file annual reports with your secretary of state or pay renewal fees for your LLC or Corporation. Scammers know this and scrape government websites for the names of corporations. If you’ve incorporated or have been required to publicly declare something related to your business, you’re a prime target.

There is a lot of paperwork associated with running a business and keep up with state requirements. Scammers will offer to do this for you for a hefty premium (often the exact amount of the state’s renewal fee to confuse you). They will send you mail that looks like official documents that need attention.

Common things they try get you to pay for are renewal fees, biannual statements, fictitious name statements, annual reports, periodic reports, certificate services and so on.

They target entrepreneurs who are afraid of messing up the bureaucratic process involved in keeping a company active, and will play up the urgency and potential of fines or fees that come with not keeping current.

How to avoid: every single state will walk you through this on their website, and most of the time it will take you a few minutes. Just ask someone else how to do it if you’re worried, or Google it. Never pay to do this! States try and make it as easy as possible and it’s not something you need to pay for. If you trust your accountant, use them as a last resort.

Additional note: always check a state’s website to see what filings are required. Companies will send you official looking notices in the mail for things that don’t actually need to be done.

You’re a prime target for this scam if you are a first timer registering your first LLC. Never trust things that come in the mail!

Phishing is an attempt to gather information from you by sending you an email purporting to be from someone else. For example, you will get an email from your bank asking you to log-in and change your password. The link in the email takes you to a log-in screen that may look like your bank, but is actually somewhere else. It gathers your log-in credentials and steals them or sells them. More complicated ones will actually send you onto your real bank and log you in making it hard to realize you’ve been scammed.

You can recognize phishing attempts because the email will usually not come from who you expect it to (although emails can be faked). Your bank’s name will still be in the email, but the domain will usually include the scammer’s domain added on. On the web or in most email clients, you can mouse over links to see where they go. For example, this link to our home page. In Chrome, it will show you in the very bottom left corner that it should go to https://startupgroundwork.com/

If you do that in an email from a scammer, it will usually show additional web addresses owned by the scammer instead of the authentic URL.

How to protect yourself? Don’t click links in emails coming from important financial partners. Instead, just go to the actual website in your browser and log in. Another backup is by using a password manager. The password manager will recognize the websites you have saved accounts with and give you the option to fill in your password. It won’t recognize a phishing website and your password won’t get filled in, giving you a clue that its not the correct website.

So if you were expecting to go to your bank’s website when you clicked a link, and your password manager doesn’t recognize to fill it in, you’re probably getting scammed.

If you’ve signed up for any social media or internet software lately you’ve probably been asked to put in a phone number. The company texts you a code that you have to enter into the website to confirm your identity.

Scammers also want to use these sites to scam people, only once their phone number has been used to scam people then it gets blacklisted. So they need a new phone number. Here’s where you come in.

This scam usually involves Craigslist or Google Voice. Here is how it works: A scammer wants to create a Craigslist account to post their scams. They begin creating an account until they get to the part where a phone number is required.

Then they go on Craigslist and find someone who is selling something and has posted their phone number (you). They text that person pretending to be a buyer, asking if it is still available, etc. They claim (without irony), that they want to make sure you as the seller are legitimate and not a scammer by sending you a code, which you need to text back to them to prove you’re real.

In reality, they have entered your phone number into Craigslist and it is Craigslist verifying your identity in the account creation process. You give the scammer the code, they create an account and then they can post their scams on Craigslist. Once their account is banned for scamming, so will yours most likely as the number associated with it.

This is also common with Google Voice, a service from Google that allows you to get a free phone number from them. However, to create an additional number, Google needs it associated with a current number (you). The scammer gets a code sent to you and then uses it to create a new number on Google Voice.

Almost everyone with an email address or web form on their website gets companies emailing them. SEO companies and other marketing services to “improve your website” top the list, along with people offering you “leads”. Spoiler alert: they will never improve your website or your SEO. They are always scams and you can safely ignore every single form submission or email. .

In case you didn’t get it the first time, an unsolicited SEO audit is always a scam.