New Business Fraud Trends: Scams and Threats to Watch

How business fraud is changing

Familiar schemes now look more convincing

Business fraud does not need a completely new concept to become more dangerous. Criminals can combine familiar tactics—impersonation, false invoices, stolen credentials, and advance payments—with tools that make their messages more credible. Generative AI can help produce polished emails, realistic images, and synthetic audio. A message with perfect grammar is not necessarily legitimate, and a recognizable voice is no longer sufficient proof of identity.

These capabilities affect both sides of a transaction. An owner may receive a convincing request to change a supplier’s bank details. A consumer may encounter a fabricated contractor profile with copied project photographs. The common weakness is accepting persuasive presentation as evidence without independently checking the underlying person, business, or request.

Focus on verification failures, not just appearances

The most useful warning signs are behavioral: unexpected urgency, secrecy, changed payment instructions, resistance to independent contact, or pressure to bypass normal approvals. None proves fraud alone. Together, however, they justify pausing before sending money, credentials, identification documents, or confidential files. Familiar branding and an established email thread should not override those concerns.

A practical defense separates three questions: Does this business exist? Is the person contacting you authorized to act for it? Is this particular transaction legitimate? A positive answer to one does not settle the others. Start with documented criteria such as the GlobalDirectoryPages trust standard, then verify transaction details through a channel you independently established.

AI impersonation and account takeover

Deepfake calls and executive impersonation

A scammer may impersonate an executive, family member, attorney, or service provider and request an urgent transfer. Synthetic voice or video can make that request feel authentic, especially when the caller includes details gathered from public websites or social media. A supposed confidential acquisition, emergency repair, or overdue account can become the pretext for skipping established payment procedures.

Do not attempt to resolve the risk by judging whether a face or voice seems artificial. Instead, end the interaction and call a number already stored in your records. For businesses, require independent approval for unusual transfers and payment-detail changes. Avoid treating a private phrase as a complete defense; shared secrets can also be exposed or stolen.

Compromised accounts can carry genuine history

Account takeover is particularly deceptive because the attacker may use a real mailbox, legitimate signature, and existing conversation. Phishing pages can imitate sign-in portals, while malicious attachments or deceptive authorization requests can expose account access. Repeated unexpected authentication prompts may also be an attempt to obtain an approval from a distracted user.

Use unique passwords, a password manager, and phishing-resistant multifactor authentication where available, such as passkeys or security keys. Review unfamiliar forwarding rules, connected applications, and active sessions. Establish a reporting route for suspicious messages so employees do not need to investigate alone. Businesses seeking specialist assistance can compare providers in the cybersecurity directory, while checking each provider’s capabilities and engagement terms independently.

Payment diversion and invoice manipulation

A small change can redirect a large payment

Payment diversion often begins with a plausible update: a supplier has changed banks, a property manager has a new payment portal, or a contractor needs the next installment sent elsewhere. The invoice may otherwise be accurate. Attackers can exploit timing around closings, payroll, renewals, and project milestones, when recipients expect significant payments and may be working under deadlines.

Confirm every change to banking instructions through a previously verified contact method—not a telephone number supplied in the change request. Record who confirmed the change and who approved it. Where practical, separate the employee who edits vendor payment information from the employee who releases funds. Consumers should apply the same callback rule before sending a deposit or closing funds.

QR codes and refund stories hide the destination

A QR code is simply a route to information or an action; it is not evidence of legitimacy. A replacement code on a printed invoice or a fraudulent payment link in a text message can lead to a lookalike site. Inspect the destination and, when uncertain, navigate to the provider’s established website or app rather than following the supplied link.

Another warning sign is an overpayment followed by a request to refund the excess through a different method. Funds appearing available in an account do not necessarily mean the original payment is final. Ask your financial institution about questionable payments before returning money. Prefer transaction methods with suitable dispute protections, and understand that protections vary by account type, payment method, and circumstances.

Fake businesses, stolen identities, and false proof

Registration alone does not establish trust

A business registration can help establish that an entity was formed, but it does not demonstrate professional competence, insurance coverage, or authorization for a regulated service. Fraudsters may copy a legitimate company’s name, license number, address, and photographs. They may also operate through a real registered entity while making misleading claims about what it can deliver.

Match the legal name, contact details, and service scope across independent sources. For licensed work, consult the relevant licensing authority and examine current status, classifications, and applicable restrictions. For insurance, request appropriate evidence and, when necessary, confirm details with the issuing agent or insurer through independently obtained contact information. A certificate does not guarantee that every proposed job or loss is covered.

Reviews and badges need their own checks

Reviews provide useful context, but copied testimonials, fabricated endorsements, and selectively displayed feedback can distort the picture. Look for specific descriptions across multiple sources rather than relying on a single rating. Ask how complaints were handled, and distinguish allegations from established findings. An absence of reviews may simply reflect a new business, not misconduct.

Likewise, a badge image can be copied. Use badge verification to check a GlobalDirectoryPages badge against its live record rather than trusting a screenshot. Compare the displayed business identity with the company requesting payment. The business directory can support your research, but verification should complement—not replace—a clear contract, suitable payment terms, and transaction-specific checks.

Contain suspected fraud without making it worse

Act quickly on payments and account access

If money may have been sent to a scammer, contact your bank or payment provider immediately using an established number or official application. Explain that you suspect fraud and ask about stopping, recalling, or disputing the transaction. Availability and success depend on the payment method, timing, and circumstances; recovery is never assured. Preserve transaction identifiers and the recipient information you used.

If an account may be compromised, secure it from a trusted device. Change exposed credentials, revoke suspicious sessions and application access, and review recovery settings and forwarding rules. In a workplace, alert the responsible IT or security team promptly. If malware is suspected, follow incident-response guidance and avoid actions that could unnecessarily destroy useful evidence.

Preserve evidence and coordinate reporting

Save original emails, message headers where available, invoices, contracts, screenshots, and a timeline of events. Record names and contact details used by the suspected scammer without continuing the conversation. Notify affected counterparties through known channels if an attacker may be impersonating your organization. Prompt warnings can help prevent another payment from following the first.

US victims can report fraud to the Federal Trade Commission and internet-related crime to the FBI’s Internet Crime Complaint Center. Depending on the incident, contact local law enforcement, an insurer, or qualified legal counsel about additional obligations. Be wary of unsolicited recovery services promising guaranteed results for an upfront fee. Victims can be targeted again by people claiming they can retrieve lost funds.

Frequently asked questions about business fraud

Does an AI-generated message automatically indicate fraud?

No. Legitimate businesses use AI to draft messages, translate communications, and support customers. The issue is whether the sender and request are authentic, not which writing tool was used. Check unusual instructions, payment destinations, and requests for sensitive information independently. Polished language does not prove legitimacy, while awkward wording alone does not establish dishonest intent.

What should I do when a supplier changes bank accounts?

Pause the update and contact a known representative using contact information already in your records. Do not rely on the reply address or telephone number included in the new instructions. Document the confirmation and follow your approval process before changing payment details. For significant payments, require another authorized person to review the change before funds are released.

Can a legitimate business have a compromised email account?

Yes. A real business can suffer account takeover, allowing an attacker to send messages from an authentic address and reuse genuine conversation history. This is why checking the sender’s domain is necessary but insufficient. Independently verify unusual requests even when the email appears inside an existing thread, especially if banking details or payment timing have changed.

Does a verified badge guarantee a safe purchase?

No. Verification can provide useful evidence about a business, but it cannot guarantee every future action, employee interaction, or transaction. GlobalDirectoryPages independently verifies licenses, insurance, and reputation, monitors businesses daily, and issues live trust badges. Check the live record for current information, then separately confirm the contract, payment instructions, service scope, and identity of the person contacting you.

Are small purchases safe enough to skip verification?

Not necessarily. A small transaction can expose card details, passwords, personal information, or access to a business account. Low-value purchases may also lead to unexpected recurring charges. Match your checks to both the amount and the information at risk. Use established checkout channels, review recurring-payment terms, and avoid reusing passwords when creating a new customer account.

Should I publicly accuse a business after a suspicious message?

First verify what happened. A legitimate company may be impersonated, or its account may be compromised without its knowledge. Preserve evidence and contact the business through an independent channel. Describe documented facts when reporting or reviewing the incident, rather than presenting unverified allegations as conclusions. Seek qualified legal advice if the situation involves substantial losses or disputed claims.

Next steps

Give owners and employees a repeatable process

Start with a short policy covering payment changes, unusual transfers, credential requests, and suspected impersonation. Identify who can approve exceptions and where employees should report concerns. Make independent callbacks routine rather than optional, and ensure staff can pause a transaction without being penalized for reasonable caution. Test the process with a realistic scenario before a genuine incident creates pressure.

Review your public business information as well. Accurate telephone numbers, service descriptions, and legal names make it easier for customers to identify you. Owners can claim their business listing and review available verification options through pricing. Keep credentials and contact details current, and explain how customers can confirm legitimate payment requests from your organization.

Make verification part of every important purchase

Buyers should compare more than price. Confirm the business identity, check credentials relevant to the work, obtain written terms, and understand how deposits, cancellations, and disputes will be handled. For projects involving regulated trades, the construction contracting directory can provide a starting point for research. Never assume that a listing alone resolves questions about a particular job.

The goal is not to eliminate every uncertainty before doing business. It is to replace preventable assumptions with repeatable checks, especially when money or sensitive information is about to move. Combine current business records with independent transaction confirmation and a clear response plan. Business owners can take the next step by checking their free trust score.