Small businesses get targeted by phone scams because someone always answers, staff are busy, and paying bills is a normal part of the day. The most common scripts are fake utility shutoff calls, calls selling or "renewing" a directory or Google listing, requests to change where you send vendor payments, and fake tech support calls to the front desk. The defense is the same for all of them: never act on the caller's instructions, and verify through a number or channel your business already trusts.
Why scammers call businesses instead of people
A business phone number is public on purpose. It is printed on your website, your signs and your listings, so anyone can reach whoever picks up. That person is often not the owner or the bookkeeper, and may not know which vendors you use or how bills are normally paid. They also know that an interruption to power, payments or online visibility feels expensive for a business, so a threat to cut one off gets attention fast.
The FTC publishes guidance on scams against small businesses and names several of the same patterns covered below. Its general rule applies here too: a caller who insists you can only pay by wire transfer, gift card, cryptocurrency or a payment app is a scammer.
Fake utility shutoff calls
The caller says your electricity, gas or water will be cut off within the hour unless you pay an overdue bill right now, over the phone. Some callers ask for a prepaid card or a payment app; some offer a "direct line" to call back.
According to the FTC's guidance on utility imposters, scammers want to scare you into paying before you can confirm anything, and a real utility will not insist that you pay only by wire, gift card, crypto or payment app. The fix is simple and takes a few minutes: hang up and call the number printed on your actual utility bill or on the utility's official website.
Directory listing and "Google listing" calls
This script comes in two versions. In one, the caller says your business directory listing is expiring and needs to be renewed, or asks someone to "confirm" your details, then later sends an invoice for a listing you never ordered. In the other, a caller or robocall claims to be from Google and warns that your business will disappear from search or maps unless you verify or pay.
Google's own Business Profile help page on fraudulent calls says that if someone calls pretending to be from Google, you should hang up and not press any buttons. Google also says it will never ask for payment information over the phone and does not guarantee a special spot in its products. You can check and manage your listing yourself by signing in to your own account, without anyone calling you.
Teach staff one line: "We don't confirm or approve anything by phone. Send it in writing and our owner will review it." Then make sure the written invoice actually gets reviewed before anyone pays it.
Fake invoices and vendor payment changes
The FTC warns that businesses receive invoices for products or services they never ordered, such as tech support, domain registration or search engine optimization, sometimes marked "past due" to create pressure. A phone call may follow to push for payment.
A more damaging variation is the payment change. Someone who appears to be a regular supplier, by email or by phone, says their bank details have changed and asks you to send the next payment to a new account. The message may look exactly like the vendor's usual emails, and caller ID can be faked, so neither proves who is on the other end. The protection is a callback rule: before changing any payment details, call the vendor at a number you already have on file, not the number in the email or the one the caller gives you. If money has already gone out, contact your bank immediately; the FBI's Internet Crime Complaint Center at ic3.gov takes reports of this kind of business payment fraud.
Tech support calls to the front desk
A caller says they are from a well-known software company, your internet provider or "IT," and that your computer or card reader has a problem. They ask the person at the desk to install a program or open a website so they can "fix it" remotely.
The FTC says legitimate tech companies do not contact you by phone to report a problem with your computer. For how these calls typically unfold and what to do if someone already allowed access, see our guide to what tech support scam callers say and do. For a front desk, the rule is short: no one gets remote access to a business computer because of an incoming call.
Staff habits that stop most of these calls
Scripts change, but a few habits cover nearly all of them:
- Nobody pays on an incoming call. Payments go through your normal approval process, even when the caller says it is urgent.
- Verify with a number you already have. Use the number on the bill, the card, the contract or the official website, never the one the caller offers.
- Know who approves what. The FTC recommends clear procedures for approving purchases and invoices from vendors you actually work with, and asking staff to check invoices closely.
- Treat urgency and unusual payment methods as a stop sign. Gift cards, wire transfers, crypto and payment apps for a "bill" are red flags on their own.
- Don't press buttons on robocalls. Pressing a number to "speak to someone" or "be removed" can lead to more calls.
- Write it down. Note the number shown, the time and what was said, so the call can be reported.
A short, printed version of these rules near the phone helps new or part-time staff. Our phone scam protection checklist covers the same ground for individuals and can be adapted for a team.
What to do next
If your business received one of these calls, report it. Fraud and fake invoices can be reported to the FTC at ReportFraud.ftc.gov, and unwanted or spoofed calls can also go to the FCC. Our guide on how to report a spam or scam call explains which channel fits your situation. If money or payment details were shared, call your bank right away using the number on your card or statement.