Protecting Against Online Fraud: The Business Guide

For fraudsters the small business is the ideal target: it has money, no IT department, a busy owner, an untrained staff. The big company they hit after months of preparation; the small one with a mass template, hundreds of attempts a day. The first truth on the online fraud topic is this: the "who would attack us" thought is itself the weakness; the attack is not personal but automatic, and it enters wherever it finds the door open.

This article gives the map of business-targeted fraud: the widespread scenarios, the recognition signs and the rules protecting the team; the phishing depth is a separate article.

The widespread scenarios: business in the crosshairs

The scenarios change, the skeleton does not: the urgency + the unusual payment demand + the blocking of verification. Recognising that trio is half the defence.

The recognition signs: the red flag set

Fraud's shared signatures: the artificial rush ("if not today, it gets cancelled"; a legitimate counterparty can wait), the channel jump (the official correspondence suddenly moves to a personal number), the detail change (the account number or payment method changes abruptly; the dearest flag), the small defects (the domain letter differs: "sirket-az.com" instead of "sirket.com"; the name right, the email foreign) and the unreal terms (an offer far better than the market price). The AI era's addition must be noted too: the fake messages are now written tidily (the old "error-riddled message" sign has weakened) and voice-clone calls are possible; hence even "a familiar voice" cannot be the sole confirmation. The verification's golden rule: confirm not through the arriving channel but through an independent one: a call to the supplier's old number, the contact found on the official site.

The team rules: the systematic defence

• The two-person rule: the detail changes and the non-standard payments pass a second person's approval; a single signature is a single weakness.
• The call-back protocol: every message asking for a money-or-account change gets confirmed by a call to the known number; without exception.
• The authority clarity: who may pay how much without approval; the written threshold.
• The account logins: 2FA + the password rules on all work accounts; the account hunt's technical wall.
• The suspicion culture: the "I checked — it wasn't you" call is not a shame but a procedure; the employee who suspects gets praised, not scolded.
• The incident plan: when a deception happens, the first hour's steps are written: the bank block, the password change, the internal check, the report to law enforcement.

If you were deceived: the first 24 hours

Shame is the worst adviser: most incidents grow because they get hidden. The step sequence: the bank/payment side (an immediate call: a transfer can sometimes be stopped; the card block), the login cleanup (the passwords of the accounts that may have been touched + closing the sessions), the documentation (the correspondence, the receipt, the numbers: a screenshot of everything; for both the bank and the police), the official report (the application to law enforcement on cybercrime; electronic filing options exist) and the open word to the team (the same scenario can reach someone else; hiding it is an invitation to a repeat). At the end the cold analysis: which rule was missing or did not work; the incident's only benefit is the procedure hardening.

Sources and further reading

Where to verify the source

The official reporting channels:

• The Ministry of Internal Affairs: the cybercrime report

Continuing the topic

The security line's neighbouring articles:

• The phishing depth
• The password and 2FA
• The cybersecurity basics
• The account theft plan
• Other articles on this topic

This week's work is one rule: announce the call-back protocol to your team: "a detail change = a call to the known number". That one-sentence rule single-handedly closes the dearest scenarios in this article.