1. The fake delivery notice
A text or email says a package is on hold, the address is incomplete, or there is a small redelivery fee. The link goes to a page that looks like UPS, FedEx, or the Postal Service and asks for a card number or a login. In December, when the office really is expecting boxes, it is easy to tap.
Do this: never use the link. Open the carrier's app or type its website yourself, and use the tracking number from the store's own order confirmation.
2. Gift cards for the boss
An employee gets an email or text that looks like it's from the owner: "Are you at your desk? I need a quick favor. I'm in a meeting and can't talk." The favor is buying gift cards for clients or staff and sending photos of the codes. The name is right, but the address is a free Gmail account or a lookalike domain.
Do this: make it a known rule that the owner will never ask anyone to buy gift cards by email or text. Any such request gets a phone call to the boss at the number already in your phone.
3. New bank details on an invoice
Year-end is when vendors chase payment, and scammers join in. A message arrives from a real supplier, sometimes from their actual hacked mailbox, saying they've changed banks and the next payment should go to a new account. It's often the most expensive scam on this list because the invoice amount is real.
Do this: treat any change to payment details as unconfirmed until you call the vendor at a number you already had, not one in the email. Our five security habits for small businesses cover this and other basics.
4. The big rush order
A large order shows up from what looks like a school district, hospital, or government office, with a real staff name and a real address. They want it shipped fast on net-30 terms, often to a different address than the one on file. Once it ships, the goods and the "customer" are gone.
Do this: read the actual email domain before you quote. We walk through a real example in how to spot a fake purchase request.
5. The too-good supply deal
Ads and emails offer printer ink, laptops, or holiday gift boxes at prices well below everyone else. The site looks professional but the web address is slightly off, it's only a few weeks old, and checkout asks for a wire transfer, Zelle, or crypto instead of a credit card.
Do this: buy business supplies from vendors you already use, and pay with a credit card so you can dispute the charge if something goes wrong.
Make your own email harder to fake
Several of these scams work because someone can send email that looks like it came from you or your vendor. SPF, DKIM, and DMARC records on your domain make that much harder, and they help your real messages stay out of spam. AXD's email security review starts at $100 and checks all three. If you're still on a free Gmail or Yahoo address, our guide to moving business email to your own domain explains the switch.
Common questions
What should I do if an employee already bought gift cards for a scammer?
Contact the gift card company right away using the number on the card or its website, tell them it was used in a scam, and ask whether they can freeze the funds. Keep the cards and receipts, then report it to the FTC at ReportFraud.ftc.gov.
What if we already paid a fake invoice?
Call your bank immediately and ask them to recall the payment. The first few hours matter most. Then report it to the FBI at ic3.gov and change the password on any email account the scammer may have used.
Is it safe to click a delivery text if I am expecting a package?
No. Type the carrier's website yourself or open its app, and paste in the tracking number from the store's own order confirmation. Real carriers do not text you a link to pay a redelivery fee.
How do I train my staff without a big program?
Share this list at your next team meeting and agree on one rule: any request involving money, gift cards, or bank details gets confirmed by phone, using a number you already had, before anyone acts on it.
Not sure if a message is real?
Forward it to us before you click or pay. AXD helps small businesses in Coos Bay, North Bend, and across the South Coast with email security and everyday IT. Book a free 30-minute call, or run our free Tech Checkup to see how your email setup grades.