Most scams rely on urgency and trust: a supplier's new bank details, the boss asking for a quick payment, or a sign-in request you didn't start. Pause, check by phone on a number you already have, and report it.
1. Fake invoices and changed bank details
A supplier emails to say their bank details have changed, often from their real email address because it's been hacked. The invoice looks genuine, and the money goes to a criminal.
Spot it: any request to pay a new account. Stop it: always phone the supplier on a number you already hold before changing bank details, and use your bank's Confirmation of Payee check.
2. The urgent request from the boss
An email or WhatsApp message appears to come from the owner or a director, asking for an urgent payment, gift cards or confidential information, often while they're "in a meeting" or "travelling".
Spot it: urgency, secrecy and a new way of asking. Stop it: agree a rule that unusual payments are always confirmed by phone or in person.
3. Fake Microsoft or Google sign-in pages
An email says your mailbox is full, a document has been shared, or your password expires today. The link opens a page that looks exactly like a real sign-in page.
Spot it: check the web address before typing your password. Stop it: never sign in from a link in an email. Open the app or type the address yourself, and keep two-step verification on.
4. Sign-in requests you didn't start
Criminals who already have a password send repeated approval requests, hoping you'll tap Approve to make them stop, or phone pretending to be IT support and ask for the code.
Spot it: any request you didn't trigger. Stop it: tap Deny, change your password and tell whoever looks after your IT. Nobody genuine will ever ask for your code.
5. Fake HMRC, delivery and bank texts
Texts about a tax refund, a missed parcel or a suspicious payment link to convincing fake websites that collect card or login details.
Spot it: unexpected texts with links. Stop it: go to the organisation's website or app yourself. Forward scam texts to 7726.
6. Fake QR codes
Stickers on parking machines, posters or letters lead to fake payment or login pages.
Spot it: check the web address a QR code opens before entering anything. Stop it: use the official app or website instead.
If you've been caught out
- If money has been paid, phone your bank's fraud line straight away. Speed matters.
- If you typed a password, change it now, everywhere it's used, and check for new email forwarding rules.
- Report fraud and cyber crime to Report Fraud at reportfraud.police.uk or on 0300 123 2040.
- Forward scam emails to report@phishing.gov.uk and scam texts to 7726.
- If customer or staff data was exposed, follow your data breach plan. You may need to tell the ICO within 72 hours.
Our free staff training teaches your team to spot these scams in 20 minutes, with a certificate for everyone who passes.
Common questions
What is the most common scam against small businesses?
Fake invoices and changed bank details are among the most common and costly. Always confirm bank detail changes by phone.
Where do I report a scam email in the UK?
Forward it to report@phishing.gov.uk. Forward scam texts to 7726.
Where do I report fraud?
Report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040, and call your bank straight away if money has been paid.
Sources
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.