Business spoofing occurs when criminals impersonate your trusted vendors, banks, or business partners through phone calls, emails, text messages, or fake websites to steal money or sensitive information.

Recent data shows 79% of businesses faced at least one attack in the past year, with criminals often targeting established vendor relationships. FBI data shows that these attacks cost businesses an average of $125,000 per successful incident.

How do spoofing attacks work?

Criminals research companies to understand vendor or bank relationships and processes. They send spoofed emails requesting updated banking details, followed by phone calls claiming to represent your supplier or bank. Some create fake websites, while others send spoofed text messages.

What channels do criminals target?

• Phone spoofing: Scammers display your bank’s or vendor’s actual phone number to request “urgent” payment changes
• Email domains: Criminals register nearly identical website domains of vendors
• Business email: AI tools help criminals write convincing emails that appear to be from your bank or vendor
• Text alerts: Fake security notifications create urgency around account verification
• Fake websites: Identical-looking vendor portals capture login credentials and payment information.

Sophisticated criminals are also using AI-generated voice and video calls to impersonate executives or vendors.

How can businesses protect themselves?

Multi-channel verification is critical, especially for payments or when logging in to bank accounts or human resources systems. The most effective defense strategies address all communication channels.

Best practices include:

• Verifying payment changes through independent contact methods using phone numbers from original contracts
• Establishing code words with key vendors for phone verification of unusual requests
• Training employees to recognize pressure tactics
• Implementing waiting periods for significant banking changes, regardless of urgency claims.

These steps create multiple checkpoints that make spoofing attacks harder to execute. Make sure your bank is working proactively with your business to offer the latest fraud monitoring and fraud prevention technology to protect against these evolving threats.

(262) 792-1400 • FIRSTBUSINESS.BANK
Member FDIC