Four sectors, four versions of the same scam — and the same free defense. No vendor required.
SMB
The boss who emails in a hurry is probably not the boss.
The classic con hasn't changed, but the polish has. You get a message from the owner — traveling, in a meeting, can't talk — who needs a wire sent now, or a stack of gift cards bought for a client, and please keep it quiet until it's done. It reads exactly like them, because the tools writing it have studied exactly how they write. The grammar is clean. The signature is right. The urgency is the whole point: hurry is how you skip the step where you'd notice.
Takeaway: the step you skip is the step that saves you. Any request to move money or buy gift cards gets confirmed on a channel the requester already owns — a phone number you had before the email arrived, not one printed in the message. A quick call to a number you already trust beats a costly mistake every time.
Do this week- Set a money rule everyone knows: any new or changed payment is verified by calling a known number first — no exceptions for "urgent."
- Save real direct numbers for your owner, finance lead, and top vendors so nobody has to trust a number from an email.
- Tell every employee plainly: the company will never ask you to buy gift cards. Make it boring, repeat it, mean it.
Law Firms
The wire instructions changed at the last minute. They always do.
A real estate closing is a magnet because the timing is public, the dollars are large, and everyone's already braced for last-minute paperwork. So the fraudulent email fits right in: a "client" or "opposing counsel" you've been corresponding with sends updated wire instructions, or a quick question that quietly opens a door. The thread looks legitimate because sometimes it is — a compromised inbox somewhere in the chain lets the con ride on a real conversation. A convincing tone is no longer proof of anything.
Takeaway: treat every change to payment instructions as wrong until a human you know confirms it by voice. Call the client or counsel at a number from your own file — never the number, link, or callback in the latest message. The few minutes this costs at closing are the cheapest insurance your firm will ever buy.
Do this week- Make verbal verification of wire instructions a required, non-skippable step on every closing checklist.
- Pull callback numbers for clients and counsel from your matter file, not from the email asking for the change.
- Brief every paralegal and assistant: a request to rush or stay quiet about a transfer is a reason to slow down and call.
General awareness, not legal advice — confirm specifics with your own counsel and malpractice carrier.
Health Clinics
"This is IT — we need to fix your account real quick."
The phone rings and it's "IT support" or "your software vendor," calm and competent, walking a front-desk staffer through a quick fix that just happens to need a password, a login code, or remote access to the machine. This is vishing — the con by voice — and clinics are a favorite target because the front desk is busy, helpful by training, and sitting on patient records that are worth a lot to the wrong people. The matching email version asks staff to "verify" a portal login through a link that looks just like the real one.
Takeaway: real IT doesn't need your password, and a real login code is never something you read aloud to someone who called you. When a call or email asks for credentials or access, hang up or close it, and reach your actual IT contact or vendor on the number you already have on file. Nobody legitimate is hurt by a callback to a known number.
Do this week- Post your real IT and vendor support numbers at the front desk so staff never rely on a number a caller gives them.
- Make the rule absolute: passwords and login codes are never shared by phone or email — to anyone, ever.
- When an unexpected "support" call asks for access, train staff to hang up and call IT back on the posted number before doing anything.
Nonprofits
"Are you at your desk? I need a quick favor." — the director, supposedly.
Lean teams of staff and volunteers run on trust and goodwill, which is exactly what the con borrows. A message lands from the executive director or a board member — warm, a little urgent — asking a junior staffer or volunteer to grab some gift cards for a donor thank-you, or to handle a quiet payment before an event. The other flavor goes after the donor list: an email dressed up as your CRM or payment provider asks someone to "verify" a login, handing the keys to your supporters' data to a stranger.
Takeaway: generosity is your mission, not your verification method. Before anyone buys gift cards, moves money, or logs in to "confirm" anything, confirm the request out loud with the person it supposedly came from — using a number or desk you already trust, not the reply button. The real director would always rather get a quick call than see a volunteer out their own cash.
Do this week- Tell staff and volunteers directly: leadership will never ask them to buy gift cards — treat that request as a scam, full stop.
- Set one simple check for any money request: confirm it in person or by a known phone number before acting.
- Reach donor and payment systems only through a bookmark you saved yourself, never through a link in an email asking you to log in.
