Online scams are becoming increasingly sophisticated, and one tactic small businesses should be aware of is email impersonation.
In an impersonation scam, someone sends an email pretending to be a legitimate business owner, employee, supplier or organization. The email may use a similar-looking email address, copy a business name or logo, or include information gathered from publicly available sources to make the message appear credible.
For small businesses, these scams can be particularly concerning because customers often know and trust the people they regularly communicate with.
Understanding how email impersonation works, how to recognize it and what steps businesses can take to reduce the risk can help protect both your business and your customers.
What Is Email Impersonation?
Email impersonation happens when someone creates a message designed to make the recipient believe it came from another person or company.
In some cases, the scammer may create an email address that looks similar to the legitimate business address. They might also use the business owner’s name, company name, logo or other publicly available information.
The goal is usually to convince the recipient to take an action such as:
- Sending money
- Paying a fraudulent invoice
- Purchasing gift cards
- Providing login credentials
- Sharing confidential information
- Clicking a malicious link
- Opening an unsafe attachment
Importantly, an impersonation email does not necessarily mean that your website or email account has been hacked. Scammers can create new email accounts and use information that is already publicly available online.
Why Small Businesses Can Be Vulnerable to Impersonation Scams
Small businesses often have close relationships with their clients and customers.
A customer may recognize the owner’s name and be accustomed to receiving emails directly from them. That familiarity can make an impersonation email more convincing.
Business information can also be found in many places online, including websites, directories, social media profiles and search results.
A scammer does not necessarily need access to your internal systems to learn who you are, what your business does or who some of your customers may be.
This is why protecting a business online involves more than securing the website itself.
Signs an Email May Not Be Legitimate
Even convincing scam emails often contain warning signs.
Check the Actual Email Address
Do not rely only on the sender name displayed in your email program.
A message may appear to be from a familiar person while actually coming from an unrelated Gmail, Outlook or other email address.
Always look at the complete sender address, particularly if the message contains an unusual request.
Be Cautious About Unexpected Requests
If someone you normally communicate with suddenly asks you to send money, purchase gift cards, change payment information or provide sensitive information, verify the request separately.
Contact the person using a phone number, email address or other communication method you already know is legitimate.
Watch for Urgency
Scammers frequently try to create a sense of urgency so the recipient acts before taking the time to verify the message.
Requests that need to be handled “immediately,” messages claiming the sender cannot speak by phone or instructions to complete a payment before the end of the day should be treated cautiously, particularly when money or confidential information is involved.
Check Links Before Clicking
A link can display one address while directing you somewhere completely different.
If you are unsure about an email, go directly to the company’s website instead of clicking a link contained in the message.
You should also be cautious about unexpected attachments.
Pay Attention When Something Seems Unusual
You know how the businesses and people you work with normally communicate.
A different writing style, unexpected email address, unusual request or sudden change in procedure can all be reasons to verify a message before responding.
What Can Small Businesses Do to Reduce the Risk?
Use a Professional Domain Email Address
Whenever possible, business communications should come from an email address associated with your domain, such as:
na**@**********ss.ca
Using a consistent business email address makes it easier for customers to recognize legitimate communications.
It also makes unexpected messages from unrelated email addresses easier to identify.
Configure Email Authentication
Business domains can use email authentication technologies such as SPF, DKIM and DMARC.
These settings help receiving mail systems determine whether an email claiming to come from your domain was actually authorized to be sent on your behalf.
Proper email authentication is particularly important for helping prevent someone from directly spoofing your business domain.
Use Multi-Factor Authentication
Multi-factor authentication should be enabled on important business accounts whenever it is available.
This includes:
- Business email
- Website administration
- Website hosting
- Domain registration
- Cloud storage
- Social media accounts
- Other systems containing business or customer information
Multi-factor authentication provides an additional layer of protection if a password is ever compromised.
Keep Your Website and Software Updated
Website security is another important part of your overall online security.
WordPress, plugins, themes and other website software should be kept current. Unused plugins, themes and user accounts should also be removed when they are no longer required.
Regular maintenance helps reduce vulnerabilities that could otherwise be used to compromise a website.
Have Clear Payment Procedures
Businesses should establish predictable procedures for invoices and payment changes.
For example, customers can be advised that changes to banking or payment information will always be confirmed through another method.
The same principle should apply internally.
If an employee receives an unexpected request involving money, banking information or sensitive data, there should be a second verification step before any action is taken.
What Should You Do If Someone Is Impersonating Your Business?
If you discover that someone is sending fraudulent emails using your name or business identity, act quickly.
Keep copies or screenshots of the messages, including the complete sender email address.
Report the account or fraudulent message to the email provider being used.
If customers may have received the message, consider notifying them and explaining how to identify legitimate communications from your business.
You may also want to review your website, hosting account, domain settings and email security to make sure there is no indication that your systems have been compromised.
If financial fraud is involved, you may also need to report the incident to your financial institution and the appropriate fraud authorities.
Online Security Is Also About Trust
Website security is often discussed in terms of malware, passwords, backups and software updates.
Those things are important, but security also includes protecting the relationship between your business and your customers.
A well-maintained website, professional domain email, properly configured security settings and clear communication practices all make it easier for customers to recognize when they are genuinely dealing with your business.
For a small business, that trust is worth protecting.
Need Help Reviewing Your Website Security?
Your website is one part of your business’s overall online security.
LCM Web Design helps small and medium-sized businesses keep their WordPress websites secure, maintained and up to date. If you’re concerned about outdated software, website security or whether your website is following current best practices, we can help identify potential issues and recommend what should be addressed.
Contact LCM Web Design to discuss your website and ongoing maintenance needs.