Your bookkeeper gets a text on a Friday afternoon. It's from you, or it looks like you, your name sitting right there at the top. The message is short and a little rushed: a supplier changed their bank, can she send the deposit to the new account before the weekend closes it out. She's seen you fire off texts exactly like that from a job site, so she almost does it.
That's the whole scam, and it's landing on shops like yours right now. The tools got cheap and convincing at the same time. Somebody can grab a few seconds of your voice off a voicemail greeting or a video you posted, clone it (make a computer copy that talks in your voice), and leave a message that sounds like you asking for a favor.
None of this means you need to panic or buy some pricey security setup. It means a couple of plain habits, taught to your crew once, stop almost all of it. Let's go through what's actually out there, and the two or three moves that do the heavy lifting.
The scams actually hitting small shops
You don't need to know every trick. A small handful shows up over and over, and they all lean on the same thing: getting somebody to move money fast without checking.
- The fake-boss text or email. A message that looks like it's from you, usually to whoever handles the money, asking for a quick payment, a gift card run, or a wire. The sender's name is spoofed (faked so it displays as you). Urgency is the tell.
- The cloned voice call or voicemail. Same idea, but now it's your voice. A short, slightly muffled message, bad reception blamed, asking someone to handle a payment while you're tied up.
- The changed-deposit switch. An email from a supplier or sub you really use, saying their banking info changed, please update it. One wrong payment and the money's gone to the scammer, not your vendor.
- The fake customer moving a deposit. Someone posing as a customer who already paid, claiming they sent the deposit to the wrong place and asking you to refund it to a new account.
Notice what they share. Every one of them is about money moving to a new destination, and every one of them wants it to happen before anybody picks up the phone.
Why it sounds so much like you
Here's the honest part, because owners trust you more when you don't oversell the threat. Voice cloning really is good now. A few seconds of clear audio is often enough to make a copy that fools a coworker on a short, noisy voicemail. If your outgoing greeting is your own voice, that's plenty of material.
But the fakes have real limits, and that's your edge. The cloned voice can read a script. It can't hold a natural back-and-forth, it doesn't know the inside stuff only you and your crew know, and it leans hard on pressure because pressure is all it's got. A live, two-way conversation on a number you dialed breaks almost every one of these.
Text and email are even easier to fake than voice, and they're the ones hitting shops most. No cloning needed, just your name in the From line and a believable ask. Which is good news, because the same fix handles both.
The two moves that stop most of it
You could teach your crew a dozen rules and they'd remember none of them by Tuesday. Teach these two instead.
Call back on a known number. Any message about money, a wire, a bank change, a deposit, a gift card, gets verified by calling the person on a number you already have. Not the number in the message. Not a reply to the email. The number in your phone, or on the last invoice. If it's really you or a real supplier, a ten-second call confirms it. If it's a scam, the real person has no idea what you're talking about, and you just saved the deposit.
Set a code word for money moves. Pick a word or short phrase that only you and the person who handles payments know. Something that isn't on your website or truck. Any request to send money, change bank info, or buy gift cards has to include that word, spoken or written. No word, no money, no exceptions. A cloned voice doesn't know it. A spoofed email doesn't either.
That's the core of it. A callback on a trusted number and a code word cover the fake-boss text, the cloned voice, and the changed-deposit email all at once.
Teach the crew without turning them into nervous wrecks
The point isn't to make everyone suspicious of every text. It's to put one speed bump in front of money. Frame it that way and people actually follow it.
- Nobody gets in trouble for checking. Say it out loud and mean it. The fastest way to break your own system is to snap at someone for calling to confirm a real request. If verifying costs them grief, they'll stop verifying.
- Slow down is the whole skill. Urgency plus money is the pattern. A message pushing someone to act right now, before the bank closes, before you land, is exactly the one to pause on.
- Make it a 15-minute talk, not a binder. Walk through one example, agree on the code word, write the callback rule on something everyone sees. Done.
One more quiet tip: trim what's public where it's easy. You can't scrub the internet, and you shouldn't lose sleep over a voicemail greeting. Just know that a long video of you talking, pinned to the top of your page, is free raw material. A plain greeting instead of your voice costs you nothing.
If you think one already got through
Move fast, because with wires and transfers the first hour matters most. Call your bank right away and tell them you may have sent money to a fraudulent account. They can sometimes stop or claw back a transfer if you catch it quick. Call the real supplier or customer on a known number to confirm what actually happened.
After that, report it. Your local police can take a report, and the FBI runs a complaint site for this kind of thing (search for IC3) that's worth filing with, especially for wires. Then tell your crew what happened, plainly. A near miss shared out loud is the best training you'll ever run.
Worth doing this week
You don't need all of it at once. Pick these off in an afternoon.
- Agree on a code word with whoever touches money, and keep it off anything public.
- Write one rule where the crew can see it: any money request gets a callback on a known number first.
- Spend 15 minutes walking the team through one fake-boss example so they recognize the pattern.
- Check your voicemail greeting and pinned videos, and swap a long voice clip for something plainer if it's easy.
- Save your real supplier and bank contact numbers in your phone now, so a callback takes seconds, not scrolling.
These scams count on nobody pausing. Give your shop one small pause before money moves and you've handled the large majority of them. If you'd like a hand setting the habits up or training the crew, that's the sort of thing we help Massachusetts shops with, and we're a phone call away.