The Small-Business Scam-Defense Checklist

Identity & email (do today)

• Turn on phishing-resistant MFA (passkey or hardware key) for finance, exec, and admin
• Enforce DMARC at p=reject for your domains
• Add a banner to all externally received emails
• Disable legacy mail protocols (IMAP, POP, basic auth)

Payments (do this week)

• Require callback verification on every new vendor bank-account change
• Set a dual-control rule for wires over $10K
• Use Confirmation of Payee where available
• Maintain a known-good contacts sheet — separate from email

People

• Run a 30-minute BEC drill with your finance team within 30 days
• Pre-share an executive challenge phrase rotated quarterly
• Train helpdesk on callback verification for password / MFA resets

Devices

• Patch operating systems weekly
• Enable disk encryption on every laptop
• Lock SIM-swap protection with carriers for execs

Vendor & insurance

• Ask vendors for SOC 2 / ISO 27001 at procurement
• Carry cyber + crime insurance with a fraud / social-engineering rider

Practice the response

• Document a 15-minute response plan for "we sent money to a scammer"
• Print the bank fraud hotline near every payment desk