
How To Protect Your Business From Scammers in 2025:
Most of us have received a ‘phishing’ scam, and we all know not to click on THAT link. But scams are becoming increasingly clever, and small business owners (think artists and coaches) are often targeted because they generally work alone and don’t have proper protections in place.
You’re too busy running your biz to deal with the boring work of digital security, and scammers know it.
I wish all scams were as easy to spot as this one a client recently received:
In 2024, the scams were primarily requests to purchase your product with Bitcoin, OR they were just comments on your photo with a link to porn or malware, like this:
(Side note: If you want to block spammy comments and links on your business page, go to ‘professional dashboard,’ then ‘moderation assist.’ You can block certain words, links, and whole countries from seeing your page.)
Recent scams I’ve encountered include voice cloning of family members needing help (it only takes two seconds of a recorded voice to create an Ai generated clone), and invitations to participate in fake events in your business niche. In the latter example, scammers create a fake website with names of people in your professional field, then ask you to login with a username and password of your choosing- in all likelihood, you will choose the same one you use on all your email accounts. They now have your email address, login, and password, and thus access to bank accounts and everything else.
In many industries, such as real estate and CPAs, the business owner hires a digital website manager to implement all their digital communications. This creates a barrier between the business asset and the scammer (and these businesses pay good $$ for the service, generally between $200-$500/month, and this is only for security, not marketing or content). Most small business owners tend to manage IT ALL themselves to save money, and trust me… the scammers are well aware.
Here’s how to protect your online business before they get through the door:
1.) Add an additional admin (i.e. provide page access) to all your accounts, and make sure that person also follows the steps below. This way, if you are hacked personally, there is someone else who can remove the spammer and help save the business.
2.) Open a password manager on your desktop and generate new passwords for all your accounts. Password managers such as 1pass cost about $5 a month.
3.) Change the answers to your security questions. These are likely in the public domain, and Ai bots can quickly ascertain your mom’s maiden name or the street you grew up on.
4.) Enable two-factor authentication (TFA). and consider becoming Meta Verified (blue check mark). TFA is like adding a second lock to your front door, and you can implement it for all your social media, as well as your email accounts. TFA will require a secondary code to be manually approved on your cell phone before anyone new is allowed access to your accounts.
Meta Verification is an additional security feature that I wish was more straightforward to implement. If you’re willing to pay $20 a month and go through the paperwork (submit business utility and EIN statements), then you’ll have access to customer service and other benefits you can read about here.
5.) Open a Meta Business Account and place a $5 ad: This is so important for any small business on Facebook and Instagram. Your Meta Business Account is a place that holds your Facebook Pages, Instagram profiles, Ad accounts, and other business assets, and helps you manage permissions of users on them. If your personal account is hacked, for example, you should still have access to your business page via the business account. It also helps with your future business growth- if you ever hire someone to help you manage your business online, you can provide access via the business account, instead of sharing with them your personal logins. Bonus: By placing a small ad, you now get the phone number (or sometimes chat messenger) for Meta’s customer service, wherein you can speak to a real live person about your concern.
6.) Before opening any link or offer, take a moment to research who it belongs to. Even elaborate websites can be created by Ai, and they may be hyper-targed to your professional niche by pulling your colleague’s names from their own social media pages, such as LinkedIn in order to trick you. Before clicking on anything, evaluate the URL- does it match the business name? Most scammers have sorted this one out, so it’s best to go straight to the digital ownership page of WHOIS.COM. A website owner can only hide their name by paying $15-$20 annually to their hosting company, and most scammers won’t do that. Instead, you’ll see the real owner, who is likely not who you think. If nothing comes up in that database, try entering the keywords from their offer into a Reddit.com thread. Many scams are reported there, and you’ll see if this offer is indeed too good to be true.
7.) Develop your email list. This is a long-game strategy of protection- social media is rented space. Make sure you have a way to connect directly with your customers from here on out. Both Constant Contact and MailChimp have free plans and will walk you through the process of landing pages and newsletters.
Have you been compromised? Here’s what comes next:
First, don’t blame yourself. They didn’t come after you personally, they just want your data. Now, let’s make sure the situation doesn’t get worse.
Don’t post that you’ve been hacked (assuming you still have access). The moment you post this, you will be attacked with more hackers offering to unhack you.
This is What You CAN Do
1.) First, set your standards low. I know you’re a go-getter, but the reality on unhacking is grim. I have successfully un-hacked only two clients out of many many many.
2.) Contact the Meta support line that you received when placing the ad. You may need to petition them to give you the page back by showing them proof of ownership. If you don’t have an ad account, file your report here. Go to THIS LINK to view Meta’s recommended process for securing/un-hacking your business account.
3.) Alert credit agencies and freeze accounts. Want to view your current credit report for free? You can do it one time each year in only one place, AnnualCreditReport.Com
4.) As you attempt to un-hack it, you may end up in the endless loop- there is wherein the system wants to send you a verification email, but that email never arrives. Check out this ‘un-looping’ technique on Reddit.
5.) If it’s not making progress to regain control, you need to move on as soon as possible. I have seen businesses spend months and even years attempting to regain control- to no avail. Start your rebuilding plan now- claim new social media handles and begin your growth strategy from square one. You’ve done this before, and you can do it again!
6.) If your online presence is important to your business, you may consider investing in a higher level of security. Companies like WoodStockIT and ProdigyTeks can be hired to lock down your data (note: I’m not affiliated with any resources in this blog, but they all come recommended by colleagues).
Finally, if you decide you don’t want to go it alone, give me a call. From one small business to another, I’m here for you!
Josie, Owner of Kata Marketing