Cybersecurity Red Flags and Scams Targeting Businesses
Learn the warning signs of untrustworthy cybersecurity vendors and common business scams, including fake security alerts and invoice fraud, with steps to respond.
Warning signs of a bad cybersecurity vendor include guarantees of total protection, refusal to put scope and pricing in writing, high-pressure deadlines, unsolicited alarming calls or emails, and requests for broad access or upfront payment by unusual methods. Separately, criminals target businesses with scams that pose as security vendors, banks, executives or suppliers. This guide covers both: how to vet a vendor, and how to recognize and respond to the scams you are most likely to encounter.
Red flags when evaluating a vendor
| Red flag | Why it matters | What to do |
|---|---|---|
| "We guarantee you will never be hacked" | No provider can promise that | Ask what they do commit to in the contract |
| Unsolicited contact claiming they found a problem on your systems | Often a sales tactic or a scam | Verify independently before responding |
| Pressure to sign today for a special price | Prevents comparison | Ask for the offer in writing and take time |
| Vague scope: "complete protection" | Impossible to compare or enforce | Request itemized scope and deliverables |
| No sample report or references | Cannot verify quality | Ask again; walk away if refused |
| Claims of certifications they cannot document | Credentials may be inflated | Ask for evidence and verify with the issuing body |
| Demands for broad administrator access immediately | Risk before agreement | Insist on a signed contract and least-privilege accounts |
| Unusual payment requests such as gift cards or wire transfers to new accounts | Typical of fraud | Pay only through normal invoicing; verify bank details by phone |
| Reluctance to discuss limitations | Honest providers know what they do not cover | Ask directly what is out of scope |
| Scare tactics based on fake statistics | Manipulates decisions | Ask for the source and check it |
Scams that target businesses
Fake security alerts and tech support scams
A pop-up, email or phone call claims your computers are infected and urges you to call a number, install remote access software or pay for cleanup. Real security vendors do not typically cold-call to say your network is compromised. Response: do not click, call or install anything. Close the page, report the message to your IT provider and run scans with your own approved tools.
Business email compromise and invoice fraud
Attackers impersonate a vendor, executive or lawyer and ask you to change bank details or wire money urgently. The FBI's Internet Crime Complaint Center (IC3) has consistently reported business email compromise among the most financially damaging categories of cybercrime. Response: verify any payment change with a known phone number, require a second approver for wire changes and enable MFA on email. If you sent money, contact your bank immediately and file a report at IC3.
Ransomware and extortion
Attackers encrypt files or steal data and demand payment. See incident response in the first 24 hours. The FBI and CISA generally discourage paying ransoms because it does not guarantee recovery and may encourage more attacks; legal and sanctions issues can also apply, so involve counsel and law enforcement.
Phishing and credential harvesting
Messages imitate Microsoft 365, Google, shipping companies or banks to steal logins. Response: train employees to check the sender and URL, use MFA and report suspicious messages. Phishing-resistant MFA such as security keys offers stronger protection than codes sent by text.
Fake invoices and domain renewal notices
Fraudsters send official-looking bills for domain renewals, "security audits" or directory listings. Response: check with the registrar or provider you actually use; ignore notices from unknown companies.
Vendor impersonation after a breach
After a publicized incident, scammers contact victims offering to "recover data" for a fee. Response: work through your insurer, attorney and verified responders.
Fake compliance sellers
Some sites sell "HIPAA certification" or "PCI compliant" badges for a fee. HIPAA has no government certification, and PCI validation follows the process set by your acquirer and the PCI Council. Response: ask your regulator or acquirer what is required.
Counterfeit or malicious software
Pirated or fake security software can install malware. Response: download from official vendor sites and use your provider's managed deployment.
How to vet a vendor quickly
- Search for the company name with words like "complaints" or "reviews" and check business registration in your state.
- Check the Better Business Bureau and the FTC's consumer sentiment resources for patterns.
- Request two references with similar size and sector, and call them.
- Ask for the contract and sample report before any sales call ends.
- Confirm certifications with the issuer, for example through the certifying body's directory.
- Call the number listed on the company's official website, not the one in a message.
For deeper evaluation criteria, see choosing the right provider.
What to do if you think you were scammed
- Stop contact and do not pay further.
- Preserve evidence: emails, call logs, invoices, screenshots.
- Contact your bank immediately if money moved; time matters for recalls.
- Change passwords and enable MFA on affected accounts; disconnect remote access tools you installed.
- Report to the FBI's IC3, the FTC and your state attorney general, and to your cyber insurer if you have a policy.
- Notify your IT provider so they can check for compromise.
Frequently asked questions
How can I tell a real security alert from a scam?
Real alerts come through channels you set up, such as your provider's portal or known contacts. Be skeptical of unexpected messages that urge speed and ask for credentials or payment.
Should I ever pay a ransom?
It is a business and legal decision. Involve counsel, your insurer and law enforcement first, and understand that payment does not guarantee data return.
Are free security scans offered by email legitimate?
Treat unsolicited offers cautiously. Government programs, such as CISA's free vulnerability scanning for eligible organizations, are available by signing up through the official site, not by responding to cold messages.
Where do I report a scam?
Use the FBI IC3 website, the FTC and your state attorney general's office.
Sources
- FBI Internet Crime Complaint Center (IC3) — report cybercrime and review annual reports
- Federal Trade Commission — report scams and read small business guidance
- CISA — phishing, ransomware and scam guidance
- Better Business Bureau — business profiles and complaints
