We’re seeing it more and more: fake invoices, spoofed emails, and slick impersonations that almost pass the smell test.
Hackers and scammers are stepping up their game. And unfortunately, trade businesses like yours are in their sights.
Here at Atlas Accounting Group, we’ve had a front-row seat to some of these fraud attempts.
From lookalike accounts pretending to be vendors, to false emails mimicking your team’s tone and logos, it’s become easier than ever for scammers to create realistic phishing attacks. This is especially true with the help of AI.
So let’s talk about what’s happening, what you can do about it, and why it’s so important to protect your business (without becoming paranoid).
What Kind of Fraud Are We Seeing?
In the last few months, we’ve helped our clients navigate things like:
- Fake invoices sent to the AP team, mimicking real vendors, down to the logo and email signature (!)
- Phishing emails pretending to be from internal staff, requesting wire transfers or sensitive tax documents.
- Spoofed domains (like john@yourbusness.com instead of john@yourbusiness.com).
- Hacked email accounts that quietly monitor communications for weeks before striking.
These scams often look real. They’re getting past spam filters. And with AI tools, scammers can write polished, convincing messages that seem authentic, right down to referencing real jobs, clients, or vendors.
Best Practices to Avoid Fraud in 2025
So what can you do about it? Here’s what we recommend.
These are the same best practices we use ourselves at Atlas:
1. Get a Proper Domain Name (and Stop Using Gmail or Yahoo Accounts)
Scammers love businesses that use generic email accounts like @gmail.com or @yahoo.com. They’re easy to spoof, and harder for customers and vendors to verify.
Our tip: Invest in a professional domain (like @yourcompany.com) and host your email securely through services like Google Workspace or Microsoft 365. You’ll look more legitimate, and you’ll have more control over security.
2. Enable Multi-Factor Authentication (MFA)
Passwords alone aren’t enough anymore. MFA, where you get a code on your phone or app, is one of the easiest ways to prevent unauthorized access to your email, accounting software, and internal systems.
Our tip: Require MFA for everyone at your company, not just your bookkeeper or office manager.
3. Do Company-Wide Password Resets Regularly
We know, it’s a pain. But resetting passwords every 3 to 6 months is smart. If a password was ever leaked (on the dark web or from a third-party service), this reduces your risk.
Our tip: Use a password manager like 1Password or LastPass to make this easier on your team.
4. Have a Verification Process for Invoices and Payments
Before sending any payment, especially via wire or ACH, your team should double-check the request using a known, trusted contact method.
Our tip: Don’t rely on the email that came with the invoice. Use the phone number you already had on file to confirm.
5. Watch for Changes in Payment Instructions
One of the most common scams right now is when a “vendor” emails and says, “We’ve updated our bank info, please use this new routing number.”
Our tip: Treat any change in payment info as a red flag until verified directly with the vendor, ideally via phone.
6. Educate Your Team (and Yourself)
The best line of defense is awareness. Make sure your team knows what a phishing email looks like, how spoofing works, and when to raise a red flag.
Our tip: Even a quick 10-minute monthly training can make a big difference.
7. Use a Reliable Accounting System with Role-Based Access
If your books are on Excel or QuickBooks Desktop and shared over email, it’s time to upgrade. Modern systems let you set access permissions, monitor changes, and reduce exposure.
Our tip: We can help set this up securely if you’re not sure where to start.
Why This Matters (Even If You’ve Never Been Targeted)
You might be thinking, “We’re a small company. Why would hackers care about us?”
The truth is, small and mid-sized trades businesses are actually more likely to be targeted because:
- You may not have IT departments or formal cybersecurity policies.
- Payments are often handled quickly, by a small team.
- You work with lots of vendors and sub-contractors, which creates opportunities for invoice fraud.
One successful fake invoice or wire transfer could cost thousands or compromise your customer relationships.
Bottom Line: It’s Time to Get Proactive
At Atlas Accounting Group, we do everything we can to keep your data and financial systems secure.
But at the end of the day, you and your team are your best line of defense.
We’re sharing this now because we’ve seen a rise in fraud attempts lately, and we don’t want you to be next.
If you’re a client of ours and you’re not sure how secure your processes are, or if something’s been feeling off lately, let’s talk.
We’d be happy to walk through your invoice workflow or payment systems and help tighten things up.
And if you ever receive a suspicious email that claims to be from us, give us a call directly.
We’d rather double-check than have you second-guess.
Until next time!
