Blog
Three subjects a small team meets in its first year, taken apart by mechanism.
English version for the United States.
Overpayment and refund scams
Ilia Zavialov fraud guide: overpayment refund scams, fake checks, Regulation CC holds, stolen-card refunds and reporting to the FTC.
Fake candidates in remote hiring
Ilia Zavialov reviews remote hiring fraud: deepfake interviews, stolen IDs, laptop farms, Form I-9 checks and reporting to IC3.
Booking fraud and fake reviews
Ilia Zavialov reviews booking fraud: hijacked rental listings, hotel texts asking for your card, fake reviews, and reporting to the FTC and IC3.
Grant and government support scams
Ilia Zavialov scam guide: how fake small business grants work, why SBA does not fund startups, and where to report to the FTC and IC3.
Outsourcing contractor reviews
Ilia Zavialov reviews how to vet outsourcing contractors: fake reviews under the FTC rule, tax preparer checks, vendor access and safe exits.
Directory and registry invoices
Ilia Zavialov on scam invoices: business directory listings, USPTO lookalike renewal notices, fake registers and reporting them to the FTC.
Tender and procurement fraud
Ilia Zavialov on tender scams: fake requests for quotes, bogus purchase orders, SAM.gov fees, changed bank details and where to report them.
Company e-signatures
Ilia Zavialov on company digital signatures and logins: calls in an agency's name, phishing the accountant, director hijacking and storage rules.
Marketplace scams for sellers
Ilia Zavialov on marketplace scams aimed at sellers: fake support, changed payout details, swapped returns, rented accounts and the rules.
Employer reviews
Ilia Zavialov on employer reviews: fake job offers, task scams, money mule recruitment and how to check a company before the interview.
Paid reviews as a job offer
Ilia Zavialov on paid review jobs and task scams: how the negative balance works, what the FTC data shows and what companies should do.
Fraudsters with an official title
Ilia Zavialov on fraud by fake IRS, FBI and bank officials: how the call is built, what it knows about you and where to report it in the US.
Your name in somebody else's advert
Ilia Zavialov on crypto scam adverts that use a company name or an executive face: why they are cheap now and the order to act in.
When the exchange goes to court
Ilia Zavialov on crypto exchange lawsuits and scams: what to record in the first day, how claim classes work, clawback risk and what to change after.
The approval that adds a stranger
Ilia Zavialov on device code phishing: how the attack adds an attacker device without stealing a password, what the logs show and which settings close it.
Fake video calls
Ilia Zavialov scam prevention for a team of five: a payment rule that survives a video call with a synthetic manager.
Restore drills
Ilia Zavialov on testing that a backup actually restores: who runs the drill, how long a small team needs to get back to work, and what sits outside it.
Offboarding
Ilia Zavialov explains closing access when someone leaves the team, covering shared logins, payment tools, and the order that stops gaps.
Payment details
Ilia Zavialov takes apart the swapped bank line inside a genuine email thread and the callback step that keeps a small team solvent.
Fake support
Ilia Zavialov explains how a fake support call looks from an employee desk and which written procedure ends it before money moves.
Payroll details
Ilia Zavialov breaks down the payroll details swap: why an email to accounting works, and which callback control stops the payment.
Two-person rule
Ilia Zavialov explains the two-person rule for payments in a small team: the threshold, who confirms, and cover for holidays and sick leave.
Payments
Ilia Zavialov explains why a changed payment detail slips past a small team, and which procedure turns that moment into a routine step.
Records
Ilia Zavialov on why access registers die within a month in small teams, and the single writing rule that keeps one usable.
Accounts
Ilia Zavialov on why a shared login costs nothing until the first incident, and how roles, a vault and a leaver routine replace it.
A shared login is the cheapest decision a small team ever makes. One password, one license, everybody working by lunchtime. The bill arrives later, on the day somebody leaves in a hurry or a payment lands in an account nobody recognizes, and it arrives in full. Ilia Zavialov treats the shared account as an operational question with a measurable price: what does an organization lose at the moment it can no longer say who did what. The answer runs through attribution, revocation and recovery, and through every procedure that quietly depends on all three.
Shared logins are rarely decided on. They accumulate. A tool is needed on a Tuesday, one seat costs less than four, and the fastest way to get three people working is to drop a password into the group chat. Nobody writes the moment down, because at the time it does not feel like a decision. Six months on, that same password opens a service holding invoices, client addresses and a stored payment method.
Every small team builds an access register once, usually in the week after a departure that took two days to unwind. Within a month the file has fallen behind reality, and within a quarter nobody opens it at all. Blaming discipline is the comfortable explanation, and it hides the real cause, which sits in the design of the register itself. The useful question is narrower than it first appears: where the register lives, who is allowed to write to it, and what event forces a line to appear. Ilia Zavialov treats that last point as the whole design, because a record that depends on memory has already failed.
An access register is a plain record of who can reach which system, in which role, since when, and on whose approval. Its value shows in the speed of a single answer: if a person stopped working with the team this afternoon, what would still be open to them by the evening. A team of a few people accumulates far more access points than any of its members can recall unprompted, once mail, file storage, banking, analytics, hosting, advertising accounts and contractor consoles are counted.
A message arrives in a thread that has been running for months, from an address that has always been correct, and it asks for the next invoice to be paid to a new account. Nothing in it has been forged, which is the reason it works. The question this article answers is what a small team puts in place so that such a message stops being a judgment call and becomes a routine step with a known answer. Ilia Zavialov treats a change of payment details as a procedure with named roles, because a decision that depends on how alert somebody feels that morning will eventually be made wrongly.
The attacker sits inside the correspondence, reached either through the contractor's mailbox or through the team's own. The thread is real, the signature matches every previous letter, the invoice number belongs to work that has genuinely been done, and the amount is the one that was agreed. The sender address passes any check, because it is the address that has always been used. Every habit a team has built around spotting a fake letter is aimed at something that has not happened here.
A small team rarely loses money to anything a person would recognize as a break-in. The money leaves through an invoice everybody expected, inside a thread everybody had already been reading, with a single line of bank details altered. The question worth working through is narrow. Which single check, placed at which point in the payment procedure, still stands when the correspondence itself has been captured?
The starting point is reading access to a mailbox on one side of the conversation. It may come from a password reused on a service breached years ago, from a copied sign-in page or from a session token taken out of a browser. For a while nothing visible happens, because the intruder is reading. Within weeks they know who approves payments and on which days money moves.
Most small teams can point at a backup. Far fewer can say when somebody last sat down, picked a real file or a real mailbox, and brought it back onto a machine that did not hold the original. That gap between owning a copy and being able to work again is where an awkward morning turns into an expensive fortnight. This article treats testing that a backup actually restores as a short, scheduled piece of work with a name attached to it.
Backup software is very good at telling you it succeeded. The dashboard turns green, the log says the job finished, the storage counter climbs. All of that describes the writing side of the work. Nobody has yet asked the archive to give anything back, and that is the only question the team will care about on the morning something goes wrong.
Ilia Zavialov reviews vacation rental and hotel booking scams the way an investigator would read a crime scene: starting from where the money went and working backward. A beach house in the Outer Banks, a hotel near a client's office in Denver, a cabin listed at half the going rate. Each one can be real, hijacked or invented, and the reviews under it can be bought. This guide covers the listing, the reviews, the text that claims to be from your hotel and the payment request, with what the FTC and the FBI tell travelers to do at each step.
The FTC describes two starting points. Scammers either take over real vacation rental listings and swap in their own contact details, or they invent properties that do not exist. In both cases the photos usually come from somewhere legitimate, which is why the listing looks right.
A customer forwards a screenshot. Your logo, your company name, a photograph of your managing director, and an invitation to an investment program nobody in the building has heard of. The economics behind that screenshot changed recently and not in your favor. Reported losses on complaints flagged as involving artificial intelligence reached 893,346,472 dollars across 22,364 complaints in 2025, impersonation schemes grew by more than 1400 percent in a year with the severity of a single case up more than 600 percent, and analysis shows an operation using these tools takes an average of 3.2 million dollars against 719,000 for one that does not. This is the order to act in, and the order matters more than the speed.
The cost of producing a convincing advert collapsed. A logo, a face, a voice, a set of testimonials and a landing page are now a short afternoon of work rather than a project with a budget.
The call lands in the middle of an ordinary afternoon, and the voice on the line already knows something. It names a system the team genuinely uses, quotes a reference number and speaks with the mild boredom of someone who does this all day. Within two minutes the employee is being walked towards a remote session tool or a six digit code. The question here is narrow and practical. What does that call sound like from the inside, and which written procedure ends it without anyone having to be clever under pressure.
The call arrives in the middle of something else. An employee is halfway through an invoice run or a support queue when the phone rings and a calm voice introduces itself as the service desk. It offers a name, a reference number and a reason: a license sync failed overnight, a mailbox has been flagged, a payment file was rejected by the bank. Nothing in the first ninety seconds asks for alarm.
A finance assistant joins a short call. The managing director is there, camera on, slightly out of focus, apologising for the rush. A supplier has to be paid today or a contract lapses. The account details are new. Everything about the call feels ordinary except the timing, and by the afternoon the money is gone. This is a working procedure rather than an explanation, written for teams of three to fifteen people who have no security officer and no budget for one. It sets out who confirms what, at which amount, through which channel, and what to do when the request comes from the person who signs your payslip.
One sentence carries most of the protection: no payment instruction is executed on the strength of a conversation, regardless of who appears in it. Not a video call, not a voice message, not a chat thread that looks like an existing one. Confirmation always travels back through a channel the requester did not choose.
Every phishing lesson your staff ever sat through taught them to check the address bar. This attack passes that check. There is no lookalike domain, no fake form and no password to steal. The employee lands on the genuine sign-in page of the service they use every day, types a short code somebody sent them, approves, and an attacker device is now signed in to their account with a valid session. Huntress counted a single campaign in March 2026 that reached 344 organizations across five countries, and attempts rose by 1380 percent between the second half of 2025 and the first months of 2026.
Device code sign-in exists because some devices cannot handle a login form. A television, a conference room display, a printer or a command line tool has no comfortable way to accept a password and a second factor. So the device shows a short code and asks you to open a page on your phone or laptop, type the code and approve.
Ilia Zavialov explains how a scam invoice reaches a small business: a bill for a business directory listing nobody ordered, a fee to stay on a register that sounds official, a paid company report, or a renewal notice for a domain or trademark from someone who is not the registrar or the USPTO. These letters arrive at the office address or the shared finance inbox, look like routine bills and count on being paid alongside rent and phones. The FTC warns about phony directories and fake invoices, the USPTO says official mail comes only from its own address and the @uspto.gov domain, and IC3 counted 32,424 government impersonation complaints in 2025. Below are the warning signs, a ten-minute check and what to do if the money has already gone.
A small finance team pushes dozens of bills through every month: rent, phones, hosting, office supplies, contractors. Most come from familiar names, so the check boils down to the amount and the bank details. The whole trick rides on that routine. The document looks like any other invoice, the amount is modest and the description says something like annual listing or yearly maintenance.
Ilia Zavialov on a company's digital signature and logins and how criminals use them. A call supposedly from the certificate provider or a tax office, an email to the accountant with an attachment, a remote access program and a signature token left in the computer all day turn the director's credentials into a key to the bank account and to the company's public record. The FBI recorded 24,768 complaints about business email compromise in 2025, with losses of 3,046,598,558 dollars. This guide explains how signatures and logins leave a company, which storage rules close most scenarios and what to do if they are already in the wrong hands.
A director's digital signature or company login used to be a formality for filing reports. Today it signs contracts, submits tax returns, opens the online bank, sends filings to the companies register and grants authority to staff. Whoever holds it acts for the company in all of these places at once.
Ilia Zavialov on employer reviews, fake job offers and money mule recruitment. Candidates' reviews are the first to show that a vacancy in a well known company's name actually leads to paying for training, a deposit for tasks or moving money through your own account. The FBI received 24,688 complaints about employment fraud in 2025, with more than 362 million dollars lost. This guide explains how to read reviews of an employer, which questions expose a fake recruiter and what a company should do when its name is misused.
Job hunting has become one of the easiest ways in for scammers. The candidate looks for the contact, sends the CV and is ready to follow instructions, because they see them as part of a new job. Employer reviews work as the first filter here: they show whether the company exists, whether it pays people and how it treats candidates.
The message usually arrives on a Friday. Withdrawals are paused for maintenance, support answers with a template, and by Monday there is a filing number and a law firm advertising for claimants. For a company this is not a market event, it is an accounting, legal and reputational one at the same time, and the decisions that matter are made in the first day, before anybody understands the scale. Court recoveries at the biggest failures range from full repayment to a fraction: creditors of one collapsed exchange passed 100 percent by the fourth distribution, while another paid between 15 and 72 percent depending on which class a claim fell into.
Treasury balances, payroll experiments, a subsidiary holding a settlement float, a supplier who asked to be paid in stablecoin. Exposure to a platform rarely arrives as a decision. It accumulates through small convenient choices that nobody wrote a policy for.
A voice on the phone says it is the IRS, a federal agent or a fraud investigator from the bank working with law enforcement. It knows the company name, the director's name and a recent invoice. It needs a payment today to prevent a freeze, a penalty or an arrest. The script is old, and it is still one of the most reliable ways to take money from American businesses and households. The FBI center recorded 32,424 complaints and 797,943,193 dollars of losses from government impersonation in 2025, and the Federal Trade Commission counted 920 million dollars lost to impersonation of government bodies, with reports rising by 40 percent in a year. This piece explains how the call is built, what it already knows about you, and the single verification rule that defeats every version of it.
A call from a stranger asking for money fails almost every time. A call from somebody who says they are the tax authority, the police or the financial regulator succeeds far more often, because it borrows an authority the listener has been trained to obey since childhood.
Ilia Zavialov scam guide for American small business owners: how a fake grant reaches you, what it asks for and how to check it before a dollar leaves your account. The pitch arrives as a text, a Facebook message or a call that looks like it comes from Washington: your business qualifies for free federal money, and a small processing fee unlocks it. The FTC calls offers of free grant money scams, SBA says it does not give grants to start or expand a business, and registering to apply for federal grants costs nothing. Below, Ilia Zavialov walks through the four common versions, the federal sources that settle the question in minutes, and where to report: your bank, ReportFraud.ftc.gov, ic3.gov and your state attorney general.
Grant fraud aimed at small firms rarely opens with a request for money. It opens with good news. A text says your LLC was preselected, a direct message from a friend's hacked account links to a relief program, a caller ID shows a Washington number. The FTC lists the routes plainly: online ads for grants that do not exist, spoofed calls made to look like a federal or state agency, and texts, emails or social media messages saying you might qualify for free money.
Ilia Zavialov reviews remote hiring fraud from the side most hiring guides skip: the candidate who is not who they claim to be. A developer hired after two video calls, a support agent nobody has met, a contractor whose documents arrived as phone photos. Within a week that person can hold email, source code, a customer database and a company laptop. This article walks through how the scheme works, what the FBI and the Justice Department have documented, how Form I-9 and E-Verify fit in, and which access a new hire should get before trust is earned.
Ilia Zavialov writes for owners and managers of companies with 5 to 50 people, where there is no security team and the person who hires, the person who pays and the person who sets up laptops may be the same person. Hiring in those firms moves fast, often through a job board or a friend's referral, and identity checking can stop at a scan of a driver's license.
Ilia Zavialov on marketplace scams aimed at small seller teams and at buyers. A call from supposed platform support, a fake claim, changed payment details, a return with a swapped item and rented accounts turn the platform's own words into a tool of pressure. The FTC reports that shopping scams were the most reported scam on social media in 2025, and the FBI received 56,478 complaints about goods paid for and never delivered. This guide explains the schemes, the rules for a team and what to do if the dashboard is captured.
A small team that trades through a platform keeps everything on one account: sales proceeds, stock, customer data and access to advertising. Whoever gets into the seller dashboard controls the prices, can withdraw the revenue and can stop the shop within minutes.
A small team rarely has a single moment where someone officially leaves. Notice periods run out and handovers get compressed into a final week, so the actual departure often happens faster than the paperwork. The real question is which logins, shared accounts, and payment tools still answer to that person once they stop coming to standups. Skipping that question, or answering it slowly, is how a clean exit turns into an open door.
The risk starts the moment a resignation letter lands or a founder decides a role is no longer needed, well before the last working day arrives. Attention shifts to hiring a replacement, and the departing person has little reason to keep things tidy. The day that decision becomes real is when closing access when someone leaves the team truly begins, because the gap before the last day is where access stays live longest.
Ilia Zavialov reviews the outsourcing market from the buyer's side: how a fraudster hides behind five-star ratings and borrowed case studies, and how a small business can vet a bookkeeper, tax preparer, law firm, IT shop, freelancer or staffing agency before handing over money and logins. The FTC now bans fake and bought reviews, yet they still shape who gets hired. Below: how to read reviews and case studies, how to check the company and the people, what to give a vendor and how to take it back, which terms belong in the contract, and where to report a vendor who vanished with a deposit, from your bank to the FTC and IC3.
A ten-person company rarely keeps an in-house bookkeeper, lawyer and sysadmin. It buys those functions, and each one comes with a set of keys: online banking, payroll, the accounting file, the domain registrar, the cloud admin console, employee Social Security numbers.
Ilia Zavialov fraud notes for small businesses start with a scheme that looks like good manners. A customer pays too much, apologizes and asks for the difference back. Sometimes the payment is a fake check that shows up in the balance and bounces weeks later. Sometimes it is a real transfer of someone else's stolen money. Sometimes it is an order paid with stolen card details, followed by a request to refund part of it to a different card. This guide covers the four versions, what Regulation CC says about when deposits become available, what the FTC and the FBI's IC3 have documented, and a one-page refund policy a bookkeeper can follow.
Ilia Zavialov, a digital security consultant for small teams, treats this scheme separately from phishing and payment redirection. Nobody breaks into an inbox or steals a password. The scammer relies on two things every small business has: a wish to look fair to customers, and a gap between the moment money appears in the account and the moment it is truly collected.
A payroll change request rarely looks like an attack. It arrives as a short, polite note from an employee who has switched bank, with an account number and an apology for the late notice. The person who opens it in accounts has no reason to doubt it and every reason to process it before the cut-off. The question here is narrow. What makes that message credible to a competent team, and which single control would have stopped the payment without slowing the department down.
Most organizations take payroll changes through a shared mailbox that several people can open. The address is published on the intranet, printed on forms and quoted in onboarding packs, so it is easy to find from outside. Messages land there all day: expense queries, tax code questions, requests for a copy of a payslip. A note asking to update bank details before the next run sits comfortably inside that traffic.
Ilia Zavialov on paid review jobs and task scams: an offer to earn money writing reviews, rating products or boosting apps, a few small real payouts, then a combination task that sends the balance below zero and a request to top up in cryptocurrency. The FTC recorded about twenty thousand task scam reports in the first half of 2024 alone, and job scam losses rose from 90 million to 501 million dollars between 2020 and 2024. This article explains how the scheme runs, why it catches careful people and what a company should do when its name is used for recruiting.
The message looks like a lucky break. A recruiter writes in a messenger or by text: a company needs people to write reviews, rate hotels, like products or boost apps in an online store, the work takes an hour a day from a phone, and the pay is far above what such simple tasks usually earn.
Ilia Zavialov looks at how a scammer turns the language of public and corporate procurement against suppliers, accounts teams and small business owners. Fake invitations to tender, fees for registration or credentialing, bogus purchase orders and bank details swapped inside a real contract all look like ordinary sales work. The GSA Office of Inspector General warns about fake requests for quotes sent in the name of federal agencies, and the FBI Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025. This guide explains the schemes, how a genuine opportunity differs from a fake one and how to check a buyer.
For a small supplier, an order from a public body or a well known corporation feels like the break the business has been waiting for. A scammer arrives with exactly that: a letter with a crest or logo, a reference number, a specification, deadlines and a draft contract. The papers look convincing because they are often stitched together from genuine notices that anyone can read online.
A small team usually pays out money the way it does everything else, which means whoever is nearest to the keyboard presses the button. That works until an instruction arrives that looks routine and turns out to be someone else's. The two-person rule for payments turns one person's momentary judgment into a procedure other people can inspect. What follows is the practical shape of it: the threshold, the approvers, and the week both of them are away.
A single approver looks efficient until you describe what it guarantees. It guarantees that money moves whenever one person, on one particular afternoon, believes a request is genuine. That belief depends on how tired they are and how well the message imitates someone they already trust. An attacker studying a small company needs one plausible minute from one distracted person.
