The scam calls, emails and invoices every small business gets

The week a business gets a website, a Google listing or a registered domain, the post and the phone change. Invoices arrive for things nobody ordered. Somebody "from Google" rings about your listing. An email warns that your domain is about to expire, from a company you have never heard of.

None of this means anything went wrong. Being visible makes you findable, and that includes by people working through lists. But most of these approaches are aimed squarely at the parts of a business I set up, so here is what they look like, how to tell the real thing from the fake, and the handful of habits that make nearly all of them harmless.

• Google does not ring you to sell anything. Its own help pages say it will "never ask you for payment information over the phone or guarantee you a special spot in our products".
• Your Google Business Profile is free. Anybody charging to "verify" or "keep it active" is selling you something you already have.
• A domain renewal notice from a company you don't recognise is not a renewal. At best it is an offer to move your domain to them at a higher price.
• "No one can guarantee a #1 ranking on Google." That is Google's sentence, not mine.
• Payment by wire transfer, gift card or reloadable card is the surest sign of a scam there is. The FTC's words: "you can bet it's a scam."
• When in doubt, don't reply to the message. Contact the company yourself, using a number or address you already had.

The Federal Trade Commission's guide for small businesses boils the methods down to four. Scammers:

• pretend to be someone you trust — a company you use, or a government agency;
• create a sense of urgency, so you decide before you check;
• use intimidation and fear, telling you something terrible is about to happen;
• ask for payment that can't be traced or reversed — wire transfers, reloadable cards, gift cards.

Every scam below is some mix of those four. Once you know the pattern, you stop needing to know the specific trick.

This is the one I hear about most. A call, often a recording, says your Google listing is unverified, about to be suspended, or about to be marked "permanently closed" — unless you press one and pay.

Google's answer is unambiguous. Its page about fraudulent calls says: "we'll never ask you for payment information over the phone or guarantee you a special spot in our products."

The Business Profile itself costs nothing to create, verify or keep. If you have not set yours up yet, this guide walks through it, and the only person who should be a Manager on it besides you is someone you added yourself.

Google takes this seriously enough to sue. In November 2022 it filed a lawsuit against an Ohio operation calling itself G Verifier, which, according to the complaint, told business owners they had to pay $99 or their listing would be suspended and their reviews would disappear. Google said "hundreds and hundreds" of Business Profile owners had complained about it.

What to do: hang up. Nothing about your listing is ever settled on a cold call. If you want to check, sign in to your profile yourself and look.

Your domain's owner details are public in most cases, so a newly registered domain attracts letters and emails within days. The common ones:

• A "renewal notice" from a company that is not your registrar. It looks like a bill. Paying it usually transfers your domain to them, at a much higher yearly price. The FTC lists domain registrations among the classic fake invoices, because scammers know that "when the invoice is for something critical, like keeping your website up and running, you may pay first and ask questions later."
• An email "from ICANN", the body that oversees domain names, asking you to renew. ICANN's own statement: "ICANN does not process domain registrations or collect fees from registrants directly."
• "Someone is trying to register your name in another country" — usually China — and only by paying today can you stop them. It is a sales pitch for domains you do not need.

What to do: know who your registrar is. On every site I build, the domain is bought on Cloudflare in your own name, so a real renewal comes from Cloudflare and nobody else. It also renews automatically at the price you already pay, so there is never a genuine emergency email about it.

An older trick, still everywhere. Someone rings to "confirm your details for your free listing" or "check the information on your existing order". Weeks later comes a large bill for a directory or advert you have never heard of — sometimes with a recording of the earlier call, played back as proof you agreed.

The FTC describes exactly this, and notes that the callers often pretend to be from the Yellow Pages. The same family includes letters warning that you will lose a trademark unless you pay a fee immediately, and invoices for workplace posters that the Department of Labor gives away free.

What to do: never say "yes" to a caller confirming an order you don't recognise, and don't pay a bill unless you know what it is for. The FTC's rule is the right one: "Never pay unless you know the bill is for items that were actually ordered and delivered."

"I was looking at your website and noticed some errors." "Your site isn't ranking for these keywords." "We guarantee page one in 30 days."

Most of these are sent to thousands of sites at once by people who have never opened yours. Google's own advice on hiring an SEO is to "reserve the same skepticism for unsolicited email about search engines as you do for 'burn fat at night' diet pills", and it states plainly that "no one can guarantee a #1 ranking on Google." Promises of special relationships with Google, or "priority submission", are on the same list of warning signs.

Nothing wrong with paying for real marketing help. But real help starts with a conversation about your business, not with a guarantee. What actually moves a local business up is mostly free, and this article sets it out.

A message offers to remove your bad reviews or add good ones. Two problems: nobody outside Google can remove a genuine review, and the adding part is illegal. The FTC says so directly: "posting fake reviews is illegal." It also puts you in breach of Google's own rules, which can cost you the reviews you earned honestly. The way to collect them properly is in getting reviews the right way.

The newer and more expensive version. An email appears to come from a supplier saying their bank details have changed, or from you, asking a member of staff to pay something urgently. Some look exactly like a password-reset email from a service you use.

The FTC's advice here is plain: "Don't believe your caller ID", and remember that "email addresses and websites that look legitimate are easy for scammers to fake." Two habits deal with nearly all of it:

• Changed bank details are confirmed by phone, on a number you already had, before a cent is sent.
• Don't sign in from a link in an email. Go to the site yourself. A real security warning will still be there.

This is also one reason I set up email authentication on every domain I build — the records that stop somebody else sending email that claims to be from your address. This article explains them.

From the FTC's own checklist, cut down to what a small business can do this week:

1. Know who you actually pay. Keep a short list: your domain registrar, your host, your web person, your card processor. Anything else asking for money about your website is not on the list.
2. Fewer people can approve payments. The FTC suggests making sure "major spending can't be triggered by an unexpected call, email, or invoice."
3. Never pay by wire, gift card or reloadable card to anyone you haven't dealt with before.
4. Call back on a number you already have. Never on the one in the message.
5. Tell your staff. Scammers often try several people in the same business, and one person saying "we got a strange call" protects the rest.
6. Search the company's name with the word "scam" before you deal with them. Somebody has usually written about it.

In the US, the FTC takes reports at ReportFraud.ftc.gov, and your state attorney general's office does too. Calls pretending to be from Google can be reported to Google through its Business Profile help pages, and scam texts can be forwarded to 7726 (SPAM). Reporting rarely gets your money back, but it is how operations like G Verifier end up in court.

• Every account I set up — domain, email, payments, Google — is in your name, and I give you the short list of who you pay and how much, so a fake invoice has nothing to hide behind.
• Domains renew automatically at the price you already pay, so there is no such thing as an urgent renewal email.
• I set up email authentication on your domain, so it is harder for anyone else to send email that claims to be you.
• Forward me anything that looks odd about your website, domain or Google listing. I would much rather read ten harmless letters than have you pay one fake one.
• I will never ask you for a password by email, and never ask you to pay by wire transfer or gift card.