“I’m too small to have anything worth stealing.”
It’s a common refrain from small business owners, said James Lee, CEO of the Identity Theft Resource Center (ITRC), a nonprofit that provides assistance and anti-fraud education to companies and individuals.
But fraudsters think otherwise. Smaller companies often have fewer security resources, making them attractive to cybercriminals looking for quick wins.
“Small business owners are a hot target for fraudsters. These bad actors know that many small businesses have no time for cybersecurity because they are preoccupied with the endless tasks that come with being an entrepreneur,” said James Mirfin, SVP and Global Head of Risk and Identity Solutions at Visa. “But unfortunately, it needs to part of the conversation on business priorities just as much as payroll, hiring, and strategy.”
The good news? Knowing the risks is the first step toward building resilience. And many attacks are preventable with the right safeguards, including regularly updating software and training your staff. We’re sharing seven essential insights about today’s fraud landscape to help protect your small business and customers, and to provide peace of mind.
Fraud risks: Today’s fraud landscape
1. Three-quarters of small business fraud cases exploit people, not technology
Cybercriminals don’t always need sophisticated hacking tools — human error is often their greatest weapon.
Some years ago, the controller of a Nebraska-based agricultural supply chain company received an email from the company’s CEO, authorizing a payment related to an acquisition the company was making. But the email wasn’t from the CEO — it was from a scammer who had spoofed the executive’s email account. The controller wired $17 million to the attacker.¹
Business email compromise (BEC) scams like these, where criminals impersonate trusted individuals to trick businesses into sending money, prey on the human tendency to trust. These sophisticated phishing scams have become so prevalent that 22 percent of all small businesses have experienced one.² In 2023 alone, BEC scams resulted in nearly $3 billion in reported losses across businesses of all sizes.³
2. Attacks on technological weaknesses are growing more advanced
Bad actors are able to steal credit card account numbers at scale with cutting-edge technology. In digital skimming attacks, for instance, malicious code on a checkout page automatically steals customer payment information. In enumeration attacks, hackers use software to rapidly guess and confirm customer payment details, while 404 page-not-found scams use a fake payment form overlaid on top of a legitimate checkout form. To give a sense of the scale, in the six months between June and December 2023, Visa blocked 50 million fraudulent transactions totaling $5.6 billion.⁴
Another rising threat is purchase return authorization (PRA) fraud, in which scammers exploit return policies to steal from businesses. Between June and December 2023, Visa saw an 83 percent increase in PRA fraud investigations compared to the previous six months.⁴
3. Small vendors supplying to big companies are especially vulnerable
Cybercriminals don’t always attack major corporations directly. Instead, they use smaller businesses as backdoor entry points. According to a recent data breach report, 62 percent of network intrusions originate from third-party vendors, including small businesses.⁵ These companies often serve as the weakest link in supply chain attacks. By infiltrating a small vendor’s systems, hackers can gain access to the larger enterprises that those vendors service.
For small businesses that serve high-value clients, a cyberattack isn’t just a direct threat — it could mean losing trust, contracts and business with bigger companies.
