Small business email fraud in Texas is not a rare or exotic crime. It happens to contractors, retailers, restaurants, and service businesses every day — and in many cases, the money is gone before the owner realizes anything went wrong. The scam usually starts with a single email that looks completely normal.

How the Scam Works

Business Email Compromise (BEC) is the technical name, but the mechanics are simple. A criminal monitors your email traffic — either by hacking an account or by closely studying your public-facing communications — and then impersonates someone you trust.

That could be your vendor, your bookkeeper, your bank, or even the IRS. The email looks right. The logo looks right. The name looks right. And then it asks you to do something: pay an invoice, update banking information for a recurring payment, or confirm an account number.

You act in good faith. The money moves. And it does not go where you thought it did.

The FBI's Internet Crime Complaint Center reported that BEC scams cost U.S. businesses over $2.9 billion in 2023 alone. Small businesses are not exempt from that number — they are a significant part of it.

The Fake Invoice Version

One of the most common versions targeting small businesses involves fake invoices. The criminal sends an invoice that closely mimics one from a vendor you already pay. Same format, similar amount, slightly different account number.

If your bookkeeper or office manager processes payments without a secondary verification step, that payment can go out before anyone notices the account number changed. By the time the real vendor follows up on a missed payment, the fraudulent transfer has already cleared.

This is one of the reasons a good bookkeeper does more than just record transactions. Part of the job is catching irregularities — a vendor payment to an unfamiliar account number, a duplicate invoice at a slightly different amount, a payment that does not match the expected cycle. At Coyote Bookkeeping, monthly bookkeeping services include regular reconciliation that can catch these discrepancies before they become costly.

The Bookkeeper Impersonation Version

This one is worth knowing specifically if you work with an outside bookkeeper. A criminal poses as your bookkeeper and sends you a message asking you to confirm banking details, approve an urgent payment, or provide access to a financial account. The email address may be off by one character. The signature looks identical.

Any legitimate bookkeeper will have an established, agreed-upon process for how sensitive requests are handled. If you get an unexpected email from your bookkeeper asking you to do something financial — especially with urgency attached to it — call them directly before you act. Not reply to the email. Call.

Red Flags to Watch For

These are the patterns that should stop you in your tracks:

Urgency. Scammers manufacture time pressure. "This must be paid today or we will lose the contract." Real vendors and real bookkeepers rarely operate that way.

A change in payment details. Any time a known vendor or contact asks you to pay to a new account, that is a reason to verify by phone before you do anything.

An email address that is almost right. Check the full email address, not just the display name. Criminals register domains like "coyotebookkeeping-llc.com" specifically to fool people at a glance.

Requests for access. Legitimate professionals will not ask for your QuickBooks login, your bank password, or remote access to your computer via an unsolicited email.

What You Can Do Right Now

A few habits that make a real difference:

• Set up a verbal verification rule for any payment over a set threshold or any change to payment details

• Make sure your

  compliance and record-keeping processes

  include a second set of eyes on outgoing payments

• Use multi-factor authentication on your email account so criminals cannot get in and monitor your communications in the first place

• Train anyone who handles payments in your business to pause on any request that involves account changes or urgency

You do not need to be a cybersecurity expert to protect your business. You need consistent habits and a team around you that is watching the same things you are.

If someone sent a fake invoice from your most trusted vendor tomorrow, would your current process catch it before the payment went out?

Coyote Bookkeeping helps small business owners in Brazoria County and Greater Houston keep their books tight and their finances protected. Schedule a free consultation to talk about what we can put in place for your business.