Scammers target small businesses with fake utility shutoffs, directory listing scams, and bogus compliance calls.
Small business owners receive an enormous volume of calls claiming to offer enhanced online directory listings, first-page Google rankings, and SEO services. The most common and costly version: a caller claims to be from Google or Google Maps and says your Google Business Profile is "incomplete" or "at risk of being deactivated," then offers to "verify" and "enhance" your listing for a monthly fee. Google does not make outbound sales calls. Google Business Profile is free and managed entirely at business.google.com — no third party can charge you for Google Business Profile management on Google's behalf, and your profile cannot be "deactivated" by failing to pay a third party.
Yellow Pages listing scams operate similarly. Callers claim you have an existing listing in a directory the caller represents and that you've been invoiced for a renewal. The caller reads back your business name, address, and phone number (all publicly available information) as "verification" that you're a current customer. Small business owners who pay these invoices are often paying for listings in directories that receive minimal traffic. The FTC and multiple state attorneys general have taken action against directory listing scams — major enforcement actions include the FTC's case against National Yellow Pages (FTC File No. 122 3165) and similar state cases. If you receive an invoice for a directory listing you don't recognize, verify the directory's name at the BBB (bbb.org) before paying.
Domain registration and website "protection" scams target business owners with calls claiming their domain is expiring, that competitors are about to register similar domains, or that their website has been blacklisted by Google. Your domain registrar (GoDaddy, Namecheap, Google Domains, etc.) sends expiration notices to the email address you used for registration — you do not receive domain expiration information by phone from your registrar. Competitors cannot "take" your trademark domain, and Google does not call businesses to tell them they've been blacklisted. To check your domain expiration date, go directly to your registrar's website and log into your account. Check your domain's blacklist status for free at mxtoolbox.com/blacklists.aspx — no phone intermediary needed.
Utility disconnection scams targeting small businesses exploit the existential threat that loss of electricity or gas represents for businesses like restaurants, retail stores, and salons. Callers claim to be from the local utility (using the utility's actual name, often obtained by looking up the business's address and the serving utility) and say the business owes an overdue balance that must be paid immediately by prepaid card or wire transfer to avoid same-day disconnection. Legitimate utility disconnection notices are sent by mail with a specific payment deadline — utilities do not call to demand immediate payment by gift card to avoid disconnection in the next hour.
This scam is particularly effective on busy days and at rush hours when the business owner is most desperate to keep operations running. Restaurants receive these calls just before the lunch or dinner rush. Retailers receive them before holiday shopping peaks. The time pressure compounds the financial pressure, preventing the business owner from taking the few minutes needed to verify the call. The verification is simple: hang up, look up your utility's customer service number on your most recent bill, and call to ask about your account status. If a disconnection notice was real, the utility can confirm it and provide payment options — none of which will involve gift cards.
Several utilities have partnered with local chambers of commerce and the Association of Small Business Development Centers (asbdc.org) to alert members about these scams, including placing notices in utility bills about the payment methods they never use. Pacific Gas & Electric, Consolidated Edison, Georgia Power, and most other major utilities have published explicit statements that they do not demand immediate payment by prepaid card or cryptocurrency to avoid disconnection. If your state's utility commission (each state has one — find yours at naruc.org/commissions) maintains a scam alert page, subscribe to it: utility impersonation scam alerts are among the most useful and timely consumer protection resources for small business owners.
Business license renewal scams are particularly effective because legitimate business license renewals do require periodic payment, and the specific fees vary by jurisdiction, making it harder for a new business owner to know exactly what they should be paying and to whom. Callers claim to represent a state or county agency and say the business's license, seller's permit, or occupational license is expired and must be renewed immediately to avoid fines or closure. They collect payment information over the phone. Legitimate business license renewal comes by mail from your specific city, county, or state agency — your jurisdiction's official government website (city or county .gov domain) lists all business license requirements and the legitimate agency that administers each one.
The Better Business Bureau's Scam Tracker (bbb.org/scamtracker) maintains a database of reported business-targeting scams searchable by scam type and location. Business license renewal scams consistently appear in the top 10 categories for small business fraud. California's Employment Development Department (EDD), Texas Workforce Commission, and Florida's Division of Corporations have all published alerts about fraudulent calls impersonating their agencies. Before paying any invoice or phone caller claiming to represent a business licensing authority, verify the agency by searching your state's official business portal — California at bizfile.sos.ca.gov, Texas at sos.state.tx.us, Florida at dos.myflorida.com — and confirm what licenses your business requires and what the renewal process actually involves.
OSHA compliance impersonation calls claim that an upcoming OSHA inspection has identified violations, and that the business must purchase safety training materials, compliance kits, or consulting services to avoid fines before the inspection. OSHA (the Occupational Safety and Health Administration) does not call businesses before inspections to solicit compliance services — inspections are unannounced except in specific programmed inspection categories. OSHA does not sell compliance materials by phone. If OSHA has a real concern about your workplace, you'll receive written notification from a real OSHA area office. Find your local OSHA area office at osha.gov/contactus/bystate to verify any call claiming to be from OSHA.
Government compliance impersonation exploits the complexity of business regulation. Small businesses must comply with federal, state, and local regulations covering employment, safety, environmental, accessibility, food service, and dozens of other domains — and few business owners know the exact requirements in every category. Callers exploit this uncertainty by claiming the business is out of compliance with a specific regulation and offering paid assistance to achieve compliance. The regulations cited are often real (ADA, OSHA, EPA, FTC regulations) but the caller's claim to represent the agency administering them is fraudulent, and the "compliance services" offered are worthless.
ADA compliance calls are among the most common: callers claim they represent an ADA compliance authority and that the business's website or physical premises violate the Americans with Disabilities Act, and that they offer compliance audits and remediation services to avoid Department of Justice enforcement actions. The DOJ does not work through phone solicitors to identify ADA violations. Legitimate ADA compliance assistance is available free through the ADA National Network at adata.org (1-800-949-4232) — a federally funded resource that provides consultation on ADA requirements at no cost to businesses. Any caller charging for ADA compliance services is almost certainly a scammer, and the services they provide (typically worthless certificates or boilerplate website overlays) provide no actual legal protection.
The most effective protection for small businesses against compliance scams is designating a specific protocol for all inbound calls claiming to be from government agencies: (1) never provide payment or personal information during the initial call, (2) ask for the caller's name, badge number, and the specific regulatory citation they're referencing, (3) tell them you'll call back using the agency's official number to verify the issue, (4) hang up and look up the agency's official number through a .gov website search. Government agencies are legally required to accept callbacks and to be reachable through published numbers — a caller who refuses to wait for a callback or claims the issue will be resolved only on this call is not a real government official.
Staff training is essential because scam calls targeting businesses often reach front-desk employees, receptionists, and office managers rather than the business owner directly. These employees may feel pressure to handle the call without escalating, especially if the caller is aggressive or threatening. A simple training checklist: (1) Any caller requesting payment information (credit card, gift card, wire transfer instructions) must be transferred to the business owner or manager — no exceptions, regardless of how urgent the caller claims the situation is. (2) Any caller claiming to be from a government agency should be asked for their name, agency, and callback number, then told "I'll have the owner call you back" — and then the owner should call the agency's official number, not the number the caller provided.
Role-play training is more effective than written policy alone. Run through specific scenarios with staff: "A caller says they're from the IRS and we owe back payroll taxes. What do you do?" (Transfer to owner; owner calls IRS at 1-800-829-1040 to verify.) "A caller says they're from Google and our Google Maps listing is being suspended — they need our credit card to keep it active. What do you do?" (Tell the caller the owner will handle it; do not provide any payment information; the owner checks business.google.com directly.) "A caller says we have 24 hours to pay a fee or our business license will be revoked. What do you do?" (Get their information; tell them we'll call back; look up the official licensing agency number.) The goal is to make "get the information and call back through official channels" automatic.
The Small Business Administration (SBA) at sba.gov/business-guide/manage-your-business/protect-your-business publishes free resources on business fraud prevention, including specific guidance on phone-based scams. The SBA's SCORE mentorship program (score.org) provides free one-on-one mentoring from retired executives who can help business owners evaluate suspicious contacts. The National Cybersecurity Alliance (staysafeonline.org) provides free cybersecurity and fraud prevention training materials suitable for small business staff training sessions. Document all suspicious calls in a log (caller ID, time, what they said, what action you took) — this documentation is valuable for any subsequent FTC or FBI report and can help identify patterns if the same scam operation contacts your business repeatedly.
RELATED GUIDES
LOOKUP BY AREA CODE