Common Online Scams Targeting Website Owners and Small Businesses

Scammers know that small business owners are busy, trust their website providers and often handle their own accounts. The same tricks appear again and again. Knowing them makes them much easier to spot.

Fake domain or hosting renewal notices

An official-looking invoice arrives saying your domain is about to expire and asking for payment to an unfamiliar company. Always check with your actual registrar by logging in directly, not through a link in the message.

Cold calls and emails about website errors

Someone calls or writes claiming your website is broken, hacked or missing from Google, and offers to fix it if you share a login or pay immediately. Genuine providers do not usually find your problems by cold calling. Do not give access to anyone who contacts you unprompted.

Phishing messages pretending to be your host, bank or Google

These warn that your account is suspended or your payment failed and urge you to click a link and log in. The link leads to a fake page that steals your details. Open a new browser tab and go to the real website instead.

Fake developers and agencies

Some people ask for full access and payment up front, then disappear or leave the site compromised. Our guide to spotting a fake developer or agency lists the red flags.

Overpayment and refund scams

A buyer sends too much money, then asks you to refund the difference before the original payment fails. Wait until funds have genuinely cleared.

Messaging app job and payment scams

Offers on WhatsApp or social media that promise easy money or ask you to move payments outside the platform are common. Be suspicious of urgency and of requests for codes or account details.

How to protect yourself

• Never share passwords, bank details or one-time codes.
• Use two-factor authentication on every important account.
• Verify requests through a number or website you already trust.
• Slow down. Urgency is a pressure tactic.
• Use delegated access for anyone who works on your site, as explained in our safe access guide.

If you have been targeted

Change affected passwords, contact your bank if money or card details were involved, and report the incident to your national fraud-reporting service. See our emergency checklist for what to do first.