Small Business Staff Scam Safety Training

Training summary

A short, practical training plan that helps small-business staff recognize when to pause, what to say, and where to route unusual requests. The goal is not to make everyone a scam expert. The goal is to make verification normal and non-shaming.

Five-minute talk outline

• Scams often look like ordinary work: invoices, vendor updates, refund requests, payroll changes, support messages, social media messages, or owner requests.
• The main stop signals are new money destinations, new access requests, unusual channels, urgency, secrecy, and requests for private information.
• No one is in trouble for pausing a request. Pausing is part of the job.
• Verify through a known channel instead of using contact details supplied in the unusual request.
• Do not share passwords, one-time codes, recovery prompts, private documents, employee details, customer details, or payment information.
• Use a pause phrase when a vendor, customer, manager, or caller pressures you.
• Route uncertain requests to the approved reviewer and write short notes about what happened.

Pause phrases

• I need to follow our verification process first.
• I cannot approve that from this message alone.
• We verify payment and account changes through a known channel.
• I will route this to the person who reviews these requests.
• I cannot share passwords, one-time codes, or private documents.
• We do not grant remote access from surprise calls, popups, or messages.
• I can continue after this is checked through our normal process.
• Our policy is to pause when a request involves urgency, secrecy, money, access, or private information.

Role examples

Monthly micro-drills

• Show one fake invoice pattern and ask staff what would trigger a pause.
• Practice two pause phrases out loud with a vendor, customer, manager, or caller example.
• Review who approves vendor payment changes and where the known-contact list is kept.
• Walk through a customer refund request that asks for a different payment method.
• Review the rule: do not share passwords, one-time codes, or private documents.
• Ask each role to name one kind of request they are allowed to pause.
• Check whether official support contacts and social media links are easy to find.
• Review one exception from the past month and discuss how it was documented.

Printable reminder

• Pause when a request involves money, access, payroll, refunds, private information, or account changes.
• Stop signals include urgency, secrecy, unusual channels, new destinations, links, attachments, popups, and QR codes.
• Verify through a known channel before acting.
• Do not share passwords, one-time codes, recovery prompts, private documents, employee details, customer details, or payment information.
• Use a pause phrase instead of deciding under pressure.
• Route uncertain requests to the approved reviewer.
• Write short notes about what was checked.
• Pausing is allowed and expected.