How to protect your startup from email scams

This guidance outlines how business email compromise (BEC) and related social-engineering tactics (spear phishing, smishing, vishing) deceive employees, highlights key warning signs (odd timing, mismatched addresses, urgency), and recommends defenses including verification via separate channels, MFA/passkeys, strict payment approval workflows, and prompt reporting. It underscores the scale and sophistication of these attacks with recent examples and emphasizes skepticism toward unexpected emails, texts, and calls to reduce risk.