CUSTOMER EDUCATION
Guarding Your Business Against Impersonation Scams & Public Data Risks
At MainStreet Bank, your account security is one of our top priorities. As cybercriminals develop increasingly sophisticated ways to target organizations, understanding how fraudsters operate is the first step in protecting your business.
Many business owners believe “it will never happen to us.” However, bad actors frequently exploit publicly available information to execute highly convincing impersonation scams that target businesses of all sizes.
Is Your Business More Visible Than You Think?
You don’t need to be a major corporation or experience a data breach to have your business details exposed online. Fraudsters routinely gather public records, government databases, and online directories to build detailed profiles on target companies.
Where Criminals Find Business Information
Public records serve many useful purposes, but they can also be scraped by scammers to build credibility. Bad actors routinely search:
- Government Grant & Loan Disclosure Databases: Public records (including federal loan programs, state relief grants, and public procurement records) often display a company’s legal name, funding amounts, loan purpose, and the specific bank involved.
- Secretary of State Corporate Registries: Business filings expose official owner names, officer titles, registered agent addresses, and corporate structures.
- Commercial Property & Tax Portals: County databases show property ownership, mortgage details, and tax assessments.
- Company Websites & Social Media: “About Us” pages and professional networking profiles give scammers full employee directories, direct phone numbers, and organizational hierarchies.
How Impersonation Fraud Works
When a fraudster links your company name with your financial institution using public records, they have all the context they need to mount a convincing social engineering attempt.
- The Contact: A fraudster calls or emails an employee, claiming to be from MainStreet Bank, a vendor, or a government agency.
- The Hook: Because they cite actual facts—such as your business name, key officers, or past financial interactions, or just the simple fact that they are calling from your actual bank—the call feels entirely legitimate.
- The Urgency: The caller creates an artificial emergency (e.g., “We detected a fraudulent transaction that requires immediate action” or “We need you to verify this ACH payment before it goes out”).
- The Trap: They direct your employee to a fake login site or ask for online banking credentials, one-time passcode (OTP) verification codes, or an immediate wire transfer to a “safe” secondary account.
Key Best Practices for Your Team
Protecting your business requires a combination of smart habits and strict internal procedures:
- Practice Safe Verification: Always verify unexpected requests by calling MainStreet Bank or vendor back directly through a trusted, known phone number—never use the phone number provided in an unverified email or text.
- Enforce Dual-Control Procedures: Establish strict internal protocols requiring secondary approval from a second authorized employee before processing payments.
- Train Administrative & Finance Staff: Ensure employees handling finances are educated on how public data can be weaponized in social engineering scams.
- Limit Publicly Shared Information: Avoid sharing sensitive operational details, financial provider names, or internal administrative structures on corporate websites or public social profiles.
Maximize Your Defense with MainStreet Bank Security Features
We offer specialized tools designed to add powerful layers of defense to your commercial accounts. While some of these may be required, others are optional – we strongly recommend the following security features to protect your accounts.
- Multi-Factor Authentication (MFA): Prevents unauthorized logins even if credentials are compromised.
- Dual-Control Payment Approvals: Mandates a second user to authorize high-value transactions or wire transfers.
- Positive Pay (Check & ACH): Automatically matches incoming debits against your issued transactions and blocks unauthorized payments.
- Account Alerts: Sends instant SMS/email alerts for large transactions, balance changes, or login attempts.
- Dedicated Banking Computer: Restricts online banking activity to a secure device free from general internet, email, and social media risks.
- Daily Payment Reviews: Requires daily monitoring of account activity so unauthorized or suspicious transactions can be identified and reported immediately.
Suspect Fraud? Act Fast.
If you suspect your credentials have been compromised, or if you believe your business has fallen victim to a scam, contact us immediately.
