Cybercriminals follow the money: how to protect your small business in 2026

Cybercrime is no longer mainly a big-company problem. Criminals now go after small businesses and their customers, because that's where the money is easiest to reach: a hotel's booking account, a clinic's Instagram page, a supplier invoice waiting to be paid.

The good news is that most of these attacks rely on a handful of tricks, and a few simple habits stop most of them. This guide covers the scams small businesses are seeing in 2026 and the steps that protect you, your team and your customers.

The numbers keep climbing

In its latest annual report, the FBI's Internet Crime Complaint Center (IC3) recorded more than one million complaints in 2025, with reported losses of about $20.9 billion, a 26% increase on 2024.¹ Business email compromise, where criminals trick a company into paying money to the wrong account, accounted for roughly $3 billion of that.²

The picture is similar outside the US. The UK government's 2026 Cyber Security Breaches Survey found that 43% of businesses had a breach or attack in the past year, most often phishing.³ The UK's National Cyber Security Centre puts it bluntly: "1 in 2 small businesses suffer a cyber incident every year."⁴

Two trends stand out:

• AI makes scams more convincing. IC3 received more than 22,000 complaints involving AI in 2025.¹ Verizon's 2026 Data Breach Investigations Report says generative AI is now being used to strengthen 15% of the attack techniques it tracks.⁵
• Phones are the new front door. Verizon found 40% higher click rates on mobile devices, which makes phones a favourite target for phishing.⁵

Five scams hitting small businesses right now

1. Fake booking messages

This is one of the fastest-growing scams in hospitality. It usually works in two steps:

• Criminals break into the hotel's account. Staff receive an email that looks like a guest complaint or a message from Booking.com. Clicking it installs malware that steals the login for the hotel's booking system.⁶⁷
• Then they message the guests. Using real reservation details, they send guests a WhatsApp or email message claiming there's a problem with the payment, with a link to a fake page that steals card details.⁷

Because the message includes the guest's real name, dates and hotel, it looks completely genuine. Switzerland's National Cyber Security Centre warned in June 2026 about exactly these WhatsApp messages, which threaten that "the booking will be cancelled unless credit card details are verified immediately via a link."⁸ Security firm Sekoia found stolen hotel booking logins being sold for between $5 and $5,000.⁷

2. Hacked Facebook and Instagram accounts

For many small businesses, the Facebook page, Instagram account and ad account are where customers come from. That makes them valuable to criminals, who take over the account and then run their own ads using the business's saved payment card.

In late 2025, Check Point reported a campaign that sent more than 40,000 phishing emails to over 5,000 organisations, mostly small and mid-sized businesses. The emails offered fake "Meta Agency Partner" invitations and free advertising credit, and some were sent from a genuine Facebook email address, which made them hard to spot.⁹

3. Fake invoices and "new bank details"

This is business email compromise. A criminal either hacks a supplier's email or creates a look-alike address, then sends a normal-looking invoice or a message saying the bank details have changed. The money goes straight to the criminal, and it's usually gone before anyone notices. According to news reports on the FBI's figures, wire transfers were the main way BEC losses were paid.²

4. AI voice and video impersonation

Criminals can now copy a person's voice or face from a few minutes of video. In one widely reported case, a finance worker at the engineering firm Arup paid out about $25 million after a video call in which the "chief financial officer" and other colleagues were all deepfakes.¹⁰ The same trick works on a smaller scale: a voice message that sounds like the owner, asking a staff member to make an urgent payment.

The FBI warns that "AI-generated content has advanced to the point that it is often difficult to identify," and recommends verifying any unusual request through a separate channel.¹¹

5. Ransomware

Ransomware locks your computers and files until you pay. Verizon found it involved in 48% of all breaches in its 2026 report.⁵ Analysis of the same report by the Cyber Readiness Institute notes that small organisations make up 96% of ransomware victims where the size of the organisation was known.¹² Attackers increasingly get in through software that hasn't been updated: 31% of breaches now start with an unpatched vulnerability.⁵

What to do this week

The guidance from the UK NCSC, the US Federal Trade Commission and the US Cybersecurity and Infrastructure Security Agency (CISA) comes down to the same few steps.⁴¹³¹⁴ Many take only a few minutes.

1. Turn on two-step verification everywhere. Email, booking platforms, Facebook and Instagram, your bank and your website. This one step stops most account takeovers, even if a password is stolen.
2. Use a password manager. Give every account its own long password (the FTC recommends at least 12 characters) and never reuse them.¹³
3. Turn on automatic updates for computers, phones, your website and any plugins. Unpatched software is now the most common way in.⁵
4. Back up important files to a separate location, such as the cloud or an external drive kept offline, and check that you can restore them.¹³
5. Lock down your Meta business account. Meta recommends removing anyone who hasn't set up two-factor authentication, limiting full control to the few people who really need it, and reviewing who has access regularly.¹⁵ Open Meta Business Suite directly, never through a link in an email.⁹
6. Agree a rule for payments. Any new bank details or urgent payment request must be confirmed by phone, using a number you already have. For voice requests, the FBI suggests agreeing a secret word only your team knows.¹¹
7. Train your team for ten minutes. Show them the scams above. Most attacks still depend on someone clicking a link or trusting a message.

The bottom line

Criminals follow the money, and small businesses are now firmly in their sights. But most attacks still rely on the same basics: a stolen password, a missing update or a convincing message. Two-step verification, updates, backups and a simple payment rule will protect you from most of what's out there.

If your website, booking flow or social accounts haven't been checked in a while, it's worth doing now, before someone else finds the gaps.