The “Big Order” Scam: How Fake Purchase Orders Target Small Businesses

This month a message came in through our website contact form that looked like every small business owner's dream: a construction company wanted to buy 20 business laptops, all the same model, shipped right away, and paid on Net 30 terms.

It was a scam. Here's how we spotted it, and how you can spot the next one.

How the scam works

Criminals pretend to be a real, established company and ask a supplier for a large order on credit (usually "Net 30," meaning pay within 30 days of delivery). They pick goods that are easy to resell, like laptops, phones, networking gear or tools. Once the shipment lands at a drop address, it's resold, and the invoice never gets paid. By the time the 30 days are up, the "buyer" is gone.

The FBI and several federal agencies have issued public warnings about this exact scheme, which they classify as a form of business email compromise. Small businesses are a favorite target because there's often no one whose job is to double-check.

The red flags in our example

1. A lookalike email domain. The company name in the signature was spelled correctly, but the email domain was missing a single letter. On a phone screen, you'd never notice.

2. The right company, the wrong people. The company is real, with a real license and a real history. But public records listed a different owner than the "president" who signed the email, and the phone number in the signature didn't match the company's published number.

3. Bulk, easy-to-resell electronics. Twenty identical laptops, with a specific manufacturer part number. Scammers like precise orders because they look professional.

4. Credit terms from a first-time buyer. No prior relationship, out of state, and asking us to ship first and get paid later.

5. Urgency and flattery. Short deadlines and a polished, friendly tone are designed to make you move before you think.

How to protect your business

• Verify independently. Look up the company yourself and call the number on their official website or state license record, never the number in the email.

• Read the domain letter by letter. Before acting on any order, invoice or payment change, check the sender's full address.

• Don't extend credit to new buyers without a credit application, references, or a prepayment on the first order.

• Confirm the ship-to address. A delivery address that doesn't match the company's known locations is a major warning sign.

• Report it. File a complaint at ic3.gov (the FBI's Internet Crime Complaint Center). Reports help investigators connect cases.

The bigger lesson

Purchase-order fraud doesn't need malware or hacked passwords. It works on people. The best defense is a simple rule everyone on your team follows: verify through a channel you already trust before you ship, pay or change anything.

Not sure your team would catch it?

Smartkinect offers a free security check-up for small businesses in Arlington Heights and the Northwest Suburbs. We'll look at your email security, backups and Wi-Fi, and give you a plain-English list of what to fix first.

Call (847) 242-1160 or contact us to schedule yours.

Want a quick read on where you stand first? Take our free 3-minute IT Security Scorecard and get a letter grade for your business.