Are you promoting your business or sharing TMI?

That photo of your team volunteering. The “welcome to the team” post announcing your latest hire. Social media is a powerful way to promote your business. Just know that criminals might be taking notes.

Scammers follow you, your company, and anyone associated with it on social media, collecting bits of information like puzzle pieces. Even these three innocent posts could be enough for a scam:

• A LinkedIn shoutout to your vendor for meeting an impossible deadline. 
• A funny meme with the caption “Me after approving invoices all day” from your accounts payable manager.  
• An Instagram video of the same manager on a beach in Hawaii.

Now, the scammer knows your vendor’s name, who approves invoices, and when they’re out of the office. They can find your vendor’s logo online, add it to a fake invoice, and submit it while the manager is away. The person filling in approves it without noticing the new bank information, and the scammer is that much richer for their efforts.

Follow these tips to keep posting without giving too much away.   

Check your current digital footprint

Search your business name on Google, Yelp, and every social media platform you can think of.

If you find sensitive information, do the following:  

• Delete or edit any content you control. 
• Update old business listings and directories.
• Ask other websites or data brokers to remove information you don’t want public or sign up for a service that does it for you.

Lock down your personal accounts

Change your privacy settings so only family and friends can see your posts, especially upcoming vacations, parental leave, or other times you’ll be away.

Set guidelines for your team

Create a written social media policy explaining what employees can and can’t share about your business. Add examples to make it clear. Share the policy with everyone from your new intern to senior leadership.

Know what's safe to post

• DO focus on your customers and the problems your business solves.
• DO celebrate employees without mentioning job details, responsibilities, or internal processes.
• DO check photos for sensitive information in the background—on computer screens, ID badges, and whiteboards—before posting.

Build protections into your approval process

• Make sure all invoice changes are verified.
• Require a second person to approve large or unusual payments.
• Use multifactor authentication on your business email and financial accounts.
• Check your accounts regularly for transactions you don’t recognize.

What to do if your business has been scammed

• Contact us immediately to see if a payment can be stopped or recalled.
• Save the scammer’s emails, invoices, and other communications.
• Report the incident to the FBI Internet Crime Complaint Center at ic3.gov.