There's a scam going around right now, and it's hitting small businesses across the province. I've been hearing about it from owners in a few different trades over the last little while. The details change from one story to the next, but the shape is always the same, and it's almost too simple to believe.

Here's how it goes:

The setup

Someone calls your business. They've got a local number and a local address, and they sound completely legitimate, because they've done their homework. They want to buy something valuable. Often it's a special order, something you don't keep in stock, so you bring it in for them. They're happy to pay the full amount up front, by credit card, over the phone.

A few weeks later the goods arrive. The customer sends a driver to pick them up, or asks you to hand them off to a courier. The paperwork checks out. The goods leave your building.

Then, a few weeks after that, you get a notice from your payment processor. The charge is being disputed. The real cardholder, the person whose stolen card was used to place that order, never authorized it. The money gets pulled straight back out of your account. Now you're out the goods and the cash, and those goods are long gone, usually shipped somewhere far away and impossible to trace.

Why you're the one left holding the bill

This is the part that catches people off guard. You did nothing wrong. You took a payment the way businesses have taken payments for decades. So why are you the one eating the loss?

Because you typed the card number in yourself.

When a card isn't physically present, when you key it in from a phone call, the rules put the risk on you, the merchant. Not the bank. Not the processor. You. If that charge turns out to be fraudulent, you're the one who pays it back.

And all the things that feel like protection aren't protecting you here. The local phone number means nothing, it's easy to fake. Those three digits on the back of the card mean nothing if the card itself was stolen. Your insurance might cover a slice of it, but often not all of it, and never the time, the stress, or the hit to your week.

The worst part is what it does afterward. Once this happens to you, or nearly happens, you start second-guessing every order that comes in by phone. And if a good chunk of your business comes from customers who can't walk through your door, from other towns, from job sites, from up the coast, then all that caution quietly costs you real sales from honest people. The scam doesn't just take one order. It makes you afraid of all of them.

Questions worth asking this week

Do you take card numbers over the phone? If the answer is yes, you've got this exposure right now. Most businesses that sell anything worth stealing do.

Would you catch it before the goods left? The tell is usually a rushed, high-value order from someone new who's oddly relaxed about paying in full and sending someone else to collect.

If a big order came in by phone tomorrow, how would you take the money safely? For most owners, there's no good answer to that yet. That's the gap the scammers are walking through.

How much good business are you turning away to stay safe? If you've started saying no to remote orders out of caution, that number's bigger than you'd think.

The fix is simpler than the scam

You don't have to stop taking remote orders. You just have to stop taking them the risky way.

Instead of keying a card in off a phone call, you send the customer a secure payment link, or an online invoice they pay themselves. When they go to pay, their own bank checks that it's really them, the same quick approval you already get on your phone when you buy something online.

Here's the part that actually matters, and it's the whole reason this works. Once a customer approves a payment that way, the rules flip. If that charge is ever claimed as fraud, it's the card issuer that covers it, not you. That's not a favour your processor is doing you, and it's not a policy that changes from one provider to the next. It's a rule the card networks set, Visa and Mastercard, and it runs straight down the chain to your account. Authenticated payment, fraud claim, the loss lands on the bank. Full stop.

And the scam we've been talking about is stolen-card fraud, plain and simple, which is exactly the kind of claim that rule covers.

Most of the time it never even gets that far. Someone holding a stolen card usually can't clear the real owner's bank approval, so the order dies right there. And in the rare case a bad one does go through, it went through authenticated, which means the risk already left your side of the table. Either way, you're not the one holding the bill.

This isn't fancy or expensive. It's standard, and for most businesses it can sit right on top of how you already work. The customer approves the quote, pays online, and the whole thing ties back to the order and your books. Less phone and paper, faster to reconcile, and the door that scam walks through is shut for good.

The point

Taking payment from people you can't see across the counter is normal business now. It's how a lot of good customers want to buy, and there's real money in it. The goal isn't to hide from that. The goal is to set things up so the honest customers sail through and the thief hits a wall.

If you take orders over the phone and you're not sure where you stand, take twenty minutes this week and look at how you collect remote payments. Not because you've done anything wrong. Because the people running this scam are counting on you not looking.

That's the kind of thing we help businesses sort out. If you want a hand closing that door before it costs you, get in touch.