If you are a small business owner, you always have an eye out for your next contract. Receiving an RFP (request for proposal) could be a way to win a new client. Unfortunately, it may also be a scam. Scammers are sending RFP emails that use the names and info of real companies in hopes of fooling business owners.
How the Scam Works:
You get an email with the subject “Communication Proposal PDF” or something similarly generic. The message appears to be from a potential client asking you to download the RFP and submit a bid on a new project. The email may even have the company’s signature block with a real address and staff contact person.
This scam takes many forms. Sometimes, the “PDF” is actually a malware-infected file. In other versions, the link points you to another website that requests that you provide bank account information, under the guise of needing payment information. No matter what the con, be sure to delete it.
How to Spot an RFP Scam:
- Call the contact information to confirm.If you aren’t sure if an RFP is real, reach out to the provided contact information. If this person doesn’t exist or refuses to speak with you, it’s a huge red flag. Scammers often make excuses such as being “out of the country.”
- Get outside confirmation.Scammers often pose as government agencies or use real company names. Check that the RFP is posted on the organization’s website. If the company doesn’t list RFPs online, call their office to confirm. But don’t use a link or phone number provided in the potentially phony message.
- Be cautious of generic RFPs. Scammers try to cast a wide net by including little specific information in their fake emails. Always be wary of messages and project descriptions that are overly broad.
- Don't believe what you see.Just because an email looks real, doesn't mean it is. Scammers can fake anything from a company logo to the "Sent" email address.
For More Information:
Own a small business? Check out this resource (FTC.gov/SmallBusiness) from the Federal Trade Commission on cyber security and protecting your company from scams.
If you’ve been the victim of an RFP scam, use your experience to help others avoid falling prey by reporting it at the BBB.org/ScamTracker.
