Protecting Your Radio Station from Impersonation Scams

I know we covered this in a recent blog post, but it’s worth a podcast this week. Your business office calls an advertiser about an overdue invoice. The advertiser insists it was paid last week and forwards the email with the payment instructions. There’s your station logo, your sales rep’s name, and a message that sounds perfectly reasonable. There’s also a payment link that has nothing to do with your station. Now you have an unpaid bill, an advertiser who has lost money, and an uncomfortable conversation neither of you expected.

I’m hearing and reading more stories like this, and radio’s reliance on personal relationships makes the situation especially concerning. An advertiser who has worked with the same rep for years has a reason to trust that person’s name. A listener who just entered a station contest has a reason to believe a message announcing they won. Someone impersonating your station is counting on that familiarity to get past the questions people might otherwise ask.

Your website doesn’t have to be hacked for someone to pull this off. A copied logo, a staff photo, and a similar-looking email address can give a fraudulent message the appearance of something legitimate. The writing may be convincing, too. The FBI has warned that criminals use AI to improve their messages and remove errors that once made scams easier to recognize. We can still watch for spelling mistakes, but we can’t treat a well-written email as proof of who sent it.

For a station manager, the useful question is what happens after one of those messages arrives. Does the employee handling invoices have a process for checking new payment instructions? Would a salesperson know what to tell an advertiser who received a questionable request? Could a listener visit your website and find out how you actually contact contest winners? Those are things you can address before someone calls about missing money.

Make unexpected payment changes worth a phone call.

A request to send money somewhere new should get checked through a contact method you already trust. If a vendor announces new banking information, call the number in your records. If an email directs you to an unfamiliar payment page, verify it before using it. Replying to the message only reaches whoever controls that conversation, and calling a number supplied in the same email doesn’t give you an independent check. The FBI recommends verifying payment requests and changes to payment procedures.

That rule needs to apply when the request appears to come from station ownership, too. An employee shouldn’t have to decide whether questioning the boss is more dangerous than sending the money. Make it clear that verification is expected, especially when a message combines an urgent expense with a reason the sender supposedly cannot talk. Establish who can approve the payment and how the request should be confirmed.

Advertisers deserve the same clarity from your station. Explain your billing process when they come on board, including how invoices arrive, which payment methods you accept, and whom to contact with questions. Every sales rep should give the same explanation. If clients are accustomed to a different arrangement with every employee, you’re asking them to identify an exception in a process made almost entirely of exceptions.

Ask someone to check your email protections.

There’s a technical side to this, but station managers don’t need to become email administrators. Send whoever manages your email this question: “Are SPF, DKIM, and DMARC configured correctly for our domain, including all the services we use to send email?”

These settings help receiving mail systems evaluate messages claiming to come from your domain. The review should include legitimate sending services such as your newsletter platform and billing system. Have the person responsible explain what is in place and whether anything needs attention. It’s a much more useful conversation than assuming that because email works, everything behind it must be configured correctly.

Email authentication has limits. It won’t prevent someone from creating an address that resembles yours or using your general manager’s name on an unrelated account. Require multifactor authentication to help protect your actual mailboxes, and make station-owned addresses standard for business communication. Advertisers shouldn’t need to remember which employees use the station domain and which conduct business through personal accounts. Consistency helps people notice a change, even though a familiar address alone is never a guarantee.

Give people somewhere reliable to check.

This is where your station website can serve a very practical purpose. Someone questioning a contest message should be able to visit the contest page and learn how winners are notified. If your station never requests payment to claim a prize, make that clear. Provide an easy way to contact the station and verify a message without using the links or phone numbers in that message.

Look at those pages from the listener’s perspective. They may be excited about winning, embarrassed about possibly being fooled, or worried that waiting will cost them the prize. Don’t make them search through old social posts to find an answer. Put the information where they entered, and keep your contact details current.

If you discover someone impersonating the station, explain exactly what is happening. Identify the fake account or describe the message, explain what it asks recipients to do, and provide a trusted way to reach your team. Publish that notice on your website and share it through the channels that reach the affected audience. The FTC recommends promptly notifying customers when a business learns its identity is being used this way. A specific warning gives people something they can recognize and act on.

Find the gaps before a scammer does.

Set aside ten minutes at your next staff meeting to walk through a few situations. A vendor sends new banking information. The owner emails an urgent payment request. An advertiser calls about an invoice your station didn’t send. A listener asks why they need a credit card to collect a prize. Have the people who would receive those messages explain what they would do and whom they would contact.

Include sales, promotions, and the people answering your phones. This won’t necessarily land with the person responsible for technology or billing first. If someone makes a mistake, they need to report it immediately so the station can respond. When money has already been sent, contact the bank or payment provider right away and report the fraud at IC3.gov. Make sure embarrassment or fear of getting in trouble doesn’t delay that call.

You can start today by requesting the email review and writing down how your staff should verify payment changes. Then check your contest and contact pages for the information a suspicious listener would need. Those are manageable tasks with clear owners, and they give your team something more useful than another reminder to “be careful.”