When a Scammer Pretends to Be Your Radio Station

An advertiser gets an email that appears to come from your station’s sales department. It includes a familiar name, your logo, and a simple request to pay this month’s invoice through a different link. Nothing about it seems especially unusual, so they make the payment and move on. Your business office eventually follows up about the unpaid invoice, and that’s when everyone discovers the money went somewhere else. I’m hearing and reading more stories like this, and it’s easy to see how a busy radio station could get caught in the middle.

Having worked in radio for years and now building station websites, I know how much of this business runs on familiarity. Advertisers trust their sales reps. Listeners recognize the morning show personalities. Employees see the owner’s name on a message and assume it deserves their attention. Someone impersonating your station can take advantage of those relationships without ever setting foot in the building.

We used to tell people to watch for misspelled words and sentences that didn’t sound quite right. Those are still reasons to be suspicious, but good writing doesn’t mean an email is legitimate. The FBI has warned that criminals use AI to make their messages more convincing and remove mistakes that might otherwise give them away. The email asking for money may read just as naturally as the real messages your staff sends every day.

The possibilities go beyond an advertiser paying a fake invoice. Your office manager could receive an urgent payment request that appears to come from the owner. A message supposedly from your website provider could threaten to take the site offline unless someone pays immediately. A fake station account could contact contest entrants and ask for personal or payment information to release a prize. Each request borrows enough from normal station activity to seem plausible, especially when the person receiving it is juggling five other things.

Start by making unexpected payment changes something your staff always verifies. If a vendor asks you to use a new bank account or an unfamiliar payment link, call a number already in your records. Don’t use the number included in the questionable message, and don’t assume replying to the email will clear things up. The FBI recommends independently verifying payment requests and changes to payment procedures. That process should apply to everyone, including the owner. An urgent message from the boss shouldn’t be a shortcut around the rules.

Your advertisers need a consistent process, too. Explain how invoices arrive, how payments are accepted, and whom to contact if something seems different. Include that information when a new advertiser comes on board, and make sure the sales team gives everyone the same instructions. If your station routinely makes exceptions and handles payments differently depending on the rep, an unusual request becomes much harder for a client to recognize.

There’s also a conversation to have with whoever manages your email and domain settings. Ask them to review SPF, DKIM, and DMARC, which help receiving mail systems determine whether messages using your domain are authorized. You don’t need to learn how to configure them yourself, but you should know who is responsible for them and whether they’re set up correctly. These protections can help reduce someone’s ability to spoof your domain. They won’t stop a scammer from using a similar-looking address or attaching your manager’s name to a completely unrelated account.

I would make station-owned email addresses standard for everyone communicating on behalf of the business. An advertiser shouldn’t have to remember that billing uses the station domain while their sales rep uses a personal Gmail address. Consistency gives people a better chance of noticing something unusual. Require multifactor authentication on those accounts as well, because a compromised employee account can put a scammer inside the very address your clients already trust.

This is also a practical use for your station website. Your contest pages should tell listeners how winners are notified and how to confirm that a message came from you. Your contact page should make it easy to reach the right person without hunting through social media. Think about someone arriving at your site because they’re unsure whether to trust an email or message. Can they quickly find enough information to check it?

If someone does impersonate your station, give people specifics. Explain what the fake message looks like, what it asks them to do, and how they can reach you directly. Publish the warning on your website and share it through your social accounts, app, or newsletter as appropriate. The FTC recommends notifying customers promptly when a business discovers it is being impersonated. A useful warning gives people something concrete to recognize; “be careful out there” leaves them guessing.

Bring this up at your next staff meeting with a few examples that fit your operation. What would someone do if the owner emailed an urgent request for payment? What if your hosting provider said the website would go down in an hour? Have the people receiving those messages explain how they would verify them and whom they would contact. Work through any gaps, and make sure everyone understands that checking a suspicious request is expected—even if it means calling you to ask whether you really sent it.