Imagine a travel agency in Casablanca. On a busy Thursday afternoon, the accountant receives an email "from the boss": a new supplier must be paid today, quietly, before the weekend. The email looks right, the tone feels right, and the pressure is real. This is how most business scams work. They do not break into your computers. They trick your people.
The scams small businesses see most often
Scammers like small and medium businesses because they often move fast and rely on trust. Here are the tricks that come up again and again:
- Fake emails (phishing): a message pretending to be your bank, a delivery company or Microsoft, asking you to click a link and log in. The page looks real, but it steals your password.
- Fake supplier invoices: an invoice arrives from a supplier you know, but the bank details have "changed". The money goes straight to the scammer.
- The urgent "CEO" request: someone pretends to be the owner or a director and asks for an urgent, confidential payment.
- WhatsApp impersonation: a message from a new number says "Hi, it's me, I changed my phone", then asks for money or a code.
- Fake codes: someone asks you to forward the six-digit code you just received. That code is the key to your account.
The new one: AI voice and video calls
In 2026, scammers can copy a voice from a short clip on social media or a voicemail. They can also fake a face on a video call. This is called a deepfake: a fake recording made by AI that looks or sounds like a real person.
So a phone call that sounds exactly like your manager is no longer proof that it is your manager. The good news is that the defence is the same as for every other scam. Hang up, and call the person back on a number you already have saved.
Habit 1: Verify by calling a known number
This one habit stops a huge share of scams. Whenever a message asks for money, a change of bank details, or private information, check it through a different channel.
Do not reply to the email. Do not call the number written in the message. Use the number you already have in your phone or your files. If the supplier really changed banks, they will be happy you checked. If they did not, you just saved your business a painful loss.
Habit 2: Lock your accounts and keep codes private
Turn on two-step verification for email, banking, social media and WhatsApp. This means that, besides your password, you also need a code from your phone to log in. Even if a scammer steals your password, they still cannot get in.
Then teach everyone one golden rule: a code you receive is never shared. Not with the bank, not with "IT support", not with a colleague on WhatsApp. Real companies do not ask for these codes. In WhatsApp, also turn on the six-digit PIN in the settings, so nobody can move your account to another phone.
Habit 3: A clear rule for payments, and regular training
Put a simple payment rule in writing. For example:
- Any new supplier, or any change of bank details, must be confirmed by phone on a known number.
- Payments above an amount you choose need approval from two people.
- No payment is ever made just because a message says "urgent" or "confidential".
When the rule is written down, your staff feel safe saying "I need to follow the procedure", even to the boss. Then spend fifteen minutes every few months showing your team real examples of scam messages. People who have seen the tricks are much harder to fool.
Scams Moroccan Businesses Should Watch For
The tricks above appear worldwide, but some take a particular shape in Morocco. Share these examples with your team, in the language they use every day.
- Fake parcel and delivery messages: an SMS or WhatsApp message says a parcel is waiting and a small fee must be paid through a link. The page asks for card details. Businesses that send and receive many deliveries are easy targets.
- Messages that look official: messages pretending to come from a bank, a telecom operator or a public administration, asking you to "update your details", settle a fine or claim a refund. Official bodies do not ask for card numbers or codes by SMS or WhatsApp.
- Darija voice notes from "the boss": WhatsApp voice notes feel personal and trustworthy, and AI can now imitate voices. A voice note asking for an urgent transfer or a mobile top-up deserves the same check as any other payment request.
- Fake orders and cash on delivery: large orders from unknown customers who later refuse delivery, or who ask you to ship to a third party. Confirm big first orders by phone before you send stock.
- Cheque tricks: a new customer pays by cheque and wants the goods immediately, or "overpays" and asks for the difference back by transfer. Wait until the cheque has cleared with your bank before releasing goods or refunding anything.
- Fake job and supplier offers: messages promising easy work, cheap stock or a tender opportunity in exchange for an upfront "registration fee".
In many SMEs, especially family-run ones, payments are approved informally and quickly between people who trust each other. Scammers count on that. Your written payment rule protects family members and long-serving staff too, because it gives everyone permission to slow down and check.
If you are targeted, keep the messages and contact your bank first. You can also report online fraud to the police. Your bank or a lawyer can advise on the right next steps for your case.
What to do if someone already clicked
Mistakes happen. What matters is speed and honesty. Make sure your team knows they will not be punished for reporting quickly. Then:
- Change the password of the affected account straight away, from a different device if possible.
- Call your bank immediately if money was sent. The faster you call, the better the chance of stopping the transfer.
- Tell your IT contact so they can check the computer and other accounts.
- Warn your contacts if your email or WhatsApp was used to send messages.
- Write down what happened: time, messages, amounts. This helps the bank and the authorities.
Need a hand putting this in place?
At Africodex, our IT consulting team helps businesses in Morocco and across Africa set up these protections in a practical way: two-step verification on every account, clear payment rules, and short, friendly training for staff. If you would like a second pair of eyes on how safe your business really is, we are happy to talk.
Common questions
Are small businesses really targeted, or only big companies?
Small businesses are targeted all the time, often because they have fewer checks in place. Scammers send thousands of messages and wait for someone to fall for one. Simple habits make you a much harder target.
How can I tell if an email is fake?
Look for pressure, urgency, secrecy, or a request to click a link and log in. Check the sender's full address, not just the name. When in doubt, do not click, and confirm by calling a number you already know.
Is two-step verification difficult to set up?
No. For most services it takes a few minutes in the security settings. Once it is on, you only need your phone for an extra code when you log in on a new device.
I received an SMS about a parcel with a fee to pay. Is it a scam?
It very often is. Fake delivery messages asking for a small payment through a link are a common way to steal card details. Do not click the link. If you are expecting a parcel, check its status directly with the delivery company through its official website, app or a number you already know.
Where can I report an online scam in Morocco?
Start with your bank if any money or card details are involved, because speed matters. Then report it to the police, who handle online fraud. Keep screenshots, phone numbers, dates and amounts, as these help both the bank and the authorities. A lawyer can advise you if the amount is significant.
How can I avoid fake orders when selling with cash on delivery?
Call new customers to confirm large or unusual orders before shipping, and be wary of requests to deliver to a different person or address. Some businesses ask for a small deposit on big first orders. Keep a simple list of customers who refused deliveries before, so your team can spot repeat cases.
Book a free security chat
Free first conversation. We reply within one business day, in French, Arabic or English.
Talk to us