How to protect an event business from phishing scams

Protect your event business from phishing by making sensitive requests go through a check the sender cannot control. Verify changes to supplier bank details through an established contact, open account alerts through the service's own app or website, give each team member appropriate access, and make it easy to report a mistake immediately.

That sounds straightforward. Then you're standing outside the venue, the production supplier wants a deposit, and someone messages you saying your ticket sales account is about to be suspended. Suddenly, a request that deserves a careful check feels like one more thing to clear before doors open.

That's the situation your protection needs to work in. You don't need a team that can spot every dodgy email. You need a way of running payments, accounts and event communications that still holds up when someone is tired, distracted or trying to help.

This guide covers the requests worth slowing down for, how to protect your accounts and payments, what to teach your crew, and what to do when someone has already responded. The examples are hypothetical event situations, not reports of particular attacks or customer experiences.

Understand what the scam is trying to get you to do

Phishing is an attempt to trick someone into handing over sensitive information, opening something harmful or taking an action that benefits the scammer. It can arrive by email, text or another messaging channel. The important part is the action being requested, even when the message looks ordinary.

For an event operator, that action might be entering a password into a fake login page. It might be sending the attendee list to someone pretending to be the venue. Or it might be paying a genuine supplier's invoice using bank details that someone else has substituted.

Those situations need different responses. A suspicious payment request belongs with the person who controls supplier payments. A possible account takeover needs the account owner and technical support. A request for attendee information needs the person responsible for deciding what can be shared. Make those responsibilities clear before an unfamiliar message arrives.

Consider an example. You've booked a sound supplier, and an email appears to continue your existing conversation. It names the right event and gives the right invoice amount. The only change is a new bank account. Everything familiar in the message makes the new instruction feel safe.

The question is whether that change was independently verified. Knowing your event name doesn't prove the sender is entitled to redirect your money. Your staff should understand the difference between recognising the conversation and authorising the action.

The FBI's guidance on business email compromise explains that criminals can imitate addresses, steal account access or use information from legitimate billing conversations. It advises verifying payment requests and changes to account details directly with the person involved. That's why a convincing invoice still needs a payment check.

Decide which requests always need another check

Don't ask people to treat every message as a security investigation. Your box office still needs to answer ticket questions, and your producer still needs to book equipment. Make the stricter rule apply to the actions that can move money, expose data or give someone control.

Put the following requests into that group:

• Changing the bank account used to pay a supplier, contractor or artist.

• Changing where event revenue or other business payments are received.

• Sharing a password, recovery code or login approval.

• Giving someone access to an event, email account or advertising account.

• Sending attendee information or downloading a new file to handle it.

• Making an unusual payment outside your normal approval process.

For each request, decide who can approve it and how they verify it. The rule should be short enough that a temporary staff member can use it, and specific enough that the founder can't wave it away with "I'm in a rush."

You might decide that supplier bank changes require a call to the contact already recorded when the supplier was booked. Attendee data requests might require approval from the event manager through your usual internal channel. Account access might require an invitation issued by the account owner after the person's identity and role are confirmed.

These are operating choices you can adapt to your business. The useful test is whether the person sending the suspicious request can also provide all the evidence needed to approve it. If the message supplies a new phone number, a new email address and the instruction to use both, you haven't independently checked anything.

Think about the exception too. What happens if the supplier doesn't answer and the truck is due at the venue? Name the person who can resolve that situation. Otherwise, the unofficial procedure becomes "do whatever keeps the event moving," which is precisely when your written rule stops helping.

Check account warnings inside the actual account

An account warning can make an operator act quickly because the commercial consequence sounds immediate. Losing access to ticket sales, advertising or attendee communications during an on sale would be a serious problem. A message that threatens that access deserves attention, but its link doesn't deserve automatic trust.

Suppose an email says you need to verify your business or ticket sales will stop. Open the service using your saved bookmark or its installed app. Check for the warning there, and use support details you obtain from the service itself if you need help.

The FTC's advice on recognising phishing recommends contacting a familiar company through a phone number or website you know is real, rather than the details in a suspicious message. Use that rule for account alerts, payment issues and supposed security checks.

A professional logo, your name and a plausible deadline don't replace that step. Neither does good spelling. Don't make your team's decision depend on whether a scammer has written an ugly email.

The same approach works when a message arrives through social media. An apparent support account might claim your event page breaks a rule and ask you to appeal through a link. Go to the platform directly and check the account status there. If you cannot find the claimed issue, contact support through the platform's normal route.

For your team, the practical instruction is simple. "If a message says something is wrong with an account, check inside the account before doing what the message asks." Put that instruction where people can find it during an event. A document buried in a drive nobody opens won't help the person covering the inbox.

Make supplier payments harder to redirect

Start with your approved supplier records. Keep the supplier's trading name, agreed job, payment schedule and established contact together. The person paying should be able to check the invoice against what you actually booked without searching through someone's personal messages.

An invoice arriving at the right moment isn't approval by itself. For example, a hypothetical staging supplier might be owed its final balance after load in. An email arriving that morning with the expected amount would fit the production schedule perfectly. You still need to confirm the recipient and payment details through your process.

When bank details change, contact the supplier using information you already held before the request. Ask them to confirm the change and follow your bank's verification tools where available. Record who checked it and who approved the payment. A reply to the same email thread should not be your only evidence.

For payments that would seriously affect your event if lost, consider a separate approver. That person should check the evidence, rather than simply click approve because someone else has prepared the transfer. Two people following the same unverified instruction don't create much protection.

The FTC's small business invoice warning advises checking invoices closely and making purchase and invoice approval procedures clear. Apply that to event work by matching each bill to a known booking, agreed scope and approved payment destination.

Watch how new suppliers enter the business as well. If a booking is made in a chat, the contract arrives by email and the bank details come through another staff member, decide which record becomes the approved one. Staff should not have to choose between conflicting screenshots when payment is due.

Explain the procedure to suppliers at the start. "We verify bank changes using the contact held on your booking" is a reasonable commercial expectation. It also makes a later delay easier to explain. You're following the arrangement, rather than inventing a new obstacle while someone is waiting to be paid.

Protect the email account that connects everything

Your business inbox deserves special attention because so much of an event runs through it. Contracts arrive there. Suppliers recognise it. Account recovery messages may go there. If someone controls that inbox, they may be able to interfere with several parts of the business at once.

List the accounts that matter to delivering and getting paid for your events. Include business email, banking, ticketing, advertising, social media, file storage and your website. Add the person responsible for each account and how the business would regain access if that person were unavailable.

That last question is easy to miss. If only one contractor knows how to recover the event's social account, your business has a continuity problem even before a scam arrives. You should be able to identify the rightful account owner and the approved recovery route without chasing someone who finished their contract months ago.

Use a different strong password for each account that still uses passwords. A password manager can help keep those passwords distinct, rather than asking you to remember them all. Protect access to the manager itself and use its supported business sharing arrangements where sharing is genuinely necessary.

Avoid storing the main login in a production document that gets forwarded to every new crew member. That document often outlives the event, the contract and the reason the person needed access. It also makes it difficult to tell who can still sign in.

Recovery needs the same care as the login. Keep recovery details current, protect recovery codes, and decide where authorised staff can find them when needed. Test the arrangement while you still have access. An event week is a poor time to discover that the recovery phone belongs to someone who left the business.

Use stronger login protection where the service supports it

Multi factor authentication means proving your identity through more than a password. You may approve a login on a trusted device, use an authentication app or sign in with a supported security key. The available options depend on the service.

Turn it on for important accounts where it is offered. For account owners and people with payment or administrative access, look for phishing resistant options, such as supported passkeys or security keys. Ask your provider or technical adviser which option works with your devices and recovery requirements.

The NCSC's guidance on authentication methods ranks FIDO2 credentials, including supported security keys, ahead of methods that use codes sent by message. It also explains that code based methods can be vulnerable to phishing. So turning on an extra login step is useful, but the method matters.

Never share a code because someone claims to be helping you fix the account. Don't approve a login you didn't initiate. If unexpected approval requests keep arriving, report them to the account owner and check through the service directly instead of approving one to make the notifications stop.

Make the arrangement practical for your operation. A security key locked in an office might be useless to an authorised manager travelling with a festival. A recovery method that only the founder can use might fail when the founder is on a flight. Resolve those cases during setup with the provider's supported options.

Don't remove protection just because a new staff member needs access quickly. Give them the access their role needs through the service's normal invitation process. If the platform does not support your desired arrangement, identify a workable approved alternative before the shift starts.

Give crew members access that matches their job

A person scanning tickets needs to scan tickets. They don't automatically need control over payouts, your attendee communications or the entire event account. Separate those jobs wherever the tools you use allow it.

For example, Loopyah's ticketing team access lets you add admins and door staff without sharing your login. Door staff can receive check in access and nothing else. That helps you equip the people working the door without handing over the organiser's account credentials.

The decision still belongs to you. Invite the right person, choose the right role and review access when their work ends. Decide what each person can do before you invite them in. It does not remove the need to verify a suspicious message or protect the accounts involved.

Before an event, check who has access to each important service. Include freelancers, former staff, agencies and suppliers who were invited for an earlier edition. A familiar name can stay on a list long after anyone remembers why it is there.

Temporary teams need a clear handover. Tell the supervisor who can grant access, who can remove it and what to do if a person cannot sign in. Otherwise, sharing the owner's password can become the improvised solution when the queue starts growing.

The same principle applies to attendee exports. A request for a list should explain the job it supports and the information actually needed. Our guide to sharing attendee data with event suppliers covers that decision in more detail. Agreeing the scope in advance makes an unexpected request easier to question.

Get technical help with email protection

Staff procedures work better when your email service is doing its share of the job. Ask whoever manages your business email to review filtering, account protections and the way your domain is authenticated. This is a setup task for someone qualified to make the changes, rather than a production manager experimenting between supplier calls.

Three names often appear in that conversation. SPF identifies authorised sending services. DKIM lets receiving systems check a message's digital signature. DMARC tells receiving systems how to handle messages that fail the relevant authentication checks for your domain.

The NCSC's email anti spoofing guidance sets out a planned approach to configuring those controls. Ask your adviser to account for every legitimate service that sends business email and test the configuration before applying stricter policies.

For your event business, the practical concern is that genuine messages still arrive. Your ticket confirmations, supplier correspondence and marketing emails might use different sending services. A careless change could interfere with work you rely on, so agree who will test each message type and monitor any problems.

These controls do not make every message safe. A criminal can use a different domain, and someone can send harmful instructions through an account they have taken over. Keep the payment and access checks even when your technical adviser confirms that the domain setup is correct.

Ask for a plain explanation of what has changed, what it protects and what it cannot stop. You don't need to become an email specialist. You do need to know which remaining decisions your staff are expected to make.

Train people using situations they actually handle

A generic security presentation won't necessarily help your casual box office worker recognise the decision in front of them. Use examples that match the messages your team handles and practise the response you want.

Take a hypothetical message saying the headline artist needs an urgent payment to a new account. Ask the team who should receive it, what record they should check and how they would contact the artist's representative independently. The exercise should end with a usable action, rather than a debate about whether the wording sounds suspicious.

Then try an attendee data request. Someone claiming to be the venue asks for the full ticket buyer list "for safety." Your team should know where the approved agreement is, who can decide whether sharing is appropriate and how to confirm that the request really came from the venue.

Include the founder in the rules. If staff have learned that senior people can bypass payment checks, a scam pretending to come from the founder has a ready made excuse. Tell them they can question your request, and respond well when they do.

Keep reporting easy. Name a person and a backup, give staff a familiar channel and say what information to include. "I received this message, I clicked the link, and I entered my password" is useful. Waiting until someone is certain they caused a problem is much less useful.

The NCSC's organisational phishing guidance warns against relying on people to identify every attack and against a blame culture that discourages reporting. Build checks into the operation and thank people for raising concerns quickly, including when the concern turns out to be harmless.

Build protection into event week

Before a busy period, settle the avoidable account work. Invite staff, confirm recovery contacts, record support routes and verify supplier payment details. Leaving all of that until the final production day creates urgent requests that look very similar to the urgency a scammer might manufacture.

Decide who covers sensitive requests while other people are unavailable. If the event manager is backstage and the finance lead is travelling, who can verify a new instruction? A backup needs the approved records and authority to act, rather than a vague instruction to "use your judgement."

Put the response contacts into your event contingency plan. Include the bank's fraud contact, account owners, technical support and the person responsible for event communications. Keep a copy available through a route that doesn't depend entirely on the account you might lose.

Think about the door separately. If a check in staff member receives a message telling them to install an unfamiliar app or give someone remote access to their phone, their supervisor should know how to handle it. Don't let an alleged support request interrupt your agreed door procedure without verification.

After the event, review temporary access and outstanding payments before everyone moves on. Settlement can involve legitimate late invoices, refunds and corrections. Keep the same checks in place; the event being over doesn't make a new bank instruction less consequential.

If someone has already clicked, respond to what happened

First, tell the person responsible for the affected account and get technical help where needed. Establish what happened. Was the message opened, was a link followed, was a file downloaded, was information entered, was a login approved, or was money sent? Those are different situations.

If the person only visited a suspicious page, stop interacting with it and report the details. If a file was downloaded or opened, involve technical support to assess the device and follow the organisation's response process. Don't keep testing the file to see whether it looks harmful.

If credentials were entered, use the provider's official recovery route from a trusted device. The Australian Cyber Security Centre's account recovery guidance recommends changing the password, checking recovery settings, signing out devices, reviewing authentication methods and checking email forwarding rules. Follow the affected provider's specific instructions as well.

Check connected accounts that may be exposed through the compromised inbox. Look for unauthorised access or changes, and have the account owners review their own services. A successful password change is one step in recovery, not evidence that every consequence has been resolved.

If money was sent, contact your bank immediately. Give it the transaction information and explain that you suspect fraud. The FBI guidance linked earlier advises asking your financial institution to contact the receiving institution. Recovery is uncertain, so avoid promises about getting the money back.

Preserve the original message and record the timing, requested action and steps taken. Use that information for the bank, service provider and appropriate reporting authority. Keep unnecessary personal data out of broad team chats while making the facts available to the people handling the incident.

Keep attendees and suppliers informed when they are affected

If someone used your account to send scam messages, the people receiving them may still act even after you've regained access. Work out which contacts were affected and warn them through a channel you control and have verified.

A useful warning says which message is affected, what recipients should avoid doing and how to reach you safely. If a fraudulent message asked suppliers to change payment details, tell those suppliers directly. If it asked attendees to pay an extra charge, explain the specific request they should disregard.

Keep your statements tied to what you know. Don't announce that no data was accessed before that has been established. Don't claim the whole problem is resolved because you can sign in again. Someone should own the updates and approve factual changes as the investigation develops.

Where personal information may have been exposed, get advice on the applicable notification and reporting requirements. Those depend on the business, affected people and jurisdiction. Your incident plan should identify who obtains that advice, so the operator isn't trying to interpret the rules while answering worried attendees.

Also review the immediate event decision. Can ticket sales continue safely? Can the door operate? Is a supplier payment now uncertain? Separate confirmed operational issues from speculation and assign an owner to each. The aim is to restore safe work while giving affected people accurate information.

Review a close call while the details are fresh

When your team catches a suspicious request, use it to improve the next event. Ask which part of the normal procedure stopped the action and which part nearly allowed it. You might find that the payment rule worked, but the approved supplier contact was sitting in an unavailable producer's inbox.

Fix that gap while you still remember it. Put the contact into the approved booking record and give the backup approver access. The lesson is much more useful when it changes how the next payment works than when it becomes another warning to "be careful."

A short review can also reveal unnecessary friction. Suppose every routine invoice gets delayed because nobody knows which producer approved the booking. That's a purchasing problem you can resolve by recording approval at booking. Clearing up ordinary work gives staff more time and attention for the unusual requests that deserve it.

Don't circulate the scam to the whole crew as a live message with working links. Use a safely prepared example, with sensitive details removed, and explain the decision that mattered. Your technical adviser can help prepare it. The point is to practise a response without exposing another person to the same harmful material.

Look at reports as useful information. If casual staff keep asking whether access invitations are genuine, improve the invitation handover. Tell them when to expect it and who to contact. If suppliers frequently change payment details informally, restate the verification process when the next contract is agreed.

Keep the review proportionate to the incident. A suspicious email that was reported before anyone responded doesn't require a meeting with every department. An unauthorised payment or account takeover needs a fuller review, with the relevant specialists and decision makers involved.

Finish with named actions. Who will update the supplier record? Who will check old access invitations? Who will change the briefing for the next event? Set a completion point that makes sense for the production schedule, then confirm the work happened.

You can also ask one practical question at the next crew briefing. "If this message arrived while your supervisor was busy, what would you do?" Listen for a real route to help, rather than the answer people think you want to hear. If nobody can name the backup, the plan still needs work. Make sure the replacement contact is available to cover the next shift.

Make the process easy enough to follow

The best starting point is a short conversation with the people who handle payments, inboxes and access. Ask them to walk through a genuine recent task. Where did the instruction arrive? What did they check? Who could change it? What happened when the usual approver was unavailable?

Write the agreed procedure around those answers. Give sensitive requests an independent check, protect the accounts that connect your business, and keep a fast reporting route available to everyone working the event. Revisit it when you change suppliers, systems or the people responsible.

You can't guarantee that nobody will ever respond to a convincing scam. You can stop one rushed decision from becoming an unchecked transfer, a shared organiser login or an unreported account takeover. That's a practical way to protect the money and trust your event business depends on.