What Entrepreneurs Can Learn from Future Crimes
Mara was three weeks from closing her seed round when an email arrived from what looked like her accounting vendor, warning her subscription would lapse unless she updated payment details within the hour. The tone was urgent, the logo familiar. She had a demo in twenty minutes and almost didn't look twice. Something about the sender's address felt slightly off, one letter swapped. She opened a new tab and logged into the vendor's site directly instead. Nothing was pending at all. The email had been built to exploit exactly this moment: distracted, moving fast, too few hands and too many logins. She forwarded it to her cofounder: we need a process for this, not just instinct.
The whole book, compressed
This edition works through 4 core lessons — take them one at a time, not all at once.
What's different for your conditions
Tap whichever ones sound like you. Nothing here is sent or saved — it's just for your own noticing.
0 of 5 selected
The core lessons, applied to you
How exploitation reaches a growing business
Most harm reaching a small company is not a sophisticated intrusion. It is a message that looks routine enough to act on without thinking: an invoice, a renewal notice, a request from a supposed new hire. These messages borrow trust that already exists between you and people you deal with daily, then add a deadline that discourages checking. This pattern of impersonation and urgency accounts for most everyday exploitation, and scales easily against businesses too small for a security team.
Founders under deadline pressure treat every unusual request as one more item to clear, not a moment for a second look.
Verify any payment or login request through a channel you already trust, such as a phone number already on file.
Why one scam can hit every business like yours
A scam that works once rarely stays aimed at one target. The same invoice-fraud template can reach thousands of companies sharing your software or industry, because the automation behind it does not care which business it hits.
It is tempting to assume a scam email was crafted for you specifically, when you were one of thousands, and that flattery lowers your guard.
Assume any unexpected financial request could be part of a mass campaign, and ask peers whether they have seen it too.
Everyday habits that protect a lean team
Protective habits are not expensive: a pause before acting on financial requests, a rule that payment details never change based on email alone, and limits on how much operational detail your team posts publicly, since job listings and investor updates can fuel a convincing impersonation. None of this needs a budget, only making verification routine.
Early on, process feels like overhead, so verification gets skipped in the name of speed, right when a loss would hurt most.
Write one rule, such as payment changes require a call to a known number, and share it with everyone who touches money.
Staying alert as the business grows
Tactics against small businesses keep changing as scammers' tools improve, so awareness needs occasional refreshing rather than a one-time setup. As your company adds people and vendors, your exposure changes too. Treat staying informed as a light ongoing habit, like reading industry news, rather than a project finished once.
The instinct to move fast and trust quickly is often what makes a startup work, and that same instinct is what phishing exploits. Verifying every unusual request can feel like it slows the speed that gives a small company its edge. Limiting what you share publicly also cuts against the visibility that helps you raise money and win customers. Judgment, not a rigid rule, decides when speed matters more than caution.
Name one thing, honestly
- Which financial or login requests currently get acted on without a second channel of verification? - What details about your company could fuel a convincing impersonation attempt? - Who on your team would know what to do with a message like the one in the opening scene?
Good. Now look back at the "Try this" line under whichever lesson feels most connected to what you just wrote, and treat that as this week's actual assignment — not all 4 at once.
The practices from this edition
0 of 3 selected
Run this for seven days
Write one rule, such as payment changes require a call to a known number, and share it with everyone who touches money.