Two free defenses for small trades shops, in one document.
Blue Collar Labs · bluecollarlabs.org/defend · Free to share, free to print.
This pack bundles the two defenses small trades shops use first. Print it, tape the wall poster near the AP desk, and run the three drills next week.
Together these are about an hour of reading and a couple of weeks of low-effort drills. They do not replace a real cyber-insurance policy or a real incident-response retainer, and we name where they hand off to those things.
If something is on fire right now, skip to the second half of this pack — the 60-minute plan starts with a cover page that tells you exactly what to do in the next five minutes.
Small trades shops are now the most-targeted bracket for business-email-compromise and voice-clone wire fraud. The reason is unromantic: the average loss per incident is high enough to be worth an attacker's time, and the average shop's defenses are still mostly "the AP person is careful." That's not enough anymore. The attacks have moved.
This pack is what we hand to the shops we audit. It is free because the cost of not having it — the wire that goes out at 4:55 PM on a Friday — falls hardest on the people who can least afford it.
If your shop wants the full audit (we'll send a fake "Joe Mendez" to your real AP person, with consent), email support@bluecollarlabs.org. Otherwise: read on.
BCL DEFEND pillar — Week 3 artifact.
Each case below is a real pattern that has actually been sent to plumbing, electrical, HVAC, and general-contractor shops in the past 6 months. Identifying details have been changed. The patterns — the structure, the social engineering, the off-channel ask — are unchanged.
For each case:
Three cases is the right number: enough variety to teach the pattern, few enough to actually run drills on all of them inside one week.
This is the most common attack against small trades shops. It's the pattern that put $48k on the line at a real shop in March 2026.
From: Joe Mendez <jmendez@graybar-billing.net>
To: ap@<your-shop>.com
Subject: Invoice 41782 — past due — wire required EOD
Hi,
Following up on invoice 41782 (attached) for the recent supply
order. I see this is now 30 days past due. Per our updated billing
terms (see vendor portal note 11/23), wire transfer is now the
only accepted payment method for past-due balances.
New wire instructions:
Bank: Pinnacle First (NY)
Routing: 026013576
Account: 8847132201
Reference: INV-41782 / <your-shop>
Please confirm by 4 PM today so we can release for next-day
delivery. Late wires hold the order another 48 hrs.
Thanks,
Joe Mendez
A/R Specialist · Graybar Electric
Direct: (212) 555-0119
It looks like a routine A/R follow-up. The shop bought from Graybar last month. The dollar amount is plausible. The urgency ("4 PM today") is normal in supply-house culture. The voice is professional but not too polished.
graybar-billing.net is not Graybar's domain. Graybar is graybar.com. Hyphenated lookalike domains (-billing, -finance, -payments) are the #1 phishing tell in trades. Real vendors use the same domain for billing as for ordering.Never wire to a new payee — or a new account at an old payee — without a callback to a number you already had on file. Never use the number in the email.
Send a fake "Joe Mendez" email to your AP person yourself, using a free Gmail you make up that morning, with a brand-new wire instruction. See how they handle it. If they catch it, buy them lunch. If they don't catch it, you've just discovered a $48,000 hole in your shop's defenses for the cost of a 5-minute prank. Tell them after — never leave a real test running.
This is the rising threat in 2026 because the cost of voice cloning has collapsed. With 30 seconds of a person's voice (a podcast, a radio ad, a YouTube job-site video, a voicemail greeting) anyone can produce a convincing audio clip in their voice.
The voicemail (or live call) sounds like the owner. Slightly distorted ("I'm at the airport, bad signal"). Asks AP / bookkeeper / spouse to wire money to a new vendor, today, before EOD, because of a deal that closes today.
The voice is right. The cadence is right. The phrases the owner usually uses are right (because the cloning model picked them up from public audio).
"Hey, it's me. I'm at the truck show in Vegas, signal's terrible. Quick one — that supplier I told you about, the one out of Tennessee — they need a 10k deposit today to lock the bulk price. Wire it from operating. Routing is 0-6-2-2-0-0-3-0, account is — let me grab it — 4-1-8-3-2-9-1-7. Reference 'TN supplier deposit.' Just do it from your phone, I gotta hop on a call. Thanks. Tell Maria I said hi."
It's the boss. He's said "Tell Maria I said hi" in voicemails for years. He's been to Vegas before. He DID mention a Tennessee supplier last week. None of it is invented — the attacker did 20 minutes of research on the shop's social media and the owner's voice.
Voice over the phone never authorizes a new wire. Period. Even if it's the boss's voice. The boss agreed to this rule in writing.
Pin the rule. Get the owner to sign it. The signature is the actual control — it removes the AP person's social pressure to comply.
Have the owner record themselves saying "Hey, it's me. I'm at the airport. Wire $8k to this account today." (No actual instructions — just the sentence.) Play it for the AP person and ask: would you have actioned this? If yes, the rule above is not yet on the wall. If no, ask them what would have made them action it. That's the next gap to close.
Less common but rising fast in 2026 as municipal e-services get more visible online. Plays on the fact that small trades shops do receive real permit-related emails from real municipalities.
From: Permits Office <permits@nj-business-permits.org>
To: <owner>@<your-shop>.com
Subject: ACTION REQUIRED — your contractor license renewal — 2026 cycle
Dear Licensee,
Our records indicate that your New Jersey home improvement
contractor registration (HIC #13VHXXXXXXXX) is in the 2026
renewal window. Renewal is now mandatory by 5/15/2026 to avoid
a $250 late fee and a 30-day suspension of your license to
perform residential work in the State of New Jersey.
Renew online: https://nj-business-permits.org/renew?HIC=13VHXXXXXXXX
The 2026 renewal fee is $90.00 and may be paid by credit card,
debit card, or e-check. Please complete the renewal on or before
5/15/2026 to maintain active status.
Thank you,
NJ Business Permits Office
The HIC# is a real format. The renewal cycle exists. The deadline pressure is plausible. The email is written in the dead, formal, slightly off voice that real municipal emails actually use, so the attacker has done its tone homework.
nj.gov (e.g. dca.nj.gov). Anything that ends in nj-business-permits.org, nj-permits.com, state-of-nj-renewals.net is fake. State governments do not use generic .org or .com domains for licensing actions. If it's not *.nj.gov, it's a scam.dca.nj.gov and the fee is set by statute. Even if the dollar amount in the email matches the real fee, the channel is the attack — they want a credit card on a fake portal so they can charge it again later.nj.gov, the email is lying.For any government, license, permit, or tax-related email — type the agency's website into your browser yourself. Never click the link in the email. Treat email links from government as untrusted by default.
This rule is also defended by browser autofill: if you've never been to nj-business-permits.org before, your password manager won't fill anything, which is a free silent warning.
Once a quarter, send your team a fake-licensing email yourself. Track who clicks. Don't blame people who fail — train them. The point is to find gaps, not to hunt humans.
┌────────────────────────────────────────────────────────────┐
│ │
│ THE THREE BCL CALLBACK RULES │
│ │
│ 1. New payee or new account? │
│ Callback to a number you already had on file. │
│ Not the number in the email. │
│ │
│ 2. Voice on the phone, urgent wire? │
│ Hang up. Call the boss back at his real number. │
│ He agreed to this rule in writing. │
│ │
│ 3. Government / license / permit email? │
│ Type the agency's website yourself. │
│ Never click a link. │
│ │
│ If you skip a rule because someone is yelling at you, │
│ the someone yelling is the attacker. Hang up. │
│ │
│ — Blue Collar Labs · bluecollarlabs.org/defend │
│ │
└────────────────────────────────────────────────────────────┘
The version a panicked owner uses at 11 PM.
If you are reading this because something just went wrong — a wire was sent, an email account is acting weird, files are encrypted, or someone in your shop just told you they "did something they shouldn't have" — read the cover, then go to the section that matches your scenario and follow the steps.
Do not call a meeting. Do not write an all-hands email. Do not start a Slack thread. Open this page on your phone and follow the steps in order.
After the 60 minutes, you hand off to professionals. This page is the first hour only.
If you can do nothing else, call your bank's fraud line right now and tell them what happened. Every other step on this page can wait 5 minutes; that one cannot.
Tape this to the inside of a desk drawer. Update once a year.
┌─────────────────────────────────────────────────────────────┐
│ PRE-FILLED INCIDENT NUMBERS │
│ │
│ Our bank's fraud line: ___________________________ │
│ (NOT the number on a card. Look it up on the bank's │
│ real website, or call the branch and ask for fraud.) │
│ │
│ Cyber insurance carrier: ___________________________ │
│ Policy number: ___________________________ │
│ 24/7 incident hotline: ___________________________ │
│ │
│ Our IT person / MSP: ___________________________ │
│ │
│ Local FBI field office: ___________________________ │
│ (newark.fbi.gov for NJ shops; ic3.gov for online report) │
│ │
│ Lawyer (employment / contracts): __________________ │
│ │
└─────────────────────────────────────────────────────────────┘
Minute 0–5: Call the bank fraud line.
Tell them, in this order: "Wire fraud. Sending account is ____. Wire was sent at ____ to ____ for $____. We believe it was a phishing attack." Ask for an immediate SWIFT recall or ACH recall if it's domestic. The faster they hear it, the higher the recall odds.
Minute 5–10: Call the receiving bank's fraud line.
Find it on the receiving bank's real website. Tell them: "We are the senders of a wire received at your bank today, sent under fraud. The receiving account is ____." Some receiving banks will freeze the receiving account on a phone call.
Minute 10–20: Email the bank a written follow-up.
Subject: "Fraudulent wire — written confirmation per [agent name] phone call [time]." Body: same facts. This creates the paper trail.
Minute 20–30: File IC3 report at ic3.gov.
This is the FBI's online intake. It does not call the cops — it routes the report. Filing inside 24 hours dramatically helps. Save the report number; insurance and the bank will both ask for it.
Minute 30–45: Call cyber insurance.
Most policies require notification within 24–72 hours. Do it now. They will assign a carrier-approved incident-response firm. Use them; do not hire one yourself first.
Minute 45–60: Preserve everything.
The next 24 hours. The IR firm runs the investigation. Your job is to answer their questions and do not communicate with the attacker.
Minute 0–5: Reset that password. Whatever site it was. Use a different machine if you can.
Minute 5–10: Reset the email password too. And the password manager master password. The attacker's first move is usually email-account takeover for downstream attacks.
Minute 10–20: Sign out all sessions. Every major site (Google, Microsoft 365, Notion, QuickBooks) has a "sign out everywhere" button. Hit it.
Minute 20–30: Turn on MFA everywhere it isn't already on. Authenticator app preferred over SMS. SMS is better than nothing.
Minute 30–45: Check the inbox for forwarding rules. Attackers add rules that auto-forward incoming email (especially anything with "wire," "invoice," "payment") to themselves. In Gmail and Outlook both, check Settings → Filters / Rules. Delete anything you didn't create.
Minute 45–60: Tell your bank. Even if no money moved. They flag the account for the next 30 days, which is when downstream attacks usually fire.
The next 24 hours. Do a credit freeze if the phished site contained your SSN.
Minute 0–5: Disconnect that machine from the network. Pull the ethernet, turn off Wi-Fi. Do not power it off — that destroys forensic evidence in RAM.
Minute 5–10: Disconnect any external drive or USB stick. And any other machine that shares files with the affected one.
Minute 10–20: Stop using shared drives. If files on the network drive look weird, the encryption is in progress. Disconnect every workstation from the share.
Minute 20–30: Call cyber insurance. Their incident-response firm handles ransomware specifically — do not pay anything, do not contact the attackers, do not even open a chat window with them. The first contact is the attacker's leverage.
Minute 30–45: Call your IT/MSP. They isolate the affected machines, check backups, and start the recovery plan if backups are clean.
Minute 45–60: Document. Take photos of the ransom note (with your phone — do NOT screenshot from the affected machine). Write down what you saw and what you touched.
The next 24 hours. Do not pay the ransom. Pay only on the explicit advice of the IR firm, and only after they have evaluated the decryptor's reliability. Most ransom payments lead to follow-on attacks within 6 months.
Minute 0–5: Do not action the wire. No matter who the voice claims to be.
Minute 5–10: Call the person back at the number you already had. Not the number in the voicemail. Not a number they texted you. The one in your phone from before today.
Minute 10–20: If you can't reach them, hold the wire. No exceptions. The cost of holding for an hour is zero. The cost of sending a fraudulent wire is everything.
Minute 20–30: Email the person from your normal email. "Got a voicemail saying you need $X wired to Y today. Confirming this is real. Calling you back at [their normal cell]." If they didn't make the call, they'll respond within minutes.
Minute 30–45: Loop in one other authorized person. This rule should be in writing already — but if it isn't, this is the moment. Two-person authorization on any new wire over a threshold the shop sets together (we recommend $5k for shops under 25 employees).
Minute 45–60: Document the call. Voicemail audio file (download it from the phone system if possible). Caller ID. Time of call. The script the caller used. This is evidence whether or not money moved.
The next 24 hours. Update the wall poster. The attacker will try again next month with a slightly different pitch.
This pack covers the first 60 minutes. After that, you hand off:
Your job during the first 60 minutes was not to fix all of that. It was to make sure the people who can fix it got called. Now they're called.
When the dust settles, in the first week after, write one page:
Tape that page next to the wall poster. Add a date. That's how a small shop builds memory.
If this pack helped, two asks:
If your shop wants the live audit (we'll send a fake "Joe Mendez" to your real AP person, with consent), the cohort wants apprentices and journeymen at any level, or you want to support free seats for low-income trades, all of that lives at bluecollarlabs.org.
Stay paid. Stay open. Don't click the link.
— Blue Collar Labs · 501(c)(3) · EIN 42-1853577