OnPoint Community Credit Union Helps Small Businesses In Oregon And SW Washington Defend Against The Latest Cyber Scams (Photo) - 10/15/26
AI-assisted impersonation, sophisticated payment fraud and new forms of phishing are raising the stakes for small businesses
PORTLAND, Ore. — Cyber threats are becoming harder for small businesses to detect as criminals use artificial intelligence, stolen credentials, and increasingly sophisticated impersonation tactics. Half of small and midsize businesses reported a cybersecurity incident in the past year, according to the National Cybersecurity Alliance’s 2026 Small Business Cybersecurity Awareness & Practices Survey.
OnPoint Community Credit Union is highlighting emerging cyber scams during Cybersecurity Awareness Month and sharing practical steps small businesses can take to protect their money, data, and operations.
“Automation and AI help cybercriminals make scams faster, more convincing and harder to recognize,” said Emma Stocker, director of information security, OnPoint Community Credit Union. “Small businesses can reduce their risk by verifying financial transactions, restricting access to critical accounts and making cybersecurity part of everyday operations.”
The cyber threats businesses should know
Cybercriminals are using new tools and tactics to make scams more convincing and harder to detect. Here are four threats OnPoint advises small business owners to watch for:
- AI-powered executive and vendor impersonation. AI is making scams more polished and convincing, including fake emails, invoices and message threads. In August 2026, Microsoft detected more than one million fraudulent emails over three days, many designed to trick accounts payable teams into authorizing fraudulent ACH payments.
- Business email compromise and payment redirection. Criminals may impersonate or compromise an executive, employee, or vendor to request payments or changes to payment instructions. The FBI reported that companies lost more than $3 billion in 2025 via email scams, a 10% increase from the previous year.
- Phishing that bypasses traditional defenses. Attackers use QR codes, malicious authorization prompts, and collaboration tools to get around security controls. Microsoft found that malicious Teams-based voice-phishing attempts increased about 80% during the first half of 2026.
- Ransomware fueled by stolen passwords and outdated systems. Many ransomware attacks happen when criminals get hold of stolen login information or take advantage of software that hasn’t been updated. Verizon found stolen credentials were involved in 38% of ransomware cases and unpatched vulnerabilities in 29%.
Protect your business against today’s scams
While cyber scams are becoming more sophisticated, OnPoint recommends seven safeguards that can help small businesses reduce their risk:
- Verify before moving money. Never authorize a wire, ACH payment, purchase, or change in vendor banking information based solely on an email, text, phone call, or video meeting. Confirm the request using a known contact or consider requiring a second person to approve high-risk transactions.
- Be cautious with login prompts and app permissions. Avoid clicking on links in unsolicited account notifications. Employees should also pause before letting a new app access email, files, or other company information.
- Use stronger forms of multifactor authentication. Multifactor Authentication (MFA) remains an essential defense, but not all methods offer the same protection. The National Coordinator for Critical Infrastructure Security and Resilience (CISA) recommends businesses use phishing-resistant MFA wherever possible, particularly for email, remote-access, and administrative accounts.
- Keep software and devices updated. Promptly install security updates, particularly for internet-facing devices such as routers, firewalls, and VPNs, to avoid leaving vulnerabilities that help attackers gain initial access.
- Protect credentials and limit access. Use unique passwords or passphrases, a reputable password manager and MFA. Employees should have access only to the systems and information necessary for their roles.
- Back up critical business data. Maintain secure backups, including a copy isolated from the company’s primary network, and periodically test that data can be restored.
- Train employees regularly. Cyber threats evolve quickly, so cybersecurity training should be refreshed on a regular basis. It should cover suspicious emails, fraudulent texts and calls, QR codes, fake cloud-sharing invitations, executive impersonation and unusual requests for payments or account access.
Cybersecurity is not only an IT issue — it is a key part of protecting a company’s finances, customers and ability to operate. OnPoint will never initiate a request for sensitive information such as passwords, secure access codes, verification codes, PINs or card security codes by phone, email or text.
###
About OnPoint Community Credit Union
OnPoint Community Credit Union is the largest credit union headquartered in Oregon, serving more than 671,000 members throughout Oregon and southwest Washington. Founded in 1932, OnPoint Community Credit Union’s membership is available to anyone who lives or works in one of 33 Oregon counties (Baker, Benton, Clackamas, Clatsop, Columbia, Coos, Crook, Curry, Deschutes, Douglas, Gilliam, Hood River, Jackson, Jefferson, Josephine, Klamath, Lane, Lincoln, Linn, Malheur, Marion, Morrow, Multnomah, Polk, Sherman, Tillamook, Umatilla, Union, Wallowa, Wasco, Washington, Wheeler and Yamhill) and who lives, works, worships, or attends school in one of four Washington counties (Clark, Cowlitz, Lewis, and Skamania), and their immediate family members. More information is available at onpointcu.com.
Federally insured by NCUA. Equal Housing Opportunity.
