Imagine one of your advertisers receiving an email from their sales rep asking them to use a new link to pay this month’s invoice. The name is right, the station logo is there, and the message sounds like someone they’ve worked with for years. Except your sales rep didn’t send it. By the time someone asks about the missing payment, the advertiser has already paid someone else. I’m hearing and reading more horror stories just like this.
After years in radio and building station websites, I can picture how easily that request could slip into a normal workday. We operate on relationships. Advertisers know their reps, listeners know their favorite personalities, and employees recognize the manager’s name in their inbox. That familiarity makes doing business easier. It also gives someone pretending to be us a head start.
The old advice about looking for bad spelling and awkward sentences isn’t enough anymore. The FBI has warned that criminals use AI to create believable messages and eliminate errors that once helped expose a scam. An email can be polished, friendly, and completely fraudulent. Apparently, even the scammers have hired a copy editor.
For a radio station, think about the different ways this could play out. A fake message from management could ask the office to pay an urgent expense. Someone pretending to be your website provider could demand payment to prevent an interruption. A copycat station account could tell a listener they won a contest and need to provide private or payment information to claim the prize. These are examples worth discussing with your staff because each one fits something people might already expect to hear from a station or its partners.
I would start with the people who handle money. Any unexpected request to change payment instructions should trigger a separate conversation using a phone number you already have. Replying to the questionable email just keeps you talking to whoever sent it. The FBI specifically recommends verifying payment requests and changes to account information through a separate, trusted contact method. That needs to apply even when the message appears to come from the owner. Especially when it appears to come from the owner and says it has to happen immediately.
Give advertisers a clear explanation of how your station sends invoices and accepts payments, too. I’d put that information in the onboarding process and make sure every rep explains it consistently. If someone receives a request that falls outside that process, they should know whom to call. A station loses that advantage when every salesperson has a different arrangement, and the business office has to figure out what happened afterward.
There is also some work for whoever manages your email. Ask them to review SPF, DKIM, and DMARC, the settings that help receiving mail systems verify messages using your domain. You don’t need to become an expert in the alphabet soup, but you should know whether those protections are configured properly within your domain settings. They help reduce domain spoofing; they don’t prevent someone from registering a similar address or putting your general manager’s name on an unrelated account.
I would also make station-owned email addresses required for all business communication. Your advertisers shouldn’t have to remember which employees use the station domain, and which use their personal Gmail account. That consistency gives them something useful to check, although a familiar address alone still isn’t proof that a request is legitimate. Enable multifactor authentication on your email accounts as well. Protecting access to the real account matters just as much as watching for an imitation.
Your website can help listeners verify what they’re seeing. Contest pages should explain how winners are contacted and how to check a questionable message from the station. Keep contact information easy to find. If someone starts impersonating your station, publish a specific warning and share it through your own channels. Explain what the fraudulent message asks people to do rather than posting a vague “watch out for scams” notice. The FTC recommends notifying customers promptly when a business discovers it is being impersonated.
At your next staff meeting, put a hypothetical email on the screen: the owner needs an urgent payment, a vendor has changed banking information, or an advertiser wants an account detail updated. Ask everyone what they would do next. If the answers vary, you’ve found something to fix. Make it clear that taking a minute to verify a request is part of the job, and that nobody gets in trouble for calling the boss to ask, “Did you actually send this?”
Pic generated by ChatGPT.
Jim Sherwood is a radio veteran turned digital strategist dedicated to helping radio stations thrive online through engaging websites and mobile apps. As the founder of Skyrocket Radio and host of the Better Radio Websites podcast, he shares best practices to help stations grow audiences and revenue in the digital space. With decades of experience in radio and a passion for connecting content with listeners, Jim ensures that every station—no matter its size—can make a lasting impact online.