Anatomy of the scam
A small business receives an invoice for a directory listing — Yellow Pages, Google Business, an industry-specific registry. The invoice looks official. The amount is moderate ($200-$800). If the business pays without questioning, they've paid for nothing. The "listing" either doesn't exist or exists on a site no one visits.
The pitch exploits administrative inertia — bookkeeping departments and small-business owners process invoices without verifying every one. Particularly successful against businesses that have used a similar real directory in the past.
Red flags
- Invoice for a listing you don't remember signing up for.
- Company name closely mirrors a real directory (e.g., "Yellow Pages Online" vs. real "Yellow Pages").
- Payment is due in days.
- The invoice arrives by physical mail or unsolicited email.
- The sender's company is unfamiliar to your industry's network.
- The "directory" website has very little traffic or content.
- No clear value proposition explained in the invoice — just "renewal."
How to verify safely
- Check your records — do you have any history with this vendor?
- Look up the company in BBB, Trustpilot, and FTC complaint databases.
- Search the company name + "scam."
- Verify any real directory listings by going to their official site directly.
- Centralize vendor approvals so every new invoice goes through a verifier before payment.
If you already paid
- Dispute the charge with your card issuer.
- Cancel any autopay for this vendor.
- Report to the FTC and your state attorney general.
- Warn your peer network — the same vendor likely targets others in your industry.
What not to do
- Do not pay invoices for vendors you can't trace to a real prior agreement.
- Do not sign autopay enrollment based on a sales call from a "directory."
- Do not assume "everyone in our industry uses them" is true without verification.
- Do not let urgency override verification.
Where to report
- FTC: reportfraud.ftc.gov — the broadest US fraud intake; reports flow to thousands of law-enforcement agencies.
- FBI IC3: ic3.gov — the right destination when the scam is internet-enabled (phishing, BEC, romance, crypto).
- CFPB: consumerfinance.gov/complaint — for complaints about banks, money transmitters, payment apps, credit cards, debt collection.
- IdentityTheft.gov — if any identity information (SSN, driver's license, account credentials) was shared.
- Your bank or payment platform. Call the number on the back of your card or use the app's in-product help. Time matters — wires can sometimes be recalled within hours; ACH and Zelle are harder but worth trying.