Summer event scams: How fake vendor invites target small businesses

Summer is a busy season for small businesses. From farmers' markets to food festivals, fairs, and other community celebrations, they all offer valuable opportunities to meet new customers and boost sales.

In recent months, event organizers on both sides of the Atlantic have warned businesses that fraudsters are impersonating festival and market representatives to steal money from vendors.

Key takeaways

• Scammers increasingly impersonate festivals, fairs, and trade shows to target small businesses.
• Fraudsters often contact vendors through Facebook comments, Messenger, email, or fake event pages.
• Some scams seek to steal money, while others aim to compromise business accounts or infect devices with malware.
• Verifying vendor invitations before paying or downloading files can prevent costly mistakes.
• Layered cybersecurity helps protect businesses even if an employee encounters a convincing scam.

How the scam works

Imagine you've been looking for local events where you can showcase your products and you stumble upon a popular summer festival on Facebook. You leave a comment that says you’re interested in becoming a vendor and receive a reply within minutes.  

A self-described “event organizer” tells you only a few vendor spaces remain and invites you to continue the conversation through Messenger or email. They provide an application form and ask for payment to reserve your booth.

Everything looks legitimate, and you’re excited about the opportunity. They use the festival's logo, photos from previous years, and professional language. They may even answer questions about the event.

But after you send payment, the person disappears.

Unfortunately, this scenario is increasingly common. In Nevada, for example, organizers of the Fallon Cantaloupe Festival alerted businesses about fake Facebook posts offering vendor spaces and requesting payment through unofficial channels. Meanwhile, the BBC reported on a growing trend of scammers targeting vendors directly through Facebook event pages, posing as organizers and tricking businesses into paying for non-existent stalls.

For busy business owners eager to secure a spot before events sell out, these scams can be highly convincing. In some cases, the damage goes beyond the loss of a vendor fee. A fake invitation can also expose your business to phishing attacks, credential theft, malware, or even ransomware.

Who is the potential target?

Small restaurants, artists, retailers, and other service providers make attractive targets for fraudsters. And what makes these scams particularly dangerous is that most of these small businesses receiving an invitation during this period seem perfectly normal. To increase the pressure, fraudsters often claim that vendor spaces are almost gone or that payment must be made immediately to avoid losing the opportunity.

If a business posts "Interested!" or asks how to become a vendor, scammers may quickly respond, posing as the organizer.

Some invite businesses into private Messenger conversations. Others direct victims to fake application websites or request payments through Zelle, Venmo, Cash App, bank transfers, or cryptocurrency.

Because these conversations happen beneath legitimate event announcements, many businesses naturally assume they're speaking with the real organizers.

Making matters worse, some of these scams don’t just focus on collecting registration payments.

A fake vendor application may ask you to create an account using your Microsoft 365 or Google Workspace credentials, allowing attackers to steal business logins, while attachments may secretly install malware when opened.

Once attackers gain access to a business device or email account, they may attempt to steal sensitive information, collect customer data, access financial information or even deploy ransomware.

For many small businesses, recovering from a cyberattack can be significantly more expensive than replacing the original vendor fee.

You may also want to read:

• How to check if your business is being impersonated
• Is it a business opportunity or a scam? How to protect your business data
• What to do if you clicked a phishing link in a business email

Warning signs every small business should be aware of

Before responding to any vendor invitation, look for warning signs, such as:

• You're asked to pay using peer-to-peer payment apps such as Zelle, Venmo, Cash App or cryptocurrency
• The sender uses a free email address instead of an official business domain
• The message creates urgency by claiming only a few vendor spaces remain
• The registration link doesn't match the organizer's official website
• You're asked to continue the conversation through a personal Messenger account
• The event page has very few followers or appears to have been created recently
• Unexpected attachments ask you to download files or enable macros

Any one of these warning signs is enough to slow down and independently verify the invitation. If you encounter a fake vendor invitation, let the event organizers know. Many festivals and trade shows issue public warnings once they're aware of impersonation attempts, helping prevent other small businesses from becoming victims. Reporting the scam to both social media platforms and the relevant authorities can also help disrupt the scam.

How to verify a vendor invitation

Before sending payment or sharing business information:

• Visit the organizer's official website instead of clicking links in messages
• Search for any scam alerts online: Check social media platforms or your local vendor groups for scam warnings
• Contact organizers using the phone number or email address published on their website
• Confirm that vendor applications are accepted through official channels
• Compare social media accounts with those linked from the event's website
• Search for previous editions of the event and independent reviews
• Double-check any invoice before making payment
• Ask another employee to review unexpected requests before acting

If someone contacts you through Facebook or Messenger, don't assume they're affiliated with the event simply because they commented on the official page.

What to do if you’ve fallen for a vendor invite scam

If you realize you've responded to a fake vendor invitation, acting quickly can help limit the damage.

If you sent money:

• Contact your bank or payment provider immediately to report the fraudulent transaction. While some payment methods offer limited recovery options, reporting the scam quickly improves your chances.
• If you paid through a peer-to-peer payment app, report the transaction through the platform and keep copies of all communications with the scammer.
• Report the scam to local law enforcement or your country's consumer protection agency. If the scam involved an online platform such as Facebook, report the fake profile or page so it can be investigated and removed.

If you shared business login credentials:

• Change the affected passwords immediately
• Update any other accounts that use the same password
• Enable multi-factor authentication (MFA) if it isn't already enabled
• Review account activity for unfamiliar logins or changes to account settings

If you downloaded an attachment or clicked a suspicious link:

• Disconnect the affected device from the internet if you suspect malware has been installed
• Run a full security scan using a trusted cybersecurity solution
• Alert employees if the compromised account may have been used to send phishing emails internally or to customers
• Monitor business accounts, banking activity, and customer communications for signs of unauthorized access

Protect your business during event season

Employee awareness is one of your strongest defenses, but technology plays an equally important role.

Businesses should keep devices updated, enable multi-factor authentication for business accounts, regularly back up important files, and train employees to recognize phishing attempts and social engineering tactics.

A layered security solution such as Bitdefender Ultimate Small Business Security helps reduce the risk of a fake vendor invitation turning into a much more serious cybersecurity incident. It helps detect phishing attempts, blocks malicious websites, identifies suspicious downloads, protects your devices against malware and ransomware, and helps safeguard business credentials if attackers attempt to compromise employee devices.

Whether the scam begins with a fake Facebook message or a convincing email, multiple layers of protection can help stop an attack before it disrupts your business.

FAQS

How do you know if a vendor is scamming you?

Scammers often impersonate legitimate event organizers, suppliers, or vendors to trick businesses into sending money or sharing sensitive information. Watch for these common warning signs:

• The vendor asks for payment through unofficial methods such as peer-to-peer payment apps, wire transfers, or cryptocurrency
• They pressure you to act quickly by claiming only a few spaces remain
• The email comes from a free or misspelled domain rather than an official company website
• They refuse to communicate through official channels or avoid answering questions
• Their website or social media page appears new, contains little information, or has few followers
• They ask you to click unfamiliar links, download unexpected attachments, or provide business login credentials

If you're unsure, contact the event organizer using the phone number or email address listed on its official website. Never rely solely on contact information provided in an unsolicited message.

What are the most common frauds targeting small businesses?

Small businesses are frequent targets because they often have limited staff and fewer cybersecurity resources. Some of the most common scams include:

• Fake vendor or event invitation scams, where criminals impersonate festival organizers or trade show coordinators
• Business email compromise (BEC), where attackers pose as executives, suppliers, or clients to request fraudulent payments
• Invoice scams, in which fake or altered invoices trick businesses into paying the wrong account
• Phishing attacks, designed to steal employee passwords or install malware
• Tech support scams, where criminals pretend to be software or IT providers and request remote access to business devices
• Ransomware attacks, which encrypt business files and demand payment to restore access

Many of these scams begin with social engineering, where attackers manipulate employees into trusting a fraudulent email, message, or phone call.

How do fraudsters target people online?

Cybercriminals use a combination of technology and psychology to make their scams look legitimate. They often research businesses and employees via company websites, LinkedIn, Facebook, Instagram, and other social media platforms.

Common tactics include:

• Sending phishing emails that imitate trusted organizations
• Creating fake websites or login pages that closely resemble legitimate ones
• Impersonating event organizers or suppliers on social media
• Monitoring public posts and comments to identify businesses looking for vendor opportunities
• Using fake advertisements or sponsored posts to lure victims to malicious websites
• Creating a sense of urgency, such as "limited vendor spots" or "payment due today," to pressure victims into acting without verifying the request

The best defense is to verify unexpected requests through trusted channels, train employees to recognize social engineering tactics, and use layered security that can help block phishing attempts, malicious websites, and malware before they compromise your business.