By Jorge Mercado Monday, October 12th, 2026

The role of data ownership

The ever-evolving threat landscape requires organizations of all sizes to be prepared for a variety of disaster events, from physical disasters like fires and floods to virtual disasters like ransomware or business email compromise. Every organization should have a response plan for potential disaster events, physical or virtual in nature, train their staff on those plans, and test their plans often. For both businesses and individuals, prevention begins with awareness and vigilance. As such, we invited Montecito Bank & Trust to share insights about online scams and help you protect your organization’s assets.

— Jorge Mercado

Closing Your Business’s Backdoor to Cybercriminals

Local small businesses are the lifeblood of our community, employing family, friends, and neighbors and providing vital services for our community.  While many of these businesses take steps to protect their physical locations, locking doors and installing security cameras, many are leaving a digital backdoor unlocked, making themselves prime targets for cybercriminals.  While ransomware attacks and data breaches at large companies make the headlines, these same attacks are being conducted against local businesses, oftentimes with more devastating effects. According to Verizon’s 2025 Data Breach Investigations Report, 43% of all cyberattacks target small businesses (under 1,000 employees). Larger businesses are usually more resilient to these attacks, able to recover and continue operations, while smaller businesses can be pushed to the brink of closing due to an attack that results in large financial loss, key data being stolen or held hostage, or experiencing an extended outage of needed computer systems.  

There are many types and methods of attack. Two of the more common attacks currently happening locally are Business Email Compromise and Imposter scams. 

• 33% of Business Email Compromise (BEC) attacks target small businesses, costing an average of $50,000 per attack. BEC attacks come in a few varieties, but all involve either a compromised email account at your business or one of your vendors, or the creation of a look-alike email account. For example, a lower-case letter “l” in an email account may be changed to the number 1. Once they have access to the email account or have created the look-alike email account, the criminals email requests for wires or ACH to be sent. This may be in the form of an existing or new vendor invoice with new receiving account information or an email from the company’s owner asking a bookkeeper to send money to a new recipient. The request may be brief and imply urgency.
• Imposter scams prey on our natural instinct to trust known companies and our desire to act quickly and efficiently. These scams usually involve a phone call, text message, or email from a company familiar to you, for example, your bank, a utility company, or an online merchant. The criminal’s ultimate goal is to exploit the trust you have in a known contact to induce you into sending them money or handing over sensitive information, such as your online banking username and password or your debit/credit card number and PIN. This scam is acutely high in our communities at this time.

Learning to fight back against scammers

The good news is these attacks can be prevented with some easy steps:

• If you receive an email or text message request to send funds somewhere or alter payment instructions for an existing payee, verify the request outside of email. Call a known phone number for the vendor or co-worker who sent the request to you.
• Don’t trust caller ID. It is extremely easy for criminals to make it appear they are calling from a business (aka spoofing). If you weren’t expecting the call, let it go to voicemail, and if you do call the business back, use a number you have on file for them, not a number left in the voicemail.
• Educate your employees about these scams and to be sceptical of any requests for money to be sent or payment instructions to be changed.
• Implement Multi-Factor Authentication (MFA) and use dual approvals for wire and ACH transactions if allowed by your bank’s online banking system.
• Set up a Positive Pay service that can validate payee information and flag suspicious payments for your review and approval. Montecito Bank & Trust offers this service to business clients. Ask your banker for information.

Although data breaches and other scams can involve complex technology and skilled hackers, the most common element involved when confidential information is compromised is a human element. That’s why, even as cybersecurity threats and fraud continue to rise and accelerate, education and awareness remain the most powerful tools.  People are key to safeguarding information. 

When a natural disaster strikes, you can nearly guarantee attacks on individuals and businesses will pick up, often from fake nonprofits and people posing as government or disaster response organizations. They’ll use similar tactics — urgency, empathy — so your preventative tools are the same, always verify by calling the organization directly or going to the website directly and not clicking on links or giving your information out! 

Montecito Bank & Trust is committed to empowering our community, providing workshops to increase awareness and sharing resources to help manage increased threats. Visit Montecito.bank for information.