Business Directory Listing Scam Calls: A Small Team Policy

Executive Summary

This report explains how a small U.S. team whose main number rings several staff mobiles should handle "just confirming your listing" calls, fake-invoice calls and other unsolicited vendor, billing and listing calls. It is U.S.-focused, drawing mainly on the FTC, the FCC and state attorneys general, with a short Canadian pointer from two Canadian federal bodies. It is not legal advice.

The documented pattern is consistent. The FTC's July 2023 small-business guide says scammers may offer a "free" listing or say a call is simply to "confirm" information, and that they may later use details, or even a recording, of that call to pressure the business to pay ^[1]. A May 14, 2026 FTC alert shows the regulator still warns about fake invoices for services never ordered ^[2]. The FTC's older 2014 brochure, which is historical, tells owners to train "everyone who may pick up the phone" ^[3]. For a ring-group team that is the whole team: whoever answers speaks for the business. Caller ID does not help, because the FCC defines spoofing as deliberately falsifying what the caller ID display shows ^[4], and its October 2025 notice says call-authentication data does not give "robust information about who is calling" ^[5].

The recommended policy has five parts. First, a one-sentence script that confirms nothing and asks for the request in writing. Second, a "who may say yes" rule naming one approver. Third, a menu option or mailbox that routes billing, vendor, advertising and listing calls to that person, chosen from a three-way comparison in Table 2. Fourth, a log of unsolicited calls. Fifth, a short procedure for a bogus invoice: do not pay on its strength, reconcile it against purchase orders ^[6], keep the exchange in writing, and report to the FTC and the state attorney general. Canadian guidance gives the same instruction that staff who did not start an unsolicited call should not "provide or confirm any information" ^[7].

Three cautions apply. No verified frequency or loss statistic was found, so none is given; the only hard numbers describe the environment, such as 36,207,130 U.S. small businesses, of which 82.3 percent have no employees ^[8]. Recording rules vary, with about 11 states primarily requiring all-party consent ^[9]. And a phone menu cannot authenticate a caller; it only decides who hears the pitch first. The phone-system comparison covers four third-party providers; the publisher's own service is disclosed separately and left out of the table.

Introduction and Background

This report is written for owners and office managers of businesses with roughly 2 to 20 people whose main number rings several team members' own mobile phones. It is U.S.-focused: the guidance comes mainly from the Federal Trade Commission (FTC), the Federal Communications Commission (FCC) and U.S. state attorney general offices. A short Canadian pointer appears later, based only on Canadian federal sources that were read for this report. Nothing here is legal advice; where a dispute or a recording question turns on state law, the reader is pointed to a lawyer or a state attorney general's office.

The subject is narrow: the unsolicited call in which someone asks a staff member to "confirm" or "verify" listing details, an order, an address or an invoice. The FTC's small-business guide describes the directory version this way: scammers "try to fool you into paying for nonexistent advertising or a listing in a phony business directory" ^[1]. The harm comes less from the call than from what the caller does with a spoken "yes" afterwards.

Three terms recur. A directory listing scam is the pattern just described. A ring group is a phone setup in which one number rings several people, at once or in sequence. An auto attendant is the recorded menu ("press 1 for service") that sends each caller to a chosen person or mailbox. The decision this report supports has three parts: who may speak for the business on unsolicited vendor, billing and listing calls; what staff say; and whether those calls get their own menu route or mailbox so they never reach someone who cannot safely refuse.

One limit on the evidence belongs up front. No verified statistic on how often these calls reach small businesses was found, and no loss total is quoted. The report describes a documented pattern and regulator recommendations, not a measured trend. The main dated sources are the FTC's July 2023 small-business guide and a May 14, 2026 FTC consumer alert about fake invoices for services never ordered ^[2].

The Pattern the FTC Describes

The FTC's 2023 guide places the directory pattern under "Online Listing and Advertising Scams." The caller may ask for contact information for a "free" listing, or say the call is simply to "confirm" the information ^[1]. A large bill follows later, and the scammer may use details, or even a recording, of the earlier call to pressure the business to pay ^[1].

The FTC's older 2014 brochure is historical and should be read as such. It says there may be no listing at all, and that callers "bulldoze the employee into" saying yes ^[3]. It adds that if the company later says it never agreed, the fraudsters "may play back a tape of the call (which might have been doctored) as 'proof'" ^[3]. The 2023 wording is more careful, saying a recording may be used, and this report does not treat recordings as always altered.

A realistic sequence (a composite, not a statistic)

This sequence is assembled from the FTC's descriptions to illustrate the pattern. It is not drawn from any particular business.

1. The call. Someone phones the main number, which rings a staff mobile, and says they are "just confirming" the business's listing details.
2. The "yes." The employee, trying to be helpful, says "yes, that's right" to a name, address or phone number.
3. The invoice. A bill arrives for a listing nobody ordered. The invoice is aimed at whoever pays the bills, in the hope that they will simply pay it.
4. The pressure. Collection-style calls and letters follow, sometimes citing the first call.
5. The playback. If the business objects, the sender may point to details or a recording of the call as evidence of agreement.

Related variants

The same guide describes a sibling pattern for goods: a caller who wants to "confirm" an existing order or "verify" an address, followed by unordered merchandise and pressure to pay ^[1]. The May 2026 alert lists bogus billed services such as tech support, domain registration and search engine optimization. State sources add wrinkles. Washington's attorney general described a call asking whether the business would like to renew a free listing when nothing exists to renew ^[10], and Florida's attorney general's office noted that many of the directories behind such invoices are never published ^[11].

Mailed versions exist as well. Under 39 U.S.C. 3001, a solicitation that resembles a bill is nonmailable unless it carries a conspicuous notice, whose statutory text includes "You are under no obligation to make any payments on account of this offer unless you accept this offer" ^[12]. South Dakota's attorney general warns that returning such a form may commit the business to a future bill ^[13].

Why a Ring-Group Team Is Exposed

When several mobiles ring from one number, whoever answers is "the business" to the caller. Three consequences follow, which are analytical inferences from the sources rather than measured findings.

• Nobody is designated. The 2014 brochure tells owners to talk to "everyone who may pick up the phone," in addition to the regular receptionist ^[3]. On a ring-group team that means everyone, including people who have never heard of the pattern.
• The nearest person is the target. An FTC business blog post on a related office-supply scam warns of callers who say they have an "urgent" need to speak to someone in the maintenance department, and tells owners that "your best defense is a trained staff" ^[14]. On a mobile team the equivalent is a technician answering from a job site.
• The pitch arrives without context. A call on a personal phone has no desk, no vendor list and no coworker nearby, so the FTC's advice to "talk with their coworkers if they suspect a scam" ^[1] is harder to follow.

The FTC has direct advice for multi-person phone answering: post a warning nearby, and designate one person to respond to inquiries about "free" offers or "existing" orders ^[14]. A mobile team has no common desk, so the practical equivalent is a staff card and a routing rule.

Caller ID does not settle it

The FTC guide says "since scammers often fake their phone numbers, don't trust caller ID" ^[1]. The FCC describes "neighbor spoofing," in which the caller displays a number similar to the recipient's own ^[15], so a local-looking number is no evidence of a local caller. Call authentication does not close the gap: the FCC explains that originating carriers can have a call's caller ID "signed" as legitimate ^[16], but its October 2025 rulemaking notice says that information does not provide "robust information about who is calling" ^[5]. The policy therefore has to rest on what staff say, not on what the screen shows.

Who is likely to be reading this

The SBA Office of Advocacy's February 2026 FAQ, using 2022 Census data, counts 36,207,130 U.S. small businesses ^[8]. Of those, 82.3 percent, or 29,811,495 firms, have no employees ^[8]. By subtraction about 17.7 percent have paid employees, the only group whose staff mobiles can ring. No source found measures how many use a ring group.

The Phone-Handling Policy: Script, Authority and Log

The recommendations in the sources translate into three working parts for a ring-group team: a sentence anyone can say, a rule about who may say yes, and a record of what was asked. The 2014 FTC brochure advises designating "a small group of employees with authority to approve purchases and pay the bills" and training employees to send all inquiries to that group ^[3].

One sentence anyone can say

The script below is a drafting suggestion built on those recommendations. It is short enough to say under pressure and does not argue, apologise or explain.

"Thanks for calling. We don't confirm or change business details over the phone. Please send it in writing to [vendor mailbox address], and the person who handles vendors will look at it."

The sentence does not depend on the caller's identity. It gives the same answer to a legitimate vendor and to a pitch, and a legitimate vendor loses nothing by writing. It also matches the FTC's advice for an unfamiliar vendor that presses for payment: deal with them "by email or letter" rather than by phone until the matter is cleared up ^[17].

The staff card

• Say the script, then end the call politely if the caller keeps going. No reason needs to be given.
• Never say "yes," "correct," "that's right" or "go ahead" to a question that begins "I'm just confirming" or "I just need to verify."
• Never read back the address, email, account numbers, the owner's name, who approves purchases, or what software or services the business uses. The Canadian Anti-Fraud Centre advises that staff who did not start an unsolicited call "shouldn't provide or confirm any information" ^[7].
• Never discuss price, a "free" offer, a "renewal" or an "existing" order. Those are the words the FTC associates with the pattern.
• Never trust the screen. A displayed name or number is not an identity ^[4].
• Afterwards, record the call in the log (Table 1) and tell a coworker. The card should say that telling a coworker is normal, not embarrassing.

The "who may say yes" rule

A template rule for the staff handbook:

• Only [named approver or role] may confirm, accept, renew or agree to any listing, advertising, directory, domain, software, supply or service by phone, and only after checking a written order.
• Everyone else uses the script and forwards the request in writing to [vendor mailbox].
• A phone "yes" never counts as an order. Orders are accepted in writing from vendors on the approved list.
• The approver keeps the list of vendors the business actually uses. The Canadian Anti-Fraud Centre recommends compiling such a list "to help employees know which contacts are real and which aren't" ^[7].

State attorneys general make the same point from the invoice side. Minnesota advises having "certain people in charge of ordering supplies" (Source: www.ag.state.mn.us), North Dakota advises confirming that "there is a corresponding authorization for the invoiced item or service" before paying ^[18], and the Competition Bureau of Canada says to "clearly define procedures for verification, payment and management of accounts and invoices" ^[19].

How this fits the callback policy

A separate risk is the request that asks the business to act on a sensitive change, such as new bank details. The publisher's verified-callback article covers it, and the logic is shared: never use the contact details the caller supplies. The FBI advises verifying payment changes "in person or via a known telephone number" ^[20], and a federal NIST guide says staff who get an unsolicited call purporting to be from a known company should "not use any phone number provided by the person who called you" ^[21]. The directory pattern is the inbound mirror image: the caller wants a yes, and the policy is to give none.

Training and escalation

The Cybersecurity and Infrastructure Security Agency (CISA) says "once-a-year training isn't enough" ^[22], and a NIST small-business guide recommends training when employees are hired and at least annually ^[21]. A five-minute staff meeting and a printed card are enough to start.

The unsolicited-call log

Table 1 below is a template for the log. It is short enough to complete in under a minute from a phone, in a shared spreadsheet or a message thread.

Table 1 summarizes the fields. The most important is "what was said": if a staff member did confirm something, the entry is the first piece of the record the approver will want if an invoice arrives. The Competition Bureau of Canada's reporting guidance gives similar advice: write down the caller's name, what they wanted and when, and the number used if they phoned ^[23].

Routing Vendor, Billing and Listing Calls

The structural question is whether unsolicited vendor, billing, advertising and listing calls should reach a person at all. A menu can reduce the odds that such a call lands on a random mobile, but it cannot authenticate anyone: a caller can press any key. What a menu does is decide which person or mailbox hears the pitch first.

Table 2 below sets out three designs and their trade-offs. The trade-offs are analytical judgments, and no benchmark comparing the designs was found.

Table 2 shows a gradient, not a single answer. Option (b) suits a team where one person already handles purchasing; option (c) suits a team where that person is often unavailable or the business prefers a written trail. A hybrid is common: the option rings the approver, then falls back to the mailbox. The rest of the menu can stay as it is, and the greeting should promise nothing to unsolicited callers.

What phone systems document

Table 3 below compares what several providers' own help pages say about menus, routing and voicemail, as read in November 2026. It is a descriptive comparison of what each provider states, not a ranking, and it does not compare plans like for like.

Table 3 shows how different the commercial structures are. Several providers price per user or limit menus to higher plans, so adding a routing destination for billing calls can change the bill. Plan details were not compared like for like, so check each provider's current plan page before choosing.

Disclosure: the publisher of this article operates a separate service, autoattendant.io, that routes calls from one number to team members' own mobiles. It is left out of Table 3 because the only source for its details is the publisher's own site. Whatever system is used, a menu only routes calls: nobody picks up on the customer's behalf, so every routed call still reaches a person who must apply the script.

Design notes for the menu

• Name the option by function. "Billing, vendors, advertising or listings" attracts the callers the policy is meant for, and genuine vendors recognise it.
• Keep one named destination: one approver, one backup, then voicemail.
• Make the mailbox address real, and have the approver monitor it.
• Consider carrier tools for volume. The FCC says phone companies "may proactively block calls connected to suspicious calling patterns" ^[34], but it also notes a number labeled "potential scam" or "spam" may have been spoofed ^[4].

The Do Not Call Registry is not a tool for this: the FTC states that "business phone numbers and fax lines are not covered" ^[35]. In March 2024 the FTC announced a final rule extending the Telemarketing Sales Rule's ban on deceptive practices to business-to-business calls ^[36]. The rule was published in the Federal Register on April 16, 2024 (89 FR 26760) and took effect May 16, 2024 ^[37]. This is not legal advice, and the rule does not remove the need for the policy above.

After a Bogus Invoice Arrives

The steps below come from FTC, state and postal guidance. They are practical steps, not legal conclusions. A business facing collection pressure, a threatened credit report, or a claim that a signed agreement exists should consult a lawyer or its state attorney general's consumer protection office.

1. Do not pay on the strength of the invoice. Minnesota's attorney general advises not paying "for goods or services until you know for" certain they were ordered or received (Source: www.ag.state.mn.us), and the U.S. Postal Inspection Service advises "withholding payment until all information is verified" ^[6].
2. Check it against the order record. The Postal Inspection Service recommends reconciling invoices "against your original purchase orders" ^[6].
3. Research the sender. Search the company's name online with terms like "review," "scam" or "complaint." Canada's Competition Bureau notes that paying only invoices carrying your own purchase order number helps stop billing scams ^[38].
4. Move the exchange to writing. Do not call the number on the invoice. Reply in writing, ask for the signed order or the recording the sender says it holds, and keep a copy. The request is a question, not an accusation.
5. Document dates and the log. Pull the call-log entries, invoice dates and the names of staff who took calls. The Canadian Anti-Fraud Centre warns the sender "may record the initial conversation and use that against you" ^[39], which is a reason to know what staff said.
6. Check mailed papers for the solicitation notice. South Dakota's attorney general says that if the document is a solicitation, "the consumer has no obligation to pay the invoice amount" ^[13].
7. If merchandise arrived unordered, the FTC says you are "legally entitled to keep it as a free gift" ^[40].
8. Report it. The FTC guide says to report at ReportFraud.ftc.gov and alert the state attorney general ^[1]. You can report "even if you didn't lose money" ^[41]. The FTC "can't resolve your individual report" but uses reports to investigate and bring cases ^[42].
9. Contact the state attorney general for the dispute. The National Association of Attorneys General (NAAG) does not assist with individual complaints ^[43], but each state has a consumer protection division that reviews complaints and gives guidance ^[43].
10. Brief the staff, without blame, and update the vendor list.

Recording, Consent and Canada

Some teams record calls, and some phone services include recording. A recording of a staff member's side of an unsolicited call can help show what was said, but a business that records must follow the consent rules for the call. This report does not address whether a recording can be used in any dispute; that is a question for a lawyer.

What the sources say about consent

Federal wiretap law, 18 U.S.C. 2511(2)(d), exempts a private person who is a party to a communication, or has a party's prior consent, from the interception prohibition ^[44]. The Reporters Committee for Freedom of the Press summarises this as federal law requiring "the consent of at least one party" ^[9] and calls it the national minimum, which states may make stricter ^[9]. Its guide says about 11 states primarily have all-party consent requirements ^[9], meaning consent of "all parties involved in a conversation" ^[9]. California Penal Code section 632 is an example ^[45]. For calls across state lines the guide advises erring "on the side of caution" and assuming the stricter law applies ^[9].

The FCC's consumer guide says the agency has no rules on recording by individuals, "but some state laws prohibit this practice" ^[46]. The Reporters Committee also treats consent as presumed where parties are warned of a recording and continue the conversation ^[9]. That is an advocacy organisation's summary, not a regulator's statement, and the guide itself says it "should not take the place of legal advice from a lawyer" ^[9].

For a ring-group team the practical points are few. If recording is on, the greeting should say so before anyone speaks, and the staff card should say what to do if a caller objects. A team with callers or staff in several states should treat the strictest applicable law as the working rule and take legal advice.

Canadian readers

Canadian federal sources describe the same pattern. The Canadian Anti-Fraud Centre (CAFC) advises owners to "tell employees at every level to be wary of unsolicited calls" ^[39]. The Competition Bureau of Canada says directory scammers "may also record your voice while you confirm your business information" ^[19] and lists the CAFC toll-free line, 1-888-495-8501, for reporting ^[23]. The Bureau's directory-scam page dates from 2018, so read it as long-standing guidance rather than new.

On recording, Criminal Code section 184 includes an exception for a person who has "the consent to intercept, express or implied, of the originator of the private communication" ^[47]. The Office of the Privacy Commissioner of Canada says an organization "must inform the customer that they are recording a call" ^[48] and that consent is usually implied if the customer proceeds knowing the call is recorded and why ^[48]. Canadian businesses should take advice on both the criminal and privacy rules before recording.

Data Analysis and Evidence

The quantitative record on this pattern is thin, and the report says so rather than filling the gap. No verified count of directory-listing calls, victims or losses was found, so none is given. What exists is a set of dated regulator statements and a few hard numbers about the environment.

The numbers that were verified

• 36,207,130 U.S. small businesses (firms with fewer than 500 employees), per the SBA Office of Advocacy's February 2026 FAQ, which draws on 2022 Census data ^[8].
• 82.3 percent (29,811,495 firms) of those have no employees ^[8]; by subtraction about 17.7 percent have paid employees.
• Up to $10,000 per violation is the penalty the FCC states for illegal spoofing ^[15]. It bears on what a spoofer risks, not on how often calls occur.
• About 11 states primarily require all-party consent for recording, by the Reporters Committee's count ^[9]. It is an approximation and should be re-checked against current state law.
• Menu capacity in Table 3 reaches 10 options for two providers ^{[30] [31]}, with Microsoft recommending five or fewer items ^[27]. These are vendor-stated limits, not benchmarks of call outcomes.

How old the evidence is

• 2011 and 2013: Connecticut's attorney general warned that businesses may be charged and "even harassed for payments" ^[49], and Washington described the "renew a free listing" framing ^[10]. The pattern is not new.
• 2014 and 2015: the FTC brochure and South Dakota's alert are historical. The "doctored" recording detail appears only in the 2014 text.
• 2023: the FTC guide is the main current statement of the directory pattern.
• 2026: the FCC's call-blocking page, last updated in September 2026 ^[34], show the topic is current alongside the May FTC alert.

No source reviewed says how often a recording is used as "proof," how often one is altered, or how many businesses pay. The report therefore does not claim recordings are usually altered.

What the evidence supports

• Supported: the pattern is described consistently by the FTC, several state attorneys general and two Canadian federal bodies. The advice converges on training everyone who answers, naming an approver, using contact details you look up yourself, and keeping everything in writing.
• Not supported by any source found: that one menu design reduces the rate of successful scams. The designs in Table 2 follow the logic of the FTC's advice to consolidate contacts, not a measured result.
• Not supported: any frequency, loss or victim figure for small businesses, so none is used.

Implications and Future Directions

A policy about who may say yes costs little and does not depend on technology. A script card, a named approver and a log can be in place within a day without a new phone system. The FTC frames the subject as training: learn the signs, then tell employees what to look for.

Routing is the second lever. Where one person already handles purchasing, a menu option or mailbox moves first contact away from the rest of the team, at the price of an extra keypress for customers and slower replies for legitimate vendors. A team that gets only a few such calls a month may reasonably choose the script and the log alone, and let the log show whether a route is worth adding.

Several developments could change the picture, and none is settled. The FCC's October 2025 notice shows it is still examining what caller information consumers should see ^[5]. The FTC's 2024 extension of its telemarketing rule to business-to-business deception changes what callers may lawfully say, though its effect on any individual call is outside what this report can assess. Carrier labeling and blocking continue to expand ^[34] and can also mislabel numbers ^[4].

Worth scheduling: a quarterly review of the vendor list and approver, a staff briefing for each new hire, and a recording-notice review if the team or the states it calls into change.

Frequently Asked Questions (FAQs)

What is a "just confirming your listing" call?

It is the opening of the directory pattern: a caller says the call is simply to "confirm" the business's information. The risk is the "yes" that can later be cited when a bill arrives. Staff should neither confirm nor deny details and should ask for the request in writing.

What if staff already said yes?

Tell the approver the same day and add it to the log with the date, number shown and what was confirmed. Do not pay any invoice that follows until it is reconciled against purchase orders ^[6], and keep further contact in writing. If a dispute develops, speak to a lawyer or the state attorney general's consumer protection office.

What about a fake invoice phone call?

Minnesota's attorney general says scam artists "often aim fake invoices at businesses" (Source: www.ag.state.mn.us). A call that asks the business to pay or confirm an order should get the script and go to the approver, who checks the written order and the vendor list.

What should we do about a call about a directory listing that names a well-known directory?

A familiar directory name on the phone, such as the yellow pages, is not an identity for the caller. The FCC advises hanging up and calling a number from an account statement, the phone book or an official website ^[15], and notes that a legitimate source will usually send a written statement before phoning, especially when asking for payment ^[4]. If a real listing exists, the vendor list and written records will show it.

How should a small business handle scam calls generally?

Tell employees "at every level" to be wary of unsolicited calls ^[39], name one approver, verify through contact details you look up yourself ^[22], and report what you see. Blocking tools help with volume but not with a live caller who gets through.

Is there a robocall script for a receptionist?

For recorded robocalls the FCC's advice is simpler than a script: "hang up right away if someone asks for money or personal information" ^[50]. For live callers, use the one-sentence script above.

How do we verify a vendor invoice call?

Do not use the number or email in the message. NIST says to verify an urgent request using known contact information or a public company website ^[51], and the FBI says to look up the company's phone number on your own ^[52].

Can an auto attendant screen these calls?

Partly. A menu can send "billing, vendors, advertising or listings" to one named person or a mailbox, keeping the rest of the team off those calls (Tables 2 and 3). It cannot confirm who the caller is.

Conclusion

A directory-listing or fake-invoice call is a small event with a delayed consequence. The FTC's description is consistent across its 2014 and 2023 guidance: a call asking for a "confirmation," a spoken "yes," a later invoice, and pressure that may cite the earlier call. For a business whose main number rings several mobiles, the exposure is structural, because anyone who picks up speaks for the business.

The policy that follows from the sources is short. Give everyone one sentence to say and a clear instruction never to confirm anything by phone. Name one approver who may accept or renew anything, and keep the vendor list that approver checks against. Route vendor, billing, advertising and listing calls to that person, or to a mailbox if the team can support it. Keep a log. If an invoice for something unordered arrives, do not pay on its strength, move the exchange to writing, keep records, and report to the FTC and the state attorney general. Treat recording and any legal dispute as matters for state or provincial rules and for professional advice.

The evidence has clear limits. No frequency or loss statistic was verified, several state sources are years old, and no source tests whether a particular menu design reduces successful scams. The policy can still be adopted with confidence in its direction, because it rests on guidance that several independent public bodies give in similar terms, and it can be reviewed against the team's own log after a few months.