Small business cybersecurity checklist for Charlotte companies

Takeaways

• Business email compromise cost U.S. victims $3.05 billion in 2025, the second-largest loss category in the FBI Internet Crime Complaint Center’s 2025 annual report.
• North Carolina ranked ninth among states with 25,940 complaints to the FBI’s IC3 in 2025, and North Carolina victims reported $63.9 million in business email compromise losses.
• Organizations reported a record 2,349 data breaches to the North Carolina Department of Justice in 2025, affecting 9,275,938 North Carolinians; hacking caused 77% of them.
• North Carolina’s Identity Theft Protection Act, G.S. 75-65, requires businesses to notify affected people without unreasonable delay and to notify the Attorney General’s Consumer Protection Division.
• The IC3 Recovery Asset Team froze $679 million in fraudulent transfers in 2025, a 58% success rate, so a fast call to your bank comes first.

This guide is for Charlotte owners and office managers who run their own technology without a security department. A small business cybersecurity checklist is a short, ordered list of controls that blocks the attacks small firms report most: stolen email logins, fake payment requests, ransomware and exposed customer data. The direct answer for most Charlotte companies is to lock down email and money movement first, with multi-factor authentication (MFA), a call-back rule for payment changes and tested backups, then learn North Carolina’s breach-notice law.

What are the biggest cyber threats to Charlotte small businesses?

The biggest cyber threats to Charlotte small businesses are frauds that start in email: phishing, business email compromise (BEC) and stolen logins. The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints with $20.877 billion in losses in 2025, according to its 2025 annual report. North Carolina ranked ninth among states with 25,940 complaints and 12th in losses at $431.6 million.

The table compares 2025 national and North Carolina figures for five crime types that often hit businesses, from the IC3 report and its North Carolina state page; the counts include individual victims as well as companies.

Crime type	U.S. complaints, 2025	U.S. losses, 2025	N.C. victims, 2025	N.C. losses, 2025
Phishing and spoofing	191,561	$215.8 million	7,784	$3.4 million
Business email compromise	24,768	$3.05 billion	675	$63.9 million
Tech and customer support scams	47,794	$2.13 billion	1,396	$58.3 million
Personal data breach	67,456	$1.31 billion	1,969	$28.1 million
Ransomware	3,611	$32.3 million	71	$15,000

Ransomware’s small dollar totals understate the damage, because the IC3’s ransomware figures normally leave out lost business and remediation costs. Among ransomware complaints from businesses outside critical infrastructure, legal services made up 18% and contracting services such as electricians and general contractors 17%.

North Carolina’s own numbers point the same way. The North Carolina Department of Justice’s 2025 Data Breach Report counted a record 2,349 breaches affecting 9,275,938 North Carolinians, a total that counts people more than once when they were caught in several breaches; hacking caused 77% and phishing 16%. Email breaches rose from 492 in 2024 to 570 in 2025, or 24.27% of all reports.

What belongs on a small business cybersecurity checklist?

A small business cybersecurity checklist fits on one page. Most of the 10 items below come from CISA, FBI, SBA and North Carolina Department of Justice guidance; items 2 and 3, the payment call-back and second-approver rules, are our own. The first four target the email and payment fraud behind the largest business losses in the IC3 data.

1. Require MFA on email, banking, payroll and administrator accounts; CISA’s small business guidance says to enforce MFA “using technical controls, not faith.”
2. Confirm any new payee, changed bank account or rush wire by phone at a number already on file, never a number in the email.
3. Require a second person to approve payroll direct-deposit changes and wires above a dollar limit you set.
4. Type bank and payroll portal addresses directly into the browser, as the FBI advised in an April 24, 2025, warning about fake search ads.
5. Turn on automatic updates; CISA calls patching “one of the most cost-effective practices to improve your security posture.”
6. Replace end-of-life routers, since the FBI warned on May 7, 2025, that routers dated 2010 or earlier likely no longer receive security updates.
7. Back up files and test a full restore; the FBI recommends offline, encrypted and immutable backups.
8. Remove administrator rights from everyday laptops and turn on disk encryption, two items on CISA’s list.
9. Train employees to spot phishing, and cut off a departing employee’s access immediately, as the North Carolina Department of Justice advises.
10. Keep a one-page incident plan with numbers for your bank’s fraud line, insurer, attorney and the FBI Charlotte field office.

The list has limits: MFA can be bypassed (see below), and the FBI’s ransomware guidance also recommends network segmentation and endpoint detection and response (EDR) tools.

How do payroll and vendor payment scams work?

Payroll and vendor payment scams work by persuading an employee to send money to an account a criminal controls. Business email compromise is a scam aimed at businesses that regularly send wire transfers, run through compromised email accounts, phone numbers and virtual meeting apps, according to the IC3 definition.

Payroll diversion is the employee-side version. In an April 24, 2025, public service announcement, the FBI said criminals buy search ads that mimic employee self-service sites, capture logins and change direct deposit details; some call victims posing as bank staff to get one-time passcodes. One warning sign the FBI lists is a sudden flood of thousands of spam emails meant to bury the real account-change alert.

Contractors face a newer twist. On March 9, 2026, the FBI warned about fake planning and zoning officials who email permit applicants with real case numbers, then demand fees by wire transfer, peer-to-peer payment or cryptocurrency from addresses such as “@usa.com.” For a Charlotte or Mecklenburg County permit, call the office at the number on its official website before paying. Businesses also reported more than $30 million in 2025 BEC losses involving AI, according to the IC3.

Does multi-factor authentication stop every attack?

Multi-factor authentication does not stop every attack, though CISA says “any form of MFA is better than no MFA.” On May 21, 2026, the FBI warned about Kali365, a phishing kit first seen in April 2026 that tricks Microsoft 365 users into entering a device code on a real Microsoft page; the attacker’s tokens then open Outlook, Teams and OneDrive without a password or MFA prompt.

A September 1, 2026, FBI warning described OAuth consent phishing aimed at prominent people and their contacts, in which a victim approves a malicious app on a legitimate permission screen; the FBI says changing the password does not revoke that access. In its Kali365 warning, the FBI recommends a conditional access policy that blocks device code sign-ins for all users, with limited exceptions for required business processes, and CISA calls FIDO authentication the only widely available phishing-resistant option.

Our read: keep MFA on, then have your Microsoft 365 administrator block device code sign-ins and review which outside apps can read company mail.

What does North Carolina law require after a data breach?

North Carolina law requires any business that owns or licenses personal information of North Carolina residents to notify affected people “without unreasonable delay” after it discovers a security breach, under G.S. 75-65. This guide is general information, not legal advice; check your situation with an attorney.

A security breach is unauthorized access to and acquisition of unencrypted, unredacted personal information where illegal use has occurred, is reasonably likely or creates a material risk of harm, under G.S. 75-61. Encrypted data counts only when the means to decrypt it was taken too. Personal information is a name combined with an identifier such as a Social Security number, driver’s license number, account or card number, or biometric data, according to the North Carolina Department of Justice.

G.S. 75-65(d) requires a clear and conspicuous notice that covers these points:

• The notice describes the incident in general terms and the type of personal information involved.
• The notice explains what the business did to protect the information from further unauthorized access.
• The notice gives a telephone number for questions, if the business has one.
• The notice advises people to review account statements and monitor free credit reports, and lists contacts for the consumer reporting agencies, the Federal Trade Commission and the North Carolina Attorney General’s Office.

G.S. 75-65 adds two filings. A business that notifies people must also notify the Attorney General’s Consumer Protection Division, which takes reports through an online security breach form; notifying more than 1,000 people at one time also triggers notice to the nationwide consumer reporting agencies. A vendor holding your data must tell you “immediately,” and a violation counts as an unfair trade practice under G.S. 75-1.1.

Where do Charlotte businesses report a cyberattack?

Charlotte businesses report cyber fraud to their bank first, then to the IC3 and the FBI Charlotte field office at 7915 Microsoft Way. Speed counts: the IC3 Recovery Asset Team handled 3,900 incidents in 2025 and froze $679,013,183, a 58% success rate.

Follow this order on the day you spot a fraudulent transfer or a breach:

1. Call your bank’s fraud line and ask for a recall of the funds, as the IC3 report advises.
2. File a complaint at ic3.gov with the full transaction details, whatever the amount lost.
3. Call the FBI Charlotte field office at (704) 672-6100, which takes reports 24 hours a day, or use tips.fbi.gov.
4. Report the breach to the North Carolina Department of Justice if personal information was exposed; its Consumer Assistance line is (919) 716-6000.
5. Save phishing emails with headers, screenshots and suspicious login details, which the FBI asks victims to include.

Is cyber insurance worth it for a small business?

Cyber insurance pays breach response and fraud costs a small business would otherwise cover itself. On its cyber insurance page, the Federal Trade Commission lists first-party coverage (notification counsel, data recovery, business interruption, cyber extortion and fraud, forensics) and third-party coverage for claims such as payments to affected consumers.

Ask the agent these questions from the FTC’s checklist before you sign:

• Does the policy cover attacks on your data held by vendors and other third parties?
• Will the insurer defend you in a lawsuit or regulatory investigation under “duty to defend” wording?
• Does the insurer run a breach hotline that answers every day of the year, at all hours?

Our read: the FTC page was last modified November 9, 2021, so ask the agent in writing whether the policy covers a BEC wire loss and at what limit.

Good to know

Each item below was checked on November 13, 2026:

• Windows 10 support ended October 14, 2025; Microsoft sells business Extended Security Updates at $61 per device for the first year, and the price doubles each following year for a maximum of three years.
• The FBI’s IC3 public service announcement page lists 2026 warnings through October 23, 2026.
• The North Carolina Department of Justice posted its 2025 Data Breach Report on April 15, 2026, and G.S. 75-65 was last amended by Session Law 2025-25.

Last updated November 13, 2026.

Have a Charlotte business question we should cover? Send us a tip.