Scammers are emailing small business owners claiming a private equity firm wants to buy their company, hoping to lure victims into sharing sensitive information or paying bogus fees.
While legitimate investment firms do contact larger privately held companies, experts say "mom-and-pop" businesses are unlikely acquisition targets, making vague buyout offers a major red flag.
Fraudsters may be after financial data, upfront payments, or access to business systems, making it essential to verify any unsolicited acquisition inquiry before responding.
It’s no secret that private equity firms are acquiring businesses, not always benefiting the businesses or the industry they’re in. But these targets are mostly larger, profitable businesses.
Would private equity be interested in your small business? Probably not, but scammers are counting on owners being flattered at the idea and walking into their trap.
ConsumerAffairs research has found a growing wave of emails that follow that exact script.
The typical email says something like:
"We have a private equity group (or family office) looking to acquire businesses in your space. Would you be available for a brief call?"
Or:
"One of our clients is actively seeking acquisitions in your industry and thought your business would be a good fit."
Some of these emails are legitimate
Private equity firms, investment banks, "search funds," and M&A brokers routinely cold-email business owners looking for acquisition targets. The lower-middle market – companies worth roughly $1 million to $100 million – has seen a surge in unsolicited outreach as investors compete for deals. Business sale advisors say many owners are surprised by the volume of these emails, but the trend itself is real.
However, they aren’t targeting small “mom & pop” businesses.
Security researchers and scam investigators have documented nearly identical emails being sent by fake firms or anonymous senders. Common red flags include:
No identifiable private equity firm is named.
The sender uses a free email account or a recently registered domain.
The message is extremely generic and could have been sent to thousands of businesses.
The sender refuses to identify the alleged buyer before getting you on a call.
They immediately ask for confidential financial information.
Identical wording
Reddit's r/scams and r/smallbusiness communities contain numerous examples of nearly identical wording. In some cases, recipients found the names, firms, or executives did not exist, and others reported the emails targeted companies that had already dissolved — strong evidence of indiscriminate mass mailing rather than genuine acquisition interest.
What is the scammers’ endgame? There isn't one single scam. Investigators have identified several possibilities:
Lead generation. The sender is really trying to sell your contact information or hand you off to brokers.
Paid valuation scam. After expressing interest, they tell you the buyer requires an "independent valuation" or due diligence report that you must purchase.
Advance-fee fraud. They eventually ask for legal fees, escrow deposits, or other upfront payments before the "deal" can proceed.
Business intelligence harvesting. They gather revenue, customer, supplier, and operational information that has value on its own.
Phishing or malware. Later emails contain "LOIs," NDAs, or financial questionnaires that install malware or steal credentials.
Business Email Compromise setup. In some cases, initial conversations are used to learn enough about a company to facilitate later impersonation or payment fraud. The FBI has repeatedly warned that criminals often begin with seemingly legitimate business conversations before attempting fraud.
How to tell if it's real
Legitimate M&A outreach generally includes:
A verifiable investment firm with an established website and professionals listed on LinkedIn.
A corporate email matching the firm's domain.
Willingness to identify the buyer or provide credible information after an NDA.
No request for money from the seller.
Reasonable questions about the business before requesting confidential financials.
Scams tend to rely on vague language like "a private equity firm in our network" or "an investor is interested in your space" without ever identifying anyone.