By Gerri Detweiler
As of August 2021, the Small Business Administration reported it had received 1.2 million complaints of loan identity theft for Economic Injury Disaster Loans. That means over a million business owners believe their business identities have been used to apply for Covid relief loans administered by the SBA.
I am one of those victims. Here’s what happened to me, along with steps I’m taking that you can also use to help protect your business.
Business identity theft: How I found out I was a victim
I learned about the fraudulent loan application because my personal Experian credit report lists an inquiry from “SBA ODA,” but I’ve never applied for a loan from the SBA.
I’ve written extensively about the Economic Injury Disaster Loan (EIDL) program since it was launched in March 2020 to help businesses impacted by the coronavirus. So when I spotted the inquiry that mentioned SBA ODA, I knew that acronym stood for the SBA Office of Disaster Assistance, and I also knew that meant someone had likely applied for an EIDL using my identity. (While I have a full-time job, I still maintain my business corporate entity created a couple of decades ago when I was self-employed.)
This isn’t my first tangle with ID thieves. A few years ago someone opened a retail credit card in my name and placed a large order for sneakers. Then in the spring of 2020, I discovered crooks were again using my name to apply for credit and stimulus benefits.
An inquiry from a major credit card issuer popped up on my credit report. I hadn’t applied for credit recently, so I called the issuer. They explained there was a pending application for a credit card, but it had not yet been issued. I told them it was fraudulent.
Then an inquiry from a different financial institution appeared on my credit report. This time I learned the would-be crooks had opened a bank account in my name. Weeks later I found out they successfully applied for unemployment using my information, even though I was employed full-time at Nav.
Fortunately, the bank froze the check that was deposited from the state unemployment agency before it was cashed. (A second bank account was opened in my name but I was able to close it down quickly before any activity took place.)
I already had a fraud alert on my credit reports, but I renewed it and visited my local sheriff’s office to file a police report, hoping that was the end of it. But then the inquiry from the SBA appeared on my credit report.
Unlike the other times when I was able to call the financial institutions in question, I wasn’t successful in finding a way to talk with someone from the SBA to alert them or to find out what was going on. And since SBA EIDL loans don’t show up on personal or business credit reports, I have no way of knowing whether there is an SBA loan outstanding with my name attached to it. (SBA EIDL loans for more than $25,000 result in a UCC-1 filing which would appear on my business credit reports, but so far I haven’t seen one on my credit reports.)
I’m in the process of filing an identity theft report with the SBA. Ironically, the only option they provide for doing so involves sending a form with personal information and a copy of my ID to them by email—not exactly what I consider the most secure method of communication.
Many small business owners affected by identity theft
Business identity theft is in on the rise, according to The National Cybersecurity Society (NCSS). In 2019, Dun & Bradstreet’s High Risk and Fraud Insight (HRFI) team saw a 100% increase in business identity theft, and in 2020 estimated there would be a 258% increase.
It can be difficult to spot or completely prevent identity theft, especially for small businesses that may not be on the lookout for warning signs. But there are a few strategies to consider.
How to detect and deal with business identify theft
1. Check and monitor your personal and business credit reports
Suspicious activity, including inquiries or new accounts you don’t recognize, may be a sign of fraud. Since credit bureaus don’t share information with each other except in very limited situations, you’ll want to check and monitor your credit with each of the major consumer credit reporting agencies— Equifax, Experian, and TransUnion— and with commercial credit agencies such as Dun & Bradstreet, Equifax, and Experian. (Here are 138+ places to get your free credit scores.)
2. Be on the lookout for scams
Watch out for phishing scams such as emails or phone calls that try to trick you into revealing sensitive information. Check links to make sure they are safe (padlock in the URL) and that they match the site you think you’re visiting. Better yet, log into accounts directly from the financial institution’s app or website.
3. Check and maintain state business filings
In some states it’s easy for scammers to check online registrations and change them. An address change you didn’t initiate is a huge red flag that something is amiss.
4. Act quickly if you notice suspicious activity
Place a fraud alert or credit freeze on your personal credit. (Unfortunately you can’t freeze business credit.) File a police report. And keep good records—you may find that you need them later on. Visit the Identity Theft Resource Center for helpful information on what to do if you are a victim of ID theft.
Protect yourself from becoming a victim
Identity theft drains time and resources, both of which business owners often find are in short supply. While you may not be able to prevent being scammed, proactively taking steps to help protect your personal and business identities can save you valuable time in the long run.
About the Author
Gerri Detweiler, education director for Nav, has been helping individuals and small business owners make smarter credit and financing decisions for more than two decades; follow her on Twitter and LinkedIn. See Gerri’s articles and full bio at AllBusiness.com.
RELATED: 7 Cybersecurity Strategies to Prevent Ransomware Attacks and Account Takeovers
This article was originally published on AllBusiness.com.