5 Types of Identity Theft That Can Harm Your Small Business

What is Business Identity Theft?

Business Identity Theft is when someone intends to defraud or cause harm to a business by using their identifying information without the authorization to do so.

Data used to identify a business primarily includes publicly available, nonsensitive information. This includes a business’s fictitious name (DBA), owner’s name, legal entity type, address, registered agent details, and date of establishment. Much of this information is publicly available through state records and general internet searches. Employer Identification Numbers (EINs) are not considered to be sensitive data like social security numbers are for consumers.

Thieves target the identities of businesses with good credit, or businesses that are no longer operating. According to the IRS, dormant and defunct businesses create a significant opportunity for criminals to commit business identity theft. If your business no longer operates, be sure to notify the IRS to close the accounts utilizing the EIN.

  

5 Types of Business Identity Theft

According to the National Cyber Security Society the five most common types of identity theft that impact small businesses are financial fraud, tax fraud, website defacement, trademark ransom, and business email compromise.

1. Financial Fraud 
   Financial fraud includes fraudulently obtaining loans, lines of credit, fraudulent UCC filings, and opening other unauthorized financial accounts using a business’s information.
2. Tax Fraud
   This includes filing fraudulent tax returns or obtaining fraudulent refunds or credits from federal and state government.
3. Website Defacement
   Cyber criminals can either create spoofed business websites or compromise legitimate business websites. The websites can be used to direct users to malicious websites to steal data, download malware, advertise illicit products, or simply vandalize the website which can impact business operations. Ransomware is another attack used in website defacement, in which the legitimate owner is demanded to pay a ransom in order to regain access to the legitimate business website.
4. Trademark Ransom
   Trademark ransom is registering an existing business’s name as an official trademark by someone who is not affiliated with the business. A ransom is then demanded from the legitimate business in order to release the trademark of the business name.
5. Business Email Compromise (BEC) 
   Business email compromise can be accomplished multiple ways. Bad actors may gain access to a business's email account and send fraudulent payment instructions to customers in order to reroute the funds to an account that is not associated with the business. Other times, the bad actors will use email addresses that look very similar to a legitimate and familiar email address and provide fraudulent payment instructions. Always be leery of requests that are made electronically. It is important to validate payment instructions over the phone at a trusted phone number prior to sending any payments where directions were received through email.

There is currently no central law enforcement agency to report business identity theft to. There is also no central law enforcement agency collecting data related to business identity theft. Due to this, it is not known what the extent of business identity theft cases is in the United States. Be aware that after your business’s identity has been stolen, you may be targeted in additional scams.

Best Practices for Handling Business Identity Theft

Place a Fraud Alert.

To place a fraud alert with Experian, email BusinessDisputes@experian.com with the subject "Fraud Alert Request". In the email, explain that you are requesting a fraud alert on your business credit report and provide a brief summary explaining why the fraud alert is necessary. In the email, include a signature from the company’s owner and their contact information. Experian will then add a message to that company’s business credit report that asks that the business be notified prior to being extended any credit from a lender. This alert will only be seen if a lender pulls a business credit report from Experian. Equifax and Dun & Bradstreet do not currently provide fraud alerts on business credit reports.

Document the Details of the Identity Theft.

If you experience business identity theft, document as much as possible. This can include interviewing staff who may have knowledge of how a compromise occurred. Take note of dates and times that information is found and how it was found. Identify and make note of what information was compromised, what accounts were impacted, and any notices received of fraudulent activity occurring. Also take note of steps you are taking to protect yourself and your business. Report any information you have to your local police department. There is currently no federal agency that takes reports for business identity theft.

Update Passwords.

Change passwords to accounts that contain sensitive data. Try to avoid repeating passwords. You can use a password manager, such as LastPass, to keep track of all of your passwords. If you believe your computer or other electronic device may be compromised, take those devices to a professional to be cleaned of any malicious software.

Notify all financial institutions with which you do business.

Notify your financial institutions if you become aware that your business’s identity has been stolen and if any accounts may be compromised. While a business’s credit cannot be frozen, financial institutions can freeze existing accounts and assist you with ensuring your accounts are secure.

Review Your Business Filings.

Review your business filings with local, state, and federal governments where applicable. It is not uncommon for impostors to make changes to filings once they have enough information to do so. Ensure that contact information, addresses, and agent information are up to date and have not been altered.

File a Report with the Internet Crimes Complaint Center.

An IC3 (Internet Crimes Complaint Center) form may be filed for identity fraud that occurs electronically. This can include cyberattacks, online extortion, hacking, phishing scams, and other crimes. The form is filled out online at https://complaint.ic3.gov/. The report goes through information step by step and clearly explains what information is being requested for each section. This report is not likely to resolve your business identity theft, however, this report is helpful to federal law enforcement in tracking fraud and scams as well as linking possible perpetrators across several victims.