Post Date: 07/01/2024
Identity theft has gotten a lot of publicity and attention lately. Most of this has focused on individuals, but business identity theft is also a growing problem. In fact, the IRS calls business identity theft a “serious threat to business, partnership, estate and trust filers.”*
Small businesses may be especially vulnerable to business identity theft because they usually don’t have the resources large businesses do to guard against it. This includes sophisticated security controls designed to detect and deter fraudulent activity. As a result, small firms are often specifically targeted by identity thieves.
Also, business identity theft is usually more complex than personal identity theft. Since businesses typically have higher bank account balances and credit limits than individuals, many thieves focus their attention here. All of this makes it crucial to understand the different types of business identity theft and what you can do to protect your company.
What Does Business Identity Theft Look Like?
In a typical business identity theft scheme, thieves assume the identity of business owners or officers to fraudulently obtain credit on behalf of the business. This might include bank lines of credit, credit cards and vendor credit. In another scheme, thieves file false tax returns on behalf of the business in order to claim refundable business credits.
According to Emily Koch, CFCI, Capital Bank Financial Crimes Fraud Investigations Lead, a common scheme is the filing of fake incorporation documents with states. “Once identity thieves have the fraudulent filing documents, they are able to open bank accounts in the name of the business and steal their mail,” she says. “Thieves also fraudulently change business addresses to redirect mail and important documents.”
In addition to the direct costs involved with these kinds of identity theft, businesses may also face legal consequences, including defending intellectual property such as trademarks, copyrights and patents. Victimized businesses also must spend time and money repairing the harm to their credit, reputation and overall finances.
Types of Business Identity Theft
Probably the most common type of business identity theft is financial fraud, as described above. But there are other types as well, including web defacement, or building fake websites that impersonate real ones. Identity thieves use these to redirect visitor traffic and capture sensitive business and customer information.
Thieves also steal business identities to commit tax fraud. Using stolen employer identification numbers (EINs), they file fraudulent tax returns to obtain subsidies and refunds through state and federal programs. In another scheme, thieves create LLCs with a similar or even the same name as an existing LLC and register the business in another state. Then they reroute mail, including checks, to the fraudulent LLC’s address.
Trademark ransom is yet another type of business identity theft. Here, thieves register business names and logos as official trademarks and demand a ransom in order to release them from the trademark.
How Thieves Steal Business Identity
There are lots of different ways thieves can steal a business’ identity. One of the most common is referred to as business email compromise, or BEC. Here, thieves use stolen logos and other brand identities to create fake emails that look legitimate. The emails try to trick employees into clicking on links that download malware onto their computers or take them to fake websites where thieves try to steal sensitive corporate information.
In another BEC scam, identity thieves use compromised or closely spoofed email accounts to trick an employee into initiating wire transfers to bank accounts they think belong to trusted partners. However, the money is actually wired into accounts controlled by the thieves. In a similar scam, thieves send fake emails to employees asking them to provide sensitive corporate information to unlock supposedly locked accounts. The thieves then use the information to steal money from corporate bank accounts.
Identity thieves can also hack into business owners’ and executives’ email accounts and send messages instructing finance employees to send wire transfers to bank accounts they control. Or they can plant unsecure Wi-Fi hotspots around the business and wait for employees to use them by mistake, which can expose sensitive corporate information. Good old-fashioned dumpster diving remains a low-tech identity theft tactic in which thieves rifle through garbage looking for sensitive corporate information they can use to steal funds.
Combatting Business Identity Theft
Here are four strategies to help you combat business identity theft at your company:
- Educate and train your employees. Your employees are your first line of defense against business identity theft so make sure they understand what it is and how they can guard against it. This includes training them to spot fraudulent emails and carefully scrutinize all wire transfer requests. Also educate employees about the importance of creating strong passwords and changing their passwords regularly.
- Regularly review your commercial credit report and business records. Koch says to keep Secretary of State records up to date and make sure all your sensitive records are stored securely. “Also check your business records to make sure that no fraudulent business entities have been created, as well as your street address to ensure it has not been fraudulently changed,” she says.
- Protect sensitive business information. This includes your EIN, bank account numbers, usernames and passwords. “Never share this information electronically or digitally, such as by email or online,” says Koch.
- Keep computer software and browsers updated. Software updates include security patches that help protect computers from identity thieves and BEC. So train your employees to update software whenever they’re promoted to and make sure they are using the latest versions of web browsers with pop-up blockers. Also consider adding key-logger software to all corporate computers.
What to do if Your Business is Victimized
If you think your company has been victimized by business identity theft, Koch recommends that you report it immediately to law enforcement and the Secretary of State. “Also notify your bank and ask them to place an alert on your accounts and profile,” she says. “And report any fraudulent change of address to the U.S. Postal Inspectors.”
In addition, consider reporting the identity theft to the major small business credit reporting bureaus: Equifax, Experian and Dun & Bradstreet. If you believe your EIN has been stolen and used fraudulently, notify the IRS. And speak with your attorney and business insurer about any potential legal and insurance ramifications of the theft.
How Capital Bank Can Help
Talk to your managers about how you can implement strategies like these to guard against business identity theft. Contact Capital Bank to discuss how we can help you initiate wire transfers and electronic funds transfers safely and securely.
