Protecting Your Identity from Theft – Not Just for Consumers

09.25.20

Identity theft. This is a topic we are all pretty familiar with. A fraudster steals your personally identifiable information, and uses that data to impersonate you for financial gain. They might open a credit card in your name and go on a shopping spree, or use the information to file for unemployment benefits. Consumer education abounds, with everyone offering advice on how to protect your personal identity.

But what about your business?

Business Identity Theft

Business identity theft, also known as commercial or corporate identity theft, occurs when a fraudster steals a legitimate business identity to impersonate or exploit that business in some way.

You may have experienced firsthand the devastation caused by a thief impersonating you and racking up credit card charges, but consider the damage that could be done if a thief opened corporate credit cards, filed a fraudulent tax return, or took out a loan in your company’s name. A fraudster may also impersonate your business by sending fake or altered invoices to clients and pocketing the proceeds. Business identity theft could go on for months or even years undetected.

Your business identity is at even greater risk during times of crisis, which pretty much sums up 2020 so far. Dun & Bradstreet’s High Risk and Fraud Insight (HRFI) team recently noted over 100 percent increase in business identity theft in 2019, with an estimate of over 250 percent spike in business identity theft since the beginning of 2020^1.

Protecting your business identity starts with prevention, which means you need to know how criminals may try to steal your corporate identity.

Business Identity Theft Schemes

Criminals use numerous tactics and schemes to impersonate legitimate business entities, and may be able to get everything they need using public sources. Below are a few examples of common strategies you should know. Once you know how a thief might try to steal your corporate identity, you can take practical steps to protect your information.

Fraudulent Business Filings and Registrations

Criminals may attempt to manipulate state business registration information, which generally consists of paying a small filing fee and filling out some paperwork. Most states are happy to process these changes online, meaning a criminal could change your business address, list him or herself as a registered agent, or suddenly appear as a director of your company, all without leaving the comforts of home. This is true for both active businesses, as well as past businesses that have been classified as inactive, closed, or dissolved. A thief may fraudulently reinstate the business registration without your knowledge.

Even without directly impacting your business registration, a fraudster may intentionally register a business or fictitious trade name similar to your legitimate business name, which could be used to trick creditors and other businesses.

PREVENTION TIPS:
To protect your state business registration information, make sure you file your annual reports and renewals on time. Schedule time to regularly review your business registration information online, and don’t forget to check on any past businesses you may have closed. Use the search feature to identify any business or fictitious name registrations similar to your business name. Check out available resources through your Secretary of State website to find out if they offer email alert services to notify you about changes to your business registration information.

Business Credit Report and Financial Information Manipulation

Publicly available information about your business may be manipulated, or completely falsified, in efforts to impersonate your business. Do you know what information about your business is publicly available?

Business credit reports contain significant information about your business, but unlike consumer credit reports, access to business credit reports is not restricted. Virtually anyone, including enterprising criminals, can purchase a business credit report. Additionally, information on these reports is largely self-reported by the business, which creates opportunity for criminals to manipulate the business credit report. Since business registration information on the report is verified through the Secretary of State, fraudsters have better success at manipulating credit reports if they have already fraudulently altered your business registration information. A criminal might falsely inflate your company’s number of employees or annual revenues.

You are probably thinking that any creditor is going to verify that information. This is where a thief will either obtain your business financial reports, or fabricate false financial reports that support the fraudulent changes they made to your business credit report. When a fraudster combines false financial reports with other real or fraudulent business credentials, they can add to the appearance of legitimacy while impersonating your business.

PREVENTION TIPS:
Review your business credit reports. Don’t just rely on one provider. In addition to Dun & Bradstreet, remember that Equifax, Experian, and TransUnion (the three national credit bureaus) provide business credit services. Obtain copies of your business credit reports from each organization and review them, just like you would with your personal credit reports. Report discrepancies immediately.

Stolen Business Information and Identifiers

Much like personally identifying information used in consumer identity theft, businesses must be vigilant about corporate identifying information that could be used to commit business identity theft. This includes your federal employer identification number (EIN), business address, and any unique license or business registration numbers.

Federal regulations have enhanced data collection requirements for financial institutions opening new business accounts, but many fraudulent relationships can still be established using just your company’s name, address, and EIN.

If your business operates out of a multi-tenant office complex, a scammer could easily lease space in the same building to fool creditors or suppliers who may not identify different suite numbers. Depending on your building’s security features, a criminal operating in your building could potentially access your mail, making off with additional business information for later fraudulent use.

Fraudsters use falsely obtained EINs to commit tax refund fraud or unemployment benefits fraud. They may report false income and withholding using your company’s EIN on federal or state tax returns. This could result in the IRS and state tax agencies demanding immediate payment from your business for unpaid withholding or employment taxes based on the fraudulent individual tax returns. Or fraudsters could falsely file unemployment benefits claims using your EIN.

PREVENTION TIPS:
Limit EIN disclosure to only required situations, such as tax reporting, business banking relationships, and W-9 forms. Keep physical documents that contain business identifiers and sensitive information in a secure location to prevent unauthorized access, and be aware of anyone who might be able to view or access these documents. Shred old or unnecessary documents using a confetti cut, diamond cut, or cross-cut shredder, or contract with a secure document destruction company. Be aware of other businesses that operate out of the same multi-tenant location. Ensure your mail is securely stored both before and after you collect it from your postal carrier or mailbox. Be diligent in reviewing and responding to unemployment insurance claims, and contest any suspected fraudulent claims with your state agency.

Your Business Identity Has Been Stolen – Act Fast

If you identify that your business has fallen victim to business identity theft, it is imperative that you act quickly and obtain as much information as you can. Below are some steps you can take. Depending on the complexity of your case, you may also want to consult a qualified attorney.

File a police report with your local police department. Keep a copy of the report to show creditors.
Protect your business’ existing financial relationships by contacting your banks and credit card companies.
Notify your key suppliers. Consider requesting additional verification processes for any orders placed in your company’s name.
Contact the major credit bureaus to request a copy of your credit report, and place a fraud alert on your file.
Close any accounts that may have been compromised or opened fraudulently. Use credit reports to identify these accounts.
Submit a Business Identity Theft Affidavit to the Internal Revenue Service (https://www.irs.gov/pub/irs-pdf/f14039b.pdf).
File a complaint with the Federal Trade Commission.
Keep organized and detailed records. Follow up promptly, and in writing.
Monitor your accounts carefully for additional fraudulent activity.

Please visit the Security and Fraud Center page on our Atlantic Union Bank website for additional information and resources.

The Cyber Elephant in the Room

I expect you are wondering why we did not touch on cyber security, online banking and other online transactions, or monitoring your digital footprint. That is because business identity theft is not an information security breach. Information obtained from a security breach could be used to perpetrate business identity theft, but as you can see from the examples above, there are plenty of ways for criminals to impersonate your business without a PhD in cybercrime.

That said, it is always wise to protect your business computers and networks, and to monitor your company’s online and public presence, including social networking sites.

Contact us immediately if you suspect you’ve been a victim of fraud or identity theft.
Customer Care: 800-990-4828
Mon-Fri: 7am – 8pm Sat: 7am – 5pm

¹(Dun & Bradstreet Perspectives Editors, 2020)

Disclosure:
The information contained in this document is for general guidance on matters of interest only. Accordingly, the information is provided with the understanding that the authors and publishers are not herein engaged in rendering legal, accounting, tax, or other professional advice and services. As such, it should not be used as a substitute for consultation with professional accounting, tax, legal or other competent advisers. While we have made every attempt to ensure that the information contained has been obtained from reliable sources, Atlantic Union Bank is not responsible for any errors or omissions, or for the results obtained from the use of this information.