Business Identity Theft: How Fraudsters Open Credit in Your Company's Name

Your business has a legal identity, just like you do. It has a name, a tax ID number, a credit profile, and public records that anyone can find. And just like your personal identity, it can be stolen.

Business identity theft is a persistent and evolving threat for small business owners, and it doesn't work the way most people expect. Fraudsters don't need to break into your office or even hack your accounts directly. In many cases, they piece together enough publicly available information to impersonate your company, apply for credit in your name, and walk away with the money before you even know something is wrong.

Here's how it actually works, what to watch for, and how to protect what you've built.

What is business identity theft?

Business identity theft happens when someone uses your company's identifying information, its name, Employer Identification Number (EIN), business license details, or registered agent information, without your permission to commit financial fraud. That could mean opening credit lines, applying for loans, filing fraudulent tax returns, or setting up vendor accounts.

It can be worse than the personal kind because many owners don't find out for months or years. Most small business owners aren't watching their business credit reports the way they watch their personal credit files, and that blind spot is exactly what makes this fraud so effective. Nav shares a first-person account of how a business owner dealt with it.

Banks and card issuers often flag suspicious personal-account activity, but many identity theft victims still learn about it late. When they use your company's EIN and business name, the fraud can be harder to spot, because business credit monitoring is far less common and the systems that track it are less consumer-facing.

How fraudsters actually do it

You don't need much to steal a business identity. That's the uncomfortable truth.

Most of what a fraudster needs is publicly available. Secretary of State websites list business names, registered agents, addresses, and ownership changes. Many state filings are searchable for free. From there, a thief can piece together a convincing picture of your company, enough to submit a credit application or, in more aggressive cases, actually file paperwork to alter your business registration.

Here are the most common tactics:

• Data breaches and phishing. Fraudsters target people inside your business with fake emails or compromised vendor systems. Once they have your credentials or EIN, the rest follows.
• Stolen business data sold online. Stolen business details (EIN, business name, banking details, owner information) can be bundled into identity data packages and sold to other criminals.
• Reactivating dormant businesses. Criminals search Secretary of State websites for businesses that have been dissolved or gone inactive. They then reinstate the entity or alter its registration so it looks like an active, legitimate business, and use that legal shell to apply for credit or loans.
• EIN fraud. Criminals use a stolen or fabricated EIN to open business bank accounts, submit loan applications, or file a fraudulent tax return, often claiming a refund before you file your own. According to Aaron Hall's legal analysis on EIN fraud, synthetic identities that combine a real EIN with fabricated personal data are used to get around verification protocols.

The window between fraud and discovery can be wide. Fraudsters count on that gap.

Warning signs your business identity has been stolen

Most victims find out too late, through a collections call, a rejected credit application, or an IRS notice about a return already filed under their EIN.

Watch for these signals:

• Unexpected credit declines. If your business is turned down for financing you'd normally qualify for, fraudulent accounts may already be sitting on your business credit report.
• Collection calls for debts you don't recognize. Creditors chasing you for accounts you never opened is a direct red flag.
• Unfamiliar inquiries on your business credit report. Multiple simultaneous credit inquiries from lenders you didn't approach can mean someone else is applying in your name. Aaron Hall flags multiple, simultaneous requests from diverse financial institutions as a red flag for EIN fraud.
• IRS notices about duplicate filings. If the IRS contacts you about a return already submitted under your EIN, your EIN may have been misused.
• Changes to your Secretary of State filing. If your registered agent, address, or officer information has changed without your knowledge, someone may have filed fraudulent paperwork to hijack your business registration.
• Vendors or clients acting confused. If a supplier says they haven't received payment you sent, or a customer says they received an invoice from you that you didn't issue, impersonation may already be happening.

If you spot any of these signs, report it to the FTC at IdentityTheft.gov and contact your Secretary of State office right away.

What happens if you don't catch it

The financial consequences of business identity theft reach further than the fraudulent debt itself.

When fraudulent accounts pile up in your company's name, your business credit profile takes the hit. That can make it harder to get a loan, secure a vendor line of credit, or even sign a commercial lease. Nav shares one owner's first-person account of what recovery involved.

There's also the reputational risk. If someone impersonates your company and fails to pay suppliers or defrauds your customers, your business name is attached to that. Sorting out who owes what, and proving the debts weren't yours, takes time and legal effort most small business owners can't easily afford.

The scale of the problem makes clear why this matters. The FTC received about 3 million fraud reports in 2025, with $15.9 billion in reported losses, and the FBI's Internet Crime Complaint Center logged 1,008,597 complaints and $20.877 billion in losses. Neither agency breaks out business identity theft separately, but the overall trend is not slowing down.

How to protect your business

The good news is that most of the protective steps are straightforward. The bad news is that most small business owners skip them.

Check your business credit reports regularly. Dun & Bradstreet, Equifax, Experian, and TransUnion each maintain separate business credit files. Full reports are mostly paid, though some bureaus offer free summaries or tiers. Check them regularly. You're looking for accounts, inquiries, or changes you don't recognize.

Monitor your Secretary of State filings. Some states let you sign up for alerts when changes are made to your business record. If yours doesn't, check your filing manually at least once a year. An unauthorized change to your registered agent or mailing address is a serious warning sign.

Guard your EIN like you guard your SSN. Your EIN is the key to your company's financial identity. Be deliberate about who you share it with, and make sure any vendors or partners who need it have legitimate, verified reasons to ask.

Ask business credit bureaus about fraud alerts. Business credit works differently from personal credit, and options vary by bureau. Experian, for example, accepts a business fraud alert request by letter to Experian Commercial Relations. This won't prevent all fraud, but it adds friction that slows many attempts.

Audit your online presence. Search your business name regularly. If you find websites, social media profiles, or directory listings that look like yours but aren't, that may be an impersonation attempt.

Use strong, unique credentials for financial accounts. Phishing and data breaches are common starting points for business identity theft. Protecting your email accounts, banking logins, and payroll platforms with unique passwords and two-factor authentication closes off a major entry point.

What to do if it's already happened

Act fast. The longer fraudulent accounts sit open, the more damage accumulates.

1. Pull your business credit reports from the business credit bureaus and document every account or inquiry you didn't authorize.
2. Contact the IRS if you suspect EIN fraud, for example after a rejected e-filed return, a return or W-2 you didn't file, an unexpected balance due, or a notice about an EIN you never applied for. Submit Form 14039-B, the Business Identity Theft Affidavit, as the notice instructs, or by mail to IRS, Ogden, UT 84201, or by fax to 855-807-5720. There is no online option. You don't need the form for a data breach that has had no tax impact.
3. Report it to the FTC at IdentityTheft.gov. This creates an official report and a recovery plan.
4. Alert your Secretary of State office if you believe your business registration has been altered.
5. Notify your bank immediately if you suspect account takeover. Most banks have fraud response teams for business accounts.
6. Contact the fraudulent creditors directly. Dispute the accounts in writing, and include documentation that the applications were not authorized by your business.

Recovery is possible, but it takes weeks to months. The earlier you catch it, the shorter and less expensive that process tends to be.

Keeping your business identity secure

Most of the steps above happen outside your inbox. Credit reports, state filings, and IRS notices are things you check on a schedule. But the way fraudsters get hold of an EIN, banking details, or login credentials in the first place is often much simpler: a phishing email or a fake login page aimed at you or someone on your team.

Guardio doesn't monitor business credit files, EINs, or Secretary of State filings. What it does is help protect the accounts that fraud often starts with, on your computer and on your phone:

• Browsing protection blocks known phishing sites and dangerous downloads before they open, on both computer and phone.
• Email Security flags phishing emails and other scams that get past Gmail's spam filter and into your primary inbox, on phone and computer.
• Identity protection scans the dark web for the email address and phone number you add, and alerts you with next steps if they show up in a data breach.

No tool replaces checking your business credit and filings, but protecting the inboxes and logins around your business closes off a common way in.

Conclusion

Your business identity is a real asset. It took time to build, the credit history, the registered standing, the professional reputation. Fraudsters know that, and they're counting on you not watching it closely.

The steps above aren't complicated, but they do require consistency. Check your reports. Monitor your filings. Protect your EIN. And if something doesn't look right, investigate it before it turns into something harder to fix.

Guardio doesn't watch business credit files or state filings, but it helps protect the inboxes and logins that fraud often starts with, on computer and phone. Get a free security scan with Guardio today and stay protected from phishing.