There have been 1.2 million complaints of EIDL loan identity theft as of August 2021, according to a report from the Office of the Inspector General titled Top Management and Performance Challenges Facing the Small Business Administration in Fiscal Year 2022. That means over a million business owners believe their business identity has been used to apply for COVID relief loans administered by the Small Business Administration. 

I’m one of those victims. Here’s what happened to me, along with steps your business can take to protect itself. 

I learned about the fraudulent application because my personal Experian credit report I monitor through Nav listed an inquiry from “SBA ODA,” but I’ve never applied for a loan from the SBA.

I’ve written extensively about the Economic Injury Disaster Loan Program (EIDL) since it launched a nationwide loan and grant program to help businesses impacted by the coronavirus back in March 2020. So when I spotted the inquiry that mentioned SBA ODA, I knew that acronym stood for the SBA Office of Disaster Assistance, and I also knew that meant someone had likely applied for an EIDL using my identity.

This isn’t my first tangle with ID thieves. A few years ago someone opened a retail credit card in my name and placed a large order for sneakers. Then in the spring of 2020, I discovered crooks were again using my name to apply for credit and stimulus benefits. 

An inquiry from a major credit card issuer popped up on my credit report. I hadn’t applied for credit recently, so I called the issuer. They explained there was a pending application for a credit card, but it had not yet been issued. I told them it was fraudulent.

Then an inquiry from a different financial institution appeared on my credit report. This time I learned the would-be crooks had opened a bank account in my name. Weeks later I found out they successfully applied for unemployment using my information, even though I was employed full-time at Nav. Fortunately, the bank froze the check that was deposited from my state unemployment agency before they could cash it. (A second bank account was opened in my name but I was able to close it down quickly before any activity took place.) 

I already had a fraud alert on my credit reports but I renewed it and visited my local sheriff’s office to file a police report, hoping that was the end of it. But then the inquiry from the SBA appeared on my credit report. 

Unlike the other times when I was able to call the financial institutions in question, I wasn’t successful in finding a way to talk with someone from the Small Business Administration to alert them or to find out what was going on. And since SBA EIDL loans don’t show up on personal or business credit reports, I have no way of knowing whether there is an SBA loan outstanding with my name attached to it. (SBA EIDL loans for more than $25,000 result in a UCC-1 filing that would appear on my business credit reports, but so far I haven’t seen one on my credit reports.) 

I’m in the process of filing an identity theft report with the SBA. Ironically, the only option they provide for doing so involves sending a form with personal information and a copy of my ID to them by email; not exactly what I consider the most secure method of communication. 

Identity theft is a growing problem facing business owners. According to a report from the ​​National Cybersecurity Society (NCSS), business identity theft appears to be on the rise. And KrebsonSecurity has reported an alarming rise in small business identity theft. Targets may even include businesses that have closed! 

It can be difficult to spot— or stop— identity theft, especially for small businesses who may not be on the lookout for warning signs. But here are a few strategies to consider:

1. Check and monitor your personal and business credit reports. Suspicious activity, including inquiries or new accounts you don’t recognize, may be a sign of fraud. Since credit bureaus don’t share information with each other except in very limited situations, you’ll want to check and monitor your credit with each of the major consumer credit reporting agencies— Equifax, Experian and TransUnion— and with commercial credit agencies such as Equifax and Experian. (Here are 138+ places to get your free credit scores.) 
2. Watch out for phishing scams such as emails or phone calls that try to trick you into revealing sensitive information. Check links to make sure they are safe (padlock in the URL) and that they match the site you think you’re visiting. Better yet, log into accounts directly from the financial institution’s app or website. 
3. Check and maintain state business filings. Getting a business license and registering a corporate entity or fictitious name (“DBA”) are steps new business owners should take to establish their business. Unfortunately, in some states it’s easy for scammers to check online registrations and then to change them. An address change you didn’t initiate is a huge red flag that something is amiss. 
4. Act quickly if you notice suspicious activity. Place a fraud alert or credit freeze on your personal credit. (Unfortunately you can’t freeze business credit, though Experian does allow you to add a fraud alert to your business credit file.) File a police report. And keep good records; you may find as I did that you need them later on. Visit the Identity Theft Resource Center for helpful information on what to do if you are a victim of id theft. 

Identity theft drains time and resources; both of which business owners often find are in short supply. While you may not be able to stop it all together, proactively taking steps to help protect your personal and business identities can save you valuable time in the long run. 

Access better funding options with a solution you can’t get anywhere else

Reduce the pain in financing with streamlined applications, instant offers and approval rates that are 3.5X higher than industry averages.

I’m Ready