What is business identity theft: How to spot it, stop it, and recover

What is business identity theft?

Business identity theft occurs when a fraudster uses a company’s identifying information — its EIN, legal name, address, or state filings — to open credit accounts, take out loans, file fraudulent tax returns, or change corporate records for their own gain. It often happens without the owner noticing until bills, collections, or government notices arrive. 

You may also see it called commercial identity theft or corporate identity theft. State officials sometimes call the records-based version “business hijacking.” Whatever the label, the target is your business's identity rather than your personal one, and small business identity theft can be just as costly as the personal kind. The damage can include a harmed credit history, denied credit, and unexpected contact from agencies like the IRS. 

Examples of business identity theft

Credit cards and loans opened in your business’s name. A thief can use your company’s information to establish lines of credit with banks, retailers, and vendors. A common first sign is a bill for merchandise bought on credit, a credit card, or a line of credit you never opened. 

EIN misuse for fraudulent tax filings and refund claims. EIN identity theft often shows up as fraudulent business tax returns or W-2s filed under your company’s name or EIN. The thief’s goal is often a refund or refundable credit. 

Hijacking a dormant or dissolved entity. In most states, the Secretary of State oversees business filings, and a dissolved or inactive entity can often be reinstated if it resumes compliance. Fraudsters have filed unauthorized reinstatements, changed the entity’s registration details, and then used the altered record to get loans or lines of credit. The IRS also flags activity on a defunct, closed, or dormant business as a possible sign of identity theft. 

Changing registered officers or addresses in state records. A thief can submit an unauthorized filing that alters an existing business’s address, officers, or employees to open accounts with vendors in your business’s name. 

Vendor and trade credit accounts. Criminals may pose as owners or employees to open accounts with vendors in your business’s name. 

Pandemic-era EIDL and PPP application fraud. During the pandemic, thieves used stolen identities to apply for Economic Injury Disaster Loans (EIDL) and Paycheck Protection Program (PPP) loans. Many potential victims didn’t find out until a bill arrived or a lender contacted them. If a loan was taken out in your name, the SBA requires you to report it.

How do I know if someone opened a business or account in my name?

Business identity theft can be harder to spot than personal identity theft, but there are warning signs to look for:

• Collection calls or bills for accounts your business never opened
• IRS notices about returns or W-2s your business didn’t file or a balance you don’t owe
• State alerts about filings or officer changes you didn’t make
• Vendor invoices or orders you never placed
• Mail that stops arriving, or notices that show an address you don’t recognize
• An address, account, or inquiry on your credit reports you don’t recognize

Where to check:

• Your business credit reports at Dun & Bradstreet^®, Experian^® Business, or Equifax^® Business.
• Your state’s business entity records, for filings under your business’s name and your name as an officer. 
• Your bank and credit card statements, reviewed as soon as they arrive. 

Why monitoring your business credit matters

While data isn’t available on the way business owners find out about identity theft, consumer data offers a useful clue. In the Identity Theft Resource Center’s 2026 report, 24% of new account fraud cases were discovered when the victim checked a credit report. The most common route was a notice from the account issuer at 33%, and 4% of cases surfaced only after a collection notice. That data covers personal identity theft, not business. 

Here’s why it still matters for business owners. For consumers, a credit freeze is the strongest preventative tool. Unlike consumer credit, though, there is no law that requires a credit freeze for business credit. Currently, business credit bureaus don’t offer that option. Experian offers a business credit fraud alert, which you can request by letter.

Business credit monitoring can help you spot accounts opened in your business’s name.

Learn more about when to consider business credit monitoring. 

What to do if your business identity is stolen

If you suspect your business identity has been stolen, act quickly, just as you would with consumer fraud. Identity theft can damage a business’s credit history and lead to denied credit. Here are steps to take:

1. Document everything

Write down what you know: when accounts were opened, when payments stopped, and every call or letter from collectors or agencies. Keep copies of notices and copies of your credit reports. These records can prove essential. 

2. Report it

Report the theft to the following agencies:

• Local police. File a police report. It may not be required but often it can prove helpful as you deal with creditors and credit bureaus. 
• The IRS. If tax records are involved, file Form 14039-B, the Business Identity Theft Affidavit. Use it if you get a rejected e-file return, a notice about a return or W-2 you didn’t file, or a balance you don’t owe. The signer must have legal authority to act for the business. 
• Your Secretary of State. If filings were altered, contact the office. Some states offer filing alerts and complaint processes, so check your state’s Secretary of State site. 
• The U.S. Small Business Administration (SBA). If an SBA loan, including an EIDL or PPP loan, was taken out in your name, report it to the SBA to start its review. 

3. Check your business credit bureaus and dispute fraudulent tradelines

Check your business credit reports with major business credit bureaus including Dun & Bradstreet (D&B), Equifax Business, and Experian Business. If you find accounts you don’t recognize, follow the credit bureau’s instructions for disputing them. 

How to protect your business from identity theft

Prevention doesn’t always stop identity theft, but it can help reduce the chances you’re a target. 

• Guard your EIN. Share it only when required and treat it like a Social Security number. The IRS urges EIN holders to keep the number safe. 
• Keep your IRS information current. Report responsible party and address changes with IRS Form 8822-B.
• Lock down state filings. Sign up for Secretary of State filing alerts where your state offers them. Ohio, for example, emails owners whenever a filing is made on their record. In a National Association of Secretaries of State 2025 survey, 13 of 20 responding states offered a notification option, such as an email or text message. 
• Monitor your business credit reports and set up alerts. With Nav Prime, you can monitor business credit reports from the major bureaus in one dashboard. 
• Review bank and card activity often. Banks and credit card companies often offer account alerts. 
• Limit who can access financial credentials. Revoke access when employees or contractors leave. 
• Secure documents and devices. Shred paper records, encrypt sensitive files, and use multi-factor authentication on email accounts. Train staff to spot phishing, including scams that target payroll and employee data. 
• Close dormant entities formally. An entity left dormant or dissolved can be reinstated by someone else. 

One more protection to keep in mind: Federal law generally caps your liability for unauthorized use of a business credit card at $50, and many cards also offer zero liability. For more details, see our guide to reporting fraudulent transactions on a business credit card. 

Nav is not a lender or a credit bureau. Credit information is provided by third-party sources.

Business identity theft insurance and protection services

Identity theft insurance typically reimburses the costs of recovering from fraud, such as legal fees and lost income. It generally doesn’t reimburse money stolen from you. Most identity fraud coverage is sold to individuals. Businesses are more likely to hold cyber insurance, which is a separate product. 
Check what your current policies cover. General liability policies typically don’t include cyber coverage. 

Protection services work differently. They’re often bundled with insurance and usually include credit monitoring, alerts, and help with restoration. When you compare options, ask: 

• Does it cover the business, or only you personally?
• Which costs does it reimburse, and what are the limits?
• Does it include restoration help?
• Does it respond to the kinds of fraud in this guide, such as fraudulent accounts or tax filings?

Business credit monitoring is one piece of protection. Learn more about Nav’s business credit monitoring.

Business identity theft vs. personal identity theft

There are three main differences between business and personal identity theft:

• Business credit has no required fraud alerts or credit freezes. On the personal side, a freeze blocks new accounts while a fraud alert is designed to tell creditors to take additional steps before extending credit. 
• Many business owners don’t check or monitor their business credit. While free personal credit monitoring is common with personal credit, federal law doesn’t require free business credit reports. 
• Business credit reports generally aren’t covered by federal law. The Fair Credit Reporting Act is a consumer protection law that generally doesn’t apply to commercial transactions, and no federal law gives businesses comparable protections.

See Nav’s guides identity theft vs. fraud and credit freeze vs. fraud alert vs. credit monitoring to learn how to protect your personal credit. 

The bottom line

Business identity theft is often found after the fact rather than stopped in advance. The discovery may be triggered by unpaid bills, an unexpected change in a state filing, or an IRS notice. Resolving business identity theft takes time and effort away from your business. The sooner you catch it, the less time and money you’re likely to spend trying to clear it up. 

Nav Prime can help you check and monitor your business credit. 

Frequently asked questions