Business Identity Theft: Criminals Can Steal Your Company, Not Just Your Data

Most people know about personal identity theft, someone stealing your name and Social Security number to open credit in your name. Far fewer know that the same thing can happen to a business, and that when it does, the damage can be even larger and harder to unwind. Criminals can, in effect, steal your company's identity: filing fraudulent paperwork to take control of your business on paper, opening credit lines and running up debt under your business's name and tax ID, and impersonating your company to your own customers and vendors. This is business identity theft, and it is a genuinely serious threat that very few owners are watching for.

The reason it flies under the radar is that it does not look like a typical cyberattack. There is no hacked computer, no locked files, sometimes no obvious digital break-in at all. Instead, a criminal exploits the public and administrative systems your business exists within, its state registration, its tax ID, its credit profile, to impersonate it. The good news is that once you understand how it works, you can watch for it and shut it down, and much of the monitoring is free. Let me walk you through what business identity theft looks like and how to protect your company from it.

The three main forms of business identity theft

Business identity theft shows up in a few distinct ways, and they can overlap. Understanding each helps you know what to watch for.

1. Fraudulent business filings

Your business exists as an official entity registered with the state, in Illinois, through the Secretary of State. Those registration records list things like your business's officers, its registered agent, and its address, and they can be changed through filings. Here is the vulnerability: a criminal can file fraudulent changes to your business's registration, altering the listed officers or address to gain a form of control on paper, or to make subsequent fraud look legitimate. They might change your registered agent or officer information so that they appear to have authority to act for your business, then use that apparent authority to open accounts or credit in the company's name. Because these filing systems are administrative and often do not deeply verify who is submitting a change, a fraudulent filing can slip through, and you may not know unless you are checking.

2. EIN theft and business credit fraud

Your business has a federal tax ID, an EIN, that functions somewhat like a Social Security number for your company. With your business's identifying information, including that EIN, a criminal can attempt to open credit lines, apply for loans, obtain business credit cards, or make purchases on credit in your company's name, then take the money or goods and leave your business holding the debt and the damaged credit. They may also commit tax fraud using your EIN. Business credit fraud can run up large sums quickly, precisely because businesses often have access to more credit than individuals, and you may not discover it until creditors come calling or your business credit is already wrecked.

3. Impersonating your business to others

The third form is impersonation aimed outward, at the people who trust your business. A criminal poses as your company to defraud your customers, vendors, or partners, using your business's name and reputation as cover. This can include setting up lookalike websites, email addresses, or accounts that appear to be yours, which is one reason keeping your real web presence secure and monitored matters, as we cover in small business website security. When criminals wear your company's identity to scam the people who rely on you, the financial and reputational harm lands on you, even though you did nothing wrong.

Why this is so damaging, and so overlooked

Business identity theft is uniquely harmful for a few reasons. The dollar amounts can be large, because it taps into business credit and accounts. It can be slow to discover, because it happens in administrative and financial systems you may not check often, so the damage compounds before you notice. And it can be genuinely difficult to unwind, requiring you to prove that filings, accounts, or debts are fraudulent and to correct records across state agencies, creditors, and credit bureaus, which takes time and effort during which your business's standing may be impaired.

It is overlooked mostly because it does not fit the mental image of a cyberattack. Owners protecting against hackers may never think to watch their state filings or their business credit. But these are exactly the places business identity theft operates, which means the defense is largely about monitoring the right things and acting fast if something looks wrong.

How to protect your business and monitor for it

The encouraging part is that much of your defense here is straightforward vigilance, and several key monitoring steps cost nothing. Here is how to protect your company.

• Check your state business filings regularly. Make it a habit to look up your business in the Illinois Secretary of State's Business Entity Search and confirm that the information on file, your officers, registered agent, and address, is correct and unchanged. Doing this periodically means you catch a fraudulent filing quickly rather than months later. If you ever see a change you did not make, treat it as urgent.
• Monitor your business credit. Just as you might watch your personal credit, keep an eye on your business credit profile through the business credit bureaus, such as Dun and Bradstreet, Experian, and Equifax. Watching for new accounts, inquiries, or changes you do not recognize is how you catch EIN and credit fraud early. Some services offer business credit monitoring and alerts, which are worth considering.
• Watch your mail and your inbox for the tell-tale signs. Unexpected mail from the state about filings you did not submit, notices from creditors about accounts or applications you did not open, bills or collection notices for debts that are not yours, or confirmations of changes you did not request are all red flags. Do not dismiss them as errors. Investigate promptly.
• Protect your business's identifying information. Guard your EIN and sensitive business details much as you would sensitive personal information, sharing them only when genuinely necessary and with trusted parties, and securing the accounts and systems where they live. This connects directly to protecting your business finances, which we cover in protect your business bank account.
• Secure your accounts and web presence. Because impersonation and account access play a role, the fundamentals still matter here: multi-factor authentication and strong protections on your business email and accounts, and keeping your real website and domain secure so criminals cannot easily hijack or imitate your online identity.
• Act fast if you spot it. If you find evidence of business identity theft, move quickly. Report fraudulent state filings to the Illinois Secretary of State's Business Services and, where appropriate, the Illinois Attorney General's office. Contact the creditors and bureaus involved to dispute fraudulent accounts. Report tax-related fraud to the relevant tax authorities, and file a complaint with the FBI at ic3.gov for the cyber-enabled elements. As with most fraud, speed improves your outcome. (Specific reporting steps and agencies can change, so confirm the current process with the relevant offices.)

How we think about it

Protecting your company's whole identity, not just the data on your computers, is part of how we think about security at Red Door Shield, through a simple framework we call KIT: Keep, Inspect, Trust. Keep what is valuable secure, including the business information, accounts, and credentials that criminals need to impersonate your company, protected with strong logins and multi-factor authentication. Inspect what is coming in, and in this case what is happening to your business out in the world, watching your filings, your credit, and your online presence for signs of impersonation. And trust through validation, verifying rather than assuming when it comes to changes and accounts tied to your business. Your company's identity is an asset worth guarding as carefully as its data, and we help you protect the whole of it.

What ready looks like

Picture keeping a quiet, regular eye on your business's identity: your state filings checked and correct, your business credit monitored with no surprises, your EIN and business information guarded, your accounts and website secured, and a clear plan to act fast if anything ever looks wrong. A criminal who tries to file a fraudulent change or open credit in your company's name finds that you notice quickly and shut it down, long before it becomes a disaster. Your company's identity is yours, and you are watching over it.

That is what ready feels like. Not assuming your business identity is safe simply because your computers are, but actively guarding the filings, credit, and reputation that make your company what it is.

Business identity theft is a serious and underappreciated threat, and criminals really can attempt to steal your company itself, not just your data. But it is also very catchable, because it operates in places you can monitor, and much of that monitoring is free and simple to build into your routine. If you want help protecting your business's identity, accounts, and online presence as part of a complete security picture, our free Business Security Assessment is the place to start, and it is a conversation worth having today.

Learn about protecting your Chicago small business, read about business email compromise, or see our guide on protecting customer data.