Trust...  but verify

In addition to state business registration records, a great deal of other information about your business may also be publicly available. This information can potentially be manipulated or falsified, and used as part of a business identity theft scheme to impersonate your business, or a fraud scheme that targets your business.

Business Credit Reports

Credit reports are a staple of modern commerce and credit decision making, and millions of businesses rely on them every day. Consumers have credit reports; and, because businesses regularly extend credit to each other, businesses have credit reports as well. However, while there are some similarities, there are two critical differences between business credit reports and consumer credit reports that business identity thieves can use to their advantage.

Consumer credit reports contain a significant amount of confidential and sensitive information about the subject of the report that could be misused. Because of this, access to consumer credit reports is restricted to businesses with a permissible business need, companies with whom the consumer has applied for credit, and companies to whom the consumer grants permission.

Business credit reports also contain a significant amount of information about the business that can potentially be misused. (See an example business credit report) However, because business credit reports are intended to promote and foster commerce and aid in risk management decision processes between businesses, a business credit report is readily available and can be purchased by virtually anyone.

Additional information may also be obtained and incorporated into the report from public records and third parties, such as other companies with which the business has credit accounts.  Depending upon the type and source of the report, a business credit report may also contain owner and principal information, financial statements, trade information, public filings, operations and facility information, SIC/SAIC codes, etc. All of this is valuable background information for thieves seeking to target a company for business identity theft.

Because a large amount of the information is self-reported, there is a potential for criminals to gain access to and manipulate the file, changing the information of their target company in order to deceive creditors or lenders as part of their business identity theft scheme. Business registration information that is included in the report is generally obtained and verified through the appropriate Secretary of State. Therefore, in some cases a criminal's first step is to attempt to fraudulently change the state business registration records, and then manipulate the business credit report. An example of this tactic was recently described in The Denver Post:

Fake Business Credit Applications

Criminals know that most business owners are eager to establish more credit for their business

When you want to apply for a personal loan or line of credit, you complete a detailed credit application that provides sensitive personal information that you would not want in the hands of criminals, such as your Social Security number, date of birth, account numbers, etc. Likewise, when your business needs a loan or line of credit, or wants to open a new account, a business credit application is routinely completed. Business credit applications request sensitive business information, such as EIN, account numbers, trade references, etc. that you would also not want in the hands of criminals. Business credit applications also frequently request the personal information of the business owners as well, as guarantors on the accounts. Yet, business credit applications are often received, dutifully completed, and submitted to the requesting party without a second thought.

What if that business credit application is not legitimate?

Thieves do not always need to purchase a business credit report to get the information they need - sometimes unsuspecting business owners willingly send the information to them for free. Business credit applications are commonplace and in many businesses would not raise a red flag, particularly if they appear to originate from a recognized source such as a credit card company, major supplier, or lender. A new line of credit or extended payment terms can be very appealing to a cash-strapped business.

Creating a fake credit application is easy, as is modifying a legitimate form and simply replacing the return mailing address to a criminal's mail drop. If the business owner completes and returns the application without verifying its authenticity, the criminals have all the information needed to defraud the business, or obtain loans or lines of credit in the business' name. The thieves receive the cash or merchandise and disappear, leaving the business and business owner to deal with the mess.

False Business Financial Reports

 

¹ Migoya, David. "Corporate ID thieves mining the store," The Denver Post, 23 September, 2010
² Prashad, Sharda. "Identity theft strikes small businesses," The Globe and Mail, 18 January, 2010