Note: of May 31, 2021, the SBA has stopped the PPP application process.
As of January 1, 2022, they have stopped taking EIDL applications as well.
If you are still receiving letters/emails regarding pre-approved lines of credit for a PPP account—read to learn more.
Have you recently received a letter from the SBA regarding your Paycheck Protection Program “PPP”, or Economic Injury Disaster Loan “EIDL”? If you did and never applied for either one of these, you could be a victim of PPP or EIDL identity fraud.
First off, don’t throw it away. Some people that received these letters thought it was junk mail or a scam and tossed it just like any other spam letter. It was actually a warning sign that a fraudulent loan was taken out using their identity, either personal or business.
What are the PPP and EIDL?
The PPP, or Paycheck Protection Program, is a non-repayable, forgiveness loan that was created by the SBA to help business retain employees during the COVID crisis. As long as funds were used properly by the employer, the loan was to be forgiven.
The EIDL, or Economic Injury Disaster Loan, was created to help meet the financial needs of struggling businesses that were negatively impacted by the pandemic. The EIDL, unlike the PPP, must be repaid at some point; however, if certain criteria were met, the business could refinance the EIDL into a PPP and the loan could be forgiven.
-How opportunities were created for PPP and EIDL Fraud
While these programs were a crucial lifeline for many small businesses during the crisis, they also presented a perfect opportunity for fraud. With over 1.2 million complaints of PPP fraud reported by the Small Business Administration, it is one of the worst cases of large scale fraud in our history. In my opinion, the SBA made three fatal mistakes when rolling out these programs.
- The application processes for these loans were streamlined to expedite the approval process, resulting in a lack of fraud detection.
- Businesses were originally required to apply with their bank. To further streamline the approval process, the SBA announced that a business could apply with any financial institution, including virtual (online) banks.
- Because PPP loans are forgivable, credit checks were not required.
How did the criminals apply for these loans?
1. Applications under fake businesses
Due to data security breaches and data aggregators amassing billions of people’s personal information, there is a good chance your name is waiting to be picked out of the hat when it comes to being a victim of fraud.
With only names, socials, and birthdays, the bad guys completed loan applications simply by creating a fictitious business and providing fake financial documents. In many of the cases we are aware of, the bad guys used the victim’s first or last name followed by “Farms” as the business name. (Smith Farms, James Farms, etc.)
Since the victim’s SSN was used, as opposed to a business FEIN, if the victim’s credit was good, the loan was likely to be approved.
Many of the loans were for $48,900 or less.
As far as proof of ID, the bad guys applied online with the virtual banks. Most, if not all, require very little information or no information for proof of identity. If a driver’s license was required, bad guys can easily make a fake one. The banks do not confirm the photo on the ID matches the photo in the state’s DMV database.
2. Applications under real businesses
Not all the applications were filed under fake businesses. We received calls from a few individuals that discovered someone used their business identity to apply for a loan or multiple loans.
In many states, business records are available to the public. For example, in Florida, anyone can search for businesses registered to conduct business in the state by visiting www.sunbiz.org. The information listed for each business often includes the business address, officers, and FEIN, information required on the PPP and EIDL application.
If you want to learn more about just how easy it is for criminals to use your business for fraud, check out our main article where we go more in depth on what is business fraud.
Warning signs to look for
-Credit inquiries
The biggest indicator that your information was used by bad guys to file these loans would have been a credit inquiry. This would have appeared as a new line of credit opened under the SBA on your credit reports.
It’s possible you wouldn’t have been able to spot any immediate warning signs at all, as the EIDL was the only loan that required a credit check. PPP loans only defaulted on the discrepancy of the financial institution. So, a PPP could have been filed without anyway of you knowing unless you tried to file one yourself.
If you DID see an inquiry from the SBA on your personal credit report, there was a good chance you’ve been a victim. The same goes for your business as well—it could have also shown up on the company’s credit report.
Fake PPP Email Scam
-In regards to your PPP Loan…
This scam has caused even more confusion on a topic that wasn’t so cut and dry already. It’s a phishing email that’s taking advantage of the chaos sparked from all the reports of PPP and EIDL loan fraud by exploiting a person’s panic response.
If you received this email, it is not a result of someone opening a loan in you or your businesses name.
As you can see from this example, this is just one of several attempts sent to one of our emails as of 2022. It’s not the most complex phishing email by any means, but it is certainly enough to elicit a reaction from people aware of PPP fraud.
Businesses typically have emails that are publicly available anyways, so this scam is nothing but another attack sent out to the masses to try an get a few potential victims to click.
Want to learn more about phishing emails and they dangers they pose? Here’s a article showing different examples of phishing attacks and the outcomes that can happen when a malicious link a clicked.
Steps to take if you believe you are a victim
If you received a letter from the SBA regarding a fraudulent PPP or EIDL loan, your best course of action is to contact the financial institute that approved the application and the SBA or visit the SBA and follow their instructions on reporting identity theft.
1. How to determine if someone took out a loan using your identity
If you’d like to see if your business was affected by PPP loan fraud, you can try searching this database that contains every company approved for a PPP loan.
What you’ll need to keep in mind though, is that these databases aren’t always reliable considering how many applications were filed under fake businesses.
2. Check your credit reports
By now (Late 2022), you or your business would have already experienced the fallout caused by a fraudulent PPP or EIDL application. However, it can’t hurt to check your credit reports to see if there are any suspicious accounts opened that you don’t recognize. If there was a fraudulent loan filed, it would show up as opened by the SBA.
If you want to learn more about how to pull your credit reports and what to check for, here’s an article where we go step by step about how to do so.
