Please be advised we have learned that businesses that received PPP loans during the pandemic are being targeted by Bank Impersonators.
PPP Loan Customers Targeted from Public Record
Publicly released Paycheck Protection Program (PPP) loan data from the U.S. Small Business Administration (SBA) has been exploited by scammers to target both PPP recipients and other business banking customers.
How the Data Was Released
The SBA initially fought to protect PPP borrower information but ultimately released a complete and detailed list of all borrowers, including:
- Business name
- Address
- Loan amount
- Lender information
- Industry and other voluntary borrower data
How Scammers Exploit It
Fraudsters use the publicly available details to:
- Impersonate banks, law enforcement, or government agencies to appear legitimate.
- Call or send letters referencing specific PPP loan details you didn’t share.
- Request online banking credentials, one-time passcodes (OTPs), or passwords to access accounts.
- Attempt to intercept OTPs used for digital banking authentication.
Common Scam Tactics
- Calls from spoofed numbers (e.g., Florida numbers in some cases) claiming urgent account issues.
- Urgent payment demands or claims of warrants to avoid arrest.
- Instructions to “stay out of your account” while they “fix” it.
- Mailed letters with urgent account or digital banking instructions.
- Fraudulent text messages appearing to come from your bank and designed to create urgency, prompting you to share sensitive information or visit external websites.
- Fraudulent invoices for products or services that were never requested.
- Requests for advance payments or sensitive information, such as Social Security numbers or bank account details, in connection with applying for or speeding up a PPP loan.
Why It’s Effective
Scammers can match their messages to publicly available loan records, making their communications sound credible and increasing the likelihood of victims complying.
Red Flags to Watch For
- Requests for OTPs, passwords, or device codes.
- Urgent threats of legal action or account closure.
- Calls from unfamiliar or spoofed numbers.
- Mailed letters with urgent account instructions.
- Unexpected emails or phone calls from anyone claiming to represent the Small Business Administration (SBA) or a financial institution.
What to Do
- Do not share banking credentials, OTPs, or passwords.
- Take time to confirm that any communication is legitimate, especially if it is unexpected.
- Hang up on suspicious calls and call your bank directly from a known number.
- Enable dual control for wires and ACH transactions.
- Set up alerts for new device enrollments and password changes.
- Report suspicious activity immediately to your bank’s fraud department.
- Bank fraud alerts: Contact your bank’s customer care or fraud support team if you suspect targeting.
- Do not share sensitive information or send money in advance in connection with a government loan.
If you or your business has been contacted, treat it as a scam until you confirm it directly with your bank.
