Fraud Alert: PPP Loans

Please be advised we have learned that businesses that received PPP loans during the pandemic are being targeted by Bank Impersonators.

PPP Loan Customers Targeted from Public Record

Publicly released Paycheck Protection Program (PPP) loan data from the U.S. Small Business Administration (SBA) has been exploited by scammers to target both PPP recipients and other business banking customers.

How the Data Was Released

The SBA initially fought to protect PPP borrower information but ultimately released a complete and detailed list of all borrowers, including:

• Business name
• Address
• Loan amount
• Lender information
• Industry and other voluntary borrower data 

How Scammers Exploit It

Fraudsters use the publicly available details to:

• Impersonate banks, law enforcement, or government agencies to appear legitimate 
• Call or send letters referencing specific PPP loan details you didn’t share 
• Request online banking credentials, one-time passcodes (OTPs), or passwords to access accounts 
• Attempt to intercept OTPs used for digital banking authentication 

Common Scam Tactics

• Calls from spoofed numbers (e.g., Florida numbers in some cases) claiming urgent account issues.
• Urgent payment demands or claims of warrants to avoid arrest.
• Instructions to “stay out of your account” while they “fix” it.
• Mailed letters with urgent account or digital banking instructions 

Why It’s Effective

Scammers can match their messages to publicly available loan records, making their communications sound credible and increasing the likelihood of victims complying 

Red Flags to Watch For

• Requests for OTPs, passwords, or device codes.
• Urgent threats of legal action or account closure.
• Calls from unfamiliar or spoofed numbers.
• Mailed letters with urgent account instructions 

What to Do

• Do not share banking credentials, OTPs, or passwords.
• Hang up on suspicious calls and call your bank directly from a known number.
• Enable dual control for wires and ACH transactions.
• Set up alerts for new device enrollments and password changes.
• Report suspicious activity immediately to your bank’s fraud department 
• Bank fraud alerts: Contact your bank’s customer care or fraud support team if you suspect targeting.

If you or your business has been contacted, treat it as a scam until you confirm it directly with your bank.