How to Prevent Business Identity Theft

Can Identity Theft Affect a Business?

Most people associate identity theft with individuals: stolen Social Security numbers, fraudulent credit cards, or accounts opened in someone else’s name.

But businesses have identities too.

A company may have an Employer Identification Number (EIN), bank accounts, credit relationships, tax records, online accounts, email domains, vendor relationships, licenses, and other information that criminals can misuse.

Business identity theft occurs when someone uses identifying information associated with a business without authorization for fraudulent purposes.

Depending on the situation, criminals may attempt to:

• use a company’s EIN or tax information,
• open unauthorized accounts or lines of credit,
• impersonate the company in emails,
• redirect customer or vendor payments,
• submit fraudulent tax documents,
• change banking or payment information,
• take over legitimate business accounts,
• create convincing fake invoices,
• or use employee credentials to gain access to company systems.

The IRS specifically warns businesses to watch for signs such as tax returns filed under their EIN that they did not submit, unexpected IRS notices, fictitious employees, unfamiliar business accounts, and unexplained financial activity.

The challenge is that business identity theft may not become obvious immediately.

A fraudulent account, altered payment instruction, compromised email account, or unauthorized tax filing may operate quietly until someone notices something that does not belong.

How Business Identity Theft Happens

There is no single method attackers use.

Often, business identity theft begins with access to information that appears relatively ordinary.

Phishing and Social Engineering

An attacker may impersonate:

• an executive,
• accounting employee,
• vendor,
• customer,
• bank,
• Microsoft,
• payroll provider,
• government agency,
• or IT provider.

The goal may be to persuade an employee to reveal credentials, send sensitive information, change payment instructions, or take another action that helps the attacker.

These attacks rely heavily on trust and urgency rather than sophisticated technical exploits.

Our guide to 5 Examples of Social Engineering Attacks explains several ways attackers manipulate employees into taking actions that appear legitimate.

Compromised Email Accounts

A stolen business email account can be particularly valuable.

If an attacker gains access to a real employee mailbox, the attacker may be able to study:

• customers,
• vendors,
• invoices,
• payment procedures,
• organizational roles,
• upcoming transactions,
• and normal communication patterns.

That information can then be used to create a much more convincing fraud attempt.

For example, an attacker could compromise a vendor's email account, wait for a legitimate invoice conversation, and then send new banking instructions from the real account.

To the recipient, the message may appear completely normal.

Stolen Login Credentials

Business credentials can be stolen through:

• phishing,
• malware,
• fake login pages,
• password reuse,
• compromised personal accounts,
• or poorly protected systems.

Once an attacker has credentials, they may attempt to access email, Microsoft 365, cloud applications, financial services, payroll systems, vendor portals, or other business resources.

This is one reason unique passwords and multi-factor authentication are so important.

Publicly Available Business Information

Some company information is intentionally public.

Business names, addresses, executive names, phone numbers, registration information, employee roles, and other details may be available through websites, social media, business directories, or government records.

Attackers can combine that information with stolen data to create convincing impersonation attempts.

You cannot hide everything about a business.

The goal is to protect the information that should remain private and make it harder for criminals to convert public information into unauthorized access or fraud.

How to Prevent Business Identity Theft

There is no single security product that can prevent every type of business identity theft.

Businesses should use several overlapping controls.

1. Protect Your Most Sensitive Business Information

Start by identifying the information an attacker could misuse.

That may include:

• EIN and tax information,
• bank-account information,
• payroll information,
• customer information,
• employee records,
• credit information,
• administrative credentials,
• account-recovery information,
• and documents containing signatures or financial details.

Access should be limited to employees who actually need the information.

Sensitive information should not be stored indefinitely simply because it might someday be useful.

The less unnecessary sensitive information a business retains, the less information there is to expose.

2. Require Multi-Factor Authentication

A password should not be the only protection around important business accounts.

Use MFA wherever practical, particularly for:

• Microsoft 365,
• email,
• banking,
• remote access,
• administrative accounts,
• cloud platforms,
• financial applications,
• and other critical systems.

MFA cannot eliminate account compromise, but it adds an important barrier when a password is stolen.

Employees should also understand that they should never approve an unexpected MFA request.

If they did not initiate the login, they should deny the request and report it.

3. Use Unique Passwords and a Password Manager

Password reuse creates unnecessary risk.

If an employee uses the same password for multiple accounts and one service is compromised, attackers may try those credentials elsewhere.

A business-approved password manager can make it practical to use long, unique passwords without expecting employees to memorize every credential.

Administrative accounts deserve particular attention because compromising one may give an attacker access to many other systems.

4. Protect Your Business Email

Email is one of the most common routes into business fraud.

Businesses should combine employee awareness with technical protections such as:

• spam and phishing filtering,
• MFA,
• suspicious-login monitoring,
• protection against malicious links and attachments,
• and proper email authentication.

Email authentication technologies such as SPF, DKIM, and DMARC can help receiving mail systems determine whether messages claiming to come from your domain are authorized.

The Federal Trade Commission specifically recommends email authentication as one way businesses can make impersonation scams more difficult.

The FTC's guidance is available here: Small Business? Know How to Stop a Would-Be Business Impersonator.

5. Train Employees to Verify Sensitive Requests

Technology cannot identify every fraudulent request.

Employees need clear procedures for situations involving:

• changing vendor banking information,
• wire transfers,
• payroll changes,
• account recovery,
• requests for tax information,
• gift-card purchases,
• unusual executive requests,
• and disclosure of sensitive information.

A simple verification process can prevent a major loss.

For example, if a vendor emails new banking instructions, call a known contact at the vendor using a phone number already on file.

Do not verify the request by replying to the same potentially compromised email.

The same principle applies when an executive appears to request an unusual payment or an employee asks to change direct-deposit information.

Verify unusual requests through a separate trusted channel.

Our Hackproof Your Workforce article explains how employee cybersecurity training can reinforce habits such as stopping, verifying, and reporting suspicious requests.

6. Limit Administrative Access

Not every employee needs administrative rights.

Businesses should follow the principle of least privilege: users receive the access necessary for their responsibilities, but not more than they need.

Administrative accounts should be:

• limited,
• separately protected,
• monitored,
• secured with MFA,
• and used only when necessary.

If one user account is compromised, limiting its permissions can reduce what an attacker can reach.

7. Monitor Bank and Financial Accounts

Financial fraud is easier to contain when it is detected quickly.

Businesses should review account activity regularly and consider using available alerts for:

• large transactions,
• wire transfers,
• new payees,
• unusual withdrawals,
• password changes,
• and other significant account activity.

Reconciliation should not be delayed indefinitely.

An unfamiliar transaction should be investigated promptly.

8. Watch Business Credit and Unexpected Accounts

An unauthorized business account or line of credit may be an early warning sign of identity misuse.

Businesses should investigate:

• bills for accounts they did not open,
• unfamiliar credit inquiries,
• unexpected collection activity,
• new accounts appearing on credit reports,
• and changes in credit activity that management cannot explain.

The IRS also lists unauthorized business credit accounts and unexplained financial activity among potential signs of business identity theft.

9. Protect Your EIN and Tax Information

An EIN is a business tax identifier and should be treated as sensitive information.

The IRS warns that criminals may misuse business identifying information to file fraudulent tax returns or Forms W-2.

Potential warning signs include:

• an electronic tax return being rejected because one has already been filed,
• an unexpected IRS notice,
• tax documents the business did not submit,
• IRS correspondence involving employees the business does not recognize,
• or expected IRS mail suddenly not arriving because the business address has been changed.

The IRS provides current guidance at Identity Theft Information for Businesses.

10. Keep Business Registration and Contact Information Current

Businesses should periodically review important records associated with the company.

That can include:

• state business registrations,
• IRS responsible-party information,
• banking contacts,
• domain registrations,
• vendor profiles,
• and other accounts where unauthorized changes could create problems.

The IRS specifically recommends keeping EIN information current and updating the responsible party or address when necessary.

Unexpected changes should be investigated.

11. Keep Systems Patched and Protected

Business identity theft is not always purely a financial scam.

Attackers may first compromise a computer, email account, or network and then use the information they find to commit fraud.

Basic cybersecurity controls should include:

• managed endpoint protection,
• security updates,
• patch management,
• firewalls,
• MFA,
• email protection,
• monitoring,
• and reliable backups.

The goal is to make it harder for an attacker to obtain the information needed to impersonate the business.

Businesses that need help coordinating these protections can learn more about our Managed Security Services.

What Are Warning Signs of Business Identity Theft?

Business identity theft can appear in several different ways.

Warning signs may include:

• an unexpected IRS or state tax notice,
• rejection of a legitimate tax filing,
• accounts or lines of credit you did not open,
• unfamiliar transactions,
• invoices customers say they received but your company did not send,
• complaints about emails your company did not send,
• unauthorized password or account changes,
• unexplained mail or email forwarding,
• new administrative users,
• unexpected MFA requests,
• vendor banking information changing unexpectedly,
• or unusual login activity.

One warning sign does not automatically prove identity theft.

But unexplained activity should not simply be ignored.

What Should You Do If Your Business Identity Is Stolen?

The appropriate response depends on what was compromised.

A stolen Microsoft 365 account requires a different response from a fraudulent tax filing or unauthorized bank transaction.

But several actions generally deserve immediate consideration.

1. Contain the Compromise

If an online account may have been compromised:

• change affected credentials,
• reset related passwords,
• revoke active sessions where appropriate,
• review MFA settings,
• remove unauthorized account-recovery methods,
• and check for unfamiliar users or administrative privileges.

For email compromises, also review:

• inbox rules,
• forwarding rules,
• deleted messages,
• sent items,
• and unusual mailbox permissions.

Attackers sometimes create forwarding rules so they can continue receiving messages even after the original compromise is discovered.

2. Contact Financial Institutions Quickly

If banking, credit cards, payments, or transfers are involved, contact the financial institution immediately.

Fraudulent transactions can become more difficult to reverse as time passes.

Ask the bank what actions should be taken to secure the account and preserve any available recovery options.

3. Preserve Evidence

Do not immediately delete everything associated with the incident.

Preserve items such as:

• suspicious emails,
• message headers,
• invoices,
• transaction records,
• screenshots,
• login records,
• and other relevant information.

Those records may help IT personnel, financial institutions, insurers, law enforcement, attorneys, or investigators understand what happened.

4. Notify the IRS When Tax-Related Business Identity Theft Is Suspected

If someone appears to be using your business name or EIN to file fraudulent tax returns or Forms W-2, follow IRS reporting procedures.

The IRS uses Form 14039-B, Business Identity Theft Affidavit, for qualifying business identity-theft situations. Current instructions are available at Report Identity Theft for a Business.

Do not submit the form solely because the company experienced a general cybersecurity incident. The IRS distinguishes tax-related identity theft from a data breach that has no known tax impact.

5. Review Business Credit and Accounts

Look for:

• unfamiliar credit accounts,
• unauthorized inquiries,
• unexpected bills,
• unexplained withdrawals,
• and changes to existing accounts.

Close or dispute fraudulent accounts using the procedures provided by the relevant financial or credit institution.

6. Notify Your Cyber Insurance Provider When Appropriate

If your organization carries cyber insurance, review the policy's notification requirements.

Some policies require prompt notice and may specify approved incident-response, forensic, legal, or breach-response providers.

Do not wait until the investigation is complete before determining whether notice is required.

7. Determine How the Incident Happened

Once the immediate problem is contained, investigate the underlying cause.

Was the attack caused by:

• phishing?
• password reuse?
• a compromised email account?
• missing MFA?
• malware?
• excessive account permissions?
• an exposed vendor account?
• inadequate payment-verification procedures?

Fixing the immediate fraudulent transaction without correcting the underlying weakness can leave the business exposed to another incident.

Business Identity Theft Is Both a Security and Business Risk

Business identity theft does not fit neatly into one category.

It can involve cybersecurity, finance, accounting, taxes, employee information, vendors, customers, and company reputation at the same time.

That is why prevention should not depend on one employee or one security product.

A stronger approach combines:

• MFA,
• secure email,
• employee training,
• least privilege,
• endpoint protection,
• financial monitoring,
• payment-verification procedures,
• protected tax information,
• business-credit monitoring,
• and a documented response plan.

You may not be able to prevent every attempt to impersonate or misuse your business identity.

But you can make those attempts significantly harder to succeed—and put your organization in a much better position to detect and respond when something looks wrong.