Author: Jeff Weeks, Senior Vice President and Chief Information Security Officer
Key Takeaways
- Scammers are targeting PPP loan recipients using publicly available loan data to appear legitimate.
- Common tactics include impersonating law enforcement, spoofing banks and sending official-looking mail.
- Red flags include urgent threats, demands for payment and requests for sensitive information.
- Get tips to protect your business.
To help businesses cover expenses related to the COVID-19 pandemic, nearly $8 billion in funds were distributed in the form of Paycheck Protection Program (PPP) loans, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act. Ninety-seven percent of funds were used to cover payroll expenses, which qualified borrowers for forgiveness under the program terms. Now, scammers are targeting PPP loan recipients by falsely questioning eligibility for the loan or its current status.
PPP scams use a combination of personal and loan details to appear legitimate, information that is easy for them to obtain. In July of 2020, the U.S. Small Business Administration, in conjunction with the Department of Treasury, publicly disclosed the details of the 4.9 million loans. Available data includes recipient names and states of operation, making it easy for fraudsters to identify businesses to target with PPP-related scams.
How PPP Loan Scams Work
- Law enforcement impersonation: Scammers call company leaders, pretending to represent local law enforcement. Businesses are told their legitimate loan was flagged as fraudulent or that the owner missed an important court date related to a fraudulent loan. Scammers threaten immediate arrest unless repayment is made.
- Bank spoofing: Other fraudsters spoof phone numbers, claiming to represent the business’ bank. The caller claims there are issues with the PPP loan or loan forgiveness and offers to help resolve the situation. In the process, sensitive information is requested, such as online banking credentials or one-time security codes sent to devices. This information is then used to drain money from bank accounts.
- Mail: Businesses are also receiving official-looking documents in the mail that claim to be from entities such as the Small Business Administration or the Department of Justice. Recipients are given details from their actual loans to bolster the scammer’s credibility and told they are under threat of immediate arrest for fraudulent statements related to their loan. Severe fines and lengthy prison terms are often mentioned as a way to push business owners into paying alleged fines to the scammers.
What Are the Red Flags for PPP-Related Fraud?
It’s important to recognize the tactics being used:
- Threatening language: Scammers threaten you or your business with arrest or fines.
- Urgency: Scammers push you to act quickly and avoid contacting others, eliminating time to think and consider the logic of the situation.
- Requests for sensitive information: Scammers express the need for usernames, passwords, PINS or verification codes sent to devices.
How to Protect Your Business from PPP Loan Fraud
If you were the recipient of a PPP loan, there are several steps you can take to avoid becoming a victim of a fraud scheme:
- Independently verify information: If you are contacted by someone regarding your PPP loan, end the call immediately and seek independent verification from your bank or the SBA, using official contact information.
- Safeguard sensitive information: Never share requested details related to your bank accounts or online access, as scammers can use this information to make withdraws.
- Ignore demands for payment: Scammers may claim to have your best interests at heart and offer to resolve alleged issues for a fee. Never pay money when contacted about your PPP loan without first verifying the situation with official sources, using legitimate contact information.
- Report fraud: If contacted by a scammer about your PPP loan, be sure to report it to your local FBI field office or IC3.gov, the FBI’s central online hub for reporting cybercrime. Reporting the incident provides officials with valuable information for assessing the current threat landscape and issuing information that could protect future potential victims.
One thing to remember is that legitimate financial institutions and government agencies will never ask for sensitive information or banking credentials via phone, email or text.
About the Author
Jeff has been with First National Bank of Omaha for more than 26 years and is currently the Senior Vice President and Chief Information Security Officer. The executive leadership and oversight provided by Jeff in the development, management, and execution of information security for FNBO enables the company’s ability to posture and protect private, personal information, and assets of the company’s clients, employees, and business partners.
