business identity theft

The first sign usually isn’t an alert. It’s a collections call for equipment you never ordered, a vendor asking about an unpaid credit line, or a letter from a lender congratulating “your company” on its new account. By then, someone has been using your business’s name, and its good credit, for weeks.

That is business identity theft, and it is not a niche problem. The Identity Theft Resource Center’s 2025 Business Impact Report found that 81% of surveyed small businesses experienced a security breach, a data breach, or both in the past year, and more than a third of those affected faced costs above $500,000. The FBI’s 2025 Internet Crime Report logged nearly $20.9 billion in reported losses, up 26% from 2024. In Arizona alone, the Corporation Commission received 208 complaints about fake LLCs in a single month in 2025.

Here is how the scheme works, how to spot it early, and what to do in the first 72 hours.

How Business Identity Theft Actually Works

Business identity theft is the impersonation of a company to obtain credit, goods, or money in its name. Criminals like it because commercial credit limits are often higher and less closely watched.

According to the National Association of Secretaries of State (NASS), most schemes follow one of three patterns:

  • Hijacking an active business. The fraudster files unauthorized changes to the company’s address, officers, or registered agent, then uses the updated record to apply for loans or credit.
  • Reviving a dormant entity. A dissolved or inactive company is reinstated and its information is quietly changed during the process.
  • Building a fake business on a real person’s identity. A new entity is formed using someone else’s name or address without permission.

The weak point is structural. NASS notes that in most states, filing offices perform a ministerial role, which means they often cannot question or reject submitted information.

A Real-World Case: 70 Companies, One Fraudster

In a federal case in the Eastern District of Virginia, a Las Vegas man pleaded guilty to mail fraud after impersonating at least 70 legitimate but inactive businesses between 2010 and 2015. He rented virtual office space in their names, set up matching domains and email accounts, and sometimes added false information to state corporate filings and commercial credit records. He then ordered electronics on credit, rerouted the shipments, and resold them. The Justice Department put the losses at no less than $550,000.

The lesson: dormant entities are not “safe” just because they are inactive. Recent Arizona news reports describe residents finding LLCs registered at their own address after receiving mail about credit accounts they never opened.

Warning Signs Your Company’s Identity Has Been Stolen

Most victims find out late. Watch for these red flags:

  • Unfamiliar accounts, inquiries, or trade lines on your business credit report
  • Mail, invoices, or collection notices for purchases you never made
  • Changes to your officers, registered agent, or address on your state filing record that no one authorized
  • An e-filed tax return rejected because one already exists for that period, or IRS notices about returns or W-2s you never filed, which the IRS lists as signs of business identity theft
  • Vendors or lenders asking you to confirm a “new” account

Anomaly detection matters here. Our guide to data analytics in fraud detection explains how unusual patterns surface hidden schemes.

What to Do in the First 72 Hours

Speed limits the damage. If you suspect business identity theft, work through this sequence:

  1. Document everything. Save notices, emails, account numbers, and dates.
  2. Contact your state filing office. Report the unauthorized filing and ask how to correct the record. In Arizona, that is the Arizona Corporation Commission.
  3. Call affected creditors’ fraud departments. Close fraudulent accounts and get written confirmation.
  4. Dispute entries with business credit bureaus. The California Secretary of State points businesses to Dun & Bradstreet, Equifax, Experian, and TransUnion for credit monitoring.
  5. File a police report. Many creditors require one to remove fraudulent debt.
  6. Notify the IRS if taxes are involved. Businesses, trusts, estates, and tax-exempt organizations use Form 14039-B, the Business Identity Theft Affidavit.
  7. Bring in legal counsel and your bank. Fraudulent accounts can raise liability and insurance questions.

Prevention: Controls That Actually Work

Prevention is mostly discipline.

  • Turn on filing alerts. In a 2026 NASS survey, 13 of the 20 responding states offered email or text notifications when a filing is made for a business. Sign up wherever it’s available.
  • Lock down your state portal. Arizona began requiring government-issued ID verification for its online Arizona Business Center on July 20, 2026, and the Commission has announced a signing authority form so owners can designate who may file for the company.
  • Close dormant entities properly. Dissolve inactive companies instead of letting them lapse, since lapsed entities are prime targets.
  • Monitor business credit reports at least quarterly, with a named owner.
  • Limit what’s public. Keep EINs, signatures, and bank details off websites and unsecured email.
  • Build reporting channels. Employees often spot odd vendor calls first. A whistleblower hotline employees actually use helps that information reach you.

Business identity theft also overlaps with lending scams. Our breakdown of merchant cash advance scams and predatory lenders covers related red flags.

Stay Ahead of the Next Scheme

Business identity theft succeeds when nobody watches the records that define your company: its filings, credit file, and tax account. Review them on a schedule, and act within hours when something looks wrong.

Want to see how these schemes play out in real cases? Explore our Case Files and financial crime coverage, and contact FraudOrder with questions.

Frequently Asked Questions About Business Identity Theft

What is business identity theft?

It is the impersonation of a company to obtain credit, goods, loans, or tax refunds in its name. Criminals often alter state business filings or reactivate dormant entities to make the impersonation look legitimate.

How is business identity theft different from personal identity theft?

The target is the company’s EIN, filing record, and credit file rather than a person’s Social Security number. Higher, less-watched credit limits can make losses larger before anyone notices.

Is my company liable for credit opened fraudulently in its name?

Businesses can generally dispute fraudulent accounts, but outcomes depend on contracts, state law, and how fast you report. Consult an attorney about your situation.

Can small or inactive businesses be targeted?

Yes. Federal prosecutors described a scheme built on inactive businesses, and small firms often lack the monitoring larger companies have.

Who should I report business identity theft to?

Start with your state filing office, affected creditors, the business credit bureaus, and local police. If tax filings are involved, file IRS Form 14039-B.

How can I check whether someone changed my company’s filings?

Search your entity in your state’s online business database and review the filing history for changes you didn’t authorize. Many states let you sign up for free email or text alerts when new filings are made.

References

  1. Identity Theft Resource Center. (2025). 2025 Business Impact Report: Costs from cybercrimes are being passed to consumers. https://www.idtheftcenter.org/post/2025-business-impact-report-cybercrime-costs-passed-consumers/
  2. CyberScoop. (2026). FBI Internet Crime Complaint Center annual cybercrime report. https://cyberscoop.com/fbi-internet-crime-complaint-center-annual-cybercrime-report/
  3. National Association of Secretaries of State. (2026). Business filing fraud: A report for state business filing agencies. https://www.nass.org/sites/default/files/surveys/2026-07/final-nass-report-business-filing-fraud-070726.pdf
  4. U.S. Attorney’s Office, Eastern District of Virginia. (2016). Las Vegas man pleads guilty to corporate identity theft scheme. https://www.justice.gov/usao-edva/pr/las-vegas-man-pleads-guilty-corporate-identity-theft-scheme
  5. Internal Revenue Service. (n.d.). Report identity theft for a business. https://www.irs.gov/newsroom/report-identity-theft-for-a-business
  6. Arizona Corporation Commission. (2026). ACC Corporations Division announces new online verification aimed at preventing business filing fraud. https://azcc.gov/news/home/2026/07/13/acc-corporations-division-announces-new-online-verification-aimed-at-preventing-business-filing-fraud
  7. Arizona Corporation Commission. (2025). ACC Corporations Division taking steps to prevent business fraud. https://azcc.gov/news/home/2025/01/28/acc-corporations-division-taking-steps-to-prevent-business-fraud
  8. California Secretary of State. (n.d.). Business identity theft resources. https://www.sos.ca.gov/business-programs/customer-alerts/alert-business-identity-theft
  9. KOLD News 13. (2026). Fake businesses are a real problem in Arizona. https://www.kold.com/2026/06/25/fake-businesses-are-real-problem-arizona/

Disclaimer

This article is for informational purposes only and is not legal, financial, or professional advice. Reading it does not create a client relationship. Consult qualified legal and financial professionals about your specific situation. For questions about FraudOrder services, visit https://fraudorder.co/