Identity Theft Protection for Small Business

Identity theft protection for a small business means locking down the four things fraudsters actually target — your EIN, your business bank and merchant accounts, your business credit file, and your state registration/domain footprint — then monitoring all four so you catch misuse in days, not at tax time. Consumer-style "credit monitoring" alone does not cover a business, because your company has its own identity (an EIN, a D-U-N-S number, a state entity ID) that criminals can hijack to open trade lines, file fraudulent tax documents, or reroute your payments. Real protection is a layered routine: file locks and alerts on the accounts that move money, business-credit monitoring at Dun & Bradstreet / Experian Business / Equifax Business, and a recovery plan that includes how you will keep payroll and suppliers paid while frozen accounts get sorted out.

This guide is written from an underwriter's seat. We see the aftermath: an owner whose operating account was drained or frozen, whose deposits look erratic for a month, and who still has rent and payroll due Friday. Prevention is most of the work — but the last section covers the cash-flow side, because that is where a fraud event quietly becomes a business-survival event.

What business identity theft actually looks like

Business identity theft is not one crime; it is a family of them, and each hits a different account. Knowing the pattern is how you pick the right defense instead of buying a generic "monitoring" subscription that watches the wrong file.

• EIN / tax fraud: A criminal uses your Employer Identification Number to file fake returns, claim refunds, or issue fraudulent W-2s and 1099s in your company's name. You often find out when the IRS rejects your real filing.
• Business credit fraud: Using your entity name, address, and D-U-N-S number, a fraudster opens net-30 trade accounts, store cards, or equipment leases. The bills — and the collections — land on you.
• Bank and merchant-account takeover: Phished or malware-stolen online-banking credentials let someone move ACH/wire funds out, or reroute your card-processing deposits to a different account. This is the fastest way to lose real cash.
• State-registration hijacking: In many states, anyone can file a change of registered agent or officer online for a few dollars. Criminals seize the entity on paper, then use that "proof" to open accounts elsewhere.
• Domain, email, and impersonation fraud: A spoofed domain or a compromised email inbox is used to invoice your customers or approve wire changes to your vendors (business email compromise, or BEC).

The common thread: the target is the company's identity, not the owner's personal SSN. Protection has to be built around those business assets specifically.

The layered protection stack that actually works

Think in layers, from the accounts that move money outward. Do the top layers first; they stop the losses that are hardest to reverse.

1. Bank and payments (do this first). Turn on transaction and login alerts for every deposit and withdrawal. Require dual approval for ACH/wires above a threshold. Use ACH debit blocks / Positive Pay so only pre-authorized parties can pull funds. Never approve a vendor's bank-change request by email alone — verify by a phone number you already have on file.
2. EIN and tax. File on time (an unfiled return is an open door), keep your IRS Business Tax Account access secured, and respond immediately to any notice about a return you did not file. Limit who inside the company can transact with the EIN.
3. Business credit files. Establish and then monitor your profiles at Dun & Bradstreet (D-U-N-S), Experian Business, and Equifax Business. Watch for new inquiries, new trade lines, and address changes you did not make.
4. State registration. Check your Secretary of State filing periodically and set up any available filing-notification or two-factor protection. A surprise "registered agent change" is a red flag.
5. Domain, email, and staff. Enforce multi-factor authentication on email and banking, set SPF/DKIM/DMARC on your domain to reduce spoofing, and train staff on the wire-change and gift-card scams — most breaches start with a person, not a firewall.

You can buy tools for several of these (business-credit monitoring, dark-web scanning, breach services), but tools are a supplement. The controls above — alerts, dual approval, out-of-band verification, MFA — prevent more real-dollar loss than any subscription.

Decision framework: works best when / avoid when

Not every business needs the same level of investment. Use this to size your program.

A heavier, paid, monitored program works best when:

• You process meaningful card or ACH volume, or move wires regularly (higher blast radius if an account is taken over).
• You have employees, contractors, or a bookkeeper with account access (more credentials to protect).
• You already have or are building business credit and trade lines (a credit file worth hijacking).
• You have been breached before, or operate in a targeted sector (construction, freight, medical, professional services handling client data).

Lighter, mostly free controls are enough when:

• You are a solo operator with one bank account and low transaction volume.
• You have no established business credit yet and no employees with access.
• You can realistically self-monitor: read every alert, reconcile weekly, and check your credit and state filings on a schedule.

Avoid these traps regardless of size:

• Relying on personal credit monitoring and assuming the business is covered — it is not.
• Buying monitoring but never turning on bank alerts or MFA (watching the smoke while leaving the door unlocked).
• Approving vendor bank-change or wire requests over email. Always verify out of band.
• Sharing one login across staff, so you cannot tell who did what after an incident.

Example: matching protection to business profile

Illustrative only — every business differs. The point is that the right stack scales with how much money moves and how many hands touch it.

These figures are examples to show relative scale, not quotes. Insurance and monitoring pricing vary widely by carrier, volume, and industry.

Early detection: the signals that mean act now

Speed decides how much you lose. The difference between a $2,000 problem and a $40,000 one is usually how fast someone noticed. Build a routine that surfaces these signals:

• A bank or login alert for a transaction, device, or location you don't recognize.
• Your business-credit file shows a new inquiry, trade line, or address you didn't authorize.
• The IRS rejects your return as already filed, or you get a notice about a filing you never made.
• Vendors ask about orders you didn't place, or customers get invoices you didn't send.
• A Secretary of State change (registered agent, officer, address) you didn't initiate.
• Deposits from your processor stop arriving or land in an unexpected account.

Reconcile bank and processor activity weekly, not monthly. Assign one person to own alerts so nothing sits unread. The cheapest fraud control in existence is a human who actually reads the notifications.

If it happens: the recovery playbook

When you confirm fraud, work fast and in order. Move money-stopping steps ahead of paperwork.

1. Contain the money. Call your bank and processor immediately; freeze or replace affected accounts and cards. For a fraudulent wire/ACH, ask about recall — the first 24-72 hours matter most.
2. Reset access. Change passwords, rotate credentials, and re-enable MFA on banking, email, and payments. Assume the original credentials are compromised.
3. Document and report. File with the FTC (reportfraud.ftc.gov), your local police for a report number, the FBI's IC3 for wire/BEC, and the IRS if the EIN was used. Reports create the paper trail insurers and banks require.
4. Notify the bureaus and correct the record. Alert Dun & Bradstreet, Experian Business, and Equifax Business; dispute fraudulent trade lines. Correct any bad Secretary of State filing.
5. Tell affected parties. Vendors, customers, and — if data was exposed — comply with your state's breach-notification law.
6. Bridge the operating gap. If accounts are frozen or drained, plan how payroll, rent, and suppliers get paid while everything unwinds. That is the next section.

Funding the recovery when fraud freezes your cash flow

Here is what owners underestimate: even when the bank ultimately makes you whole, the money is not there this week. Accounts get frozen during investigation, replacement cards take days, and reversed wires can sit in limbo. Meanwhile payroll, rent, and key suppliers do not pause. A fraud event becomes a survival event in that gap.

Traditional bank loans are the wrong tool here — they underwrite slowly and lean on credit scores that a fraud episode may have just dinged. When you need to bridge a short, temporary gap fast, a revenue-based financing or MCA marketplace is built for exactly this: approval is based on your recent bank deposits and revenue rather than credit alone, so a strong-revenue business with a temporarily messy month or a bruised score can still qualify. Typical parameters we see: minimum funding around $10,000, FICO 500+ considered, and decisions in 24-48 hours once bank statements are in. Funds are repaid as a set share of ongoing sales, which fits an operation that is still generating revenue but has had its cash access disrupted.

Two honest cautions from the underwriting side. First, no legitimate funder guarantees approval — anyone who does is a red flag, ironic given you are recovering from fraud. Second, revenue-based financing is a short-term bridge, not a fix for a structural cash problem; use it to keep operating while your accounts are restored, then let normal deposits carry the repayment. If your revenue is steady and the disruption is temporary, it is one of the few tools that can put working capital in the account before the fraud mess is fully resolved.

For the mechanics of how approval on deposits works and what documents move fastest, see our pillar guides on revenue-based financing and managing business cash flow.