Small Business Loan Scams: How to Spot Them and Stay Safe

The single most reliable sign of a small business loan scam is a request for money up front — an "advance fee," "insurance deposit," or "processing payment" you have to wire before funds are released. Legitimate business funders are paid out of the deal, not before it; they deduct fees from the disbursement or build them into the payback, and they never ask you to send cash to unlock an approval. Real scams also cluster around a few other tells: guaranteed approval regardless of credit, pressure to decide today, requests for remote access to your bank login, and lenders who cannot be found in any state or federal registry. This guide walks through each pattern the way an underwriter reads a file, gives you a verification checklist you can run in ten minutes, and shows a decision framework for when to walk away versus when a fast, revenue-based offer is genuinely legitimate.

The core red flags: what an underwriter sees before you do

Fraud has a grammar, and once you learn it, most scams announce themselves in the first email or phone call. Here is what a funding professional treats as an immediate stop:

• Money before money. Any demand to wire, Zelle, gift-card, or crypto a fee before you receive funds is disqualifying. Real origination, broker, or underwriting fees are netted from the disbursement or amortized into the payback — you should never fund the lender.
• Guaranteed approval. Underwriting is the product. A funder who "guarantees" approval before seeing a single bank statement is either lying to get a fee or harvesting your data. Legitimate offers are always conditional on revenue, deposits, or credit.
• Pressure and a fake clock. "This rate expires at 5 p.m." exists to prevent verification. A real offer is repriced, not vaporized, if you take a day.
• Credential and access requests. Asking for your online banking password, a screen-share into your bank, or your full SSN over an unsecured channel is a data-theft pattern. Real bank verification uses read-only statement uploads or a secure aggregator link.
• Channel mismatch. A "bank" emailing from a Gmail address, a number that only reaches voicemail, a contract with no legal entity name, or a website registered weeks ago.

None of these alone proves fraud in isolation — but two or more together mean you close the tab.

The five scam archetypes targeting US business owners

Most complaints fall into a handful of repeatable schemes. Recognizing the shape helps you place a new pitch instantly.

1. Advance-fee fraud. The classic. You're "approved" for a large amount, then told to pay an up-front fee for insurance, a good-faith deposit, tax, or first-payment escrow. Once you pay, the funder vanishes or invents a new fee.
2. Lender impersonation. Scammers copy the name, logo, and even the website of a real SBA lender, bank, or well-known online funder, then route you to a lookalike domain or a personal phone line. The SBA and major banks are frequently spoofed.
3. Phishing for data. The "application" exists only to collect your EIN, SSN, bank details, and voided check — which are then used for identity theft or to drain the account. There's never a real offer.
4. Fake broker / bait-and-switch. A broker collects a fee to "shop" your file, then either disappears or delivers a far worse product than advertised. Brokers are legitimate — paid up-front fees to a broker are not the norm.
5. Grant and government-program scams. "You qualify for a federal small-business grant" (often via social media DM) that requires a processing fee. Real federal grants are listed on Grants.gov and never require a fee to claim.

Example: legitimate offer vs. scam offer, side by side

The table below contrasts two offers a business owner might receive in the same week. Figures are illustrative, for example purposes only, to show the pattern — not a quote.

A real fast-funding product — for example a revenue-based advance approving on deposits with funding in 24-48 hours — still checks every box in the left column. Speed is not the scam signal; the fee-before-funding and guaranteed-approval columns are.

A 10-minute verification checklist before you send anything

Run this before you upload a statement, sign, or pay a cent. It's the same diligence an underwriter runs on a counterparty.

• Confirm the legal entity. Get the exact company name and search your state's Secretary of State business registry. No registration, no deal.
• Check the domain age. A funder with a domain registered a few weeks ago and a polished "20 years in business" claim is lying about one of them.
• Verify contact reality. Call the number on the official website — not the one texted to you. A real funder has a staffed line and a physical US address, not just a mobile and a Gmail.
• Search the name plus "scam" and "complaint." Check the BBB, the FTC, and reviews that predate your contact. A clean but brand-new footprint is its own flag.
• Read the contract for named parties and clear terms. If the agreement names no legal entity, or the fee structure is vague, stop.
• Never share login credentials. Provide statements as read-only PDFs or through a secure bank-verification link, never a password or screen-share.
• Confirm SBA or bank claims directly. If someone claims to be an SBA lender, verify against the SBA's own lender list, not their say-so.

If you want a deeper primer on how legitimate underwriting actually reads your file, see our pillar on business loan requirements and how funders evaluate you.

Decision framework: when a fast offer is safe vs. when to walk away

Speed and a light credit check are not the same as fraud. The question is whether the mechanics are legitimate. Use this framework.

A fast, revenue-based offer works best when:

• The funder can be verified — registered entity, real address, footprint that predates your call.
• Approval is tied to your bank deposits and revenue, and they ask for statements (read-only), not passwords.
• All fees are disclosed in writing and come out of the funding or the payback — nothing is due before you're funded.
• You have real, near-term revenue to support repayment from cash flow, and you need capital in days, not weeks.
• The offer survives a 24-hour pause without "expiring."

Avoid — and treat as a likely scam — when:

• Any fee must be paid up front, in any form, before funding.
• Approval is "guaranteed" regardless of credit or revenue.
• They want your online banking login, screen-share, or full SSN over text/email.
• The entity can't be found in any state or federal registry, or the domain is brand-new.
• You're being rushed, threatened, or told not to tell your bank or accountant.

A legitimate revenue-based or MCA marketplace fits the first list: it approves on bank deposits and revenue over credit, works with FICO around 500+, funds common amounts starting near $10,000 in 24-48 hours, and never guarantees an outcome. The absence of a guarantee is a feature — it means real underwriting is happening.

What to do if you've already been targeted or paid

If you've engaged with a suspected scam, act fast — the first 24 hours matter most for recovery and containment.

• Stop all contact and payments. Do not send another fee "to release" the first one — that's a recovery-scam layer.
• Call your bank immediately. If you wired funds or shared account details, request a recall and fraud hold, and consider a new account and credentials.
• Change credentials. If you shared any login or password, reset it and enable multi-factor authentication everywhere it's reused.
• Report it. File with the FTC at ReportFraud.ftc.gov, the FBI's IC3 (ic3.gov), and your state attorney general. Reports feed the databases the next owner searches.
• Monitor business and personal credit. Watch for new accounts opened with your EIN or SSN, and consider a fraud alert or freeze.
• Document everything. Save emails, numbers, wire details, and the domain — it strengthens both your bank dispute and the fraud report.

How legitimate funders actually get paid (so you know what normal looks like)

Understanding the real economics makes scams obvious. Legitimate business funders make money in three normal ways, none of which involve you wiring a fee first:

• Netted origination fees. A fee is subtracted from the amount deposited — you're funded net of it, so you never pay out of pocket up front.
• Built-in cost of capital. On revenue-based products, the cost is expressed as a factor and repaid from a slice of future revenue or fixed remittances, out of the cash flow the funding helps generate.
• Broker commissions paid by the funder. Reputable brokers are compensated by the funding source on closed deals, not by charging you an up-front "application fee."

In every legitimate structure, value flows to you first and the funder is repaid afterward. Any arrangement that reverses that order — you pay them before they fund you — is the scam pattern, full stop. For how to compare real offers on cost and cash-flow fit, see our guide to business funding options and how to choose.