Business Identity Theft: EIN Fraud Signs, Reporting, and Penalties

Business identity theft is the unauthorized use of a company’s Employer Identification Number, legal name, or corporate records to open credit, file tax returns, take out loans, or launder money in the business’s name. It usually runs longer than personal identity theft because companies don’t get the automatic consumer credit alerts individuals do, and the dollar amounts involved are larger. If it happens to your company, you’ll need to move on several fronts at once: the IRS, local police, the business credit bureaus, and every creditor whose name shows up on a fraudulent account. Federal penalties for the person committing it range from 5 years to 30 years in prison depending on what the fraud was tied to.

How Your Business Identity Gets Stolen

Most of the raw material is already public. State business filings, annual reports, and assumed-name certificates list officers, registered agents, and addresses, and criminals scrape those records freely. They pair that information with an EIN pulled from tax filings, court records, or intercepted mail. Physical mail theft from commercial mailboxes is still a common route because bank statements and IRS notices contain everything a fraudster needs.

Phishing does the same job digitally. An email that looks like it came from a vendor, a bank, or the IRS tricks an employee into handing over credentials or account details. Dormant businesses and small companies with limited bookkeeping oversight are the easiest targets because no one is watching the accounts closely.

Once the perpetrator has enough, they usually move in one of three directions: file a fake business tax return to claim a refund, apply for commercial loans or high-limit credit cards and drain them, or run money through a bank account opened in the company’s name.¹

A newer variation is synthetic business fraud: a real EIN paired with a fabricated business name and a rented virtual office, then registered with a state agency that allows online filing without in-person verification. The real business only learns about it when a lender comes for repayment or a new inquiry appears on its credit report.² In other cases, criminals file unauthorized amendments directly with a state’s business registry, swapping in a new registered agent, officer, or address on a real entity. Companies that have been administratively dissolved are especially exposed, because a fraudster can attempt to reinstate the entity and change its records during reinstatement.

Warning Signs Your EIN Has Been Used

The earliest signal is usually a letter from the IRS about a return you never filed. When the IRS spots a mismatch between the return filed under your EIN and information it received from banks or payers, it sends a notice proposing changes. Getting one of those when you haven’t filed, or when the numbers don’t match your actual return, is a strong indicator that someone else filed using your EIN.³

Other things to watch for:

Invoices for equipment, supplies, or services your company never ordered.
New credit lines, sudden score drops, or hard inquiries from lenders you never contacted on your Dun & Bradstreet or Experian Business report.
Rejection on a credit application you legitimately submitted because the credit line is already overextended.
Notices from a state workforce agency about unemployment benefits filed for people who never worked for you. The IRS warns employers to respond quickly to these and to watch for misuse of the EIN in jobless claims.⁴
Notifications from your secretary of state about amended officers, a new registered agent, or an address change you never requested.

Any single one of these warrants a look. Two or three together mean you should treat it as confirmed and start reporting.

What to Pull Together Before You Report

The core document is IRS Form 14039-B, the Business Identity Theft Affidavit. You’ll enter the entity’s legal name and EIN, describe the suspected fraud, and check the box that fits your situation (for example, receiving notices for a business you never formed, or suspecting an existing entity has been victimized). The form has to be signed by someone with legal authority to act for the entity and receive its tax information, and Section E lists what you attach as proof of that authority along with a government-issued photo ID.⁵

Alongside the affidavit, have these ready:

Your original CP 575 EIN assignment letter. It’s the cleanest proof of legitimate ownership.
A log of every suspicious notice, invoice, or inquiry with dates and senders.
Bank statements, credit card statements, or wire transfer records showing activity you didn’t authorize.
Current reports from Dun & Bradstreet and Experian Business, with unrecognized accounts and inquiries flagged.

For fraudulent debts owed to private creditors, IdentityTheft.gov generates a formal Identity Theft Report that works as an affidavit when you dispute accounts. The online assistant walks you through up to five incidents and produces a document you send directly to creditors.⁶

Reporting Business Identity Theft

Filing With the IRS

Mail Form 14039-B to Internal Revenue Service, Ogden, UT 84201. If you received an IRS notice tied to the fraud, attach the form to the back of that notice and mail it to the address on the notice instead. You can also fax the form toll-free to 855-807-5720 if you didn’t get a notice, or to the fax number on your notice if one was included.⁵

The IRS is required to send an acknowledgment (Letter 5316C) within 30 days confirming the case is open.⁷ The IRS targets 120 days for resolution, but pandemic-era backlogs pushed the actual timeline well past that. Plan for a longer wait and keep records of every contact with the agency in the meantime.⁸

If your EIN was used to file fraudulent unemployment claims, the IRS says to file Form 14039-B for that too. If the business is closing, write to the IRS to formally close the tax account so a dormant EIN can’t be exploited later.⁴

Filing a Police Report

File a formal report with your local police department. The case number it produces is something creditors and credit bureaus routinely require before they’ll investigate. Even when local police lack jurisdiction over the underlying fraud, the report documents that you moved quickly.

Notifying the Business Credit Bureaus

Contact Dun & Bradstreet, Experian Business, and Equifax Business. Each has a business fraud department that can flag your file, add fraud alerts, and freeze the profile to block new accounts. Send copies of your police report and IRS affidavit, and follow up to confirm the alerts stay active while the investigation runs.

Disputing Fraudulent Accounts and Loans

For each fraudulent account, call the creditor’s fraud department, explain that the account was opened with stolen business information, and ask for it to be closed. Request a letter confirming the account was fraudulent, that you’re not liable, and that the creditor has told the credit bureaus to remove it. Your FTC Identity Theft Report and police case number make this go faster.⁶

For fraudulent SBA loans, including PPP or EIDL loans taken out in your business’s name, report through IdentityTheft.gov and through the SBA’s identity theft portal at sba.gov/idtheft. If a private lender issued the loan, contact that lender separately to ask for release from the obligation and removal of the loan from your credit files.⁶

If someone filed unauthorized amendments to your state registration, contact your secretary of state. Many states now have formal complaint processes for fraudulent filings, and once a complaint is substantiated the filing is typically cancelled and the record reverts to its pre-fraud state.

Federal Criminal Penalties

The main federal statute is 18 U.S.C. § 1028, which criminalizes producing, transferring, or using identification documents and means of identification without authorization. Penalties scale with what the fraud involved:

Up to 5 years in prison for transferring or using a stolen means of identification.
Up to 15 years when the fraud involves government-issued identification documents or when the perpetrator obtains $1,000 or more in value during any one-year period.
Up to 20 years if the identity fraud facilitated drug trafficking, was connected to a crime of violence, or followed a prior conviction under the same statute.
Up to 30 years if the fraud facilitated domestic or international terrorism.

Each level can carry fines on top of prison time, plus forfeiture of any property used to commit the offense.⁹

A companion statute, 18 U.S.C. § 1028A, adds a mandatory consecutive prison term when identity theft is committed during another felony: 2 years for most qualifying felonies and 5 years when the underlying crime relates to terrorism. That add-on cannot run concurrently with the underlying sentence, so it always extends total prison time.¹⁰

When the fraud involved hacking a business computer system, prosecutors can also bring charges under 18 U.S.C. § 1030. Unauthorized access to a protected computer for commercial advantage or in furtherance of another crime carries up to 5 years on a first offense and up to 10 years on a second.¹¹

You Don’t Have the Same Protections as an Individual Consumer

This part surprises most owners. The Fair Credit Reporting Act, which gives individuals the right to dispute errors on their credit reports and forces bureaus to investigate within 30 days, covers consumer reports about individuals, not commercial credit files. You cannot force a business credit bureau to investigate or correct a fraudulent entry on the same legal timeline that protects you personally.

Credit card protection is narrower too. The Truth in Lending Act’s $50 liability cap on unauthorized charges applies to business credit cards only in limited circumstances. If an employee’s business card is lost or stolen, the $50 cap does apply to that cardholder. But broader unauthorized-use rights consumers take for granted, including the right to dispute charges and withhold payment during an investigation, are far more limited in the commercial context.¹²

Wire transfers work the same way. Under Article 4A of the Uniform Commercial Code, which governs commercial fund transfers in most states, if your bank followed commercially reasonable security procedures and accepted a payment order in good faith, the loss from an unauthorized transfer falls on you rather than the bank. Businesses carry more risk for unauthorized electronic transactions than individuals do under the Electronic Fund Transfer Act.

The practical result: cleaning up after business identity theft depends on direct negotiation with creditors, the strength of your documentation, and in some cases litigation. Consumer statutes will not do the work for you.

Ongoing Monitoring So You Catch It Early

Prevention is really about shortening the gap between when fraud starts and when you notice. Pull your business tax transcripts from the IRS periodically through your business tax account or with Form 4506-T. The tax account transcript shows return filing dates, refunds, deposits, and penalties, so anything unexpected is immediately visible. The entity transcript confirms your EIN, filing requirements, and ownership structure. If something looks off, call the IRS business and specialty tax line at 800-829-4933.¹³

Enroll in the Electronic Federal Tax Payment System if you haven’t. EFTPS lets you track federal tax payments and set up email notifications, so a payment made under your EIN that you don’t recognize will show up.¹⁴

Check your business credit reports at least quarterly. Paid monitoring for business credit typically runs $200 to $500 per year for multi-bureau coverage, and free tiers with limited alerts exist. Periodically verify your registration with your secretary of state to confirm the listed officers, registered agent, and address haven’t changed.

Use multi-factor authentication on business banking and tax accounts, limit who has access to your EIN and financial records, and train staff to recognize phishing. If the business is closing, write to the IRS to close the tax account. A dormant EIN sitting behind an active state registration is exactly what fraudsters look for.⁴

1
Internal Revenue Service. Identity Theft Information for Businesses
2
FedPaymentsImprovement.org. Fake Companies, Real Risk: The Rise in Synthetic Business Fraud
3
Internal Revenue Service. Understanding Your Letter 2030
4
Internal Revenue Service. Identity Theft and Unemployment Benefits
5
Internal Revenue Service. Form 14039-B – Business Identity Theft Affidavit
6
IdentityTheft.gov. Steps to Take After Identity Theft
7
Internal Revenue Service. IRM 25.23.9 Business Master File (BMF) Identity Theft Processing
8
Internal Revenue Service. IRS Identity Theft Victim Assistance: How It Works
9
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
10
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
11
Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers
12
HelpWithMyBank.gov. Does the Truth in Lending Act Apply to Credit Cards Issued for Business Purposes
13
Internal Revenue Service. Get a Business Tax Transcript
14
Internal Revenue Service. EFTPS: The Electronic Federal Tax Payment System