Scam activity aimed at small businesses is growing, especially for those that received Paycheck Protection Program (PPP) loans. If your business was part of the program, it’s a good idea to be on alert. Knowing what these scams look like can help you avoid them and protect your business.
How the Scam Works
Scammers are using publicly available information to find businesses that received PPP loans. From there, they launch convincing attacks that can appear legitimate at first—but are designed to trick you.
Common Tactics to Watch For
- Spoofed Bank Phone Calls
Scammers use spoof call technology to make their number appear as if it’s coming from your bank. Even if the caller ID looks real, banks will never ask you for login credentials, passwords, or one-time passcodes.
- Direct Calls to Business Lines
These fake phone calls from the bank are often directed to main office lines, with the caller asking for specific employees by name.
- Requests to “Verify” Transactions
They may claim they need to confirm a wire or ACH transaction, pressuring employees to share credentials or approve transfers.
- Impersonation of Bank Staff
The caller may pretend to be someone from Treasury Management or ACH Operations, using insider terms to sound credible.
- Fake Security Messages
Scammers also use text messages that look like they're from your bank. One example uses a made-up term—“client credentials termination process”—to create urgency.
A message might look like this:
Keeping your information secure is our top priority. We’re always looking for new ways to protect you and your business. One of our security measures is the client credentials termination process.
<FAKE URL>
Reply STOP to opt out
This message is not legitimate. Banks do not use processes like this or ask customers to act through external websites. Even if it sounds official, do not click any links or enter your credentials.
How to Protect Your Business
- Don’t Trust Caller ID
A spoofed bank phone call can look like it’s from your bank, but scammers can manipulate caller ID to display any number.
- Never Click Suspicious Links
Always log in through your official Commercial Online Banking portal—not a link sent via text or email.
- Never Share Credentials
No legitimate bank associate will ask for your username, password, or authentication code.
- Verify Requests
If a call seems off, hang up and call your banker or known bank contact directly.
- Educate Your Employees
Share this information with employees so they know how to spot a scam and what to do if they receive a suspicious call or message.
PPP loan scams are becoming more common, but with awareness and caution, they’re also preventable. A single spoofed call or fake message can do real damage—unless you know the warning signs. Share this guidance with your team, stay alert, and always verify before you trust.
