Identity theft is not just a consumer problem. Businesses of every size are getting hit, and the schemes are getting more polished. Javelin Strategy has reported that identity theft resulted in losses of $56 million in a single recent year, and the trend line is not flattering.
The good news is that most of the common patterns are easy to recognise once you know what to look for. The bad news is that the same patterns are easy to miss until money has already moved.
Five schemes to watch
Fake accounts.** Impersonator profiles use your brand name, logo and product photos to disrupt your legitimate channels, post malicious content, or harvest your followers for phishing lists. Detection requires routine social listening and fast takedown workflows.
Phishing.** Attackers impersonate an executive or vendor and email staff, customers or partners asking for payments, credentials or wire transfers. The pages and signatures look correct, which is what makes it work.
Fake invoices.** Criminals send invoices to your customers using a similar domain or a spoofed address. The customers pay, the money lands in the attacker's account, and the dispute begins weeks later.
Website mimicry.** A lookalike site goes up using your brand, possibly to harvest credentials or to defraud customers who think they are buying from you. Search your own brand regularly and watch for typosquatted domains.
Logo theft.** Your brand mark is copied with small tweaks and used by another business. This usually ends in a demand for payment to "resolve" the infringement.
Where to report
If you suspect business identity theft in the United States, the IRS is the first stop. Its business helpline is set up to take identity theft reports and provide guidance. Beyond the IRS, notify your state attorney general, any financial institutions involved, and the major credit bureaus so that fraudulent credit lines can be flagged.
Who should care
Security teams.** Your job is to make the early signals visible. Domain monitoring, brand monitoring on social platforms, and dark web lookups for leaked credentials all feed the same picture. You need the monitoring; someone else needs to own the response.
Finance teams.** Your job is to slow down payment changes. A new bank account for an existing vendor should never be honoured on email alone. Treat every payment detail change as suspicious until verified through a separate channel.
Legal and compliance.** You own the playbook. When fraud is confirmed, you need a written response plan that covers stakeholder notification, evidence preservation, and regulatory reporting timelines. If the plan lives in someone's head, it does not exist.
Operations managers.** You are often the link between finance and security, which makes you the typical target for social engineering calls. Verify requests before escalating, and never feel pressured to skip a step.
Our analysis
The core trade-off in business identity defence is between friction and speed. Extra verification on vendor bank account changes costs your team time. Skipping it costs you money. Most organisations eventually settle on a callback requirement for any payment detail change, which is annoying but cheap compared to a single successful fraud.
A second trade-off is between monitoring tools and human response. Automated brand monitoring is cheap and tireless. Takedown workflows, customer notifications and bank disputes are still slow and human. Invest in the response playbook before buying another dashboard. A tool that finds a problem you cannot act on is noise.
A worked example
Say your accounts payable team receives an email from a long-standing vendor asking to update the bank account on file. The signature looks right, the domain is one letter off from the real one, and the request is polite but urgent. The right move is to call the vendor on the number already in your system, not the one in the email, and confirm the change. If your policy requires the same for every change, this is a routine call. If your policy has exceptions, this is how a six-figure wire goes out the door.
Bottom line
Business identity theft is mostly a process problem, not a technology problem. The attacks are cheap to run, and they rely on your team skipping a step. The defence is also cheap, and it relies on your team never skipping that step.
Key takeaways
- Treat any vendor bank account change as suspicious until verified out of band.
- Run regular brand and domain monitoring to catch lookalike sites early.
- Build a written playbook for identity theft response before you need it.
- Report to the IRS, state authorities and banks as soon as fraud is confirmed.
Frequently asked questions
What is the most common form of business identity theft?
Phishing emails that impersonate executives or vendors and request payments or credentials remain the most common pattern.
Where do I report business identity theft in the US?
The IRS is the first stop, with its business helpline set up to take identity theft reports, followed by state authorities and your bank.
How do I detect a fake invoice?
Cross-check the sender domain, confirm the request through a known phone number, and watch for urgency cues that push staff to skip verification.
How can small businesses protect themselves?
Train staff on phishing patterns, require callback verification for any payment detail change, and update your data regularly to make it harder for bad actors to gain access.
Should I invest in identity theft protection for the business?
Yes, as one layer in a broader defence. Pair it with monitoring, process controls and an incident response plan that finance and security both know how to execute.