Growing scam targets recipients of Paycheck Protection Program (PPP) loans

How the scam works

Scammers rely on publicly available business and PPP loan information to gather enough detail to convincingly impersonate a bank employee. Then, they call, email, or text business owners or authorized employees and claim there's an issue with a business account. They'll request information they say is needed for verification purposes, such as online banking credentials, a user ID or password, or a one-time security code. After complying with the request, the business owner may discover significant unauthorized wire or ACH transactions debited from their account.

Why is PPP loan data public?

Because PPP loans were a federal spending program, they're part of the public record and subject to the Freedom of Information Act (FOIA) requirement for public access to government records. PPP loan data made public by the SBA includes borrower name, address, business type, NAICS code, ZIP code, loan forgiveness status, loan amount ranges, and, for loans more than $150,000, specific amounts.

What to be aware of

By watching for certain red flags, you can help protect your business accounts.

• Unsolicited calls, emails, or text messages that claim to be from your bank or that reference publicly available data in an attempt to appear legitimate or gain more information
• Requests for online banking credentials, sensitive information, or one-time passcodes
• Inquiries about payments, transactions, or suspicious account activity

Tips to safeguard your business

• Educate your employees on how to identify and report suspicious activity.
• Be skeptical of unsolicited calls or text messages and verify the authenticity of requests by ending the communication and contacting your bank directly.
• Protect your online banking credentials and never share them with anyone.
• Remember that KeyBank will never contact clients to request login credentials, passwords, or one-time passcodes.