- Understand how SBA fraud crackdowns now affect legitimate borrowers and contractors.
- Recognize how EIN-based identity theft can surface during loans or contract bids.
- Anticipate longer SBA decision timelines and why minor mismatches trigger holds.
You might read that and think: good, go after the criminals. And the SBA is doing exactly that. But the tools they are using do not only affect fraudsters. The SBA has rolled out stricter identity checks, cross-referencing across federal databases, and clawback procedures that now touch every active SBA program. That means 7(a) loans, 504 loans, disaster relief, and federal contracting.
If you plan to apply for SBA financing, renew a disaster loan, or bid on a federal contract in the next year, the process just got slower and pickier. This is true even if you never took a dollar of PPP or EIDL money. The fraud net is wide, and legitimate businesses are swimming in the same water. If you keep an eye on SBA program updates each month, you have probably already noticed the shift in tone. If you haven’t, this is your heads-up.
Someone Might Already Be Borrowing Under Your Name
Your EIN is basically a Social Security number for your business. The IRS assigns it when you form your LLC or corporation. It appears on your tax returns, your bank accounts, and every government application you file. And unlike your personal Social Security number, your EIN is not particularly hard for a stranger to find.
State business filings are public records. In most states, anyone can search the Secretary of State website and pull up your company name, address, and formation documents. Fraudsters used those public records during the pandemic to grab EINs and file fake EIDL applications. The business owner often had no idea it happened.
Think of it like personal identity theft, but worse in one specific way. When someone opens a credit card in your personal name, the credit bureaus usually flag it. You get an alert. With business identity theft, there is no automatic flag. You find out when the SBA sends a demand letter about a loan you never took. Or your bank calls about a subpoena you cannot explain. Or your next loan application gets denied because a federal database shows debt under your EIN that you never agreed to.
The SBA’s new cross-referencing work is surfacing these cases faster than before. That is useful in the long run. But it means some owners are getting unpleasant surprises right now. If you have ever received a confusing IRS notice or a call from a bank you do not use, this is the business version of that moment. With federal cybersecurity priorities shifting toward identity protection, expect this kind of cross-referencing to increase, not decrease.
Your Next SBA Loan Will Take Longer. Here’s What That Looks Like.
Two years ago, applying for a 7(a) or 504 loan through your bank felt fairly routine. You gathered your financials, your lender submitted the package to the SBA, and you waited a few weeks for a decision. The documents were standard. The back-and-forth was minimal. Most owners spent their time worrying about approval odds, not paperwork logistics.
That experience has changed. Lenders working with the SBA now run additional identity verification before submitting your application. Your EIN gets checked against federal fraud databases. Your ownership documents get compared against state records. If anything looks inconsistent, even a minor mismatch between your operating agreement and your state filing, the process pauses.
What this feels like in practice: you submit your application package, and a week later your lender emails asking for documents you already sent. Then they ask for a second form of business identity verification. Then you wait while a cross-referencing hold clears on the SBA’s side. As the chart below shows, a process that once took three to four weeks from submission to decision can now stretch six to eight weeks, sometimes longer. This applies across 7(a) loans, 504 loans, disaster loans, and government contracting applications.
None of this means the SBA is broken. It means a system that approved billions in fraudulent loans is trying to make sure it does not do that again. The friction is real and frustrating, especially if you need capital on a timeline. But knowing about it in advance lets you plan around it instead of being blindsided by it.
A 20-Minute Checkup and the Folder That Saves You Three Weeks
You can check whether your business identity has been compromised in about 20 minutes. Think of this like pulling your personal credit score, but for your LLC or S-corp. You do it once. If everything looks clean, you move on with your day.
Here are the four checks that matter most:
- IRS business transcript. This is a record of all tax activity filed under your EIN. You can request one through your IRS online account or by calling the IRS Business line. Look for any loan disbursements, credit activity, or tax filings you did not authorize.
- Secretary of State filing. Go to your state’s Secretary of State website and search for your company. Look at every filing, amendment, and officer change listed. If you see anything you did not submit, someone may have altered your business records.
- Business credit report. Pull a report from Dun and Bradstreet or Experian Business. Look for inquiries or accounts you do not recognize. This is where unauthorized borrowing activity often shows up first.
- CAIVRS check. CAIVRS (Credit Alert Interactive Voice Response System) is a federal database that tracks delinquent federal debt. If you have ever had a federal loan, ask your lender to run a CAIVRS check on your EIN. If a fraudulent SBA loan was flagged as delinquent under your business, it will appear here.
If all four checks come back clean, you are in good shape. If something looks wrong, the response plan later in this article will help.
The Ready Folder
Keep these documents in one place, digital or physical:
- Articles of organization (or incorporation), current version
- EIN confirmation letter from the IRS (the CP 575 notice)
- Federal tax returns for the last two years
- Bank statements for your primary operating account, last three months
- Operating agreement or shareholder documents showing current ownership
- One-page business summary with your company name, address, industry, revenue range, and number of employees
The key word is current. If your operating agreement lists a former partner, or your articles of organization show an old address, those mismatches trigger re-verification requests. That is where a two-week delay becomes a five-week delay. If you have been tracking changes to federal filing requirements, you may already have some of these documents updated. If not, this is worth 30 minutes of your time today.
Some lenders have also started asking for a second form of business identity verification beyond the EIN letter. A current state filing certificate or a stamped copy of your articles of organization usually satisfies this. Having it ready before they ask keeps things moving. And while you are checking state records, a quick scan for any recent state rule changes that might affect your filings is worth the extra few minutes.
You will probably never need most of this in a rush. But when you do need it, the owner who has a folder ready gets funded. The owner who has to search through email and call the IRS waits.
If a Letter Shows Up About a Loan You Never Took
Hopefully you never need this section. But if a letter from the SBA arrives referencing a loan you did not take, having a plan keeps a bad surprise from becoming a drawn-out crisis. Think of it like a fire extinguisher: you probably will not use it, but knowing where it is matters when the alarm goes off.
Day 1. Do not ignore the letter. Do not panic either. Read it carefully. Write down the loan number, the dollar amount, and the program name (EIDL, PPP, 7(a), etc.). These details will be the reference points for every conversation that follows.
Days 1 through 3. Call the SBA Office of Inspector General fraud hotline at 1-800-767-0385. Explain what you received and that you did not apply for or receive the loan in question. Then call your bank to alert them. File an identity theft report at IdentityTheft.gov. This creates a federal record that you are a victim, not a borrower.
Days 3 through 7. Go back to your Secretary of State website and check for any unauthorized filings or changes. Notify your accountant or tax preparer so they can watch for any tax implications tied to the fraudulent loan.
Days 7 through 14. Send a written follow-up to the SBA, referencing your OIG report number from the hotline call and your IdentityTheft.gov report. Written documentation matters more than phone calls in federal disputes. Keep copies of everything you send.
This Crackdown Actually Helps Honest Businesses
During the pandemic, fraudulent businesses used stolen identities to win SBA contracts and claim loans that real businesses should have gotten. Every EIDL loan clawed back from a thief returns money to the lending pool that funds your next application. Every fake contractor removed from the system opens a slot for a business that actually does the work.
If you have ever lost an SBA contract bid or been told that disaster loan funding was tapped out, some of that scarcity was artificial. It was created by fraud, not by real demand. The cleanup is partly about making the system work for you again.
The short-term friction is real. Extra documents, longer waits, a process that feels like it is treating you as guilty until proven innocent. But a lending system that cannot tell the difference between a real business and a stolen EIN is not a system you can rely on. The tighter it gets now, the more likely it is that the capital is actually there when you need it.
