U.S. Attorney’s Office for the District of Massachusetts Warns Small Businesses Receiving Paycheck Protection Program (P3) Loans of Dramatic Increase in Reports of Compromise Programs by e-mail related to the program. Scammers use information about PPP recipients released by the Small Business Administration (SBA) to impersonate PPP lenders asking for additional information about PPP loan applications or loan cancellation.
In July 2020, the SBA released information on PPP loan recipients, which included the names and addresses of companies for loans over $ 150,000. In December 2020, the SBA released exact loan amounts for more than 600,000 small businesses and nonprofits that received at least $ 150,000 in loans. The published data also included the names of entities receiving less than $ 150,000, which represents approximately 87% of the total number of loans in the program, as well as the name of the lender and the date of distribution of each loan.
Scammers use this publicly available information to send phishing emails to PPP loan recipients, masquerading as the recipients’ PPP lenders to request sensitive information, such as email addresses and passwords, social security numbers and financial information. This information could be used to access a company’s computer network in order to compromise confidential information or for identity theft.
PPP loan recipients should carefully examine the headers of emails that appear to be from their PPP lenders to ensure that the domain of the sender email address matches the domain of other emails received. of the lender. They should also use common sense to consider whether the lender is likely to contact the recipient at that time (for example, in response to a loan request or forgiveness), or whether the timing seems to be irrelevant. along with other communications with the lender. Recipients should not reply or click on links contained in suspicious emails; recipients may want to call their lenders if they think the content or timing of an email is suspicious.
Suspected criminal activity can be reported to the Department of Justice’s National Disaster Fraud Enforcement Center at https://www.justice.gov/disaster-fraud.