En español | With Congress moving last week to extend the Paycheck Protection Program (PPP), small businesses now have until Aug. 8 to apply for a slice of the $130 billion in federal loans still available for enterprises struggling with economic fallout from the coronavirus pandemic.
And fraudsters have another month to try to steal money, personal information or both from business owners seeking help from the high-profile program.
Since the PPP was enacted in late March as part of the CARES Act, the Federal Trade Commission (FTC) and state attorneys general have warned businesses to be on the lookout for con artists offering bogus help in obtaining loans, one of many strains of coronavirus scams.
"Often, government-assistance programs like the PPP provide an obvious and easy target” for scammers, who impersonate lenders or government officials in emails, robocalls and phony websites to attract victims, Arkansas Attorney General Leslie Rutledge's office said in a May alert.
Congress allocated about $659 billion in two tranches to the PPP, which provides forgivable, low-interest loans to help small businesses and nonprofit organizations stay afloat and continue paying employees through the coronavirus slowdown.
Although nearly 4.9 million loans have been approved, the program still had roughly a fifth of the money left when it was set to expire on June 30, prompting the extension.
Watch for impostors
PPP crooks typically reach out to business owners pretending to be from the Small Business Administration (SBA), the federal agency overseeing the program, or from financial institutions administering the loans. They might also claim to represent third-party agencies that promise to facilitate or fast-track a loan for your firm.
The tell is a request for upfront payment, or for private information like a Social Security or bank account number, to apply for, process or expedite a PPP loan, according to the FTC.
The SBA does not charge for information (you can learn about its coronavirus programs for free online) or to apply for loans, and it will not contact you out of the blue and ask for business or financial information. Anyone who does so is likely looking to glean data to use for identity theft, or to file for PPP funds in your name.
"Information collected about a business principal can easily be recycled into a fraudulent loan application or other forms of financial fraud,” says John Buzzard, a fraud and security analyst with digital-finance research firm Javelin.
Be careful where you click
Another giveaway is a link or attachment in an unsolicited email or text message. Clicking it supposedly takes you to important PPP information or forms you need to fill out. But as the FTC warns, the real purpose is to get you to disclose private information, or to infect your device with malware.
One such phishing message that made the rounds in April, shortly after the PPP launched, featured the SBA logo and instructions to download “documents we need you to sign for the Paycheck Protection Program” and return them, with sensitive business information, to a supposed government portal.
As Billings, Montana-based regional bank First Interstate noted in an online warning about the scam, lenders handle PPP paperwork, not the SBA.
"We're still seeing the same types of scams that showed up earlier this year, and anticipate these scams will continue, both in our service area and beyond,” says Marcy Mutch, chief financial officer at First Interstate, which operates in six states across the Northwest.
Mutch says the bank has also heard of scammers contacting businesses in the guise of SBA or lending institutions to “verify loan information,” distribute fake PPP applications or collect a nonexistent application fee.
The scam threat might not evaporate when the program expires next month, says Buzzard, the Javelin analyst. “This would be the perfect time for criminals to randomize versions of PPP scams as follow-up,” he says.
For example, scammers might send out new rounds of emails or robocalls claiming that additional money had been allocated for PPP, that the deadline had been extended again, or that unclaimed funds were being released to applicants who got turned down.
How to avoid PPP scams
The FTC and the SBA offer these tips for spotting and stopping Paycheck Protection Program cons and other scams targeting small businesses.
- Be skeptical of an unsolicited email or call from someone claiming to be from the SBA. The agency does not initiate contact to find out about you or your business or to offer loans.
- Don't give personal information like your Social Security or bank account number to someone who calls, emails or texts you out of the blue.
- Don't pay in advance for a government loan or information about a loan program. Guidance on the PPP and other coronavirus resources for small businesses is available for free from the SBA and the Treasury Department. You can also contact the SBA's Answer Desk at 800-827-5722 or firstname.lastname@example.org.
- Be alert to signs of spoofing. Fraudsters use the SBA logo or familiar corporate branding to make emails and websites appear authentic. Carefully check email and website addresses; a legitimate SBA page or message will have the domain sba.gov.
- Don't apply for a PPP loan without confirming that the lender is SBA-authorized. The agency has an online search tool you can use to find eligible lenders.
- Don't click on links or download files from an email or text unless you're 100 percent sure of where it's from. Links or attachments may be ploys to deliver malware to your device.