Reporting identity theft (2024)

If you suspect that someone used your personal information without your knowledge or permission to obtain an SBA loan, you must submit a report to SBA to initiate the review process that may release you of your obligation to repay the loan. The instructions below apply to the following types of SBA loans:

• COVID-19 EIDL
• SBA disaster loans
• Paycheck Protection Program (PPP)

1. File an Identity Theft Report

You can file this report either with the Federal Trade Commission (FTC) at IdentityTheft.gov, with another federal law enforcement agency, or with your local police department.

Fill out theSBA Declaration of Identity Theft form. You will need to print, sign (with a handwritten signature), and scan or take a photo of this document.

3. Submit completed documents to SBA

To report suspected identity theft to SBA, you must submit the following three documents:

• A copy of your photo identification issued by a Federal or state agency. Examples are a Driver’s License, state ID card, U.S. Passport, or military ID
• A copy of theIdentity Theft Report you submitted to the FTC, federal law enforcement, or your local police department
• The completedSBA Declaration of Identity Theft form

Report online

If you know the loan number of the suspected fraudulent loan or already have a MySBA account, your best option is to report identity theft through theMySBA Loan Portalusing the steps below:

1. Log in or register for theMySBA Loan Portal.
2. After logging in, click “Messages” in the top right corner of the page to contact SBA.
3. Click “Send a Message,” then choose “Report Identity Theft” as the message subject, and draft and send your message.
4. When SBA responds to your message, you will receive instructions for uploading the three required documents via the secure portal.

Report by email, fax, or mail

If you cannot create a MySBA Loan Portal account or do not know the loan number of the suspected fraudulent loan, then you may submit your report using one of the options below.

For COVID-19 Economic Injury Loan (EIDL) and Disaster Loan identity theft:Email the three documents listed above to[email protected].

You can also fax all three documents above to 202-481-5200 or mail them to:

U.S. Small Business Administration
Attn: ID Theft Records
14925 Kingsport Rd.
Fort Worth, TX 76155

For Paycheck Protection Program (PPP) identity theft:Email the three documents listed above to[email protected].

Please note that SBA’s review of your identity theft claim is for the sole purpose of releasing you of your obligation to repay the loan. SBA will not provide information regarding the status of any possible criminal investigations being conducted by SBA’s Office of Inspector General or other law enforcement agencies in connection to your case. SBA is also unable to release any documents related to an ongoing criminal investigation.

For COVID-19 Economic Injury Loan (EIDL) and Disaster Loan identity theft: Statements and payment reminders are generally paused within two to three business days of receiving your report, while SBA conducts a review. You should retain these statements until the review is finished. When the review is over, SBA will notify you in writing and provide a final determination letter.

For Paycheck Protection Program (PPP) identity theft: After reporting suspected PPP identity theft to SBA, you will typically hear from SBA about next steps within two to three business days, but it may take longer depending on the volume of requests. The process may vary given the role of lender intermediaries in the PPP program. If you know the lender that issued the loan, then you should also report suspected identity theft to the lender. Reporting to the lender may expedite the pausing of statements and payment reminders.

Protect yourself moving forward

To protect yourself against future attempts to use your identity, we suggest you follow the recommendations issued by the FTC on their IdentityTheft website:

• File a Federal Trade Commission (FTC) report at IdentityTheft.gov. You will receive step-by-step recovery help.
• FTC will guide you through the process for placing a free, one-year fraud alert on your credit, getting your free credit reports, closing fraudulent accounts opened in your name, adding a free extended fraud alert or credit freeze to your credit report, and more.
• FTC will also produce an Identity Theft Report that you can use to clear fraudulent information from your credit reports.
• Check your personal credit report regularly. Visitwww.annualcreditreport.com, the only authorized source for obtaining the free credit reports that consumers are guaranteed by law.

For more information about preventing fraud and identity theft, visitsba.gov/fraud.

All PPP lenders have an obligation to mitigate fraud, waste, and abuse in SBA programs. If a lender receives a complaint about suspected SBA identity theft, they must send the loan file to SBA, collect and submit required documents, conduct a review, and make a determination.

1. Send the loan file to SBA

Send a copy of the loan file to [email protected]. The loan file should include the following documents:

• Original loan application
• Supporting application documents (e.g. Schedule C and payroll documentation, funding instructions, and DocuSign certifications)
• KYC-related documents collected with application
• Communications between lender and applicant, including any payment notices that were sent

2. Collect required forms from the victim

To report suspected identity theft to SBA, the lender must collect the following three documents from the victim:

• A copy of the victim’s photo identification issued by a Federal or state agency. Examples are a Driver’s License, state ID card, U.S. Passport, or military ID
• A copy of the Identity Theft Report the victim submitted to the FTC, federal law enforcement, or your local police department
• The completed SBA Declaration of Identity Theft form

After receiving the three documents from the victim, email them to [email protected]. You may choose to encrypt your document with a password by following these instructions. If you choose to protect your documents with a password, an SBA official will reach out to obtain it.

3. Conduct investigation and make a determination

Lenders are required to follow Banking Secrecy Act (BSA) policies and conduct an investigation to determine what occurred. After completing the investigation, send the following details to [email protected]:

• A summary of the investigation findings
• A determination whether the applicant provided false documents and information that is different than the information provided by the complainant
• A description of the documents reviewed that led to the lender’s determination
• An analysis of whether similar attributes were found in the lender’s portfolio, which may indicate that additional cases are involved

MySBA Loan Portal technical assistance:Please contact MySBA Loan Portal Customer Service at 833-572-0502 from 8:00 a.m. to 8:00 p.m. ET, Monday to Friday, or email[email protected].

COVID-19 Economic Injury Disaster Loans:Please call COVID-19 EIDL Customer Service at 833-853-5638 (TTY: 711), email[email protected], or send a message through theMySBA Loan Portal. COVID-19 EIDL Customer Service is open from 8:00 a.m. to 8:00 p.m., Monday through Friday.

Disaster Loans:Please contact the SBA Disaster Assistance Customer Service Center at 800-659-2955 or email[email protected].

Paycheck Protection Program (PPP): For questions related to suspected identity theft, please contact [email protected]. For all other PPP assistance, please contact the lender that issued the loan.

7(a), 504 and Microloans:Please contact the lender that issued the loan.

For any other assistance:Pleasecontact SBA.