Banks as well as state and federal banking regulators are seeing a scam increasingly spreading across the country that targets recipients of Paycheck Protections Program (PPP) loans issued during the COVID-19 pandemic.

---

Background on the PPP Scam

• Scammers have contacted PPP loan recipients and impersonated bank employees, local law enforcement, or employees of the U.S. Small Business Administration (SBA).
• The scammers are using PPP borrower information, which was published by SBA, to trick PPP participants into sharing their banking login information or sending payments.
• Scammers may pretend to be from a bank’s fraud department or from the SBA and claim they have seen unusual activity on the account. In addition, they may pose as law enforcement officers, claiming a warrant has been issued for the customer’s arrest.

---

Scale of the Issue

• More than 11.5 million forgivable PPP loans were issued to small businesses and nonprofits during the pandemic.
• After news organizations used the Freedom of Information Act and lawsuits to seek to compel the SBA to publish loan information data on the PPP loans, SBA began to publish data in 2020 in response to a court order that determined the public interest in the SBA’s management of the PPP outweighed any limited private interest in nondisclosure.
• Fast forward many years later and sophisticated scammers are using downloadable spreadsheet data from SBA’s website, which includes:

---

How the PPP Scam Often Works

• Scammers rely on publicly available business and PPP loan information and then they impersonate a bank employee to call, email, or text business owners or their employees and claim there has been an issue with a business account.
• They will request information, supposedly for verification purposes, such as online banking credentials, a user ID or password, or a one-time security code.
• After complying with the request, the business owner may discover unauthorized transfers debited from their account.
• A related twist on the scam is to use high pressure tactics and say they are from law enforcement or from SBA, explain that a warrant has been issued, and state that a payment must be made immediately to avoid being placed in jail.

---

How Customers Can Protect Themselves

• Be skeptical of anyone who contacts you by phone, text, or email and claims to be from your bank.
• Don’t use a phone number provided in the message, even if the caller id appeared legitimate, as scammers can fake the caller information. Instead, contact your bank by using the phone number on its website or the back of your credit or debit card.
• Verify law enforcement claims by calling your local police or sheriff’s department. Demands for payment to avoid arrest are scams. A legitimate law enforcement officer will never ask you to pay with gift cards, cryptocurrency, or through a kiosk.
• Never share your log-in credentials, passwords, PINs, or one-time passcodes.
  • A bank employee will never call you and ask for your password, PIN, or a one-time passcode to “verify” your account or to “prevent fraud.” This is a common scam tactic.
  • Banks will not ask for your credentials or a one-time passcode through an unsolicited email or social media message.
  • If you receive a call, email, or text message asking for your login details or a passcode, hang up or delete it. It is a scammer trying to gain access to your account.
• Be suspicious about anyone who pressures you to act immediately or threatens you with consequences like sending you to jail.
• Help keep your login information secure by using strong and unique passwords, update your passwords often, and enable multi-factor authentication (like one-time codes sent to your cell phone via text, an authenticator app, or biometric fingerprint or facial recognition).
• If you have been targeted by or become a victim of this scam, contact your bank immediately. Also, contact local law enforcement and the SBA Office of Inspector General to report it.