Business Identity Theft During Tax Season: How to Catch It Early and What to Do

Tax season is when many cases of business identity theft come to light, as scammers use company data stolen earlier to file fraudulent returns or claim refunds. At the same time, it can also be the moment when attackers try to steal business identities in the first place. During tax season, small business owners are more responsive, more accustomed to sharing documents, and more likely to assume that requests for sensitive information are legitimate and simply part of the filing process, especially when deadlines are approaching.

Law and tax rule changes add another layer of uncertainty. New deductions, updated filing rules, or changes to reporting requirements often come with incomplete or evolving guidance, particularly in the first year they apply. 

When business identity theft is discovered during tax season, the impact is often immediate: a rejected or delayed tax return, for example. 

Untangling the situation can take weeks of back-and-forth, right when you need to focus on closing the year or planning the next one.

Related: The “One, Big, Beautiful Bill” Brings New Tax Deductions. 8 Potential Scams Small Businesses Should Watch Out For

What is business identity theft?

Business identity theft happens when someone uses your company’s information to impersonate your business. That can include your business name, address, tax ID or EIN, bank details, or access to key accounts such as email, accounting, or payroll tools.

If you want a deeper explanation of how business identity theft works year-round, along with practical steps to protect your business, you can find it in the article What Is Business Identity Theft and How to Protect Your Business.

Warning signs of business identity theft related to tax administration

On their own, some of these issues may look like clerical mistakes or routine administrative problems, but none should be ignored. During tax season, they can point to business identity theft rather than a simple error.

Specific red flags linked directly to tax administration include:

• You can’t e-file a return, or your return is rejected because someone has already filed using your business’s EIN or SSN.
• A refund is delayed, missing, or arrives with an amount that doesn’t match your records.
• Your return is processed as an amended return, even though you never filed an original return for that year.
• You receive notices from the IRS about employees who don’t exist.
• You receive tax-related notices for a business that is closed, dormant, or no longer active, even though all balances were settled.

Other warning signs that often appear alongside tax-related identity misuse include:

• You don’t receive expected or routine correspondence from the IRS because the business address has been changed without your knowledge.
• Unusual or unexplained activity in your business bank account related to tax payments, refunds, or changes to account details.
• Requests for tax documents, confirmations, or verification steps that you didn’t initiate and that don’t align with your current filing activity.
• Letters or emails from tax authorities that don’t match the returns you’ve filed, the businesses you operate, or the actions you’ve taken.

What to do if your business identity is used in tax-related scams

Fill your taxes as early as you reasonably can, so you reduce the window of opportunity for someone else to file in your business’s name. Many cases of tax-related business identity theft are discovered simply because the real owner attempts to file and learns that a return has already been submitted.

It also helps to check whether your business data may have been exposed in a breach. Many small business owners only find out their information was compromised once it’s already being misused. Monitoring tools that alert you when business or personal data appears in breaches can provide an early warning, sometimes months before tax season starts, and give you time to secure accounts before damage spreads.

Related: How to Check If Your Business Is Affected by a Breach (And What to Do if It Is)

Steps to take if your business identity is involved in tax fraud*

• Report it to IRC through the official channels to create a record and speed up recovery:
• Report the suspected identity theft by submitting an affidavit. 
• Contact the tax authority’s business help line to report suspected identity theft or misuse of your EIN.
• Report a suspected business data security breach if sensitive company or employee information may have been exposed.
• Report a Form W-2 or payroll-related email scam involving employee data, even if no money was lost.
• File a police report with your local police department. While this may not resolve the issue on its own, it creates an official record that tax authorities, banks, or credit bureaus may request.
• Carefully review and reconcile business bank and account statements as soon as they become available, paying close attention to tax payments, refunds, and any changes to account details.
• Regularly review your business registration information online, including records for closed or dormant businesses, to make sure no unauthorized changes have been made.
• Monitor your business credit reports for suspicious activity at least once every 12 months. Unexpected accounts, inquiries, or changes can indicate misuse.
• Place a free one-year fraud alert on your credit reports by contacting any one of the three nationwide credit reporting agencies. The agency you contact is required to notify the other two. If appropriate, you may also request a credit freeze by contacting each bureau directly.
• Close or secure any accounts that have been tampered with or opened without your permission, and reset access credentials for related services.
• Update antivirus, secure your business email, accounting, and payroll accounts by changing passwords and enabling two-factor authentication where possible.
• Stay alert in the weeks and months that follow. Business identity theft often unfolds in stages, and follow-up attempts are common once scammers know certain information has worked before.

Catching issues early or preventing them altogether protects your time, your cash flow, and your ability to keep your business running smoothly. Having layered protection in place can make a real difference. 

Bitdefender Ultimate Small Business Security helps protect your business’s digital identity and core assets, such as email, devices, and online accounts, by blocking scams, monitoring for data exposure, and alerting you early, so potential problems are dealt with as soon as possible. 

Try Bitdefender Ultimate Small Business Security free for 30 days.

Source: irs.gov 

FAQs

What is tax-related business identity theft?

Business identity theft during tax season happens when criminals use stolen company information — such as a business name, EIN, or bank details — to file fraudulent tax returns, claim refunds, or trigger tax-related actions in the business’s name. In many cases, the data was stolen earlier and only misused when tax filing begins.

Can business identity theft happen even if my business is small?           

Yes. Very small businesses, freelancers, and sole proprietors are often targeted because they have fewer security layers and handle tax administration themselves. You don’t need employees or large revenue to be affected.

How do scammers get business tax information?

Scammers often rely on data from previous breaches, phishing emails, compromised email accounts, or access to accounting and payroll tools. Tax season is when that information becomes especially valuable and easier to misuse.

What are the first signs of tax-related business identity theft?

Common early signs include a rejected tax return because one was already filed, delayed or missing refunds, unexpected tax notices, or requests for tax documents you didn’t initiate. These issues are often mistaken for clerical errors at first.

What should I do if my business tax return is rejected because one was already filed?

This is a strong indicator of business identity theft. You should contact the Internal Revenue Service immediately using official contact details, follow their instructions, and document all communication related to the incident.