Business Identity Theft During Tax Season: How to Catch It Early and What to Do

Tax season gives scammers a perfect opening to misuse stolen business data, especially when owners are already rushing to file, verify documents, and respond to unfamiliar requests. This guide explains how business identity theft can surface during tax filing, which warning signs matter most, and what small businesses should do quickly if their company information has been used in tax fraud.

Key Takeaways

• Tax season is when many cases of business identity theft come to light, often because criminals use stolen company data to file fraudulent returns or claim refunds first.
• The clearest red flags include rejected e-filings, missing or mismatched refunds, IRS notices about non-existent employees, and tax correspondence tied to actions your business never took.
• Small businesses are especially exposed because owners are more likely to be handling filing themselves, sharing sensitive documents, and assuming unusual requests are part of the normal tax process.
• The fastest response is practical: file as early as possible, report suspected identity theft through official IRS channels, review bank and registration records, secure affected accounts, and enable stronger protections like two-factor authentication.

Tax season is when many cases of business identity theft come to light, as scammers use company data stolen earlier to file fraudulent returns or claim refunds. At the same time, it can also be the moment when attackers try to steal business identities in the first place. During tax season, small business owners are more responsive, more accustomed to sharing documents, and more likely to assume that requests for sensitive information are legitimate and simply part of the filing process, especially when deadlines are approaching.

Law and tax rule changes add another layer of uncertainty. New deductions, updated filing rules, or changes to reporting requirements often come with incomplete or evolving guidance, particularly in the first year they apply. 

When business identity theft is discovered during tax season, the impact is often immediate: a rejected or delayed tax return, for example. 

Untangling the situation can take weeks of back-and-forth, right when you need to focus on closing the year or planning the next one.

Related: The “One, Big, Beautiful Bill” Brings New Tax Deductions. 8 Potential Scams Small Businesses Should Watch Out For

What is business identity theft?

Business identity theft happens when someone uses your company’s information to impersonate your business. That can include your business name, address, tax ID or EIN, bank details, or access to key accounts such as email, accounting, or payroll tools.

If you want a deeper explanation of how business identity theft works year-round, along with practical steps to protect your business, you can find it in the article What Is Business Identity Theft and How to Protect Your Business.

Warning signs of business identity theft related to tax administration

On their own, some of these issues may look like clerical mistakes or routine administrative problems, but none should be ignored. During tax season, they can point to business identity theft rather than a simple error.

Specific red flags linked directly to tax administration include:

• You can’t e-file a return, or your return is rejected because someone has already filed using your business’s EIN or SSN.
• A refund is delayed, missing, or arrives with an amount that doesn’t match your records.
• Your return is processed as an amended return, even though you never filed an original return for that year.
• You receive notices from the IRS about employees who don’t exist.
• You receive tax-related notices for a business that is closed, dormant, or no longer active, even though all balances were settled.

Other warning signs that often appear alongside tax-related identity misuse include:

• You don’t receive expected or routine correspondence from the IRS because the business address has been changed without your knowledge.
• Unusual or unexplained activity in your business bank account related to tax payments, refunds, or changes to account details.
• Requests for tax documents, confirmations, or verification steps that you didn’t initiate and that don’t align with your current filing activity.
• Letters or emails from tax authorities that don’t match the returns you’ve filed, the businesses you operate, or the actions you’ve taken.

What to do if your business identity is used in tax-related scams

Fill your taxes as early as you reasonably can, so you reduce the window of opportunity for someone else to file in your business’s name. Many cases of tax-related business identity theft are discovered simply because the real owner attempts to file and learns that a return has already been submitted.

It also helps to check whether your business data may have been exposed in a breach. Many small business owners only find out their information was compromised once it’s already being misused. Monitoring tools that alert you when business or personal data appears in breaches can provide an early warning, sometimes months before tax season starts, and give you time to secure accounts before damage spreads.

Related: How to Check If Your Business Is Affected by a Breach (And What to Do if It Is)

Steps to take if your business identity is involved in tax fraud*

• Report it to IRC through the official channels to create a record and speed up recovery:
• Report the suspected identity theft by submitting an affidavit. 
• Contact the tax authority’s business help line to report suspected identity theft or misuse of your EIN.
• Report a suspected business data security breach if sensitive company or employee information may have been exposed.
• Report a Form W-2 or payroll-related email scam involving employee data, even if no money was lost.
• File a police report with your local police department. While this may not resolve the issue on its own, it creates an official record that tax authorities, banks, or credit bureaus may request.
• Carefully review and reconcile business bank and account statements as soon as they become available, paying close attention to tax payments, refunds, and any changes to account details.
• Regularly review your business registration information online, including records for closed or dormant businesses, to make sure no unauthorized changes have been made.
• Monitor your business credit reports for suspicious activity at least once every 12 months. Unexpected accounts, inquiries, or changes can indicate misuse.
• Place a free one-year fraud alert on your credit reports by contacting any one of the three nationwide credit reporting agencies. The agency you contact is required to notify the other two. If appropriate, you may also request a credit freeze by contacting each bureau directly.
• Close or secure any accounts that have been tampered with or opened without your permission, and reset access credentials for related services.
• Update antivirus, secure your business email, accounting, and payroll accounts by changing passwords and enabling two-factor authentication where possible.
• Stay alert in the weeks and months that follow. Business identity theft often unfolds in stages, and follow-up attempts are common once scammers know certain information has worked before.

Catching issues early or preventing them altogether protects your time, your cash flow, and your ability to keep your business running smoothly. Having layered protection in place can make a real difference. 

Bitdefender Ultimate Small Business Security helps protect your business’s digital identity and core assets, such as email, devices, and online accounts, by blocking scams, monitoring for data exposure, and alerting you early, so potential problems are dealt with as soon as possible. 

Try Bitdefender Ultimate Small Business Security free for 30 days.

Source: irs.gov 

FAQs

What is identity theft on taxes?

Tax-related identity theft happens when someone uses a stolen Social Security number, ITIN, or other taxpayer information to file a fraudulent tax return or claim a refund in your name. For businesses, the same idea applies when someone misuses a company’s name or EIN to file fraudulent returns or forms.

Why did the IRS flag my return for identity theft?

The IRS may flag a return when its systems detect signs that a return filed under your SSN or ITIN could be suspicious and needs identity verification before processing continues. In practice, that is why taxpayers may receive letters such as 5071C, 4883C, or 5747C asking them to verify both their identity and the return itself.

Can a business have identity theft?

Yes. The IRS explicitly recognizes business identity theft. That can happen when someone uses a business name or Employer Identification Number to submit fraudulent tax returns, Forms W-2, or other tax documents. The IRS says affected businesses should use Form 14039-B, Business Identity Theft Affidavit.

What triggers IRS identity verification?

IRS identity verification is typically triggered when the agency receives a return it believes may not match the real taxpayer or may indicate possible identity theft or refund fraud. If that happens, the IRS sends a letter instructing the taxpayer to verify identity and return information before the return can be processed.