Much like people, businesses have tax identification numbers, credit accounts and their good names to protect. Business "identity" can be stolen or otherwise abused by criminals with increasing access to diverse forms of relevant information.
Identity theft has undeniably grown in the public consciousness in recent years, but it is most often treated as a concern for individuals, and, in turn, the financial services firms serving those individual customers.
Awareness of the threat to merchants is not high, however. A key reason is that merchants, especially small merchants, are often less likely to report breaches for fear of the impact on their business. So there is a lack of good data on the number of businesses affected and the economic toll extracted through losses.
According to the Small Business Administration, there were 27.5 million small businesses in operation in 2009, of which 21.4 million were sole proprietorships. These companies generate more than half of nonfarm GDP and employ half of all private-sector employees. Small business is clearly big business in aggregate. Banks are well aware of this, as loans under $1 million totaled $695 billion in 2009.
Unfortunately, identity thieves also recognize the opportunity presented by small businesses, which are ripe targets for several reasons beyond just collective size. They have low awareness of the threat. They often lack the IT security infrastructure and legal know-how to protect themselves as capably as larger firms. And finally, small businesses are also often targeted by thieves who know that merchants typically have higher credit limits than individuals.
Javelin Strategy and Research found that the incidence rate for identity theft among small businesses the self-employed in 2009 was 7.4%.
The means that over 2 million businesses were impacted by the crime in a single year.
While old-fashioned theft of paper records continues to be a prominent threat, the increasing use of online and now mobile transactions presents new vectors for attack by identity thieves. Therefore not only are small-business identities at risk, but customer, employee and partner identities can be compromised too, leaving tarnished reputations, legal problems and labor difficulties in their wake.
Perhaps more troubling for small businesses (and big ones) is that ID theft is often perpetrated as an inside job by employees, who frequently have unfettered access to sensitive company and customer data. With that information in hand, an employee turned thief can easily tap into existing business credit accounts or establish other fraudulent credit lines in the name of the business or partner companies.
While financial institutions and payments processors are not necessarily compelled to help protect merchants against ID theft, doing so can be good business for both parties.
Here are some steps banks should consider.
• Educate small business on the many threats they face from identity theft. Small businesses are often far more consumed with the day-to-day operation of their business, so externalities like ID theft go overlooked until it's too late.
• Apply the same standards imposed by "red flag" rules for individual accounts to business accounts, and alert customers to potential breaches with options on how to take action.
• Bundle ID protection services with packages designed for small businesses. Third-party partners can help offer a variety of white-labeled services, from check fraud protection to a full gamut of ID theft detection and restoration for thefts that occur online and off. Offering such services can not only provide an additional revenue stream for financial services providers, but can also deepen business relationships with merchants.
• Supplement your physical safety deposit boxes with a secure online vault, and eliminate as much paper as possible, keeping all vital information under lock and key.
It has taken a decade to educate the public about the dangers of identity theft for individuals. Prevention and protection of small business is unfortunately well behind that curve. Financial institutions can help raise awareness of the issue and begin stemming the tide.
