Ohio Department of Commerce issues consumer alert regarding PPP loan scam targeting Ohioans
The Ohio Department of Commerce Division of Financial Institutions has issued a Consumer Alert to Ohio residents regarding an emerging scam that is targeting recipients of Paycheck Protection Program (PPP) loans in the state. The Division has received multiple reports of scammers contacting customers of Ohio banks and impersonating bank personnel in an attempt to gain access to the customers’ financial accounts.
Fraudsters are accessing publicly available borrower information from the Small Business Administration (SBA) website and using that information to trick business owners that received PPP loans into providing sensitive online banking credentials.
How the Scam Works
1. Spoofed Bank Numbers: Scammers pose as legitimate banks by altering their phone number so the caller ID on the recipient’s phone displays a bank’s real phone number.
2. Impersonating Bank Officials: Scammers claim to represent the victim’s bank and tell consumers they need to verify account details or assist with PPP loan-related matters.
3. Credential Theft: Scammers trick victims into providing their online banking login credentials and, in some cases, the one-time security code sent by the bank.
4. Unauthorized Access: Armed with the victim's credentials, fraudsters reset passwords and gain full account access, while bypassing security protocols.
5. Fraudulent Transfers: Using same-day Automated Clearing House (ACH) transfers, the scammers drain funds from victims’ accounts before the fraud is detected and can be stopped.
The Division of Financial Institutions urges consumers to remain vigilant and take proactive steps to safeguard their accounts. If you are a PPP loan recipient and receive unexpected communications from individuals claiming to be your bank, verify their authenticity independently by hanging up on the call, then contacting your bank directly via a published number.
“Scammers are becoming increasingly sophisticated in their methods, but Ohio consumers can protect themselves by staying informed and being skeptical of individuals who contact them,” said DFI Superintendent Kevin Allard. “Always verify the identity of anyone requesting sensitive banking information and never share your personal login credentials or one-time security codes over the phone unless you are 100% certain of the individual who is on the other end.”
Action Steps for Consumers
• Verify Communication Sources: Always contact your bank directly using the official contact information on their website or physical documentation. Be skeptical of anyone who contacts you via phone or messaging saying they’re from your bank.
• Be Wary of Urgent Requests: Scammers often utilize pressure tactics to get victims to act quickly. Always take time to verify the legitimacy of the request.
• Update Online Banking Security: Strengthen your online banking credentials by using strong, unique passwords, updating those passwords often, and enabling multifactor authentication.
• Report Fraudulent Activity: If you believe you’ve been targeted or have fallen victim to this scam, contact your bank immediately. Also report the incident to the Ohio Department of Commerce Division of Financial Institutions at 614-728-8400 or at https://com.ohio.gov/divisions-and-programs/financial-institutions/cont…, and also the SBA Office of Inspector General (OIG).
If you believe you’re the victim of identity theft, visit the Federal Trade Commission’s (FTC’s) website at www.IdentityTheft.gov to access resources and step-by-step instructions on how to recover from identity theft. For individuals affected by data breaches, specific guidance from the FTC is available at www.identitytheft.gov/#/Info-Lost-or-Stolen.