Even though the Paycheck Protection Program (PPP) ended years ago, scammers are currently targeting businesses that received PPP loans.
Using publicly available PPP loan information released by the Small Business Administration (SBA)—such as a business’s name, location, lender, and loan status—fraudsters are impersonating banks, government agencies, and even law enforcement to steal sensitive banking credentials and money.
How the Scam Is Being Deployed
PPP loan scams most often begin with a phone call, but may also be deployed via email, text message, or official looking mail. Common tactics include:
Bank Impersonation
Scammers pose as your bank, often spoofing the caller ID to appear legitimate. They may claim there is a problem with your PPP loan, loan forgiveness, or a recent ACH or wire transaction. During the call, they request online banking credentials or one time security codes sent to your device.
Law Enforcement or Government Threats
Some scammers impersonate the SBA, Department of Justice, or local law enforcement, falsely claiming your PPP loan is under investigation. This communication is designed to create fear and urgency, pressuring victims to pay “fees” or provide information immediately.
Official Looking Letters or Emails
Businesses have also reported receiving documents that appear to be from government agencies, citing real loan details and threatening severe penalties unless immediate action is taken. These communications may include phone numbers or links that connect directly to the scammer.
Red Flags to Watch For
Be cautious if you receive any unsolicited communication about your PPP loan that includes:
- Urgent or threatening language demanding immediate action
- Requests for online banking credentials, passwords, or one time passcodes
- Instructions to move money, wire funds, or “reverse” a transaction
- Claims that your bank, the SBA, or law enforcement needs to "verify" your account information
A legitimate bank or government agency will never ask for your login credentials or security codes.
How Business Owners Can Protect Themselves
Taking a few proactive steps can significantly reduce your risk:
- Do not trust caller ID alone. Phone numbers can be spoofed.
- Never share online banking credentials or one time security codes, even if the caller sounds legitimate.
- End suspicious conversations immediately and contact Tri Counties Bank directly at 1-800-922-8742 to verify communication.
- Educate your employees, especially those with access to business accounts, on how impersonation scams work and what information should never be shared.
- Be skeptical of any urgent PPP related outreach.
Remember
Tri Counties Bank will never call, text, or email you to ask for your User ID, password, PIN, one-time passcode, or any other sensitive information. If you receive a suspicious call claiming to be from Tri Counties Bank, simply hang up and contact us directly at 1-800-922-8742 to confirm communication.