Mid October stacks three document seasons on top of each other. Extension returns are due Thursday the 15th. Holiday inventory orders are going out with deposits attached. And a lot of shops are assembling an application packet for a fourth quarter advance, which means bank statements are moving toward desks the owner has never met.
The people who steal from small businesses read this calendar closely. The IRS keeps an alert up about schemes built around the October 15 deadline. The FBI’s 2025 internet crime figures put business email compromise at just over $3 billion in reported losses, across 24,768 complaints. And the FTC counted nearly $1 billion lost to business impersonators last year, with the fake bank rep as the most expensive version.
Very little of that is hacking. Most of it is paperwork the owner handed over, one reasonable-sounding request at a time. The documents that get a shop an advance are the same ones that empty an account when they land on the wrong desk.
What a real packet has in it
Underwriting an advance takes less than people expect. A short application. Three or four months of business bank statements, the PDFs you download yourself from your own online banking. Card processing statements when repayment rides card sales. A voided check at contracting, not on day one. For most deals, that is the whole file. I walked through how underwriters read bank statements in an earlier piece, and the point stands here: the PDFs carry everything a pricing decision needs.
Notice what is missing. Nobody pricing an advance needs your online banking username and password. A legitimate desk reads statements you generated, or uses a read-only connection you authorize through your own bank. The keys to the account never change hands.
The fake version asks for more, and the extra asks are the tell. A portal that wants your banking login typed in so it can verify deposits directly. A rep who needs the processing login rather than the processing statements. The driver’s license, the EIN letter, and a voided check demanded on the first call, before any offer exists. Each ask sounds almost reasonable alone. Together they are a checklist for taking over an account.
The stop signs, and the first moves if a packet already went out
When I look back at how these situations went wrong, the same handful of moments shows up. These are the points where the real file and the fake one split:
- Any request to type or share your online banking password, for any stated reason
- A verification link that arrives by text or email for an application you never started
- A fee that has to move before an offer exists
- The full identity file demanded on first contact, before anyone has read a statement
- An offer that expires tonight, every night, all month
The channel matters as much as the ask. Back in July I wrote about the payoff redirect, where the theft arrives by email in the last week of a balance. This is the front door version of the same move. The boring defense works on both: type the web address yourself instead of clicking what was sent to you, and call a number you found on your own, not the one in the signature block.
If a packet already went out to a desk you now doubt, move fast and skip the embarrassment. Change the online banking password first, from a device you trust. Call your bank’s fraud line and say exactly which documents left. File a report at ic3.gov. Then watch the account daily for debits you did not schedule, for a few weeks at least.
The honest cost of this care is a day, sometimes two. I’ve watched an owner slow down to check out a desk and lose a real offer because the window closed while they checked. That happens, and it stings.
I would still take the day.
A real shop will wait 24 hours while you confirm who they are. A packet that went to the wrong one does not come back.