The U.S. Attorney’s Office for the District of Massachusetts is warning small businesses that received loans through the Paycheck Protection Program (PPP) of a dramatic increase in reports of business email-compromise schemes related to the program. Scammers are using information about PPP recipients posted by the Small Business Administration (SBA) to impersonate PPP lenders requesting additional information about PPP loan applications or loan forgiveness.

In July 2020, the SBA published information about PPP loan recipients, which included business names and addresses for loans greater than $150,000. In December 2020, the SBA released the exact loan amounts for more than 600,000 small businesses and nonprofit organizations that received at least $150,000 in loans. The published data also included the names of entities receiving less than $150,000, which represent about 87 percent of the total number of loans in the program, as well as the name of the lender and distribution date for each loan.

Scammers are using this publicly-available information to send phishing emails to PPP loan recipients, impersonating the recipients’ PPP lenders to request sensitive information, such as email addresses and passwords, Social Security numbers, and financial information. This information could be used to gain access to a business’s computer network to compromise confidential information or for identity theft.

Recipients of PPP loans should carefully review the headers of emails that appear to come from their PPP lenders to ensure that the domain of the sender’s email address matches the domain of other emails received from the lender. They also should use common sense to question whether the lender is likely to be contacting the recipient at that particular time (e.g., in response to an application or loan forgiveness), or whether the timing appears to be unconnected to other communications with the lender. Recipients should not respond to, or click any links, in any suspicious emails; recipients may want to call their lenders if they believe the content or timing of an email is suspicious.

Suspected criminal activity may be reported to the Department of Justice’s National Center for Disaster Fraud at https://www.justice.gov/disaster-fraud.