COLUMBUS, OH (CRAWFORD COUNTY NOW)—The Ohio Department of Commerce Division of Financial Institutions has issued a Consumer Alert to Ohio residents regarding an emerging scam targeting recipients of Paycheck Protection Program (PPP) loans in the state.

The division said it has received multiple reports of scammers contacting customers of Ohio banks and impersonating bank personnel in an attempt to gain access to the customers’ financial accounts.

According to the alert, fraudsters are accessing publicly available borrower information from the Small Business Administration (SBA) website and using that information to trick business owners who received PPP loans into providing sensitive online banking credentials.

How the Scam Works

  • Spoofed Bank Numbers: Scammers are altering their phone number so the caller ID on the recipient’s phone displays a bank’s real phone number.
  • Impersonating Bank Officials: Scammers claim to represent the victim’s bank and tell consumers they need to verify account details or assist with PPP loan-related matters.
  • Credential Theft: Scammers trick victims into providing their online banking login credentials and, in some cases, the one-time security code sent by the bank.
  • Unauthorized Access: Armed with the victim’s credentials, fraudsters reset passwords and gain full account access, while bypassing security protocols.
  • Fraudulent Transfers: Using same-day Automated Clearing House (ACH) transfers, the scammers drain funds from victims’ accounts before the fraud is detected and can be stopped.

The Division of Financial Institutions is urging consumers to be vigilant and take proactive steps to safeguard their accounts. If you are a PPP loan recipient and receive unexpected communications from individuals claiming to be your bank, the division advises verifying their authenticity independently by hanging up and contacting your bank directly via a published number.

“Scammers are becoming increasingly sophisticated in their methods, but Ohio consumers can protect themselves by staying informed and being skeptical of individuals who contact them,” said DFI Superintendent Kevin Allard in a statement. “Always verify the identity of anyone requesting sensitive banking information and never share your personal login credentials or one-time security codes over the phone unless you are 100% certain of the individual who is on the other end.”

Action Steps for Consumers Recommended by the Division:

  • Verify Communication Sources: Always contact your bank directly using the official contact information on their website or physical documentation. Be skeptical of anyone who contacts you via phone or messaging saying they’re from your bank.
  • Be Wary of Urgent Requests: Scammers often utilize pressure tactics to get victims to act quickly. Always take time to verify the legitimacy of the request.
  • Update Online Banking Security: Strengthen your online banking credentials by using strong, unique passwords, updating those passwords often, and enabling multifactor authentication.
  • Report Fraudulent Activity: If you believe you’ve been targeted or have fallen victim to this scam, contact your bank immediately. Also report the incident to the Ohio Department of Commerce Division of Financial Institutions at 614-728-8400 or by clicking here, and also the SBA Office of Inspector General (OIG).

The division also advises that if you believe you’re the victim of identity theft, visit the Federal Trade Commission’s (FTC’s) website at IdentityTheft.gov for resources and step-by-step instructions on how to recover.