Nationwide Payment Systems
Synthetic Identity Theft Is Targeting Business Owners
How Scammers Open Credit Cards, Loans, and Merchant Accounts in Your Name
Synthetic identity theft scammers are combining stolen personal information with fake businesses to open credit cards, loans, bank accounts, and merchant accounts. Learn why business owners need active credit monitoring. Synthetic identity scammers are combining stolen personal information with fake businesses to open credit cards, loans, bank accounts, and merchant accounts. Learn why business owners need active credit monitoring.
Presented by Allen Kopelman, CEO — Nationwide Payment Systems-Host of B2B Vault: The Biz2Biz Podcast
AI OVERVIEW
sponsored by
Identity theft is no longer limited to someone stealing a credit card number and making a few unauthorized purchases.
Today’s criminals are building complete synthetic identities using stolen Social Security numbers, real business information, fake identification documents, newly formed corporations, artificial intelligence, hijacked websites, and bank accounts controlled by fraud networks.
They can use those identities to apply for:
- Business and personal credit cards
- Vehicle and equipment loans
- Lines of credit
- Bank accounts
- Merchant processing accounts
- Credit card terminals
- Online payment gateways
- Buy now, pay later accounts
- Business financing
The victim may not know anything has happened until a new account appears on a credit report, a credit card terminal arrives unexpectedly, a collection agency calls, or the business owner discovers that their name has been added to an industry risk database.
In this episode of B2B Vault: The Biz to Biz Podcast, host Allen Kopelman spoke with Noam Izhaki, co-founder and CEO of Ballerine, about the growing synthetic identity problem and how artificial intelligence is making these scams easier to create, scale, and operate.
For business owners, the message is clear: you cannot assume that your identity is safe simply because you still have your wallet, your driver’s license, and control of your bank account.
What Is Synthetic Identity Theft?
Synthetic identity theft occurs when criminals combine real stolen information with fabricated details to create a new identity that appears legitimate.
A scammer might use:
- A real person’s Social Security number
- A legitimate business owner’s name
- A stolen or altered driver’s license
- A real business address
- A newly formed corporation
- A fake email address
- A newly created telephone number
- A manipulated bank statement
- A fraudulent website
- An account opened at an online bank
Some of the information belongs to a real person. Other pieces are invented or altered.
That combination makes synthetic identity theft harder to detect than traditional identity theft. When a lender, bank, or payment processor checks the application, several data points may come back as valid.
The Social Security number may be real. The address may exist. The business may be registered. The credit profile may be good. The bank account may be verified.
But the person submitting the application may be a criminal located somewhere else entirely.
Why Are Business Owners Attractive Targets for Identity Thieves?
Business owners are valuable targets because their identities can be used to access both personal and commercial financial products.
A criminal who steals a business owner’s identity may be able to apply for personal credit, business credit, merchant processing, equipment financing, bank accounts, and commercial loans.
Business owners may also have stronger credit profiles, established companies, public corporate records, websites, professional licenses, business addresses, and online profiles that help make fraudulent applications appear legitimate.
Much of this information may be publicly available through:
- State corporate databases
- Professional licensing websites
- Company websites
- Google Business Profiles
- Property records
- Social media accounts
- Online directories
- Data broker websites
A scammer can use those sources to learn where someone works, what company they own, how long the company has operated, where it is located, and who is authorized to sign on its behalf.
The criminal may then combine that public information with stolen private data purchased through illegal marketplaces or obtained through data breaches.
How Do Scammers Use Stolen Identities to Open Credit Cards?
Scammers use stolen personal information to apply for new credit cards or add themselves to accounts opened under a victim’s name.
They may have enough information to answer identity-verification questions involving:
- Previous addresses
- Vehicle loans
- Mortgage providers
- Family members
- Credit accounts
- Employment history
- Telephone numbers
Once approved, the scammer may have the card sent to a controlled address, virtual mailbox, vacant property, or location connected to an accomplice.
Sometimes the criminal starts with smaller credit lines and makes payments to establish a stronger synthetic credit profile. After the profile improves, the scammer may apply for larger cards, loans, and lines of credit before disappearing.
The unpaid debt may eventually be connected to the real Social Security number used in the application.
How Do Scammers Use Stolen Identities to Get Loans?
Synthetic identity thieves may use stolen identities to apply for vehicle loans, equipment financing, personal loans, business loans, and revolving lines of credit.
Allen described a business owner who reviewed his credit after being warned about identity theft. The report showed multiple unfamiliar credit inquiries, including attempts to obtain credit cards and finance a vehicle.
This is one reason credit inquiries should never be ignored.
An unfamiliar inquiry may be the first visible sign that a scammer is testing your identity.
The criminal may submit several applications to determine which lenders have weaker verification controls. Even when the applications are denied, the inquiries can still appear on the victim’s credit file.
How Do Scammers Open Merchant Accounts Using Stolen Identities?
Scammers use stolen identities to open merchant accounts so they can process stolen credit cards, launder transactions, and move money into bank accounts they control.
A merchant account allows a business to accept card payments. For a criminal, it can become a tool for converting stolen card data into cash.
The scammer may create a fake business or impersonate an existing company and submit:
- A stolen Social Security number
- A real business owner’s name
- A legitimate federal tax identification number
- Fake identification
- A fraudulent bank account
- A professionally created website
- Fake supplier invoices
- Altered business documents
Once the merchant account is approved, the criminal may receive a physical credit card terminal or access to a virtual terminal that allows card numbers to be entered manually.
They may then process stolen cards and attempt to withdraw the settlement funds before the transactions are reported as fraud.
What Happens to the Real Business Owner?
The real business owner may be left facing credit damage, account closures, legal expenses, collection activity, banking problems, and payment processing interruptions.
When a fraudulent merchant account is opened using someone else’s identity, the victim may later discover that their information has been connected to excessive chargebacks, fraud, transaction laundering, or another prohibited activity.
The victim may have no connection to the fake business, but they may still be forced to prove that their identity was stolen.
That can require:
- Filing a police report
- Filing an identity theft report
- Contacting credit bureaus
- Disputing fraudulent inquiries
- Contacting lenders and banks
- Contacting payment processors
- Obtaining merchant application records
- Consulting an attorney
- Freezing credit files
- Replacing compromised identification
The criminal may disappear quickly. The business owner can spend months trying to repair the damage.
Can Identity Theft Put a Business Owner on the MATCH List?
Yes. A stolen identity may be used to open a merchant account that is later terminated and reported to Mastercard’s MATCH system.
MATCH is a database used by acquiring banks and payment processors to identify merchants and individuals associated with certain types of terminated merchant accounts.
A legitimate business owner may apply for payment processing and unexpectedly be told that their name, Social Security number, tax ID, or business information appears in MATCH.
The person may have never opened the account in question.
In these situations, the business owner generally must work with the reporting processor or acquiring bank to obtain information, document the identity theft, and request that inaccurate information be corrected.
Being a victim does not automatically make the removal process fast or simple.
That is another reason early identity theft detection matters.
How Sophisticated Are Synthetic Identity Scams?
Some synthetic identity scams now involve complete fake business operations designed to survive basic underwriting checks.
Allen described a case involving a scammer who appeared to take over a legitimate business’s digital identity.
The fraudster allegedly gained control of the company’s online presence, changed the telephone information, answered verification calls, submitted a merchant application, and received a payment terminal.
The identity, company, website, telephone number, and business records appeared to support the application.
Nationwide Payment Systems noticed suspicious transaction activity and shut down the account before the fraudster received the funds.
The real business owner later regained control of the company’s online information.
That case demonstrates how scammers may use a real business as camouflage.
How Is Artificial Intelligence Making Identity Theft Worse?
Artificial intelligence is making it faster and less expensive to create fake documents, websites, business descriptions, customer communications, and complete online identities.
A fraudster can now build a professional-looking e-commerce website quickly. AI can generate product descriptions, company histories, frequently asked questions, customer-support language, blog content, and social media posts.
Criminals can also use AI-assisted tools to improve phishing emails, impersonation scripts, fake invoices, and verification responses.
The underlying crimes are not new. What has changed is the ability to operate them at scale.
A criminal organization may be able to create many fake companies, submit many applications, and test many financial institutions at the same time.
Even if most applications are declined, the operation may remain profitable when a small percentage are approved.
Why Are Traditional Identity Checks Not Enough?
Traditional identity checks may confirm that the information belongs to a real person without proving that the applicant is that person.
For example, a system may verify:
- The Social Security number
- The date of birth
- The home address
- The business registration
- The bank account
- The tax identification number
- The telephone number
- The credit history
A sophisticated criminal may already possess all of those details.
Knowledge-based authentication questions are also not foolproof. If the scammer has access to a detailed credit report or personal data, they may be able to correctly answer questions about prior addresses, car payments, and financial accounts.
Verification must therefore look at the complete story.
Does the applicant’s behavior match the identity? Does the business model make sense? Does the website history align with the claimed operating history? Does the address match the type and size of business being presented?
A valid identity is not the same thing as a valid applicant.
Why Is Credit Monitoring Essential for Business Owners?
Credit monitoring can alert a business owner when someone applies for credit, opens an account, or changes information associated with their identity.
Without monitoring, fraudulent activity may remain hidden for weeks or months.
By the time the victim discovers the problem, the scammer may have opened several accounts and caused substantial damage.
Credit monitoring may alert you to:
- A new credit inquiry
- A recently opened account
- A new address added to your file
- A significant credit score change
- A new loan or credit card
- A delinquent account
- A collection account
- Changes to your personal information
An alert does not always mean fraud occurred. But an inquiry or account you do not recognize should be investigated immediately.
Business owners should not wait until they are applying for a mortgage, vehicle loan, credit card, or merchant account to review their credit.
Why Should Business Owners Monitor Both Personal and Business Credit?
Business owners should monitor both because criminals may target personal and commercial credit profiles at the same time.
Small-business lenders and merchant account providers often rely on the owner’s personal information and personal guarantee.
A scammer may therefore use a business owner’s Social Security number alongside the company’s employer identification number.
Personal credit monitoring may reveal credit cards, loans, and inquiries. Business credit monitoring may reveal commercial accounts, changes to business information, or financing activity connected to the company.
Monitoring only one side can leave the other exposed.
What Should You Do When You Receive an Unfamiliar Credit Alert?
You should investigate the alert immediately and contact the company that made the inquiry or opened the account.
Do not assume the inquiry is a mistake or harmless marketing activity.
Start by checking:
- The name of the lender
- The date of the inquiry
- Whether the inquiry was hard or soft
- The type of account requested
- Any new address connected to the activity
- Whether other inquiries occurred around the same time
If you did not authorize the activity, contact the lender’s fraud department and explain that you may be an identity theft victim.
Document every call, email, case number, and letter.
You should also review all three major credit reports because fraudulent activity may not appear on every report at the same time.
Should You Freeze Your Credit?
A credit freeze can make it more difficult for criminals to open new accounts using your personal information.
A freeze generally prevents new creditors from accessing your credit file until you temporarily lift or remove it.
Business owners who are not actively applying for financing may want to consider keeping their personal credit files frozen and lifting the freeze only when necessary.
A credit freeze does not eliminate every form of identity theft. It may not stop fraud involving existing accounts, bank accounts, tax filings, merchant accounts, or business credit.
However, it can create an important barrier against unauthorized personal credit applications.
What Other Accounts Should Business Owners Protect?
Business owners should secure every account that could be used to impersonate the company or redirect communications.
Important accounts include:
- Business email
- Personal email
- Domain registrar
- Website hosting
- Google Business Profile
- Telephone provider
- Bank accounts
- Accounting software
- Payroll systems
- Payment gateways
- Social media accounts
- State corporate filing accounts
Use unique passwords and multifactor authentication whenever possible.
Email security is especially important. If a criminal controls the business owner’s email, they may be able to reset passwords, communicate with banks, obtain financial documents, and impersonate the owner during underwriting.
What Are the Warning Signs of Business Identity Theft?
Business owners should watch for anything involving their company that they did not initiate.
Warning signs include:
- Credit inquiries you do not recognize
- New credit cards or loans
- Unexpected credit card terminals
- Calls from unfamiliar processors
- Mail addressed to unknown companies
- Changes to your Google Business Profile
- Changes to your business telephone number
- Password-reset emails you did not request
- Bank-account verification deposits
- New addresses on your credit report
- Business registrations you did not file
- Collection notices
- Tax notices involving unfamiliar income
- Payment accounts you did not open
- Customers calling about a fake website
- Processors asking about transactions you did not run
One unusual event may be an error. Several related events may indicate an active identity theft operation.
What Should Identity Theft Victims Do?
Identity theft victims should act quickly, preserve evidence, and notify every affected organization.
Recommended steps include:
- Review your personal credit reports.
- Review your business credit reports.
- Contact the fraud department of each affected lender.
- Freeze your personal credit files.
- Change passwords for email, banking, and business accounts.
- Enable multifactor authentication.
- File an identity theft report.
- File a local police report when appropriate.
- Dispute unauthorized credit inquiries and accounts.
- Contact payment processors connected to fraudulent merchant accounts.
- Monitor bank accounts for verification deposits or unusual activity.
- Consult an attorney if significant losses or industry databases are involved.
Keep copies of every report, dispute, application, email, and response.
Identity theft cases often involve several institutions, and each may request different proof.
How Can Payment Companies Stop Synthetic Identity Fraud?
Payment companies must evaluate more than whether the submitted information is technically valid.
Merchant service providers, banks, ISOs, and acquiring institutions should examine the complete business narrative.
They should ask:
- Does the person genuinely control the business?
- Does the address match the business operation?
- Does the website history match the stated history?
- Does the projected sales volume make sense?
- Is the inventory real?
- Are the suppliers verifiable?
- Are several merchants using the same address?
- Is the email account newly created?
- Is the IP address masked or inconsistent?
- Does the transaction activity match the business?
No single check will stop every scam.
Effective fraud prevention requires identity verification, business verification, document analysis, portfolio cross-referencing, human judgment, and early transaction monitoring.
Why Is Early Transaction Monitoring Important?
A fraudulent merchant account may look normal during onboarding and reveal itself only after processing begins.
Payment providers should closely monitor new merchant accounts during the first days and weeks.
Warning signs may include:
- Rapid increases in volume
- Large keyed transactions
- Repeated identical amounts
- Transactions occurring at unusual hours
- Cards issued outside the expected market
- High decline rates
- Sales inconsistent with the website
- Immediate withdrawal or transfer of settlement funds
- Transactions unrelated to the approved business type
Catching the fraud after the first suspicious transactions can dramatically reduce losses compared with discovering it after weeks of processing.
What Should Merchant Service Agents Know?
Agents can face reputational and financial consequences when they submit fraudulent applications.
Some agent agreements may contain provisions that assign responsibility for merchant losses, equipment, chargebacks, or fraud.
Agents should review their contracts and avoid submitting applications simply because the merchant promises significant volume or appears eager to begin processing immediately.
Before submitting an online lead, agents should consider:
- Did the applicant answer the phone?
- Does the person understand the business?
- Does the website appear authentic?
- Does the address match the operation?
- Is there proof of inventory?
- Is the email domain established?
- Does the applicant’s explanation remain consistent?
- Is there a legitimate reason for changing processors?
Agents should be sales professionals, but they must also be the first line of defense against fraud.
Can AI Help Defend Against Synthetic Identity Theft?
AI can help banks, lenders, and payment companies connect risk signals that may be missed when each document or database is reviewed separately.
According to Noam Izhaki, Ballerine uses AI agents designed to operate with the investigative mindset of experienced underwriters and fraud professionals.
AI can potentially help identify:
- Connected companies
- Reused addresses
- Reused telephone numbers
- Suspicious fulfillment centers
- Inconsistent ownership information
- Unusual transaction patterns
- Business models that do not match the available evidence
- Networks of related merchants
AI should not be used only to approve more applications faster.
It should also help institutions understand why an application is suspicious and provide evidence supporting the decision.
Fraudsters are using AI to attack the financial system. Financial institutions must use advanced technology to defend it.
How Often Should Business Owners Check Their Credit?
Business owners should use continuous credit alerts when available and conduct a more complete review of their credit reports regularly.
An annual review is no longer enough for someone who owns a company, handles financial accounts, signs personal guarantees, or has publicly available business information.
The faster an unauthorized inquiry or account is discovered, the easier it may be to stop additional fraud.
Credit monitoring should be treated like cybersecurity, insurance, and fraud prevention—not as something to think about only after a problem occurs.
Final Thoughts: Protect Your Identity Before a Scammer Builds a Business Around It
Synthetic identity theft is becoming more sophisticated because criminals can combine stolen data, public business information, fake documents, artificial intelligence, and organized fraud networks.
They are not simply stealing credit card numbers.
They are stealing identities and using them to create entire financial lives.
A scammer may use your name to open a credit card, finance a vehicle, obtain a business loan, open a merchant account, receive payment equipment, process stolen cards, and move the money before you know anything happened.
Business owners are particularly vulnerable because their personal and company information are often closely connected and widely available.
Credit monitoring cannot prevent every form of fraud. But it can provide the early warning that gives you time to act before one unauthorized inquiry becomes several fraudulent accounts.
Monitor your credit. Secure your email. Protect your online business profiles. Investigate unfamiliar inquiries. Freeze your credit when appropriate.
Your identity is one of your company’s most valuable assets.
Treat it that way.
About B2B Vault: The Biz to Biz Podcast
B2B Vault: The Biz to Biz Podcast delivers business news, payment-industry insight, fraud-prevention strategies, technology discussions, and practical guidance for business owners, ISOs, agents, and payment professionals.
The podcast is hosted by Allen Kopelman and sponsored by Nationwide Payment Systems.
In this episode, Allen spoke with Noam Izhaki, co-founder and CEO of Ballerine, about synthetic merchants, stolen identities, AI-powered fraud, merchant underwriting, and the future of financial crime prevention.
How Can Nationwide Payment Systems Help?
Nationwide Payment Systems helps legitimate businesses accept credit cards, ACH payments, online payments, recurring payments, and digital invoices with dedicated support and hands-on account review.
The NPSONE payment gateway and Smart Invoicing platform allow businesses to send invoices by text or email, accept cards and ACH, collect deposits, manage recurring payments, and provide customers with convenient online payment options.
Unlike fully automated providers, Nationwide Payment Systems gives business owners access to experienced payment professionals who understand underwriting, fraud prevention, chargebacks, account security, and payment risk.
Visit Nationwide Payment Systems to learn more about NPSONE and Smart Invoicing.
