Business identity theft: how to spot a hijacked company

Business identity theft is when criminals pose as a real company, its owners or its officers to get credit, open accounts or redirect payments in its name. A common route is the public record: a filing at the business registry that changes the company's address, officers or registered agent, or that reinstates a company that had been dissolved, sometimes alongside a lookalike email domain and website. To spot it, read the company's filing history for changes made just before it contacted you, check whether the new address, officer and domain connect to anything in the company's past, and confirm the request by contacting the company on details you found yourself.

This piece covers how a hijack works, why old and dormant companies are targets, the checks a credit, onboarding or accounts payable team can run, and what to do if the company is yours. Our guides to KYB verification and shell company red flags cover company research more widely, and finding out who owns a website goes further into domains.

California's Secretary of State describes it as criminals who "pose as owners, officers or employees of a business" to get cash, credit and loans, "leaving the victimized business with the debts". Colorado's Secretary of State notes that it is also known as "corporate or commercial identity theft".

The National Association of Secretaries of State (NASS) describes it in a September 2025 report on business filing fraud: an unauthorised filing changes a legitimate company's registration details, "e.g. address, officers, registered agent, etc.", and the altered record is used "to obtain loans or lines of credit or to facilitate a variety of other criminal activities". The report says this is "sometimes referred to as 'business identity theft' or 'business hijacking'", and that it can include an unauthorised filing "to reinstate a dissolved (or otherwise inactive) business entity".

Colorado's resource guide separates two types: "hijacking" an existing business by changing its details, and creating an entirely new business with a victim's address, or sometimes their name and address. This piece is about the first.

A hijack can combine three steps.

Change the record. NASS says that in most states the Secretary of State's office "serves only as the official repository for business records", and that a filing which meets the basic requirements may be accepted without the office questioning it or checking what it says. California's list of common schemes includes filing documents "to change the business' registered address or the names of directors, officers or managers of the company". In the UK, Companies House says that "Fraudsters are known to hijack a company by changing the details of the company's directors and registered office."

Build the front. A 2022 joint advisory to the food and agriculture sector from the FBI, the FDA's Office of Criminal Investigations and the US Department of Agriculture lists tactics that include "Creating email accounts and websites that closely mimic those of a legitimate company", using "the names of actual officers or employees of a legitimate business", and "Copying company logos".

Use the identity. The same advisory describes falsified credit applications that pass because "The scammer provides the actual information of a legitimate company so the credit check results in an approval of the application." A 2023 FBI announcement on business email compromise (BEC) adds that criminals impersonating real companies "apply and are often granted credit repayment terms known as Net-30 and Net-60 terms, providing fake credit references and fraudulent W-9 forms to vendors."

Two federal cases show the pattern.

• In Georgia, two brothers were sentenced in March 2017, after pleading guilty, for a scheme that ran from 2012 to 2014. According to the Justice Department, they "stole the identities of dormant Georgia corporations" by filing new registration information listing "new company officers and a new corporate address, which was a virtual office space under the conspirators' control." They then used fake credit applications to order laptops and other electronics on credit in the companies' names, over $540,000 of it from 16 suppliers, who "received little more than a couple hundred dollars, if anything".
• In New Jersey, federal prosecutors charged twelve people in November 2025 over a conspiracy to deposit stolen checks. According to the charges, they impersonated the businesses listed as payees "by acquiring business documents in the names of the payees" and used them to open business bank accounts. The criminal complaint alleges that one method was to change the registered agent on a payee's official records to one of the defendants. By October 2026 ten had pleaded guilty, and charges against the other two, both of whom the complaint says used that method, were still pending.

An established company brings a credit history and a name that suppliers and lenders recognise. Colorado's Secretary of State says criminals "assume a business's identity and good credit history by manipulating business records and credit agency data", then use that identity to get lines of credit with banks or retailers.

A dormant company adds a record nobody may be watching. The Texas Secretary of State warns that "Criminals target businesses that have been tax forfeited", and the Georgia case above used dormant corporations.

The real company often learns late. California says thieves typically "cash out quickly and go unnoticed until the bills and collection notices arrive at the door of the victimized business." How often it happens is unclear. NASS says "the actual scope and prevalence of business filing fraud is difficult to quantify."

When a request arrives in an established company's name, check these signals. Each is a reason to look closer, and none proves fraud on its own.

• A change of address, officers or registered agent filed shortly before the company contacted you, or a reinstatement after years of inactivity.
• A new officer, address or registered agent with no link to the company's past.
• An email domain registered recently that differs from the one the company has used for years.
• Contact details that differ from the company's archived website, listings and older filings.
• A delivery address away from the company's known premises, or pressure to approve credit quickly. The 2022 advisory warns of "last-minute changes" in "shipping destinations" and of "unexplained urgency regarding payment requests or orders, especially from new customers."

Open the full filing history, not just the summary page, and read it in date order. Many registries publish it online: California's bizfile service lets anyone view and print all of a business's filings free, with no log-in, Texas's SOSPortal lets users "review the filing history of an entity", and Companies House's free service includes "full transaction filing" and "current and resigned officers", according to its guidance.

Then ask four questions of the filings.

1. When did the details last change? In the Georgia case the record was changed first and the companies' names used afterwards, so a change in the weeks before an application deserves a close look.
2. Who is named now, and who was named before? Compare the latest officers with those in earlier years' filings and with the person who signed your application.
3. Has the registered agent changed? The New Jersey complaint alleges that changing it was one way the defendants took over a company's record.
4. Was the company dissolved, inactive or forfeited, and then restored shortly before it contacted you?

Because a registry may accept a filing without checking what it says, a filing shows that someone filed it, which is not the same as showing that the company agreed. Some registries also show little about a company's people, as our guide to finding out who owns an LLC describes, so older filings may be the only place an earlier officer or address appears.

A genuine change usually leaves a trail outside the registry, and an impostor's change often has none.

For a new address, check whether it appears anywhere else in the company's history: its website over the years, trade directories, invoices you hold, earlier filings. In the Georgia case the new corporate address was a virtual office the fraudsters controlled, and the goods were shipped there.

For a new officer, look for anything that ties them to the company before the filing: an earlier filing, a mention on its website, a professional history that names it, news of a sale or a change of leadership. A buyer or new director normally leaves some of these, and the previous officers can often be reached. A name that appears only in the latest filing and on your application needs an answer before you extend credit.

Compare the domain on the application with the one in the company's older filings, its archived website and any correspondence you already hold. The 2022 advisory says lookalike addresses "may include extra letters or words, substitute characters", such as the number 1 for a lower-case l, "or use a different top level domain".

Then date the domain. For a generic domain such as .com, the public registration record includes its creation date, which ICANN's Lookup tool shows through RDAP, the definitive source of that data since January 2025. A long-established company can move to a new domain, but one created weeks before the application is a reason to ask why.

The Internet Archive's Wayback Machine shows the company's website on each date it was captured, including old contact pages. Gaps prove little, since the Archive notes that some sites are missing because its crawlers "were unaware of their existence at the time of the crawl". A new site at a new domain that copies the old one but changes only the contact details is a strong reason to look further.

Contact the company on details you found yourself, from before the change. The FBI's 2023 announcement advises "Directly calling a business's main phone line to confirm the identity and employment status of the email originator, rather than calling numbers provided via email contact." The 2022 advisory says to "Verify all payment changes, credit requests, and transactions in person or via a known telephone number rather than through a number or link provided in a suspicious email".

The source of the number matters, because the hijack may have changed the company's current public record. Take the number from the archived website, older filings, a trade directory or your own records, treat any detail that first appeared with the recent change as unverified, and ask for someone the older records name.

In one case in the advisory, a sugar supplier asked to sell a full truckload on credit noticed an extra letter in the email domain and "independently contacted the actual company to verify there was no employee by that name working there".

The first signs often come from outside: bills for credit you never applied for, a supplier asking about an order you never placed, or missing mail. The IRS lists among the signs of business identity theft that "You don't receive expected or routine correspondence from the IRS because the business address has been changed." Then act quickly.

1. Check your record. Read your filing history at the registry for any filing you did not make.
2. Keep the evidence. California and Texas both advise getting a certified copy of the fraudulent filing before you update your records, so you keep a record of exactly what was filed.
3. Tell the registry and correct the record. Colorado lets a hijacked business file a complaint and correct the details with a Statement of Correction, and California says to submit new filings with the correct information.
4. Turn on the registry's protections. In a NASS survey reported in 2025, 13 of the 20 states that answered offer an email or text alert when a new filing is made on a company's record, and 11 have password protection or other verification for online filing. Under Colorado's Secure Business Filing, "documents can't be filed without the correct email address and associated password", and California's User Access lets a business control who can file online on its record. Since 1 August 2026, only users with that access can file a Statement of Information online.
5. Tell your bank, creditors and suppliers. California advises asking whether they have seen "recent or unusual charges or orders" in your name, and California and Texas both advise requesting copies of the documents used to open or access accounts.
6. Report it. California and Texas both advise reporting to local law enforcement, and the 2022 advisory says to "Immediately report any online fraud or BEC activity" to the FBI's Internet Crime Complaint Center (IC3).
7. Search for your company's name. The 2022 advisory recommends regular searches to find "multiple websites that may be used in a scam".

In the UK, Companies House's fraud guidance points to its free Follow service, which emails an alert when a filing on your company is accepted, and its PROOF scheme, which rejects paper versions of forms that change a company's registered office or officers. It warns that anyone who knows your authentication code "can change your company's details online", and directs fraud reports to Report Fraud. A separate process covers a company using your name or address without permission, and that guidance points to Police Scotland for a company registered in Scotland.

The case is a composite. Calverholt Precision, Ellen Crennock and Dennis Carrowden are invented, the domains use the .example names reserved for documentation, and the phone numbers come from the 555-0100 to 555-0199 range reserved for fictional use.

In October 2026 a metals distributor in the Midwest receives a credit application from Calverholt Precision Inc., a machine shop it has never sold to, for 30-day terms on a first order of about $96,000 of aluminium and stainless bar, delivered to an industrial unit in another town. It is signed by Dennis Carrowden as president, comes from d.carrowden@calverholtprecision.example and gives a mobile number, +1 260 555 0186. A business credit report on Calverholt comes back clean, with more than thirty years of history.

The filing history. The state registry shows Calverholt incorporated in 1991, with years of periodic reports naming Ellen Crennock as president at the same plant address. Three weeks before the application, a report filed online names Dennis Carrowden as president, moves the principal office to the industrial unit and changes the registered agent. No other filing mentions him.

The domain. RDAP shows that calverholtprecision.example was created 19 days before the application. The older filings and every capture of the company's website in the Internet Archive since 2006 use calverholt.example, which RDAP dates to 2002. The new site copies the old one page for page, with the mobile number and the industrial unit in place of the plant.

The footprint. A regional manufacturers' association directory, the archived contact page and the older filings agree on the plant address and a main line, +1 260 555 0147, and name Ellen Crennock. Nothing outside the recent filing connects Dennis Carrowden or the industrial unit to the company.

The call. The credit manager calls the main line from the directory and the archived site, not the number on the application, and asks for Ellen Crennock. She has not sold the business or moved, does not know Dennis Carrowden and had not seen the filing. Two other suppliers have phoned her in the past week about orders she never placed.

The credit report passed because it described the real company. The filing history dated the change, the domain and footprint showed that the new details had no past, and the call settled it. The distributor declines the application, keeps it with the emails and credit report, and files a complaint with the IC3. Ellen Crennock orders a certified copy of the filing, corrects the record, signs up for the registry's email alerts and reports it to her local police. Two questions stay open, and the file says so: who made the filing, and whether Dennis Carrowden is a real person whose name was used or a name invented for it.

Count only independent evidence: a new website that copies the registry's new address is one fact seen twice.

• Patience. A change filed months before it is used removes the timing signal, so the checks on the new officer and address carry more weight.
• A compromised mailbox. If the real company's email is taken over, requests come from its long-standing domain. The 2022 advisory lists "Gaining access to a legitimate company's email system" among the tactics, so the call matters even when the domain matches.
• Inside access. A former employee, officer or filing agent with the company's registry password or authentication code can file changes that look authorised. Companies House advises changing the code when someone who knows it is no longer authorised to file.
• A thin past. A small company may have no website, no directory listing and few filings to compare against. Invoices you already hold and references you found yourself can stand in.
• A number from the wrong source. A call to a number taken from the application, or from the company's current record after the change, may reach the impostor.

Most changes to a company's record are ordinary, and a fair review checks the ordinary explanation first.

• Businesses are sold, owners retire and new directors join. A genuine change of control usually leaves other traces, and the previous owner can often confirm it.
• Companies move premises and open new sites.
• Rebrands and acquisitions bring new domains, often announced on the old site.
• Accountants, registered agents and staff often file on a company's behalf. Colorado suggests adding a registered agent and an accountant as trusted users of a Secure Business Filing account.
• In many states a company that misses periodic reports can be dissolved and later reinstated. NASS describes this as part of the ordinary filing process, so a reinstatement means reading the filings around it.
• Disputes happen. NASS notes that some changes reported as unauthorised "may be the result of a genuine dispute among parties associated with the entity."

Keep three levels apart. A recent change means look further. A recent change with no link to the company's past, alongside new contact details, calls for contacting the company on details you found yourself. The company's answer on those details settles the question, and the file should record what it leaves open.

A registry shows what was filed and when, and the company's own past shows whether the filing belongs to it. Sixtyfour's agent starts from what you already have, such as a company name, an officer's name, an email domain or a website, researches public sources such as registry filings, the company's web footprint, news and professional profiles, links what it finds to the right company and people, and returns every finding with its source. Anything it could not establish is reported as open, and a person on your team decides. It does not check bank accounts, credit files or identity documents, and it does not replace the call to the company. There is more on how financial crime teams use it on our financial institutions page.

When a request arrives in an established company's name, read its filing history for recent changes to its address, officers or registered agent, and check whether those details, and the email domain, connect to anything in the company's past. Then confirm the request on contact details you found yourself, from before any change, and if the company is yours, check your record, keep the evidence, correct it with the registry and turn on its alerts.