No matter how small or large your business may be, business identity theft (or corporate identity theft) can reach deep into your profits. The most obvious area is when your clients or customers become victims of identity theft. As with other areas of corporate identity theft, there are specific, measurable areas your company can be affected, and there are "intangibles" that need to be considered, as well.
The Obvious Stuff
Let's say you own Widgets, Inc. If one of your customers is a victim of identity theft, the identity thief may order 300 widgets on the customer's account. Obviously, the customer is not going to pay for widgets they did not receive. And you want to keep the customer, so you will agree to take the charges off of their account. But you will never see your 300 widgets again, widgets that you have already manufactured or purchased wholesale. You can write them off as a loss of course, but to keep your business running your drive you have to manufacture 300 more widgets to replace the ones that were lost.
Let's say the identity thief didn't use an account though, maybe they used a stolen credit card instead. Since the identity thief didn't want you to look too closely at the credit card, they came in while you were busy, so you didn't really even checked their ID to make sure they were the person whose name was on the card. Not only have you lost your 300 widgets, but when the victim calls the credit card company to dispute the charges your company will get a "chargeback". This means the credit card company is going to take back the money you got for the purchase. There may be an investigation as well, and the credit card company hits you with a fine because you didn't check ID before you ran the card. Keep in mind, this has nothing to do with the law, it has to do with how the credit card companies do business. So now you've lost 300 widgets, received no compensation for them, and paid a hefty fine on top of it all.
If you run a business, you already see how big this problem is. These are deep financial waters if your company doesn't have a huge cash reserve (and who really does these days?)
The Less Obvious Stuff
One of the most common complaints from identity theft victims is that they have such a hard time convincing businesses that they were the victim, and shouldn't be responsible for the bill. The obvious stuff above is the biggest reason why. Businesses (especially utility companies and cell phone providers) have had to deal with people who did not want to pay their bill since money was invented. They have heard every excuse in the book, and a lot of them have gotten very jaded. The new Federal laws that deal with identity theft and data breach are causing a change in how businesses handle identity theft complaints. This helps the actual victims, and puts additional responsibility on the business owner. If your business is big enough, you might be able to hire somebody to handle this stuff for you. Otherwise, you will have to handle it yourself, which means you have to take time away from your business.
And everybody knows, in business time is money.
Businesses have always protected certain information, records of transactions being high on that list. So when somebody calls Widgets, Inc. and says they want those records, a business owner's first response will be "No." But FACTA says victims of identity theft have a right to all transaction records related to the identity theft. (There are a couple of exceptions to the rule, but don't count on that helping at all.)
So, on top of losing your widgets, not getting paid for them, getting a fine from the credit card company, and getting yelled at by the customer for trying to protect your company from people who want to get something for nothing, you'll be burning the midnight oil digging up records for transactions that may be years old. (And when you give those copies to the victim or an investigator, be prepared to answer a subpoena if the identity thief gets caught and prosecuted, because the copies you gave to the victim are generally not accepted in a court.)
But the biggest nightmare for a small company is having two or three clients become victims of identity theft around the same time. This can often mean your company has suffered a data breach. If that's the case, your company must notify any customer who may be at risk of identity theft because of the breach. This means additional time investigating who might be affected, the cost involved in notifying them all, the likelihood of a Federal investigation, maybe even fines and lawsuits.
All told, it's easy to see that when it comes to identity theft, business is the biggest victim.
