What are the red flags of this scam?

An unsolicited email claims you are 'pre-selected' for an SBA line of credit — the real SBA does not proactively offer pre-approved credit via unsolicited email • The offer promises $4 to $10 million within 48 hours with minimal requirements — no legitimate SBA program works this way • The email links to a site that looks like sba.gov but the URL is slightly different (extra subdomain, different TLD, or hyphens in the domain) • The form asks for your EIN, business bank routing/account numbers, owner's SSN, and annual revenue before any call with a real loan officer • The email passes spam filters even though it uses financial keywords — attackers use invisible characters to split trigger words

What should I do if this happened to me?

Never submit your EIN, bank account, or SSN via a link in an unsolicited email — type sba.gov directly into your browser to check real SBA programs • SBA loan applications go through SBA-approved lenders you contact yourself — the SBA does not email you a pre-approval out of the blue • If you already submitted information: contact your business bank immediately to flag potential fraud on your accounts • Place a business credit freeze through Dun & Bradstreet, Equifax Business, and Experian Business if you shared your EIN and revenue data • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

HIGH phishing Last reported: Sep 8, 2026 Share

A "pre-approved SBA loan" email is a phishing attack harvesting your business banking details

Q: Is this a scam?

Yes. This is a documented scam pattern. Emails impersonating the U.S. Small Business Administration offer $4–10 million in pre-approved credit within 48 hours. They harvest your EIN, business bank account, revenue figures, and owner SSN to enable follow-on wire fraud and business identity theft.

Emails impersonating the U.S. Small Business Administration offer $4–10 million in pre-approved credit within 48 hours. They harvest your EIN, business bank account, revenue figures, and owner SSN to enable follow-on wire fraud and business identity theft.

Also known as: fake SBA loan email, SBA pre-approval phishing, SBA funding scam, small business grant phishing

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Never submit your EIN, bank account, or SSN via a link in an unsolicited email — type sba.gov directly into your browser to check real SBA programs
2 SBA loan applications go through SBA-approved lenders you contact yourself — the SBA does not email you a pre-approval out of the blue
3 If you already submitted information: contact your business bank immediately to flag potential fraud on your accounts
4 Place a business credit freeze through Dun & Bradstreet, Equifax Business, and Experian Business if you shared your EIN and revenue data
5 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Red flags

⚠ An unsolicited email claims you are 'pre-selected' for an SBA line of credit — the real SBA does not proactively offer pre-approved credit via unsolicited email
⚠ The offer promises $4 to $10 million within 48 hours with minimal requirements — no legitimate SBA program works this way
⚠ The email links to a site that looks like sba.gov but the URL is slightly different (extra subdomain, different TLD, or hyphens in the domain)
⚠ The form asks for your EIN, business bank routing/account numbers, owner's SSN, and annual revenue before any call with a real loan officer
⚠ The email passes spam filters even though it uses financial keywords — attackers use invisible characters to split trigger words

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources