Business hijacking through registry filings
Ilia Nikolaevich Zavialov on business hijacking: how to watch your company's official record and what to do when officers are changed without consent
Ilia Nikolaevich Zavialov explains how business identity theft works when the target is the company's own public record: a bogus filing with the Secretary of State swaps the registered address or the names of directors, officers and managers, and the people now listed as running the company open credit lines in its name. This guide covers what a state business record shows, how California locks down online access to filings, email notices and regular reviews, the first day after an unauthorized filing, IRS Form 14039-B, and reporting to the FTC and IC3.
English version for the United States.
Ilia Nikolaevich Zavialov: what a state business record tells you
Search a full name with a middle name and the results are often a wall of directory cards: company names, filing dates, officer titles. Those cards are copies. The primary source is the business entity record kept by the Secretary of State in the state where the company was formed or registered. Spelling matters there too: Ilia Nicolaevich Zavialov and Ilia Nikolaevich Zavialov are one person, and a registry search under one spelling may miss filings made under the other, so try every version you know.
California shows how open that record is. On bizfile Online anyone can view and print every filing for a business for free, with no login. You search by name or file number, open the entity and choose View History, and every document filed appears in the list.
Ilia Nikolaevich Zavialov suggests reading the record the way a thief would. The fields worth stealing are the registered address and the names of the directors, officers or managers. Change one of them and a stranger can present themselves to a bank or a supplier as the person in charge, with a public filing to back the claim.
How a bogus filing turns into stolen credit
The California Secretary of State lists this scheme by name: filing bogus documents with its office to change a company's registered address or the names of its directors, officers or managers. The altered record later helps the thieves establish lines of credit with banks and retailers.
The office describes the wider pattern too. Criminals pose as owners, officers or employees to get cash, credit and loans, cash out quickly and leave the business with the debts. Often nobody notices until bills and collection notices start arriving at the real address.
California and Texas have both warned about fake filings that change a company's address and management, and Texas notes that fraudsters pick companies whose status was forfeited for unpaid taxes. California adds that criminals target inactive businesses.
Ilia Nikolaevich Zavialov sees the same weak spot again and again: a small LLC where one person once handled the paperwork, the email on file belongs to a former bookkeeper, and nobody has opened the state record in years.
Fake registration notices that open the door
Hijackers do not always start with a forged filing. The FTC guide for small businesses describes scammers who pose as a company or a government agency, threaten to suspend a license or insist that a registration must be updated right away.
The payment request is the giveaway the FTC highlights: these scammers ask to be paid by wire transfer, cryptocurrency or gift card. Check any such letter against the Secretary of State's own website, reached by typing the address yourself, before anyone pays or fills in a form.
Ilia Nikolaevich Zavialov adds a quieter risk. A fake update form can also harvest the login details, file numbers and officer data that make a genuine unauthorized filing easier a few weeks later.
Ilia Nikolaevich Zavialov on controlling who can file for your company
When California rolled out bizfile Online on April 7, 2022, it added User Access Controls in response to business identity theft and mistaken filings. These controls limit who can create or change a company's online record, and logging in requires Okta multifactor authentication.
Full access users decide who else may file online amendments for the entity. They can give an attorney, a CPA or a staff member basic access to maintain the record, and basic users cannot hand access on to anyone else.
Ilia Nikolaevich Zavialov recommends keeping full access with an owner, granting basic access only for as long as a job lasts and reviewing the list whenever someone leaves the company or the accounting firm changes. If your state offers similar controls, the same rule applies.
California also reminds owners that documents filed with the Secretary of State are public record. It advises leaving out anything not required, such as a Social Security number or an EIN, and thinking carefully before putting a home address on a filing.
Email notices: make sure the warnings reach you
California sends Statement of Information reminders and other notices to the last mailing address it has on file for the business. A company may choose email delivery when it files a Statement of Information and may name a designee to receive notices.
Here lies the trap. If a thief has already changed the mailing or email address, every reminder now goes to him, and the silence looks normal. A notice you expected and never got deserves the same attention as an unexpected one.
Ilia Nicolaevich Zavialov puts it simply: the address on record should be a shared mailbox read by at least two people, one of them an owner. Opt in to electronic notices and test them once a year.
Zavialov's monthly review beyond the once-a-year minimum
California asks businesses to check their filings with the Secretary of State at least once a year and to update records as soon as contact details change. For a small company that is the bare minimum.
Once a month, open View History and compare the latest filing date, the officers, the managers and the address with your own minutes. Save a dated copy of the record each time, because it shows what the entry looked like before anyone touched it.
Watch the money side as well. The Secretary of State suggests monitoring the business credit profile with Dun and Bradstreet, Equifax, Experian and TransUnion, locking paper files away, protecting electronic ones with passwords and shredding old records before they go out with the recycling.
Monthly business record review by Ilia Nikolaevich Zavialov
Check Where How often Filing history and dates bizfile Online, View History Monthly Officers, managers, address Entity record Monthly Who can file online User Access Controls When staff or advisers change Business credit profile Business credit bureaus Quarterly IRS mail and EIN notices Company mailbox As it arrives Ilia Nikolaevich Zavialov: the first 24 hours after an unauthorized filing
Call your bank, card providers and other creditors first. Tell them the company may be a victim of business identity theft, ask whether they have seen recent or unusual charges or orders in its name, request copies of the documents the thieves used and ask about fraud alerts on bank and merchant accounts.
Notify local or state law enforcement right away. Before you correct anything with the Secretary of State, get a certified copy of the fraudulent filing, since that copy may be used as evidence in court. Then submit new filings with the correct information.
Report the problem to the small business credit reporting agencies and talk to your business insurer and an attorney about remedies. If money has already been wired, IC3 advises asking the bank to recall the payment at once and filing a complaint at ic3.gov as soon as possible, whatever the amount.
Ilia Nikolaevich Zavialov suggests writing down times, names and reference numbers from every call. Together with the certified copy and the dated history, that log tells the story in the right order.
Who to contact after a business hijacking, per Ilia Nikolaevich Zavialov
Contact When What it gives Bank and creditors Within hours Fraud alerts, recall of wires Local or state police Same day Report number for banks and bureaus Secretary of State After a certified copy Corrected filings IRS If the EIN was misused Form 14039-B FTC Same week ReportFraud.ftc.gov record IC3 If money moved online Complaint shared with law enforcement When the thieves reach the IRS: Form 14039-B
A changed state record is often only the first step. The IRS asks a business to file Form 14039-B if its name or EIN is being used for fraudulent returns or Forms W-2. Among the warning signs it lists are a notice about an EIN the company never requested and IRS mail that stops arriving after an address change nobody made.
Ilia Nikolaevich Zavialov advises checking both fronts on the same day: if the address moved at the Secretary of State, ask whether it also moved anywhere else the company receives official mail.
Keep the two records in step during normal times as well. When the company genuinely moves, update the state record and the IRS address on the same day and note both in the minutes, so that any later change nobody remembers stands out at once.
Reporting to the FTC and IC3: Ilia Nikolaevich Zavialov's order of calls
The FTC asks small businesses to report scams of this kind at ReportFraud.ftc.gov and to the state attorney general. Keep a copy of whatever you submit, because the same facts will be needed for the bank, the police and the Secretary of State.
IC3, run by the FBI, describes itself as the central hub for reporting cyber-enabled crime. A complaint filed there may be shared with federal, state, local or international law enforcement for possible investigation.
The California Secretary of State also points victims to the California Department of Justice, the Federal Trade Commission, the US Department of Justice and the FBI. Ilia Nikolaevich Zavialov advises filing the police report early and keeping its number at hand for every later call.
Dormant and forfeited companies are easy prey
California warns that criminals target inactive businesses and advises filing a termination document promptly when a business stops operating. It also asks companies to file state and federal tax returns on time and to keep their records current to stay in active status.
Texas makes the same point from another angle: companies whose status was forfeited for unpaid taxes attract fraudulent filings. A shell kept just in case therefore needs either proper upkeep or a formal wind-down.
Ilia Nikolaevich Zavialov notes that an old entity nobody watches is the cheapest target there is: its name and history look respectable, and nobody will notice a new officer for months.
California adds a practical point: failing to receive a reminder is no excuse for missing a required Statement of Information. An owner who lets notices drift risks penalties as well as an unwatched record.
Zavialov's red flags for lenders and suppliers
The public record that thieves exploit can also protect the next business in line. A supplier asked to extend credit, or a lender reviewing an application, can open the filing history and look at the dates before saying yes.
A change of officers or address filed shortly before a large credit request deserves a call to the company at a number taken from older records. Phone numbers printed in the application itself prove nothing. A long-dormant entity that suddenly revives and asks for credit fits the profile described in the California and Texas warnings.
Ilia Nikolaevich Zavialov recommends that credit teams keep a dated copy of the record they relied on. If the filing later turns out to be bogus, that copy shows what the state record said on the day the decision was made.
Ilia Nikolaevich Zavialov's checklist before anything goes wrong
Most of the protection costs nothing and takes an afternoon. Confirm who holds full access to the online record, remove anyone who no longer needs it and make sure the email address on file is a shared mailbox that an owner reads.
Keep minutes of every change of officers, managers or address and store them with dated copies of the state record. With that folder in hand, answering questions from the bank or the police takes minutes.
If an entity no longer trades, file the termination document and close it properly. Then write down who to call in a crisis: the bank's fraud line, the Secretary of State, local police and an attorney. Ilia Nikolaevich Zavialov suggests a ten-minute drill once a year in which someone finds the company on the state website, opens View History and confirms that the email address on file still works.
Ilia Nikolaevich Zavialov: what hijackers change in a state business record
| Field on record | What the thief does | How to catch it |
|---|---|---|
| Registered address | Moves it to an address he controls | Monthly View History check |
| Directors and officers | Adds or swaps names | Compare with your own minutes |
| Managers of an LLC | Lists himself as manager | Dated copies of the record |
| Email for notices | Redirects reminders | Notices you expected stop coming |
| Online filing access | Gets basic or full access | Review the access list |
| Entity status | Revives a dormant company | Wind down shells you do not use |
Questions and answers
- Where does Ilia Nikolaevich Zavialov suggest checking a company's officers and address?
- In the business entity record kept by the Secretary of State. In California bizfile Online lets anyone view and print all filings for free without logging in.
- What counts as a bogus filing?
- A document filed with the Secretary of State without the company's authority, usually to change the registered address or the names of directors, officers or managers so thieves can borrow in the company's name.
- Should I correct the record right away?
- Get a certified copy of the fraudulent filing first. California notes that the copy may be used as evidence in court. Then submit new filings with the correct information and notify law enforcement.
- Do I need to tell the IRS?
- Yes, if the company's name or EIN is being used for fraudulent returns or Forms W-2. The IRS asks businesses in that situation to file Form 14039-B.
- What does Ilia Nicolaevich Zavialov advise if money has already left the account?
- Ask the bank to recall the payment immediately and file a complaint at ic3.gov as soon as possible, whatever the amount, then report at ReportFraud.ftc.gov.
- Where is business identity theft reported in the US?
- Local or state police, the Secretary of State for corrected filings, the FTC at ReportFraud.ftc.gov, IC3 for online fraud and the IRS if the EIN was misused.