You Are the Attack Surface

I know what tax identity theft looks like from the inside — not from a case study, but from my own return. Someone filed under my Social Security number before I did, collected the refund, and disappeared. What followed was months of paperwork, phone calls to agencies not designed to move quickly, and the particular frustration of trying to prove you are who you say you are to an institution that has already decided otherwise.

That experience is what led me to build a free resource — lockdownyourid.com — with every concrete step I wished I'd known before it happened. But working with small business owners over the years has shown me something the consumer-facing guides miss entirely: when a founder's identity is compromised, it isn't just a personal problem. It becomes a business problem. And nobody is writing about that version of the story.

Roughly fifteen million Americans experience identity theft every year. The ones who feel it the most are not the ones who have the least to lose.

In my direct experience working with dozens of small business owners, one pattern was consistent: the higher up in a company a person sat, the more resistant they were to anything that added friction to their day. Security measures felt like an imposition — something for the IT department to worry about, not the person running the company. But the higher up in a company a person sits, the more sensitive and important information they hold. The founder who won't set up two-factor authentication is also the person with access to the business bank account, the payroll system, the client contracts, and the employee records. They are not the lowest-risk person in the organization to attack. They are the highest-value target in it.

Large companies get the headlines when they're breached. They also have security teams, incident response plans, cyber insurance, and legal counsel on retainer. The attacker who goes after a Fortune 500 company is contending with layers of defense specifically designed to stop them.

The attacker who goes after a small business owner is contending with one person who's also managing payroll, client deliverables, and a leaky faucet in the office bathroom. The asymmetry is the point. Small business owners are targeted not despite being small — but because of it.

And unlike an individual consumer, a compromised founder hands over access to an entire ecosystem. Personal bank accounts. Business credit lines. The Employer Identification Number used on tax filings. Employee Social Security numbers stored in payroll software. Every client relationship that lives in their email. The attack surface isn't one person — it's every system that person has ever authenticated into.

The average identity theft case takes six to eighteen months to resolve. For an individual, that's a miserable stretch of paperwork and waiting. For a business owner, those same eighteen months might contain a commercial lease renewal, a bank loan application, a line of credit needed to cover a seasonal gap, or a key hire that requires a background check.

A frozen or flagged credit profile doesn't politely wait for the investigation to conclude before affecting those things. The business that needed capital to take on a new contract doesn't get to pause while the founder sorts out a fraudulent tax return filed two years ago. The timeline of resolution and the timeline of the business don't negotiate with each other.

Tax identity fraud alone accounts for roughly one million cases per year. The typical financial impact to the individual is around $1,300 — but that number doesn't capture the cost of the business decisions that had to be delayed, deferred, or abandoned during the months it took to get there.

None of what follows requires a security team or a significant budget. It requires decisions — made once, before the moment they're needed. These are the five I recommend to every founder, in the order I'd do them.

Before any conversation about tools or services, I ask four questions. The answers tell me more about a business owner's actual exposure than any technical audit.

The first question almost always lands quietly. Most people have no real answer — which means the answer is "months." That's the window an attacker has to do meaningful damage before the alarm sounds.

The fourth question is the one I find most useful. People's phones contain their email, their banking apps, their password reset pathways, and often their authenticator codes. A phone without a strong passcode — or set to biometric-only without a backup PIN — is a single point of failure for the entire account stack built on top of it.

The founders I've worked with who had the hardest time accepting this were also the ones who had built the most. Something about having built a real business from nothing makes the idea of being a victim feel incompatible with the identity of being the person who built it. I understand that instinct. It's also exactly what makes the resistance to basic protection so costly when the moment arrives.

Every one of the five protections above can be completed in an afternoon. A credit freeze takes fifteen minutes across three websites. An IRS IP PIN takes a single enrollment. A password manager takes an hour to set up and a few weeks to fully migrate into. These are not ongoing burdens. They are one-time decisions that return years of protection — the same kind of decision you made when you chose the platform your business runs on, or the contract language that protects your client relationships.

Before you close this page, sit with this one question.

Not how long would it take to resolve — that's six to eighteen months and largely outside your control once it happens. How long would your business wait for you to be able to sign a lease, close a loan, or clear a background check while the IRS works through a backlog that was not designed for urgency?

The protection is available. Most of it is free. The IRS IP PIN alone closes the most common attack vector in a fifteen-minute enrollment. A credit freeze at three websites removes the next one. The people who have done these things are not more technically sophisticated than the people who haven't. They're just the ones who asked the question before the answer became urgent.