"Great news, you qualify. We just need your bank login to verify revenue. Takes two minutes, then I'll read you the offer."
It's the third funding call before lunch. Then comes the second ask: "Your bank just texted you a code. Can you read it to me?"
This is Part 25 of Stop the Calls. Part 24 checked whether a "direct lender" is really a broker. Today: what to send instead of your password, and what to do if you already gave it.
General information, not legal advice. The call above and Birchline Upholstery (a made-up shop) below are invented examples.
Why they want the login, not the statements
A funder does need to see revenue. But a PDF statement shows the months you pick, once. A login shows everything, for as long as the password works: every deposit, every balance, every daily debit from an advance you already carry.
From the industry side: that view tells a broker how many positions you have and when you might need more. It also makes your file easy to shop around.
That code your bank texted is the second lock. A caller asking you to read that code is asking for the key.
The FTC tells small businesses not to share passwords by phone, text or email (FTC: Cybersecurity for Small Business).
The tactic: the no-login swap
Step 1: never read a code out loud. No login, password or one-time code to any caller. Log the call in your call log template.
Step 2: offer statements you control. Download the PDF statements from your bank yourself. Send them only to a company address you have checked.
Step 3: if a funder insists on a connection, get its legal name in writing. Connect only through your own bank's sign-in page, read-only, where your bank offers that. Your password goes to your bank, not their form.
Step 4: turn it off after the decision. Look for connected apps in your online banking security settings.
The script
"I don't share my online banking login or any security code. I can email PDF statements I download from my bank, to your company address. If your funder needs a bank connection, send me the funder's legal name in writing and I'll connect through my bank's own sign-in page. If that doesn't work for you, please put [phone numbers] on your internal do-not-call list."
Birchline's owner read it at 11:05 AM. The caller said PDFs "slow things down," asked for the code again, then hung up.
Already gave it? Do this today
- Change the password from a device you trust, and turn on multifactor authentication (CISA: Turn On MFA).
- Call your bank's fraud line, using the number on your card.
- Check connected apps, added users, new payees and any ACH or wire changes. Remove what you don't recognize.
- If you also signed a debit authorization you want to end, see the ACH revocation letter.
- If money moved, report it on the FTC fraud reporting site and to the FBI's Internet Crime Complaint Center.
How we use AI on this
When we help an owner, an AI sort flags any funding message that asks for a login, password or code, and drafts the statement-only reply. Try it in any AI chat:
"Here is a message from a business funding company. List anything it asks for that would give someone access to my bank account. Then write a short reply offering downloaded PDF statements instead."
The rules behind it, and where they stop
- Federal Regulation E protections for unauthorized electronic transfers are written for consumer accounts set up for personal, family or household use (12 CFR 1005.2(b)). Business accounts mostly depend on your bank agreement: 12 CFR 1005.2 on eCFR
- Even on a consumer account, a transfer by someone you gave access to may not count as unauthorized until you tell the bank (12 CFR 1005.2(m)).
- Business lines aren't covered by the National Do Not Call Registry at all. It's for personal numbers: FTC Do Not Call FAQs
Rules differ by state and bank, and none of this promises an outcome. A licensed attorney can tell you how they apply to you. More in Know Your Rights.
Your checklist
- No login, password or code to any caller.
- Send PDF statements you downloaded yourself.
- Connect only through your bank's own page, then turn it off.
- Already shared it? Change it and call the bank.
Coming in Part 26: the e-sign link texted at 9 PM, and what to read before you tap Sign.
