An overpayment credit on the state unemployment insurance tax account was sent to a bank destination the small business owner never authorized.
The regional staffing agency had carried an active UI tax account with the state workforce commission for nine years. The company's EIN, legal name, and employer account number sat in the commission's public employer directory so claimants could verify registration status. An actor who found the employer account number in that directory submitted an online change through the self-service portal and rewrote the banking destination for tax credits and refunds. A credit from a prior rate adjustment paid out to the fraudulent account on the next processing cycle. The accountant discovered the loss when the credit was no longer available to apply against a quarterly payment.
The portal accepted the employer account number, the EIN, and the registered email as enough to change payment routing. Those values were public or had already appeared in a prior breach at a compliance software vendor used for HR files. Recovering the disbursed credit meant a dispute with employer services and a trace through the commission's payment records on the commission's timeline. While that ran, the credit balance stayed unresolved.
A small business owner who never audits the bank details on file with every government agency that holds payment routing data has not mapped the full money surface. Each portal that can push a refund or credit is its own control point. The directory built for claimant convenience is the same directory that hands an actor the account number required to move those funds. Fixing the bank field after a theft does not restore the cycle already paid out, and it does not tell the owner how many other agencies still hold a routing path built from the same public identifiers.
The system you trust is actively selling a roadmap straight to your front door. You don't have to accept that. The RuleDraft Small Business Isolation Manual shows Small Business Owners how to separate their business from their personal lives.