Ilia Zavialov on a company's digital signature and logins: how they are stolen, how directors are swapped and how money leaves

01

Why the director's digital signature became the key to a company

A director's digital signature or company login used to be a formality for filing reports. Today it signs contracts, submits tax returns, opens the online bank, sends filings to the companies register and grants authority to staff. Whoever holds it acts for the company in all of these places at once.

That is why criminals no longer need to break into the whole finance department. It is enough to obtain the signature, the login that stands in for it, or the right to use it. From there they can move money from the account, change bank details in contracts, file a change of director and sign obligations that the company will spend months disputing.

Ilia Zavialov looks at how a signature leaves a company, which scenarios are the most common and which storage rules close most of them. The focus is on small teams where two or three people use the signature and nobody works on security full time.

02

The call from the certificate provider

A typical scenario starts with a call. The caller says they work for the certificate provider or the tax office and warns that the signature certificate is about to expire, and without renewal the company will not be able to file or pay. Such calls come in the last days before a filing deadline, when the accountant is already working against the clock.

The caller then asks for a code from a text message, sends a link to a renewal page or asks the accountant to install a program so that a specialist can do everything remotely. Each of these steps hands a stranger either access to an account or control of the computer that the signature token is plugged into.

The team rule fits on one line: renewing a signature never starts with an incoming call. Any conversation about a certificate, a code or installing software ends with the words I will call you back, after which the employee finds the provider's number on its official website or in the documents received when the signature was issued.

03

An email to the accountant and a remote access program

The second scenario arrives by email. The accountant receives a reconciliation statement, a demand from the tax office, an invoice from a supplier or a notice of an inspection, and the attachment is an archive or a document that asks to enable its content. Opening it installs a program that gives the attacker remote control.

The danger is that this computer usually holds everything at once: the signature token plugged in for the whole day, the online bank left open and saved passwords. The attacker waits for the evening, connects and sends a payment on behalf of the company, signed with the real signature of the real director.

In this situation the bank sees an ordinary payment with a valid signature from a familiar computer. Protection therefore has to be in place in advance: the token comes out after work, the online bank runs on a separate device, and attachments from unknown senders or unexpected letters from authorities are checked by phone on a known number before they are opened.

04

A change of director: how a whole company is hijacked

The heaviest scenario is aimed at the company itself, and money from the account is only the first step. With a stolen signature or a forged authority, criminals file a change of director or shareholder with the register. By the time the real owner finds out, the new director is already opening accounts, signing contracts and withdrawing money.

Signs of such a hijack appear in public records before they appear at the bank. A stranger's name shows up in the register extract, the address changes, a new authority appears in the company's file. If nobody on the team reads the extract regularly, the first signal is a call from a counterparty or a letter from the bank about a frozen account.

For a small company the main defense here is organisational. You need to know who can file on the company's behalf and where, to watch for changes in the register and to use the safeguards that the state in your country offers, such as identity checks or bans on filings without the owner. The local section below covers them.

05

What US agencies see

In the United States the same attack usually arrives through email and online banking. The FBI Internet Crime Complaint Center recorded 24,768 complaints about business email compromise in 2025, with losses of 3,046,598,558 dollars, second only to investment fraud. Between October 2013 and December 2023 it counted 305,033 such incidents with potential losses of 55,499,915,582 dollars.

Finance staff and tax professionals are named targets. The IRS put new client and document request emails with malicious links or attachments on its Dirty Dozen list for 2026, warning that they aim to steal client data or gain access to systems. The FTC reports that in 2025 people lost nearly 1 billion dollars to scammers posing as companies and about 920 million dollars to scammers posing as government agencies.

06

Authorities, tokens and a shared PIN

In a small team the signature is often used in turns. The token lives in a desk drawer, the PIN is written on a sticky note or sent in a messenger, and an authority to sign is held by an employee who left long ago. Each of these habits is convenient, and each turns the director's signature into a shared key that is hard to revoke.

An authority to sign is especially treacherous. It allows the holder to sign for the company and stays valid until the date written in it, even after the person has left. When an employee leaves, revoke the authorities issued to them and any signature certificates issued in their name for company work, together with their access to email and the online bank.

A shared PIN makes any investigation impossible. If three people used the signature, the transaction log can no longer show who sent a payment. Everyone who signs documents should therefore have their own signature within their own powers, and the director's signature should stay with the director.

07

Business identity theft in state and tax records

A company can be hijacked on paper. The National Association of Secretaries of State describes unauthorised filings that change a company's address, officers or registered agent, notes that 13 of the 20 states it surveyed send alerts about new filings, and warns that a state office often has little or no authority to reject such a document. The Secretaries of State of California and Texas warn about bogus filings to change a company's address and directors, and Texas notes that criminals target businesses that lost their status over unpaid taxes.

The tax side has its own signs. The IRS lists a notice about an Employer Identification Number the company never requested, and routine IRS mail that stops arriving because the business address was changed. If someone is using the company's name or EIN to file fraudulent returns or W-2 forms, the IRS asks the business to submit Form 14039-B, the Business Identity Theft Affidavit.

08

Rules for storing a signature in a small team

The first rule concerns the token. The signature is kept on a protected token that is plugged in only while it is being used and removed straight afterwards. The token never stays in the computer overnight and is never handed over together with its PIN. The PIN itself is stored apart from the token and never sent in a message.

The second rule concerns the computer. The online bank and the services that use the signature are best opened on a separate device that is not used for email or attachments. If there is no separate device, the work computer should have no remote access programs that the employee did not install with the director's agreement.

The third rule concerns money. At the bank, switch on approval of payments by a second person, limits on amounts and alerts on the director's phone for every login and every transaction. Even a stolen signature does not move money if a large payment needs a second approval and the owner sees the login attempt the same minute.

09

What to check once a month

A regular check takes half an hour and closes the most expensive scenarios. Once a month, open the register extract for your company and compare the director, shareholders, address and business activities. Any discrepancy means an immediate call to the registration authority.

On the same day, review the list of valid signature certificates and authorities. A certificate issued without the director's knowledge or an authority in a stranger's name has to be revoked that day. If the certificate provider or the bank sends notices about new certificates, route them to an address the director actually reads.

The last item concerns the bank. The list of devices and users in the online bank, the login history and the current limits show whether someone extra has appeared. Remove former employees, old phones and forgotten accounts at once, even if nothing suspicious has happened yet.

10

If the signature is already in the wrong hands

When there is a suspicion that an outsider has used the signature, time is counted in hours. First call the bank on the number in your contract and ask it to block access to the online bank and all outgoing payments until the matter is clear. Money that has not yet left the account is the easiest to save.

Then ask the certificate provider to revoke the certificate. While it is valid, documents signed with it look legitimate, so revocation cannot wait for the end of the investigation. At the same time change the passwords for email, the online bank and government accounts, and remove remote access programs from the computer.

After that, check the register, the tax account and the bank for filings and documents signed on behalf of the company. Record everything you find with dated screenshots: these materials will be needed for the police report and for disputes with counterparties who received documents in the company's name.

11

Fake beneficial ownership letters and where to report

In December 2024 FinCEN warned about fake forms such as a Form 4022 or Form 5102 that demand a fee and include links or QR codes, and reminded companies that a government agency will never ask for money to file beneficial ownership information. In August 2026 FinCEN permanently removed that reporting requirement for US companies and US persons, so a letter pressing a US company to pay for a beneficial ownership filing deserves deep suspicion.

If money has already left, call your bank first and ask it to recall the transfer, then file a complaint at ic3.gov. Report the scam to the FTC at ReportFraud.ftc.gov, use IdentityTheft.gov for the recovery steps and send Form 14039-B to the IRS if the company's tax identity was misused.