In most states, a stranger could file a financing statement against your company this afternoon, and the filing office would accept it without asking a single question. That is not a flaw in the system — it is the system. Commercial filing offices work on a "ministerial" basis: they record what is submitted, they do not investigate whether it is true. The design keeps borrowing cheap and fast. The side effect is that the public record of your business — the record lenders, landlords, and partners search before they trust you — is more editable than most owners realize.
Rhode Island just became the latest state to do something about it. In June 2026, the governor signed Senate Bill 3212 (the companion to House Bill 8324A), a package of amendments aimed squarely at business identity theft: fraudulent filings made in a business's name, entities formed with stolen identities, and the deceptive solicitation letters that piggyback on all of it. If you run a business anywhere in the United States, the law matters for two reasons. First, its playbook is portable — the steps it enables in Rhode Island are worth demanding, and often already available, in your state. Second, the problem it targets is almost certainly bigger than you think.
What a UCC filing actually is, and why a fake one hurts
When a lender secures a loan with your assets — equipment, inventory, receivables — it files a form called a UCC-1 financing statement with the state filing office, usually the Secretary of State or Department of State. The filing puts the world on notice that someone claims a security interest in your property. Lenders run UCC searches before extending credit, landlords search before leasing, buyers search before acquisitions. A clean search is table stakes for closing almost any deal.
Here is the problem: nothing at the filing office verifies that the person filing has any relationship to the debtor. Filing a UCC-1 against a business you have never dealt with is, in principle, as easy as filing one against your own customer. The National Association of Secretaries of State (NASS) has documented a sustained increase in these "bogus filings" — false liens filed against businesses and individuals, sometimes as harassment or retaliation, sometimes as part of paper-work campaigns by people who believe they can create legal obligations by writing them down. Legal practitioners estimate that fraudulent financing statements affect thousands of businesses and individuals every year.
The damage is real even when the claim is absurd:
- Deals stall. A surprise lien on the record can freeze a credit line, delay a closing, or kill an acquisition while everyone waits for an explanation that never comes.
- Cleanups are slow. Traditionally, the victim's options were to demand that the filer send a termination, attempt to file a termination amendment themselves, or sue — and in some states litigation has effectively been the only reliable path, which means months of expense for a filing that took the fraudster ten minutes.
- The record is public. Anyone searching your business name sees the claim. It sits there, implying you owe someone money, until it is formally removed.
States have been chipping away at this for over a decade. After the national UCC rules were tightened in the early 2010s, many states criminalized knowingly false filings, and legal surveys now count at least fourteen states whose filing offices have some authority to take corrective action on fraudulent records already on file. But the norm remains: the burden of detection and removal falls mostly on the victim.
Business identity theft is bigger than fake liens
Fraudulent UCC filings are the loudest variant of a broader problem. State business registries are public, low-friction, and — by design — light on verification. That openness, which makes starting a company cheap, also means:
- Someone can form an entity that uses your name. Bad actors register look-alike companies, or list your name and address as a "registered agent" or "authorized person" without your knowledge, borrowing your credibility for their scheme.
- Someone can file changes against your existing entity. Unauthorized amendments, address changes, or agent changes can hijack where your official mail — including government notices and tax documents — actually goes.
- Someone can mine the registry to target you. Your registered address, your formation date, your annual report deadline are all public. That is exactly the data needed to send you a convincing fake invoice.
Rhode Island's registry alone covers more than 110,000 active entities. Multiply that across fifty states and you get a target list with no equal.
What Rhode Island's SB 3212 actually does
The new law, which the Department of State's Business Services Division pushed for, attacks the problem on three fronts.
1. A formal complaint and removal process
The centerpiece is an administrative remedy. Individuals and business owners whose identities were used in unauthorized filings can now submit a complaint directly to the Rhode Island Department of State, which gets a formal process for removing illegitimate filings from the public record. That is a meaningful shift: instead of retaining a lawyer to chase a fraudulent lien through the courts, a victim files a complaint with the office that holds the record, and that office — not the victim — carries the removal forward. The department noted that the process limits the legal and financial harm to fraud victims by clearing the record, rather than leaving it in place while a dispute plays out.
2. Authorization requirements and refusal authority
The law also tightens what gets accepted in the first place. Records become effective only when submitted by parties actually authorized to file them, and the Department of State gains clearer authority to refuse filings that appear fraudulent, misleading, or intended to harass. That moves the office from purely ministerial to selectively protective — not adjudicating disputes, but screening out filings that set off alarm bells. Combined with clearer procedures for identifying and terminating false filings that do get through, the effect is defense in depth: harder to file garbage, easier to remove it.
3. Deceptive solicitations must now admit they're ads
The third piece targets the junk mail economy around the registry. Companies that sell "annual report filing services" and similar third-party filing help must now disclose clearly that their communications are advertisements, not government correspondence, and include information on how to file directly with the Department of State — so filers can see what the "service fee" is really costing them.
This is worth pausing on, because the scheme is evergreen. Businesses across the country regularly receive official-looking letters warning that an annual report or statement of information is due, with a stern deadline, a form to return, and a fee of $75 to $150 or more for what is typically a $0 to $25 filing you can complete on the state's own website in ten minutes. The letterheads mimic government design, the deadlines are real (your actual deadline is real, after all), and the markup is pure margin. State attorneys general issue consumer alerts about these mailers every year. Rhode Island now requires the disclosure by statute, enforced under its deceptive trade practices framework — which gives the mailers a legal reason to stop looking like invoices from the government.
Why this matters even if you're not in Rhode Island
Three reasons.
The playbook is spreading. Rhode Island's approach — administrative removal, refusal authority, solicitation disclosure — tracks recommendations NASS has been publishing for years. Similar provisions exist in scattered form across other states. If your state's filing office currently tells fraud victims "get an attorney," that answer is aging badly; several states have already built the complaint process Rhode Island just codified, and more are likely to follow.
Fraud doesn't respect state lines. A fraudulent filing or look-alike entity in a state where you used to operate, or where a creditor of your name-alike operates, can still surface in a search. Multi-state operators should assume their footprint defines their exposure.
The defensive habits are identical everywhere. Everything the law enables reactively, you can and should be doing proactively. Which brings us to the practical part.
How to check whether you already have a problem
Set a recurring calendar item — quarterly is plenty for most small businesses — and run these three checks. They are free.
Search the UCC database for your business name. Nearly every Secretary of State or Department of State offers a free online UCC search. Search as a debtor using your exact registered name; also search common variants and, if you personally guarantee business debts, your own name. You are looking for financing statements you do not recognize, secured parties you have never borrowed from, or filings that should have been terminated years ago. Pay attention to collateral descriptions that name "all assets" — those are the ones that most aggressively cloud future borrowing.
Inspect your entity record itself. Pull up your company in the business entity database. Verify the registered agent, the registered address, and the list of officers or authorized persons. If anything has changed that you did not authorize, that is an incident, not a typo — unauthorized agent changes are a classic precursor to mail interception.
Read "government" mail with the filing fee in mind. Before paying any notice that demands a fee for an annual report, certificate, or compliance filing, go to your state's filing website directly (type the address yourself; do not use the link or QR code in the letter) and check the real deadline and the real fee. If the official channel charges $15 and the letter wants $125, the letter is a solicitation, not a notice. Under the new Rhode Island standard, it should say so on its face.
If you find a fraudulent filing
Work the ladder from cheapest to most expensive:
- Document everything. Download the filing, screenshot the database entry, note the file number, the filer of record, and the date. If this ends up in court or a criminal referral, your contemporaneous records are the case.
- Send a written termination demand to the filer of record. Many bogus filers back down when challenged formally; some genuinely filed in error. Certified mail, keep the receipt.
- File a complaint with the filing office. In Rhode Island, this is now the formal path to removal. In other states, ask the UCC desk whether an administrative correction process exists — a meaningful and growing number do, and several charge nothing for it.
- Consult an attorney if the filing involves significant collateral, an active deal, or a filer who refuses to terminate. A false financing statement is actionable, and in many states filing one knowingly is a crime.
- Watch your business credit afterward. Removal clears the public record, but data vendors may have already ingested the lien. A quick dispute with the relevant business credit bureau closes that loop.
One bookkeeping note that owners miss: the cost of cleaning up identity fraud — legal fees, certified mail, lost staff hours, even the missed discount from a delayed supplier negotiation — is real money with real tax treatment, and it is only deductible if you actually tracked it. Tie each expense to the incident in your ledger as it happens, not at year end from memory. (If you have never set up expense tracking by category, the docs walk through it in about an hour.)
Keep Your Business Records as Clean as Your Public Ones
There is an uncomfortable symmetry here: the state registry got abused because nobody was watching a public, append-only record of claims against businesses. Your own books deserve better. Beancount.io gives you plain-text accounting where every transaction is a line in a version-controlled file — transparent, auditable, and impossible to quietly rewrite after the fact. When a fraud cleanup or a disputed expense needs a paper trail months later, that history is exactly what you will wish you had. Get started for free and keep your financial record as defensible as your company's public one should be.