Despite the growing number of cybercrimes affecting small businesses each year, which increases exponentially, many small businesses are either not prepared for the problem or complacent. The federal government has taken a great deal of action in the past several years to try and criminalize cyber-acts that hurt small businesses, encouraged by several non-profit organizations. In the end, however, it’s up to small businesses to protect themselves from cybercrime. The first step is to become aware of its breadth and depth.

FACTA - Fair and Accurate Credit Transactions Act
Did you know that a small business can face a federal fine of $2500 per employee or even a class-action lawsuit under FACTA laws? Congress passed FACTA legislation in 2003 to protect consumers against identity theft and other forms of consumer fraud. In addition, recent FACTA rules were written regarding the disposal of confidential consumer (customers, employees, suppliers, etc) records. The law requires the destruction — "shredding or burning" or "smashing or wiping" — of all paper or computer disks containing personal information "derived from a consumer report" before it is discarded. If a business does not comply with FACTA, they face potential civil liabilities, state fines, federal fines, and even class-action lawsuits.

How will FACTA laws affect your business? Proper legal advice can help you determine what security measures your business needs to implement to protect you and your business?

OSHA - Occupational Safety and Health Act
OSHA reporting is not required for retail, financial or service business or for businesses with fewer than 11 employees. But did you know that its rules apply to all employers, regardless of size?

ERISA - Employee Retirement Income Security Act
You may have set up a plan to allow employees to deduct health insurance premiums. Are you aware of your filing requirements under ERISA?

ADA - Americans with Disabilities Act of 1990
Have you done renovations without specifically addressing ADA requirements? Could you be forced to totally re-do the work?

Identity Theft is one of the fastest growing crimes in America, and new laws establish significant liabilities for companies that fail to take specific steps before a problem occurs with respect to employees and critical information.

These days, it is almost impossible to be in business and not collect or hold personally identifying information—names and addresses, Social Security numbers, credit card numbers, or other account numbers—about your customers, employees, business partners, students, or patients. Thus, by merely maintaining these records, especially in an electronic format, the small business puts itself and its customers at risk. Identity thieves are well aware of the treasure trove of information businesses have access to and use a variety of methods to attempt to obtain it. For the less computer savvy thief, there are physical ways of obtaining personal information. For example, credit cards can be stolen through robberies, burglaries, [and] postal theft. Criminals can listen in on public telephone conversations when a person provides businesses with a credit card number over the phone. Another method is “dumpster diving,” which entails combing through people’s trash for old receipts, paycheck stubs, and bank statements, which all contain vital information. “Crooks sometimes seek jobs that will give them access to financial information, or they may bribe employees in such positions to supply them with the data they want.

Additionally, 20% of identity theft is committed by the betrayal of personal friends, relatives, employees, and others who are close to you.” In fact, the methods described above are used more frequently to steal identities than technological ones. One survey found that “only 11 percent of known identity cases occurred online, with low-tech dumpster diving and phone fraud accounting for far more thefts than the Internet.” One analyst suggests that although the Internet is responsible for a share of identity theft, it might also “help consumers remain vigilant against theft because they can monitor their accounts multiple times over the month.” Given that “70% of all identity theft starts with the theft of personal records from the workplace, consumers should be more wary of the ways in which they store and discard physical information.

Despite these statistics, the use of computers appears to be growing. Via the Internet, thieves could gain access to information provided by individuals for online banking and shopping if there is a security breach. Computer hackers can make their way into the files of a consumer’s personal computer or that of the small business with whom the consumer transacts to retrieve valuable information. Furthermore, since the Internet is not regulated, it is an invaluable resource for thieves. While many people are aware of the dangers of providing personal information on the Internet, they continue to do so perhaps because of the speed and ease of Internet transactions. Moreover, many merchants and institutions advertise the security of their transactions. Despite the precautions many small business owners take, small businesses are especially vulnerable to security breaches. Awareness and preparation are the biggest differences between a large enterprise and a small business. Identity theft is an issue that is rarely contemplated by small business owners. Perhaps owners are unaware of the problem or maybe they just think they are immune because of their size or do not think they can afford to fix the problem. In fact, the director of a small business development center said “the issue of data security has never come up during his meetings with small business owners.

While the effect on individuals who employ one or more people could be bad enough, the real impact is more likely to be on small to midsize businesses. This is true not only when a loss in goods or payment occurs, but also because regulations impose the same penalties regardless of size. Under the Fair and Accurate Credit Transactions Act (FACTA),71 an employer could face civil liability, federal fines up to $2,500 for each violation, and/or state fines up to $1,000 for each violation, for failing to comply with the safety requirements imposed to protect consumer information. A couple of thousand dollars may not be a great deal of money to a large business, but to a small business owner, it could be a significant part of profits. The effects of identity theft are also felt in non-monetary ways. The crime of identity theft undermines the basic trust on which our economy depends.

Identity theft harms not only its direct victims but also many businesses and customers whose confidence is shaken. It is hard for anyone who has suffered at the hands of an identity thief to feel safe enough to engage in similar transactions again. Consumers become more wary and small business, especially online retailers, may be forced to close their businesses if the losses to identity theft become too great. Moreover, identity theft can damage the reputations of consumers and merchants, which may take months or years to repair.