How to share documents securely with your business loan broker

Send documents through your broker's secure upload portal, or connect your bank account through a read-only verification service when a lender asks. Never text your Social Security number, never share an online banking password, and confirm the portal link or email address by phone before your first upload. A loan file holds everything a fraudster needs, so it deserves the same care as a wire transfer.

Why your loan file is worth protecting

A typical file holds your Social Security number, date of birth, driver's licence, business tax returns, bank statements with account numbers, and a voided check. Together, that is enough to open accounts in your name or redirect a payment.

The scale of the problem is real. The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025 with reported losses of $20.9 billion. Business email compromise, where a criminal impersonates someone you deal with by email, accounted for 24,768 complaints and just over $3 billion in losses. Phishing and spoofing produced 191,561 complaints on their own.

Brokers who handle documents carefully are protecting you and their own reputation. Expect the professionals to set this up for you.

The channels, compared

What never to send by text or plain email

• Your full Social Security number or ITIN
• A photo of your driver's licence, passport or a voided check
• Bank or card account numbers
• Online banking usernames or passwords
• One-time security codes from your bank, under any circumstances

If a lender needs your identity verified, it will send its own secure request or do it on a recorded funding call. A one-time code is for you alone. Anyone asking you to read one back is not your broker.

Bank statement PDFs versus verified bank connections

Many lenders now ask to connect to your business bank account through a verification service rather than relying on PDF statements alone. You may see this described as a Plaid style connection, after one of the best known providers.

How it works. You click a link from the lender or broker, choose your bank, and log in on your bank's own screen or the service's secure window. The service shares a read-only copy of transactions and balances with the lender. Your broker never sees your password.

Why lenders like it. The data comes straight from the bank, so it cannot be edited. That speeds underwriting and removes questions about statement accuracy.

What to ask before you connect:

1. Which service is this, and which lender receives the data?
2. Is the connection read-only?
3. How many months of history will it pull?
4. How long does access last, and how do I revoke it?

PDF statements still have a place. For early pre-qualification, your broker usually needs your most recent months of statements. Download them directly from your bank's website rather than scanning paper copies, and upload them through the portal. Native bank PDFs are easier for lenders to verify and harder to question.

Tax returns: let the IRS send them

For bank and SBA loans, the lender will often verify your tax returns with the IRS directly using Form 4506-C, the IRS's Income Verification Express Service request. According to the IRS, the agency releases tax records to a third party only with the taxpayer's consent. The form covers business returns such as Forms 1065, 1120 and 1120-S, and the IRS must receive it within 120 days of your signature, so sign it close to when the lender needs it.

This is often the safest path for tax data: you authorise a specific participant, and the transcript goes from the IRS to the lender.

Verify who you are sending to

Business email compromise works because the message looks right. Build these habits:

• Confirm the portal link by phone at the start of the deal, using a number you already have or one listed on the broker's register entry, not one in the email.
• Check the domain. A lookalike such as a swapped letter or an extra word is the most common trick.
• Treat "we changed systems" emails with suspicion. A new upload link or new email address mid-deal deserves a phone call before you use it.
• Never act on payment instructions by email alone. If anyone asks you to send money, including a fee, confirm by phone with a known number.
• Know who has your file. Ask your broker which lenders will receive your documents before they go out.

A pre-upload checklist

Before you send anything:

1. Name files clearly: "Smith Bakery bank statements April to September 2026.pdf."
2. Mask everything but the last four digits of your Social Security number where the lender does not need the full number. Your broker will tell you when it does.
3. Remove unrelated pages, such as personal account statements, unless asked.
4. Use the portal. If there is no portal, use a password-protected PDF and give the password by phone.
5. Keep a list of what you sent, to whom and when.

Our guide to documents a business loan broker will ask for lists what lenders need by product, and getting your financials broker ready covers how to clean them up first.

What to ask a broker about data handling

These questions are reasonable on the first call, and a professional answers them in a sentence each:

• Where are my documents stored, and who at your firm can see them?
• Which lenders will receive my file, and will you ask me first?
• Do you use a portal, and how do I log in?
• How long do you keep my documents after the deal, and will you delete them on request?

A broker who answers clearly is showing you how they will handle the rest of the deal. Asking for your online banking password, or insisting on documents by text, is the behaviour to walk away from.

After the deal closes

• Revoke any bank connections you no longer need from your bank's settings or the service's own site.
• Ask your broker to delete documents you do not want kept, and to confirm in writing.
• Change any password you shared by mistake, and turn on two-factor sign-in for your bank and email.
• Keep your own copy of the closing set in one secure folder.

When you are choosing a broker, use the match form or search the register. Every entry carries a register number and a last checked date, and verified entries show fees in writing.