The BOI scam is one of the most common frauds targeting Hispanic business owners in the United States: an official-looking envelope arrives containing a form with a number, a short deadline, and a payment amount. The problem is, this payment doesn't exist. FinCEN, the Treasury Department agency responsible for reporting beneficial owners, issued a formal alert warning that some individuals are using its name, logo, and even fabricated forms to extract money or personal information.
In this guide you will see what these letters look like, what signs give them away, why the charge in 2026 is even more absurd than before, and what to do if you have already paid.
What is the BOI scam and why does it work so well?
The BOI—Beneficial Ownership Information—was for a time a mandatory report for millions of small businesses. This requirement generated confusion, haste, and fear of fines. And where there is confusion and fear, scammers appear.
The scheme is simple. You receive a communication by mail, email, or text message. It bears the Treasury logo or something similar. It includes an office name that sounds legitimate. And it contains a clear instruction: fill out this form and pay this fee, or face daily fines and legal action.
According to the FinCEN alert, the fake forms detected include "Form 4022," "Form 5102," a purported "2024 Beneficial Ownership Information Reporting Form," and notices titled "Important Compliance Notice." None of them exist.
The five signs of a BOI scam
These are the red flags that FinCEN and several government departments have documented:
- They ask you for money. Submitting the BOI directly to FinCEN has never had a cost. And FinCEN does not send correspondence requesting payment for filing it.
- They include a link or a QR code. They direct you to a site that mimics the official one to capture your payment and your data.
- They come from an office that doesn't exist. "United States Business Regulations Department" and "Annual Records Service" are two of the most commonly used names. Neither is a federal agency.
- They give you a tight deadline. Hours or a few days, with threats of daily fines and even criminal charges. Urgency is the tool.
- Te piden mandar un check o giro postal. A payment that leaves no trace that is easy to claim.
Why in 2026 any charge for the BOI is doubly suspicious
Here's the game-changer. FinCEN issued a final rule making the interim rule exemptions permanent, and that rule took effect in August 2026. In practice: U.S.-based companies are now exempt from filing the BOI report . Those still required to file—entities formed under foreign law and registered to operate in a U.S. state—do not report U.S. owners or applicants. And U.S. persons are not required to provide their information to any company.
We explain it in detail in our guide on the FinCEN BOI exemption.
Translation for your business: If someone is charging you today to "file your BOI," they either don't know what they're talking about, or they're intentionally scamming you. In either case, don't pay.
What's at stake: the true size of the problem
Government agency impersonation scams are not an isolated case. According to the FBI's Internet Crime Complaint Center (IC3), cited in the FinCEN alert itself, losses from this type of fraud rose 63% in 2023, with more than 14.000 victims reporting losses of nearly $400 million.
The same alert points out that these schemes can constitute mail or electronic fraud, crimes punishable by up to 20 years in prison and fines of up to $250.000.
What to do if you receive one of these letters
Four steps, in this order:
- Don't pay and don't click. Do not scan the QR code, do not open the link, do not fill out the form.
- Check the source. Go directly to fincen.gov/boi Enter the address yourself. Never use the link in the letter.
- Report. Applications that misuse the FinCEN name or logo are reported to the Treasury Department's Office of Inspector General and the Federal Trade Commission at ReportFraud.ftc.gov. If the fraud occurred digitally, it is also reported to the FBI's IC3.
- Notify your accountant and your team. Anyone who opens the business email should know that this exists.
If you already paid
Act the same day. Call your bank or card issuer and ask them to block or reverse the charge; the faster you act, the better your chances. If you sent a check, request a stop payment order. Gather everything: the envelope, the form, the receipt, the mail. This documentation supports your claim and complaint.
And check if you provided any sensitive information. If you gave out your EIN, personal identification number, or bank details, monitor your business accounts for the next few months. It's also a good idea to keep your IRS-registered business address up to date: that's where legitimate notices arrive, and it helps you distinguish them from fake ones.
How to protect your business from now on
Scammers rely on your lack of knowledge about the actual process. So, the best defense is to be clear about your tax obligations: what your annual state tax return is, when it's due, how much it costs, and who you submit it to.
The same principle applies to your suppliers and contractors: require Form W-9 before the first payment, and keep track of your estimated tax payments . A business with clear deadlines is a business that's hard to scare off.
Frequently Asked Questions about the BOI Scam
Did FINCEN ever charge for filing the BOI?
No. Filing directly with FinCEN has never cost anything. A third party can charge you to do it for you, but that's a private service, not a government fee.
Does "Form 4022" exist?
No. It is one of the fabricated forms that FinCEN identified in its alert, along with "Form 5102" and several fake "compliance notices".
My company is based in the United States, do I have to report the BOI in 2026?
With the final rule in effect since August 2026, companies incorporated in the United States are exempt. Always check your case at fincen.gov/boi.
What if my company was formed outside the United States?
Entities formed under foreign law and registered to operate in a state or tribal jurisdiction remain within scope, but do not report to U.S. owners or applicants.
Can I be fined for not responding to one of these letters?
No, because whoever sent it doesn't have the authority to fine you. The threat is part of the deception.
Conclusion
The rule is simple and applies to almost any scam: no federal agency will ever charge you by mail with a QR code and a 48-hour deadline . If the letter asks for money, it's a scam. Verify the information with the official source, report it, and go about your day.
If you'd prefer someone to review with you what your company's actual obligations are this year—federal and state— request a quote from our team and put together your compliance schedule right away.
