Why am I getting loan offers from companies I’ve never heard of?

The message says you've been pre-approved for $150,000 in working capital. It's from a company you've never heard of, the sender's first name is all you get, and the follow-up two days later wonders whether you saw the first one. You never applied for anything. Nobody has looked at your books. Yet here is a number with a dollar sign in front of it.

Business funding offers are one of the highest-volume categories on this site, and the people receiving them are usually baffled. Here's where the offer came from, why the sender's domain is three weeks old, and what happens if you answer.

Where they got your name

Nobody checked your credit. The trigger is almost always a public record that says a business exists and is new, growing, or borrowing:

• A new business registration. The state publishes it, list sellers download it, and "new business" is the easiest list in the industry to buy. This is why the offers often arrive before the company has a bank account.
• A UCC filing. When a business takes financing, the lender usually files a public notice naming the borrower. Lead sellers read those filings to find businesses that have borrowed before, on the theory that they'll borrow again.
• A previous application. If you ever filled out a form on a funding site, a broker may have sold the lead on. Some applications are resold more than once.
• A directory listing or a credit-bureau file. Business directories and commercial credit bureaus both sell marketing lists sorted by age, industry, and revenue estimate.

Why your inbox exploded covers the records themselves. The short version is that nothing you did was a mistake.

What "pre-approved" means

In this kind of message it means nothing. No underwriting has happened, because the sender has nothing to underwrite with. The figure is a lead-generation number, chosen to sound specific. The actual terms, if you get that far, depend entirely on the bank statements you'd be asked to send.

Most of these senders aren't lenders. They're brokers, sometimes called ISOs, who collect applications and pass them to funding companies for a commission. The commission is why the volume is so high.

Why the sender's domain is three weeks old

Brokers churn through domains. A domain that has sent a few thousand unsolicited messages gets filtered, so the next campaign uses a new one, usually a near-match of the company name with a word added. Each new domain gets SPF, DKIM, and DMARC set up correctly, because the sending platform hands out those records at signup, and that's enough to pass every check your mail server runs.

The records in the business funding category show this pattern: a domain registered weeks before the message, authentication that passes, and a website that is either a placeholder or a single page with a form.

Why the offer is vague about terms

Most of what's being offered isn't a loan. It's a merchant cash advance: a lump sum in exchange for a share of future receipts, repaid by daily or weekly bank debits, priced as a factor rate rather than an interest rate. Factor rates translate to high annual costs, and the message won't put that in writing because the number would end the conversation.

Financing offered to a business generally doesn't come with the disclosure rules that apply to a personal loan. A few states now require them. In most places, the first time you'll see the real cost is in the contract.

What happens if you reply

A reply confirms a live, interested business. Expect a short application that asks for your last few months of bank statements, your tax ID, and the owner's Social Security number, followed by calls. The lead is now worth more, and it may be sold again to other brokers whether or not you proceed.

If you want business financing, start with your own bank or a lender you chose. If you don't, don't reply, don't click unsubscribe, and don't call the number. All three confirm the address.

What reduces it

• Keep the owner's personal email address out of the state filing. Use a registered agent and a role mailbox.
• Give each registration its own address so you can retire the one that leaks.
• Don't fill in "see how much you qualify for" forms. Each one is a resale.
• Set up SPF, DKIM, and DMARC for your own domain so that at least nobody sends these as you. The domain report card checks it in a few seconds.

The volume tapers on its own as the lists age. It doesn't reach zero, because a business that exists is a business someone will offer to fund.