Organised criminals are targeting the government loan scheme for small businesses hit by the coronavirus pandemic with fraudulent applications, the UK’s top crime agency has warned.

The National Crime Agency (NCA) said on Friday it had found evidence that the “bounce-back” loan scheme is being exploited, and said it was working with the banking sector and other law enforcement organisations.

The government launched the scheme at the start of May with the aim of giving cheap loans to smaller businesses whose finances had been damaged by the pandemic. Small and medium-sized businesses are able to borrow up to 25% of their turnover to a maximum of £50,000 under the scheme. The loans, interest-free for 12 months, are administrated by private-sector banks, but are 100% backed by the government.

The loans have proved popular, with 1.3m smaller businesses having borrowed more than £38bn by 20 September, according to figures from the Treasury. Almost 300,000 applications have been rejected.

HSBC, one of the UK’s biggest banks, on Thursday closed its doors to new applicants under the scheme, saying it needed time to work through a backlog of existing applications.

The scheme was designed at the height of the coronavirus lockdown to get money to small businesses as quickly as possible, with businesses allowed to self-certify their eligibility. There have been reports of fake businesses being set up to access the cash, and the NCA said it was being exploited.

An NCA spokesperson said: “Our intelligence suggests that the bounce-back loan scheme is being exploited, including by organised criminals. On the basis of our assessments, we have provided red-flag indicators to the banking sector to aid their detection of fraudulent applications.

“We are providing intelligence to assist partner investigations, and we will investigate cases ourselves where there is a serious and organised crime element.”

A Treasury spokesman said: “Our support has been targeted to ensure we help those who need it most as quickly as possible and we won’t apologise for this.

“We’ve looked to minimise fraud – with lenders implementing a range of protections including anti-money laundering and customer checks, as well as transaction monitoring controls. Any fraudulent applications can be criminally prosecuted for which penalties include imprisonment or a fine or both.”

The government has been warned of the risk of fraud. In September, the National Audit Office said it was clear that ministers had chosen to go ahead with the scheme knowing the fraud risk.

Keith Morgan, the chief executive of the government-owned British Business Bank, warned the business secretary, Alok Sharma, in May that the scheme’s rapid launch posed “very significant fraud and credit risks”, a letter published this week revealed.

“The scheme is vulnerable to abuse by individuals and by participants in organised crime,” Morgan wrote. “Alongside the fraud risk, there will be considerable credit risk in the current economic environment, which will be exacerbated by removing significant elements of the credit checks that would otherwise have been undertaken.”

Sign up to the daily Business Today email or follow Guardian Business on Twitter at @BusinessDesk

A spokeswoman from UK Finance, the banking industry lobby group, said that businesses self-certify that they will be able and intend to repay the loans.

“Lenders have a range of checks in place to detect and prevent fraudulent activity, including through a cross-industry initiative to check if duplicate applications have been made,” she said.

“Applications from customers without an existing business account are subject to additional checks, including customer fraud, anti-money laundering and ‘know your customer’ assessments prior to any loan being made.”