FinCEN Advisory FIN-2020-A007 — COVID-19 Unemployment Insurance Fraud (Oct. 13, 2020)

Record facts

Summary

Advisory FIN-2020-A007, issued October 13, 2020 by the Financial Crimes Enforcement Network (FinCEN), alerting financial institutions to unemployment insurance fraud observed during the COVID-19 pandemic. It describes five types of such fraud: fictitious employer-employee, employer-employee collusion, misrepresentation of income, insider and identity-related fraud. The advisory then lists financial red flag indicators, such as UI payments from another state, payments in names other than the accountholder's, rapid transfers to foreign accounts and many UI deposits into newly opened accounts. It asks institutions filing Suspicious Activity Reports to include the key term for this advisory in SAR field 2 and to select SAR field 34(z), and lists information useful to law enforcement.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

1
Introduction
The Financial Crimes Enforcement Network (FinCEN) 
is issuing this advisory to alert financial institutions to 
unemployment insurance (UI) fraud observed during the 
COVID-19 pandemic.  Many illicit actors are engaged in 
fraudulent schemes that exploit vulnerabilities created by the 
pandemic.  This advisory contains descriptions of COVID-
19-related UI fraud, associated financial red flag indicators, 
and information on reporting suspicious activity.
This advisory is based on FinCEN’s analysis of COVID-19-
related information obtained from Bank Secrecy Act (BSA) 
data, open source reporting, and law enforcement partners. 
Financial Red Flag Indicators of 
Unemployment Insurance Fraud Related to 
COVID-19 Relief
As unemployment claims in the United States have surged 
due to the pandemic, U.S. law enforcement and financial 
institutions have detected numerous instances of COVID-
19-related UI fraud.  The following are representative types 
of this illicit activity: 
•	 Fictitious employer-employee fraud: filers falsely claim they 
work for a legitimate company, or create a fictitious 
company and supply fictitious employee and wage 
records to apply for UI payments;
Advisory on Unemployment Insurance Fraud During the 
Coronavirus Disease 2019 (COVID-19) Pandemic 
Detecting and preventing unemployment insurance fraud and other illicit activity related 
to COVID-19 are critical to safeguarding the integrity of government relief efforts.
This Advisory should be
shared with:
•	Chief Executive Officers
•	Chief Operating Officers
•	Chief Compliance Officers
•	Chief Risk Officers
•	AML/BSA Departments
•	Legal Departments
•	Cyber and Security Departments
•	Customer Service Agents
•	Bank Tellers
FIN-2020-A007
October 13, 2020
SAR Filing Request:
FinCEN requests financial 
institutions reference this 
advisory in SAR field 2 (Filing 
Institution Note to FinCEN) and 
the narrative by including the 
following key term: “COVID19 
UNEMPLOYMENT INSURANCE 
FRAUD FIN-2020-A007” and 
select SAR field 34(z)
(Fraud - other). Additional 
guidance for filing SARs appears 
near the end of this advisory.

F I N C E N  A D V I S O R Y
2
•	 Employer-employee collusion fraud: the employee receives UI payments while the employer 
continues to pay the employee reduced, unreported wages;
•	 Misrepresentation of income fraud: an individual returns to work and fails to report the income 
in order to continue receiving UI payments, or in an effort to receive higher UI payments, an 
applicant claims higher wages than he/she previously earned; 
•	 Insider fraud: state employees use credentials to inappropriately access or change UI claims, 
resulting in the approval of unqualified applications, improper payment amounts, or movement 
of UI funds to accounts that are not on the application; or
•	 Identity-related fraud: filers submit applications for UI payments using stolen or fake 
identification information to perpetrate an account takeover.1
As no single financial red flag indicator is necessarily indicative of illicit or suspicious activity, 
financial institutions should consider all surrounding facts and circumstances before determining 
if a transaction is suspicious or otherwise indicative of potentially fraudulent activities related to 
COVID-19.  In line with a risk-based approach to compliance with the BSA, financial institutions 
also are encouraged to perform additional inquiries and investigations where appropriate. 
FinCEN identified the financial red flag indicators described below to alert financial institutions to 
fraud schemes targeting UI programs, and to assist financial institutions in detecting, preventing, 
and reporting suspicious transactions related to such fraud.
Financial red flag indicators of UI fraud may include: 
	Account(s) held at the financial institution receive(s):
a.	 UI payments from a state other than the state in which the customer reportedly resides or 
has previously worked;
b.	 Multiple state UI payments within the same disbursement timeframe; 
c.	 UI payments in the name of a person other than the accountholder, or in the names of 
multiple unemployment payments recipients;
d.	 UI payments and regular work-related earnings, via direct deposit or paper checks;
e.	 Numerous deposits or electronic funds transfers (EFTs) that indicate they are UI payments 
from one or more states to persons other than the accountholder(s); 
f.	 A higher amount of UI payments in the same timeframe than similarly situated customers 
received.
1.	
See, FinCEN Advisory, FIN-2020-A005, “Advisory on Cybercrime and Cyber-Enabled Crime Exploiting the Corona­
virus Disease 2019 (COVID-19) Pandemic,” (July 30, 2020).  In some situations, fraudsters use the stolen identification 
information to perpetrate an account takeover.  For additional information on identifying account takeover activity, 
see FinCEN Advisory, FIN-2011-A016, “Account Takeover Activity,” (December 19, 2011).

F I N C E N  A D V I S O R Y
3
	The customer withdraws the disbursed UI funds in a lump sum by cashier’s checks, by 
purchasing a prepaid debit card, or by transferring the funds to out-of-state accounts.
	The customer’s UI payments are quickly diverted via wire transfer to foreign accounts, 
particularly to accounts in countries with weak anti-money laundering controls. 
	The customer receives or sends UI payments to a peer-to-peer (P2P) application or app.  The 
funds are then wired to an overseas account, or withdrawn using a debit card, in a manner 
that is inconsistent with the spending patterns of similarly situated customers.   
	Individuals quickly withdraw disbursed UI funds via online bill payments addressed to an 
individual(s), as opposed to businesses, as payee(s), with some individual payees receiving 
multiple online bill paychecks over a short time period.
	The IP address associated with logins for an account conducting suspected UI-fraud activities 
does not map to the general location of stated address in identity documentation for the 
customer or where the UI payment originated. 
	Individuals direct UI-related EFTs, or deposit UI checks into suspected shell/front company 
accounts, which may be indicative of money mules transferring these funds in and out of the 
accounts. 
	Multiple accounts receiving UI payments at one or more financial institutions are associated 
with the same free, web-based email account that may appear in more than one UI application. 
	A newly opened account, or an account that has been inactive for more than thirty days, starts 
to receive numerous UI deposits.  After a financial institution suspects UI fraud and requests 
additional identification documentation to verify the  identity(ies) of the customer(s), queried 
individuals provide documents that are incorrect or forged, which may be an indicator of an 
account takeover or identity theft. 
	After a financial institution suspects UI fraud and conducts due diligence, it determines 
that the customer does not have a history of living at, or being associated with, the address 
to which the UI check or UI debit card is sent, or within the geographical area in which the 
registered debit card is being used. 
Information on Reporting Suspicious Activity
Suspicious Activity Report (SAR) Filing Instructions
SAR reporting, in conjunction with effective implementation of due diligence requirements 
by financial institutions, is crucial to identifying and stopping unemployment insurance fraud 
related to the COVID-19 pandemic.  Financial institutions should provide all pertinent and 
available information in the SAR and narrative.  

F I N C E N  A D V I S O R Y
4
•	 FinCEN requests that financial institutions reference this advisory by including the key 
term “COVID19 UNEMPLOYMENT INSURANCE FRAUD FIN-2020-A007” in SAR field 
2 (Filing Institution Note to FinCEN) and the narrative to indicate a connection between the 
suspicious activity being reported and the activities highlighted in this advisory.  
•	 Financial institutions also should select SAR field 34(z) (Fraud - other) as the associated 
suspicious activity type to indicate a connection between the suspicious activity being 
reported and COVID-19.  When addressing unemployment fraud in a SAR, financial 
institutions should include the keywords “unemployment fraud” in SAR field 34(z).  
•	 When filing a SAR, in addition to standard transaction data, providing the following 
information is highly valuable to law enforcement: relevant email addresses, IP addresses 
with their respective timestamps, login information with location and timestamps, cyber-
related information and technical indicators, virtual currency wallet addresses, mobile 
device information (such as device International Mobile Equipment Identity (IMEI)), phone 
numbers, monikers, and description and timing of suspicious electronic communications.
•	 Please refer to FinCEN’s Notice Related to the Coronavirus Disease 2019 (COVID-19), which 
contains information regarding reporting COVID-19-related crime, and reminds financial 
institutions of certain BSA obligations.
For Further Information
Financial institutions should send questions or comments regarding the contents of this advisory 
to the FinCEN Regulatory Support Section at frc@fincen.gov.  To report suspected illicit activity 
please visit our website at https://www.fincen.gov/coronavirus, which also contains information on 
registering to receive FinCEN Updates.
The mission of the Financial Crimes Enforcement Network is to safeguard 
the financial system from illicit use, combat money laundering and its 
related crimes including terrorism, and promote national security through 
the strategic use of financial authorities and the collection, analysis, and 
dissemination of financial intelligence.

File and source

File

FIN-2020-A007_Unemployment-Insurance-Fraud_2020-10-13.pdf

Size

570,981 bytes

SHA-256

32ad52b46a71018c2a19ca19f812042f99cfdb2e131a8f925bbfae11a726d370

Our copy

FIN-2020-A007_Unemployment-Insurance-Fraud_2020-10-13.pdf

Original

www.fincen.gov