RJN 2 — In re Bank of America California Unemployment Benefits Litigation (Dkt. 590-4, S.D. Cal. No. 3:21-md-02992)

Record facts

U.S. District Court for the Southern District of California · No. 3:21-md-02992-GPC-MSB · Doc. 590-4 · 2025-10-17 · Docket on CourtListener

Full text

RJN 2 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39882 
Page 1 of 60

CONFIDENTIAL 
Employment De1Jelopment 
Department 
Significant Weaknesses in EDD's Approach to 
Fraud Prevention Have led to Billions of Dollars 
in improper Benefit Payments 
January 2021 
BANA_EDD_MDL-00080294 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39883 
Page 2 of 60

CALIFORNIA STATE AUDITOR 
621 Capitol Mall, Suite 1200 
Sacramento 
CA 
95814 
916.445.0255 
TTY 916.445.0033 
For complaints of state employee misconduct, 
contact us through the Whistleblower Hotline: 
1.800.952.5665 
Don't want to miss any of our reports? Subscribe to our email list at 
For questions regarding the contents of this report, please contact Margarita Fernandez, Chief of Public Affairs, at 916.445.0255 
This report is also available or.line at www.auditor.ca.gov 
/\lterr.Jtive format reports available upon request 
Penr,ission is granted to reproducP. reports 
CONFIDENTIAL 
BANA_EDD_MDL-00080295 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39884 
Page 3 of 60

January 28, 2021 
2020-628.2 
The Governor of California 
President pro Tempore of the Senate 
Speaker of the Assembly 
State Capitol 
Sacramento, CA 95814 
Dear Governor and Legislative Leaders: 
Elaine M. Howle State Auditor 
As authorized by state law, my office presents the results of our high risk audit concerning the 
Employment Development Department's (EDD) management offederal funds related to the COVID-19 
pandemic. EDD administers California's unemployment insurance (UI) program and received a 
significant amount of federal funding in response to the COVID-19 pandemic and related federal 
expansion of UI benefits. The following report details our conclusion that significant weaknesses in 
ED D's approach to fraud prevention have led to billions of dollars in improper benefit payments. 
EDD did not take substantive action to bolster its fraud detection efforts for its UI program until 
months into the pandemic, resulting in payments of about $10.4 billion for claims that it has since 
determined may be fraudulent because it cannot verify the claimants' identities. Specifically, EDD 
waited about four months to automate a key anti-fraud measure, took incomplete action against claims 
filed from suspicious addresses, and removed a key safeguard against improper payments without 
fully understanding the significance of the safeguard. 
Further, EDD's lack of preparation left it unable to manage two important fraud-related situations 
that arose during its 2020 pandemic response. In September 2020, because of fraud concerns, EDD 
directed Bank of America to freeze 344,000 debit cards (accounts) that it used to provide benefit 
payments to claimants. However, EDD did not have a plan in place to ensure that it could unfreeze 
those accounts found to belong to legitimate claimants, and it has been slow to acknowledge its role 
in freezing these accounts. EDD was also unprepared to prevent payment of fraudulent claims filed 
under the names of incarcerated individuals, the total of which is an estimated $810 million. Because 
it had not developed the capacity to regularly match data from its claims system with data from state 
and local correctional facilities, EDD did not detect fraudulent claims until after it had paid them. 
EDD has put its UI program at higher risk for such fraudulent payments by relying on uninformed and 
disjointed techniques to prevent and detect impostor fraud. For example, EDD has not established a 
centralized unit that is responsible for managing its fraud prevention and detection efforts, and it does 
not monitor or assess its numerous fraud prevention and detection tools to determine whether they are 
successful. Consequently, EDD may be using ineffective fraud prevention and detection techniques, 
which can delay payments to legitimate claimants while it puts their claims through additional and 
unmerited review. 
Respectfully submitted, 
ELAINE M. HOWLE, CPA 
California State Auditor 
621 Capitol Mall, Suite 1200 I Sacramento, Cl\ 95814 
CONFIDENTIAL 
916.445.0.255 
916.327.0019 tax 
www.auditor.ca.gov 
BANA_EDD_MDL-00080296 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39885 
Page 4 of 60

iv 
Report2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
Selected Abbreviations Used in This Report 
CARES 
CDCR 
EDD 
GAO 
PUA 
SSNs 
UI 
Coronavirus Aid, Relief, and Economic Security 
California Department of Corrections and Rehabilitation 
Employment Development Department 
Government Accountability Office 
Pandemic unemployment assistance 
Social Security numbers 
Unemployment insurance 
BANA_EDD_MDL-00080297 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39886 
Page 5 of 60

CONFIDENTIAL 
CONTENTS 
Summary 
Introduction 
EDD's Fraud Prevention Approach During the Pandemic Was 
Marked by Significant Missteps and Inaction 
Recommendations 
EDD's Lack of Preparation Left It Unable to Effectively Address 
Two High-Profile Situations 
Recommendations 
EDD Has Relied on Uninformed and Disjointed Techniques to 
Prevent Impostor Fraud 
Recommendations 
Appendix 
Scope and Methodology 
Response to the Audit 
Employment Development Department 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
5 
9 
22 
23 
30 
33 
38 
41 
.lam.iary 2021 
California State Auditor's Comments on the Response From EDD 
43 
51 
BANA_EDD_MDL-00080298 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39887 
Page 6 of 60

vi 
Report2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Blank page inserted for reproduction purposes only. 
CONFIDENTIAL 
BANA_EDD_MDL-00080299 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39888 
Page 7 of 60

(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
.lam.iary 2021 
SUMMARY 
The Employment Development Department (EDD) is responsible for administering the 
State's unemployment insurance (UI) program, which provides partial wage replacement 
benefits to eligible Californians who have become unemployed, including those affected 
by the COVID-19 pandemic (pandemic). Since the surge in pandemic-related California 
unemployment claims began in March 2020, individuals, news organizations, and law 
enforcement officials have reported many cases of potential and actual UI fraud. Not 
surprisingly, the pandemic conditions increased ED D's UI workloads and also resulted 
in changes to federal UI benefit programs, both of which have created a greater risk of 
fraud. We assessed EDD's response to increased fraud risk during the pandemic-such 
as allegations of impostor fraud, which occurs when a perpetrator uses someone else's 
personal information to fraudulently collect benefits-and evaluated its overall efforts to 
detect fraud. 111is report draws the following conclusions: 
EDD's Fraud Prevention Approach During the Pandemic Was 
Marked by Significant Missteps and Inaction 
EDD did not take action to bolster its fraud detection efforts until 
months into the pandemic. As a result, its data show that it paid 
about $10.4 billion in claims that it has since determined may be 
fraudulent. Even as late as December 2020, EDD was allowing 
claimants to continue to collect benefits using suspicious addresses 
because it did not establish payment blocks for their claims. Further, 
$1 billion of the $10.4 billion paid for suspicious claims was the 
result of ED D's decision to remove a key safeguard against payment 
to claimants whose identities it had not confirmed. EDD staff 
misunderstood the importance of that particular safeguard and, from 
April to August 2020, made payments to claimants despite concerns 
about the legitimacy of their identities. 
Page9 I 
EDD's lack of Preparation left it Unable to Effectively Address 
I 
Two High-Profile Situations 
Page 23 
1. 
Because of fraud concerns, EDD directed Bank of America to freeze 
I 
344,000 debit cards (accounts) that it uses to provide claimants with 
benefit payments. However, EDD did not have a plan to ensure that it 
could selectively unfreeze accounts belonging to legitimate claimants, 
has been slow to provide clear information about its role in freezing 
these accounts, and does not have a full understanding of which 
accounts are frozen. Additionally, EDD was unprepared to prevent 
payment for fraudulent claims filed under the names of incarcerated 
individuals-which it estimated to total about $810 million. EDD had 
CONFIDENTIAL 
BANA_EDD_MDL-00080300 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39889 
Page 8 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
I 
Page33 
CONFIDENTIAL 
told the Legislature for years that it was considering adopting 
a cross-match between claim and incarceration data. However, 
because it had not developed the capacity to match data between its 
claims system and the data from state and local correctional facilities, 
it did not detect these fraudulent claims until after the fact. 
EDD Has Relied on Uninformed and Disjointed Techniques to 
Prevent Impostor Fraud 
EDD has not established a centralized unit that is responsible for 
managing its fraud detection efforts, and it does not reliably track 
potential fraudulent activity from detection to resolution. As a 
result, ED D's UI program is at a higher risk for fraud. Further, it 
does not monitor or assess its numerous fraud prevention and 
detection tools to determine whether they are successful in mitigating 
fraud. Consequently, EDD may well be using ineffective fraud 
prevention and detection techniques and delaying payments to 
legitimate claimants while it puts their claims through additional and 
unmerited review. 
Summary of Recommendations 
legislature 
To protect against fraudulent UI claims, the Legislature should 
amend state law to require EDD to regularly cross-match its claims 
against data from state and local correctional facilities. 
To ensure that EDD effectively protects the integrity of the UI 
program, the Legislature should amend state law to require EDD to, 
by January 2022, and biannually thereafter, assess the effectiveness of 
its fraud prevention and detection tools, eliminate those that are not 
effective, and reduce duplication in its efforts. 
EDD 
To ensure that it does not suspend critical safeguards, EDD 
should plan in advance which UI fraud prevention and detection 
mechanisms it can adjust during recessions to effectively balance 
timely payment with fraud prevention. 
BANA_EDD_MDL-00080301 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39890 
Page 9 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
To provide timely access to benefits for legitimate UI claimants 
with frozen accounts, EDD should immediately obtain and review 
a comprehensive listing of benefit accounts that are frozen and, by 
March 2021, begin the process of unfreezing legitimate accounts. 
To ensure that it can approach UI fraud prevention in a 
comprehensive and coordinated manner, EDD should do 
the following: 
• By March 2021, establish a central unit responsible for 
coordinating all fraud prevention and detection efforts. 
• By May 2021, develop a plan for how it will assess the 
effectiveness of its fraud prevention and detection tools. 
Agency Comments 
EDD stated that it undeniably struggled to timely distribute 
benefits to the millions of newly unemployed Californians and 
simultaneously prevent fraudulent claims. It agreed with all of our 
recommendations and indicated that it will implement them all. 
.lam.iary 2021 
BANA_EDD_MDL-00080302 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39891 
Page 10 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Blank page inserted for reproduction purposes only. 
CONFIDENTIAL 
BANA_EDD_MDL-00080303 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39892 
Page 11 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
.lam.iary 2021 
INTRODUCTION 
Background 
The Employment Development Department (EDD) is responsible for 
administering the State's unemployment insurance (UI) program, which 
provides partial wage replacement benefits to eligible Californians who 
have become unemployed. In general, individuals who claim these 
monetary benefits (claimants) must meet certain requirements, such as 
being unemployed through no fault of their own and 
being able and available to work. Claimants must also 
provide certain information, such as their Social Security 
numbers (SSNs) and information about their previous 
employment, including their estimated earnings, which 
can help EDD ensure that it issues proper benefit 
payments to the correct individuals. 
The benefit payments that EDD administers are subject 
to two main types of potential fraud: benefit fraud and 
impostor fraud. Benefit fraud can occur when individuals 
misreport their earnings or employment information 
under their own identity. For example, individuals may 
establish legitimate UI claims using their own personal 
information but then fail to report that they returned to 
work, fraudulently continuing to collect UI benefits. EDD 
has several methods for detecting benefit fraud and, in 
general, this type of fraud is easiest to trace to a specific 
individual because the person filing the fraudulent claim 
benefits from it. As we detailed in an earlier report about 
EDD, in March 2020 it indefinitely postponed most of its 
required UI eligibility determinations, which has likely 
increased the UI program's vulnerability to benefit fraud 
during the COVID-19 pandemic (pandemic).' As we 
discuss later in the Introduction, the pandemic-related 
benefits also increased ED D's risk of the second type of 
fraud: impostor fraud, which occurs when a perpetrator 
uses someone else's personal information to collect 
UI benefits. 
EDD's Fraud Detection Processes 
A number of divisions and offices within EDD play 
a role in its efforts to detect UI fraud, as the text box 
describes. According to EDD's June 2020 report to the 
EDD Has Several Divisions and Offices That 
Undertake Fraud Detection Efforts 
Investigation Division, Criminal Intelligence Unit: 
Manages fraud reports submitted by UI staff, by the 
by law enforcement, by state and federal 
agencies, by the Govemor or Legislature, and by others; 
oversees EDD's fraud hotline. 
Investigation Division, Enforcement Operations Units: 
Investigate egregious and costly cases of fraud and may 
pursue criminal charges against impostors. 
UI Support Division, Integrity and legislation Unit: 
Manages a fraud report mailbox and initiates the identity 
verification process for certain claims. 
UI Integrity and Accounting Division, Identity 
Verification and Technical Support Section: Verifies 
daimant identities when potential fraud 01 other identity 
issues have been detected. 
UI Integrity and Accounting Division, Benefit 
Overpayment Section: Performs daily, weekly, and 
quarterly matches between employer data and UI benefit 
claims to detect improper payments and potential fraud. 
UI Integrity and Accounting Division, Benefit Claims 
Section: Assigns new unique identifiers to potentially 
fraudulent claims to reduce the impact on the true 
owners of compromised SSNs. 
Information Technology (IT) Branch: Facilitates fraud 
detection efforts 
EDD's technical systems, 
111uudi11'cl as directed by other responsible parties. 
local field offices: Report potential fraud and suspicious 
claims to the fraud report mailbox and initiate the 
identity verification process for certain claims. 
Source: Analysis of f:DD roles and responsibilitie\ f:DD 
dornrnentation, and interviews with EDD staff. 
1 EDD's Poor Planning and Ineffective Management Left It Unprepared to Assist Californians Unemployed by 
COV/D-19 Shutdowns, Report 2020-128/628.1, January 2021. 
BANA_EDD_MDL-00080304 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39893 
Page 12 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
Legislature on fraud deterrence and detection activities, in 2019 
EDD investigated 61 ongoing and new UI fraud cases representing 
potential fraud payments of around $24,4 million, including 
14 cases of UI impostor fraud representing more than $5.5 million 
paid in fraudulent benefits. EDD also reported more than 110,000 
UI overpayments due to fraud-or payments that EDD expected 
claimants to return to EDD-totaling $116.8 million in UI benefits 
paid in 2019. EDD further reported that this $116.8 million 
represented only 2.3 percent of its $4.9 billion benefit payments 
made in 2019. 
One of the key ways that EDD attempts to prevent impostor fraud 
is by verifying the identities of prospective claimants as a condition 
to providing benefits, as federal law requires. Historically, this 
process has included basic automated verifications to ensure that 
the information that claimants submit to EDD, such as SSNs and 
driver's license numbers, match the information retained by the 
U.S. Social Security Administration and California Department of 
Motor Vehicles. If these verifications detect discrepancies, EDD 
activates a manual identity verification process to confirm whether 
the claimant is the true owner of the identity. When it activates 
the manual identity verification process, ED D's system suspends 
or stops payments to the affected claim while EDD attempts to 
verify the claimant's identity. EDD will pay eligible claimants whose 
identities it confirms for the weeks their payments were paused. 
This process does not block the claimants' access to UI benefit 
payments that EDD has already issued. However, in October 2020, 
EDD introduced a new online identity verification tool, ID.me, as 
part of its efforts to process claims faster while preventing impostor 
fraud at the onset of a claim. EDD has indicated that ID.me makes 
it easier for claimants to verify their identities, reduces the amount 
of manual work by EDD staff necessary to process claims, and 
includes more robust protections against impostor fraud. 
Reported Cases of UI Fraud During the COVID-19 Pandemic 
Since the pandemic began affecting California unemployment 
rates in March 2020, individuals, news organizations, and law 
enforcement officials have reported many cases of potential and 
actual UI impostor fraud. For example, the Beverly Hills Police 
Department announced in September 2020 that it had arrested 
44 individuals responsible for identity theft and EDD fraud and had 
recovered EDD debit cards containing more than $2.5 million in 
fraudulently obtained UI benefits. Moreover, in November 2020, we 
reported that many individuals had received mail from EDD that 
was addressed to other people, and that this mail may have been the 
BANA_EDD_MDL-00080305 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39894 
Page 13 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
result of attempts to fraudulently collect UI benefits.2 For example, 
an individual who had recently moved into a new home reported 
receiving more than 65 pieces of mail from EDD addressed to at 
least 15 different people. The significant amount of mail returned 
to EDD because it was undeliverable suggests that such cases have 
likely been widespread. Finally, in a November 2020 letter to the 
Governor, several district attorneys reported that EDD fraud was 
occurring in prisons across the State. We discuss this inmate-related 
fraud later in this report. 
Two main factors have made the UI program especially vulnerable 
to fraud during the pandemic: the sudden and massive increase 
in UI claims and the significant expansion of eligibility for 
benefits. After the start of the pandemic and the imposition of 
the statewide stay-at-home order, California's unemployment 
rate surged from 4.3 percent in February 2020 to 16.2 percent by 
April 2020, according to EDD's labor market information. This 
surge in unemployment created a dramatic increase in the number 
of UI claims individuals submitted: EDD received nearly 2-4 million 
UI claims in April 2020, about 13 times as many as it received in 
April 2019. This massive increase in demand for benefits may have 
made it harder for EDD to carry out typical fraud detection efforts. 
In addition, in late March 2020, the federal government enacted the 
Coronavirus Aid, Relief, and Economic Security Act (CARES Act), 
which expanded UI benefits and relaxed some requirements for 
receiving those benefits. For instance, the CARES Act extended 
pandemic unemployment assistance (PUA) to certain individuals 
who were not eligible for regular unemployment benefits, such 
as individuals who had been self-employed and therefore would 
not have a third-party employer to report their wages or validate 
unemployment. Further, the CARES Act added $600 per week to 
the amount of benefits claimants could otherwise receive under 
state law between March and July 2020. The U.S. Department 
of Labor (Department of Labor) has also specified that states 
must backdate PUA claims to the first week in which claimants 
became eligible for benefits, which was as early as February 2020-
meaning that a larger amount of money was available to claimants 
because they could receive benefits from many previous weeks 
before the date that they filed their claims. 1hese factors further 
contributed to the heightened risk of fraud, since impostors had 
opportunities to earn more benefits without providing verifiable 
information about their work histories. 
2 Follow-Up-Employment Development Department: Since the COV/D-19 Pandemic It Continues to 
Mail Documents Containing Social Security Numbers and Put Californians at Risk of Identity Theft, 
Report 2020-502, November 2020. 
.lam.iary 2021 
BANA_EDD_MDL-00080306 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39895 
Page 14 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Blank page inserted for reproduction purposes only. 
CONFIDENTIAL 
BANA_EDD_MDL-00080307 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39896 
Page 15 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
.lam.iary 2021 
EDD's fraud Prevention Approach During the Pandemic 
Was Marked by Significant Missteps and Inaction 
Key Points 
• EDD failed to take fast enough action at the beginning of the pandemic to bolster 
its UI fraud detection efforts. As a result, from March through December 2020, out 
of $111 billion in UI benefits, EDD paid about $10,4 billion on claims that it later 
determined might be fraudulent. 
• EDD paid $1 billion of the $10,4 billion in part due to a problematic decision to 
streamline its processes by removing a safeguard against paying individuals with 
unconfirmed identities. EDD issued payments to those claimants with unconfirmed 
identities before discovering it had inadvertently removed the safeguard for more than a 
four-month period. 
• EDD faces an impending workload to assist the victims of identity theft whose personal 
information was used to file fraudulent claims. Given the high levels of potentially 
fraudulent claims and its processes for addressing them, EDD is underprepared to 
handle this work. 
EDD's Failure to Act Promptly to Reduce Fraud Resulted in About $10.4 Billion in Potentially 
Fraudulent UI Benefit Payments During the Pandemic 
ED D's data show that out of a total $111 billion paid during the pandemic, from March 2020 
through December 2020, it paid about $10,4 billion for claims that it has since determined 
could be fraudulent. These payments happened despite warnings from the U.S. Department of 
Labor (Department of Labor) to states at least twice in the early months of the pandemic that it 
had not relaxed its expectations related to fraud prevention in light of the pandemic. First, in its 
April 2020 instructions for implementing and operating the PUA program, it reminded states 
that they were required to take reasonable and customary precautions to deter and detect 
fraud, such as conducting a random audit of a sample of claims. Then, in May 2020, it issued 
another letter to remind states of their need to ensure the integrity of the UI program. This 
letter advised that states should perform essential ongoing reviews meant to detect improper 
payments throughout the UI program, including new benefits that the federal government had 
established in March 2020. Also in May 2020, when it requested data from EDD to identify 
fraud trends, the Department of Labor's Office of the Inspector General warned EDD that 
California was likely to see at least $1.2 billion in potential fraud based on the 2.9 million new 
claims that EDD had received in March and April 2020. 
Despite these repeated warnings, EDD did not take prompt action to enhance safeguards 
against illegitimate benefit payments. As Figure 1 shows, EDD did not make any substantive 
changes to its fraud detection practices until late July 2020-four months after the 
pandemic-related shutdowns led to a surge in UI claims. That July 2020 change automated 
ED D's process for stopping payment on claims that EDD believed were suspicious. Previously, 
ED D's staff needed to perform a manual review of daily reports of thousands of possibly 
BANA_EDD_MDL-00080308 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39897 
Page 16 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
fraudulent claims and manually stop payment on each. Because it 
delayed this automation, EDD likely allowed fraudulent claimants to 
collect benefits through the first four months of the pandemic. For 
example, we reviewed the reports from just two days each of April, 
May, and June 2020 and found that these reports had identified more 
than 1,000 claims as suspicious or potentially fraudulent on each of 
these days. EDD asserted that two staff members were responsible for 
reviewing these reports each day and stopping payment by initiating 
the identity verification process for all current claims that this report 
identified as suspicious. However, EDD's reliance on this manual 
process gave claimants the opportunity to collect UI benefits before 
staff were able to stop payment on the claims. Given that these reports 
can contain more than a thousand claims each day, EDD may have 
allowed many more fraudulent claims to collect payments without 
impediment before it automated this process. 
EDD delayed responding to instances in 
which an unusually high number of daims 
under different names were filed from a 
single address. 
Additionally, EDD delayed responding to instances in which an 
unusually high number of claims under different names were filed 
from a single address, despite having substantial evidence that 
fraudsters were using this approach to defraud the UI program 
during the pandemic. According to EDD, multiple claims from the 
same address, such as a vacant building or house, can be a sign that 
fraudsters are trying to intercept or gather the mail associated with 
this address. However, EDD did not identify suspicious addresses 
associated with these claims until September 2020. Further, at that 
time EDD performed two separate analyses of the suspicious address 
issue, it took action on only a portion of the cases it identified. One 
of its assessments identified 26,000 suspect addresses that were 
associated with a total of more than 555,000 claims. However, EDD 
stated that it did not stop payment on all of these claims because 
it considered this list informational. Rather, it performed another 
assessment to determine addresses that may have been associated 
with fraudulent claims, which identified only 10,000 suspicious 
addresses associated with 250,000 claims. Most of these 
10,000 addresses also appeared on the larger informational list of 
26,000 addresses. EDD asserted that it stopped payment on this 
set of 250,000 claims and required these claimants to verify their 
identities. The most egregious example from this analysis was a case 
of more than 1,700 claims going to a single address. 
BANA_EDD_MDL-00080309 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39898 
Page 17 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
111 
Figure 1 
EDD Responded Slowly to Fraud Risks as Claims Surged 
12,000,000 
10,000,000 
0 
N 
0 
N 
-~ 
-~ 
8,000,000 
"' u 
ro 
·.;:::; ·c 
.,_ 
6,000,000 
0 
cii 
..a E 
::, 
z 
4,000,000 
QJ > 
·.;:::; 
"' 
:i 
E 
::, 
u 
2,000,000 
0 
UI claims begin to surge. 
By the end of March, EDD had 
received more than 2 million 
claims since the start of 2020. 
>. 
>. 
.J:: 
"' 
"' 
u 
"' 
::, 
::, 
C 
..a 
~ 
~ 
QJ 
LL 
0.. 
<! 
Four months and more than 
5.6 million claims later, 
EDD automates its process to stop 
payment on certain suspicious 
claims. 
>. 
QJ 
2:-
"' 
C 
~ 
..=; 
..=; 
Source: Analysis of EDD's claims data and its fraud tools and modifications made durinq the pandemic. 
It is almost certain that because of its lax approach, EDD missed 
stopping payment on fraudulent claims during the pandemic. As 
Figure 2 shows, we selected three addresses that appeared only 
on ED D's list of 26,000 addresses. In other words, EDD identified 
claims from these three addresses as potentially fraudulent but did 
not take any action to stop payments on claims from those addresses 
(unblocked addresses). More than So UI claims were filed at one of 
these unblocked addresses. Moreover, because EDD was unable to 
verify the identities of claimants for more than 70 of those claims, 
V, 
::, 
Ol 
::, 
<! 
.lam.iary 2021 
Six months and 7.4 million 
claims later, EDD: 
Stops automatically "backdating" new 
claims, or allowing them to receive 
payments for previous weeks without 
additional action. 
Begins taking action on addresses with 
unusually high numbers of claims. 
• Asks Bank of America to freeze 
344,000 suspicious accounts. 
cii 
cii 
..a 
..a 
E 
.8 
QJ 
u 
15.. 
0 
QJ 
Vl 
BANA_EDD_MDL-00080310 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39899 
Page 18 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Figure2 
it is likely that impostors used this address to file fraudulent claims. 
However, ED D's fraud detection tools failed to detect 12 of the more 
than 80 claims as suspicious, allowing those 12 claims to remain 
active. As of mid-December 2020, EDD has paid more than $300,000 
in UI benefits related to these 12 active claims. One of the other two 
unblocked addresses that we reviewed, which had more than 20 claims 
associated with it, raised similar concerns. Our review illustrates 
that EDD continues to pay claims despite having evidence that they 
are very likely fraudulent. After we shared our concerns with EDD, 
it performed another analysis identifying more than 572,000 claims 
at more than 30,000 addresses it identified as indicative of fraud. 
Most of these 30,000 addresses were included on ED D's larger 
informational list of 26,000 addresses identified in September. EDD 
asserted that it stopped payment on some of those fraudulent claims 
in mid-December. However, EDD still had not stopped payments on 
the claims associated with two of the three unblocked addresses we 
selected, including the address with 12 active claims. We made other 
observations about EDD's efforts to address problematic numbers of 
claims at a single address and, to avoid publishing information that 
could expose EDD to additional fraud, we shared those observations 
with ED D's management in a confidential letter. 
EDD Has Not Stopped Payments on Claims at Addresses It Identified as Suspicious 
EDD IDENTIFIED 26,000 ADDRESSES THAT IT DETERMINE□ WERE LINKE□ TO SUSPICIOUS CLAIMS 
BUT IT ONLY STOPPED PAYMENTS TO CLAIMS ASSOCIATE□ WITH I0,000 OF THESE ADDRESSES ... 
We looked at three of the 
unblocked addresses and 
found~ with ... 
More than 
more than 
80 ➔ 12 ofwhich ➔ $300K 
total claims ... 
were still eligible to 
receive payment and ... 
had been paid to 
claims at the address. 
Source: Review of EDD's analysis of suspicious addresses and claim information. 
CONFIDENTIAL 
BANA_EDD_MDL-00080311 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39900 
Page 19 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
113 
EDD took another action that compounded the effect of its slow 
and inadequate reaction to potential fraud. As part of its temporary 
COVID-19 procedures, EDD instructed staff to automatically 
backdate new UI claims to the date the claimant said they became 
unemployed. In other words, staff were told to enter an effective date 
for a claim that could be weeks before the date the claimant actually 
filed, allowing that individual to be paid benefits for those weeks. The 
Department of Labor provided guidance instructing states to backdate 
pandemic related claims to the week in which claimants first became 
unemployed. According to EDD, it automatically backdated new 
claims to comply with this guidance. EDD asserted that automatically 
backdating claims reduced the manual workload that would have 
otherwise been required to pay claimants. However, since early 
September 2020, in response to suspected fraud in the PUA program, 
EDD has required claimants to submit a separate request, aside 
from their UI claim, to obtain backdated payment. Since EDD took 
that action, claims for PUA have fallen considerably. Although we 
cannot establish a direct link between ED D's actions and the drop 
in PUA claims, it is possible that by ceasing its practice of automatic 
backdating, EDD has deterred fraudulent claims from occurring. 
Since early September 2020, EDD has 
required claimants to submit a separate 
request, aside from their UI daim, to obtain 
backdated payment. 
A Key Process for Detecting Fraud Has Been Overwhelmed During 
the Pandemic 
Under normal circumstances, some of ED D's benefit fraud detection 
efforts might have allowed it to detect impostor fraud. Benefit fraud 
can occur when individuals continue to receive benefits by failing to 
report that they have returned to work. To detect such fraud, EDD 
performs daily reviews using California employer data and weekly 
reviews using nationwide employer data. Because these reviews use 
SSNs to identify overlap between ED D's benefit data and employer 
databases, the reviews would detect when impostors filed claims using 
the identities of people who were earning wages. When an overlap is 
detected, EDD generates and mails documents to the employers of 
the claimants whom the system detected as both continuing to work 
and receiving UI benefits, asking for further information about the 
claimant. EDD staff must then review the returned documents to 
assess whether fraud has occurred and take appropriate action. 
.lam.iary 2021 
BANA_EDD_MDL-00080312 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39901 
Page 20 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
However, during the pandemic, the amount of work generated by 
these matches overwhelmed the unit responsible for performing these 
reviews-the Benefit Overpayment Section within the UI Integrity 
and Accounting Division. Between March and November 2020, 
this process generated more than 840,000 matches, illustrating that 
hundreds of thousands of claimants were either collecting UI benefits 
while working or had had their identities stolen and impostors were 
using those identities to collect benefits. These 840,000 reviews 
generated during the pandemic were quadrupled from the number 
generated for this section to complete in 2019. This process relies on 
employers to provide details about whether an employee who matches 
a claimant in ED D's system is earning wages. EDD staff explained that 
this process can enable EDD to learn about potential impostor fraud 
because employers often notify EDD that the employees are continuing 
to earn wages and have attested to the employer that they are not 
collecting UI benefits. Complaint data we reviewed indicated that 
employees tell their employer that they are not receiving UI benefits 
after being questioned by their employer. However, because of the 
significant increase in the number of reviews generated, as of the end 
of November 2020, the section responsible for performing them had 
completed only 113,000 of the 840,000 reviews generated during the 
pandemic. This process is entirely paper-based and, as of the end of 
November 2020, the section was still processing documents received 
in August 2020. Staff do not stop payment on these claims until they 
process these documents, meaning that EDD has likely continued to 
pay on these potentially fraudulent claims, despite having identified 
them through this process. As a result of these workload challenges, 
EDD has been unable to effectively leverage this practice of relying on 
existing cross-match reviews to quickly detect fraud . 
... an employment data match process 
generated more than 840,000 matches, 
illustrating that hundreds of thousands 
of claimants were either collecting UI 
benefits while working or had had their 
identities stolen ... 
EDD's Slow Response Has Led to About $10.4 Billion in Payments to 
Suspicious Claims 
As of late-December 2020, EDD had more than 2.2 million claims 
submitted during the pandemic for which it could not confirm the 
identity of the claimant-24 percent of the 9.5 million claims filed 
BANA_EDD_MDL-00080313 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39902 
Page 21 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
115 
from the time the CARES Act became law in March. EDD issued at 
least one benefit payment on about 597,000 of those claims before 
identifying them as potentially fraudulent. 3 In total, EDD paid about 
$10-4 billion for these claims, as Figure 3 summarizes. Although 
EDD explained that it is not able to confirm that all of these claims 
are fraudulent-some of the claimants may have legitimate reasons 
for ignoring EDD's request for identity information-it does not 
know how many are legitimate and how many are fraudulent. More 
than 534,000 of the claims were paid UI benefits in excess of ED D's 
traditional dollar threshold for pursuing a criminal investigation 
of an impostor. As we explain in the Introduction, EDD reported 
that in 2019, its Investigation Division investigated only 14 cases 
of UI impostor fraud representing more than $5.5 million paid in 
fraudulent benefits. EDD's Investigation Division told us that as of 
December 10, 2020, it had opened more than 250 criminal cases 
related to potentially fraudulent claims filed during the pandemic 
and estimated an initial loss totaling greater than $30 million on 
these cases. However, considering that EDD's data show many more 
potentially fraudulent claims and the difficulty of identifying the 
perpetrators of the impostor fraud in 2020, it seems highly unlikely 
that EDD will be able to investigate more than a small fraction of 
these fraudulent claims, let alone recover a significant portion of 
the lost funds. 
We asked EDD for its perspective on the slow and reactive approach 
that it took to combating fraud in 2020. EDD asserted that its 
fraud tools effectively identified and stopped potentially fraudulent 
claims throughout the pandemic and that it enhanced its existing 
processes and tools as needed. However, an estimate of the total 
UI benefit payments EDD prevented through these fraud prevention 
tools demonstrates that EDD paid almost as much to suspicious 
claims as it prevented. Using the number of claims associated with 
individuals with unconfirmed identities to which EDD had not issued 
payment and an estimated benefit amount based on Department 
of Labor data for 2020, we estimated that EDD stopped about 
$12.8 billion in payment to potentially fraudulent claims. Although 
any amount of fraudulent payment that EDD stops is a benefit to the 
UI program, a thorough analysis of the effectiveness of ED D's fraud 
prevention efforts needs to compare the amount of fraud prevented 
to the amount paid to potentially fraudulent accounts. As we note 
in the next paragraph, the total amount EDD paid to fraudulent 
claims is likely to continue growing as it completes upcoming work, 
further showing that ED D's fraud prevention methods have not 
been adequate to stop it from paying on fraudulent claims during 
the pandemic. 
3 This figure does not include approximately 10,000 additional claims for which EDD could not 
verify the identity of the claimant but issued at least one payment, and for which the claimant 
has appealed EDD's determination that their identity was unverified. 
.lam.iary 2021 
BANA_EDD_MDL-00080314 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39903 
Page 22 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
Figure 3 
EDD Paid About $10.4 Bil lion in Benefits to Claimants With Unconfirmed 
Identities 
A CRITICAL PART OF E□□'S FRAU □ PREVENTION 
EFFORTS IS VALIDATING CLAIMANT IDENTITIES. 
But it paid benefits 
to almost fif)'.?,QOO 
other such claims. 
These payments totaled 
$1Q~4J?Ulion. 
EDD stopped payments from 
going to 1.6 million claims on 
which it could not identify the 
claimant... 
Source: EDD data on payrnents and identity alerts, and Department of l.abor estirnated fraud rates 
tor UI programs. 
BANA_EDD_MDL-00080315 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39904 
Page 23 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
117 
The $10,4 billion is likely not the full amount of improperly paid 
benefits. As we describe earlier in this section, we observed 
instances in which EDD continued to pay on suspicious claims 
that its fraud detection methods had not yet identified. During our 
audit, the number of claimants for which EDD could not confirm 
identity grew. Further, ED D's pending reviews of employment data 
mean it is likely that more claims will be called into question. As 
of early January 2021, EDD has requested identity information 
from more than 1.2 million claimants to whom it has already paid 
$19.5 billion in benefits. It is unlikely that EDD will verify the 
identity for all of these claimants with pending identity issues. 
Therefore, it is highly probable that EDD will ultimately determine 
that it improperly paid significantly more than the $10,4 billion we 
identify in this report as potentially fraudulent. 
EDD Suspended a Critical Fraud Prevention Safeguard During the 
Pandemic Because of Its Poor Planning 
Early in the pandemic, EDD altered a critical fraud prevention 
mechanism, resulting in it paying more than $1 billion of the 
$10,4 billion in benefits we discuss in the previous section to 
suspicious claimants. Figure 4 summarizes this problem. As we 
describe in the Introduction, EDD stops payment on claims while 
it verifies claimants' identities, ensuring that it pays benefits only to 
legitimate and verified claimants. However, early in the pandemic, 
EDD decided to remove a key safeguard against paying claims 
for which staff had identity concerns because of the mistaken 
belief that other safeguards would stop payments on these claims. 
However, because the EDD leadership who made these decisions 
did not adequately understand how the stop payments worked, 
EDD waived the barriers to payment for almost 77,000 claims 
and paid more than $1 billion on claims that it has determined are 
potentially fraudulent. 
EDD explained that the early months of the pandemic presented 
challenges in balancing prompt payments for claims against 
its fraud prevention efforts. In the effort to respond to the 
overwhelming volume of unemployment claims, EDD leadership 
decided to identify and remove certain barriers to payment. 
EDD management asserted that it removed these barriers to 
streamline its processes. Nevertheless, this decision had significant 
consequences: EDD incorrectly believed that other safeguards in its 
claims processing system would stop all payments to claimants with 
unconfirmed identities. As Figure 4 shows, this incorrect belief was 
costly. We found that EDD continued to waive this payment barrier 
into August 2020-meaning it was not until four months after its 
decision to waive the barrier that EDD reversed its decision and 
ceased the practice. 
.lam.iary 2021 
BANA_EDD_MDL-00080316 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39905 
Page 24 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Figure4 
EDD Removed a Key Fraud Safeguard and Paid $1 Billion to Individuals With Unconfirmed Identities 
CLAIM FORM 
PAYNON 
Normally, EDD applies 
STOP PAYMENT ALERTS 
to claims with potential identity 
problems. 
Early in the pandemic, 
EDD removed 
stop n<Tn-n•yo,•,1' alerts, 
EDD .cdstakenly believed 
that other safeguards would 
continue to stop payment on 
these claims. 
EDD paid $1 BILLION 
to the unknown claimants 
before eventually reinstating 
the stop payment alerts in 
August 2020. 
Source: Analysis of EDD's claims database and intervievvs with EDD staft 
CONFIDENTIAL 
The decision to waive this safeguard could have had even more 
significant consequences. At the time EDD waived the safeguard, 
it paid an additional 93,000 claims an additional $490 million 
in benefits before knowing that the claimant identities were 
confirmed. Although EDD eventually confirmed the identity of 
these claimants, it did not have that assurance when it issued 
these payments. Had EDD evaluated the risk of removing barriers 
to payment, it may have determined the need to streamline other 
processes in its system that would not have exposed it to so much 
potential fraud. 
BANA_EDD_MDL-00080317 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39906 
Page 25 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
119 
EDD paid $1 billion for almost 77,000 daims 
that it determined may be fraudulent. 
\Xfe found that the majority of claims with unconfirmed identities 
for which EDD waived the payment safeguard had future payments 
prevented by other safeguards. In fact, most of the 77,000 claims 
received payments only for backdated benefit weeks. For example, 
one claimant filed a claim on August 3, 2020, but reported having 
become unemployed due to the pandemic on February 2, 2020-
26 weeks prior to filing the claim. EDD immediately stopped 
payment on the claim on the same day it was filed. However, 
when it waived the safeguard for this claim, its data show that it 
paid benefits for the backdated weeks-totaling almost $22,000. 
Secondary safeguards stopped any future payments on the claim. 
Subsequently, EDD was unable to confirm this claimant's identity 
and disqualified the claim from any additional payments. 
EDD could have avoided this misstep through more careful 
planning and preparation. As we explain in more detail in our 
earlier review of EDD, the department was unprepared for an 
economic downturn. 1 Its planning deficiencies extend to the area 
of fraud prevention. As shown by the decision we describe above 
to remove a claim payment safeguard, EDD leadership made a 
critical misstep because it had an inadequate understanding of 
its fraud prevention mechanisms-a gap in understanding that is 
more easily discovered and dealt with when planning in advance of 
a crisis moment. In addition to the key features of sound recession 
planning that we identified in our previous report, ED D's recession 
planning must include descriptions of the available adjustments to 
fraud prevention practices that EDD could make while continuing 
to best mitigate risk. Identifying the types of tasks it determines 
it is able to stop or delay during a recession while maintaining 
acceptable fraud detection and prevention efforts would minimize 
the need for less informed steps like the decision we describe above. 
In the Near Future, EDD Will likely Need to Dedicate Considerable 
Resources to Assisting Victims of Identity Theft 
EDD will likely face a significant workload in the future to support 
the many individuals whose identities were stolen by impostors who 
filed fraudulent claims during the pandemic. Between March 2020 
4 EDD's Poor Planning and Ineffective Management Left It Unprepared to Assist Californians 
Unemployed by COV/D-19 Shutdowns, Report 2020-128 / 2020-628.1, January 2021. 
.lam.iary 2021 
BANA_EDD_MDL-00080318 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39907 
Page 26 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
and early January 2021, more than 2.2 million claimants did not 
satisfactorily answer ED D's request that they provide identity 
documentation. According to EDD, fraudsters are often not able to 
provide documents to confirm identity; therefore, EDD considers 
claims that are disqualified due to nonresponse as evidence that 
it has effectively deterred fraud. Although not every one of these 
2.2 million claims made it far enough in the process to be paid, 
EDD's data indicate that it paid benefits totaling about $10,4 billion 
on almost 597 ,ooo of these claims, suggesting that these individuals 
may have obtained benefits fraudulently. However, these are only 
the cases EDD has identified; the actual number of claims filed 
with other people's personal information may be higher because 
people who have not yet learned that they were victims of identity 
theft have not yet reported it to EDD. Further, we do not believe 
that ED D's fraud detection tools have yet detected every fraudulent 
claim filed during the pandemic. 
When EDD pays benefits on claims involving stolen identities, 
the victims of that identity theft may be asked to pay taxes on the 
benefits or to pay back the benefits. A victim's interactions with 
EDD to resolve the theft will depend upon the circumstances under 
which the fraud is discovered, as we show in Figure 5. For example, 
victims of identity theft may not know they are victims until they 
receive a tax form notifying them to report income from benefits, 
are contacted by EDD, or try to collect UI benefits themselves. In 
each of these cases, the work EDD will need to perform to assist 
these identity theft victims represents a potentially significant 
increase in its workload. 
ED D's main process for addressing complaints of identity theft has 
been overwhelmed during the pandemic. If individuals discover 
that their identity has been used to file a fraudulent claim with EDD, 
they can notify EDD through its online fraud reporting portal or 
through its telephone hotline. ED D's data show that by July 1, 2020, 
EDD was receiving hundreds of these reports each day, growing to 
consistently receiving more than 1,000 a day in September 2020 
and peaking at more than 1,800 reports on a single day that month. 
By comparison, EDD only received 6,000 UI fraud reports in all of 
calendar year 2019. EDD has dedicated only a single staff position 
to receive and assess these reports, and that position became vacant 
in July 2020. As a result, from April through October 2020, EDD 
responded to less than 2 percent of the UI fraud reports it received 
through its online portal. Further, it had yet to address more than 
77,000 fraud reports as of November 2020. Many of these reports 
likely involve victims of identity theft who will need ED D's help to 
resolve their situations. 
BANA_EDD_MDL-00080319 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39908 
Page 27 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
I 21 
Figure 5 
EDD Wil I likely Need to Assist Victims of Identity Theft in Several Ways 
TAXES DUE 
Victims may be asked to pay 
taxes on benefits they did not 
receive or request. 
EDD would need to 
determine the legitimacy 
of a complaint and 
coordinate with the IRS. 
REPAYMENT DEMANDED 
EDD may request money back 
from victims that the victims 
did not receive. 
EDD would need to perform 
a manual identity verification 
process to remove any 
repayment 
Source: Analysis of EDD's data, workload, and fraudulent claims pmcesses. 
To successfully resolve each case of suspected identity theft, 
EDD must first investigate the complaint to determine whether 
it can substantiate that identity theft has likely occurred. Once it 
completes that analysis, EDD can perform the work necessary to 
clear the reported income from the victim's name. According to 
data EDD provided, as of mid-December 2020, it had performed 
this work for about 21,000 victims of identity theft for claims that 
had been filed from March through November 2020. This process 
will prevent the victims of identity theft from receiving incorrect 
tax forms. However, if EDD did not complete this process for an 
identity theft victim before reporting income to the IRS-a likely 
outcome given the volume of potentially fraudulent claims and the 
number of outstanding fraud reports that EDD has received but 
not yet addressed-the victims will need to contact EDD to resolve 
their cases. EDD will need to respond to fraud reports as identity 
theft victims submit them. EDD anticipates these submissions will 
represent a large workload in the future. 
EDD could be better situated if it modified its existing practices to 
handle this upcoming work. Specifically, instead of continuing 
to receive complaints of identity theft through its regular fraud 
report mechanisms, EDD would provide faster and better service 
to identity theft victims by setting up a dedicated communication 
channel for those individuals. Further, to better understand the level 
of work it needs to accomplish, EDD should establish a working 
group specifically to coordinate the work needed to resolve each 
complaint of identity theft and make decisions about staffing levels 
necessary to accomplish that work. Without a concentrated focus, 
.lam.iary 2021 
CLAIM COMPUCATIIJNS 
Victims may attempt to collect 
benefits on their own UI claims and 
realize fraudulent 
, (, 
claims e~st 
f@~ 
0 
I 
EDD would need to perform a 
manual identity verification 
process, stop payment on the 
fraudulent claim, and assign the 
claim a unique identifier that 
indicates it was fraudulent. 
BANA_EDD_MDL-00080320 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39909 
Page 28 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
EDD risks unnecessarily delaying assistance to victims of identity 
theft, who will remain in precarious tax situations until EDD 
completes its work. 
Recommendations 
To ensure that its recession planning encompasses its fraud 
prevention efforts, EDD should identify the fraud prevention and 
detection efforts it can adjust during periods of high demand 
for UI benefits. It should ensure that it accounts for all probable 
consequences of the adjustments and design procedures that 
appropriately balance the need to provide prompt payment during a 
recession with the need to guard against fraud in the UI program. 
To prepare to respond to victims of identity theft who receive 
incorrect tax forms, EDD should, by mid-February 2021, provide 
information on its website and set up a separate email box for such 
individuals to contact EDD and receive prompt resolution. 
To ensure that it provides appropriate assistance to victims of 
identity theft who report fraud through its online fraud reporting 
portal, EDD should, by March 2021, establish a working group to 
coordinate the work needed to resolve each complaint of identity 
theft, make decisions about staffing levels necessary, and add 
staffing to accomplish the work. 
BANA_EDD_MDL-00080321 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39910 
Page 29 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
.lam.iary 2021 
EDD's Lack of Preparation Left it Unable to Effectively 
Address Two High-Profile Situations 
• In September 2020, EDD directed Bank of America to freeze 344,000 debit 
cards (accounts) because of concerns about UI fraud. Since then, EDD has 
not acknowledged its responsibility for this action, and it did not have a plan 
or take action to ensure that it could unfreeze those accounts belonging to 
legitimate claimants. 
• EDD left itself especially vulnerable to UI fraud associated with incarcerated 
individuals-which it estimates has reached about $810 million-because it has not 
had a system to regularly cross-match UI claims with information from state and local 
correctional facilities. 
When EDD Directed the Freezing of Accounts for 344,000 Claims, It Did Not Take Sufficient 
Action to Help Legitimate Claimants 
ED D's reactive response to its discovery of potentially fraudulent activity appears to have 
harmed legitimate claimants. Bank of America-the State's vendor for distributing UI 
benefit payments-identified more than 309,000 of its UI accounts that it believed to be 
fraudulent and notified EDD of its plans to freeze-or shut down to prevent cardholders 
from accessing the funds-these accounts in mid to late September 2020. EDD reviewed the 
accounts the bank identified and confirmed that Bank of America should freeze 271,000 of 
the accounts. EDD also directed Bank of America to freeze another set of 73,000 accounts 
that Bank of America had not identified as accounts it planned to freeze. Therefore, in late 
September 2020, EDD directed Bank of America to freeze about 344,000 benefit accounts, 
which Bank of America did, effectively stopping anyone in possession of the debit cards 
aligned with these accounts from spending the benefit payments deposited into them. Bank 
of America froze 53,000 additional benefit accounts in the same week because the accounts 
exhibited certain fraud indicators established by Bank of America. However, because those 
fraud indicators differed from ED D's fraud criteria, Bank of America quickly unfroze the 
majority of these accounts in early October 2020 in an effort to align its fraud efforts with 
ED D's. Figure 6 summarizes key exchanges between EDD and Bank of America. 
Several elements of ED D's role in these events are troubling. First, EDD did not initiate the 
request to freeze these potentially fraudulent accounts on its own, indicating that its fraud 
detection and prevention methods were not functioning optimally. Second, EDD mishandled 
the aftermath of this incident. Following public outcry in early October 2020 from legitimate 
claimants who could not access their benefits, EDD requested that Bank of America 
unfreeze all 344,000 accounts it had originally directed the bank to freeze-including the 
73,000 claims it had independently identified as potentially fraudulent. In effect, EDD's 
response was to permit potentially fraudulent activity to continue to ensure that legitimate 
claimants received their benefits. However, it had no analysis supporting its decision to make 
such a swift change to its previous direction. In the end, Bank of America disregarded EDD's 
123 
BANA_EDD_MDL-00080322 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39911 
Page 30 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
request to unfreeze the accounts. In a subsequent letter to the 
Legislature, Bank of America cited its obligation to prevent fraud 
under federal law as its reason for freezing accounts without ED D's 
approval. This series of events reveals flaws in EDD's response 
to fraud: it erred in its initial analysis and request that Bank of 
America freeze the 344,000 accounts, and it reacted poorly once it 
realized that accounts of legitimate claimants had been frozen. 
Figure6 
EDD and Bank of America Have Repeatedly Corresponded About Fraudulent 
Accounts 
9/18 
9/23-25 
9/29-10/1 
10/3 
11/17 
12/2 
12/7 
12/10 
Bank of America sends EDD a list of more than 309,000 accounts 
that it believes are fraudulent. 
EDD directs Bank of America to freeze 344,000 accounts, which 
Bank of America does. 
Bank of America freezes 53,000 additional accounts demonstrating 
indications of fraud, in addition to those on ED D's list. 
EDD's director issues a memo to Bank of America directing it to 
unfreeze the accounts that do not meet EDD's fraud criteria. 
Bank of America only unfreezes 51,000 of the accounts that it 
originally froze. 
EDD requests that Bank of America unfreeze the 344,000 frozen 
accounts it directed the bank to freeze. 
EDD sends a list of 2,270 verified accounts to 
Bank of America to unfreeze. 
Bank of America sends EDD a list of 104,000 suspicious accounts 
to review. 
EDD sends another list of 2,280 verified accounts to 
Bank of America to unfreeze. 
EDD sends another list of 3,000 verified accounts to 
Bank of America to unfreeze. 
Bank of America notifies the Legislature that it has identified 
more than 640,000 potentially fraudulent accounts. 
EDD informs Bank of America that it already stopped payment on 
99,000 accounts of the 104,000 suspicious accounts that 
Bank of America sent in November. 
Source: Analysis of EDf.Ys correspondence records with Bank of flmerica and public documents, 
BANA_EDD_MDL-00080323 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39912 
Page 31 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
.lam.iary 2021 
In addition, ED D's lack of transparency throughout 
this exchange damages the public's trust in its 
statements. When it became apparent that legitimate 
claimants had been included in the listing of frozen 
accounts-leading to media reports of people being 
unable to pay their bills or feed their families-EDD 
was slow to provide information. In fact, we found 
EDD's Director Dld Not Acknowledge EDD's Role 
in Freezing 344,000 Accounts 
no public statements that acknowledged that EDD 
had directed the freezing of the 344,000 accounts. 
About a week after EDD directed Bank of America 
to freeze those accounts, the director of EDD 
testified to the Legislature that EDD and Bank of 
America were coordinating "additional review" of 
more than 350,000 suspicious claims. As the text box 
shows, when one assemblymember asked the 
director who froze the accounts, the director did not 
describe ED D's responsibility and identified Bank of 
America as the responsible party. A letter from 
59 members of the Legislature in November 2020 to 
the chief executive officer of Bank of America shows 
that the Legislature believed that EDD had far less of 
a role in freezing accounts than it actually did. The 
Assemblymember: I know rny district office has continued 
to receive several constituent cal is rnore recently regarding 
the Bank of America cards that have been suddenly frozen. 
Can you give us a sense as to why are they being frozen? And 
whose accounts are being frozen? ls that something that the 
department directed them to do mis this something that the 
bank is doing? 
EDD Director: This is part of the Bank of fa,merica's fraud 
protection se1·vices, I guess. And that's what I mentioned, that 
B of A and our-EDD and Labor Agency-we're meeting this 
afternoon to waik through exactly what was going on, what 
makes sense. And look at that balance again between paying 
claims versus fighting fraud. So we're aggressiveiy 
look at that. 
Source: Director's testimony at a hearing of the /\ssernbly 
Budget Subcormnittee on State Administration on 
October i, 2020. 
letter indicates that EDD informed the Legislature that frozen 
accounts were solely the result of Bank of America's efforts. Although 
it is true that Bank of America froze some accounts without direction 
from EDD, the department played a significant role in directing that 
344,000 accounts be frozen. 
Subsequent coordination between EDD and Bank of America 
about potentially fraudulent accounts has also been problematic. 
First, EDD has been slow to respond to another list of questionable 
accounts that the bank identified. In early November 2020 Bank 
of America sent EDD a list of more than 104,000 accounts that it 
identified as suspicious and requested guidance from EDD about 
what to do with the accounts. EDD delayed providing direction to 
Bank of America until one month later, risking that some fraudulent 
claimants would continue to collect benefits while EDD performed 
its analysis on those accounts. Further, when it did respond, EDD 
informed Bank of America that it had already stopped payment 
to more than 99,000 of the accounts, but failed to provide explicit 
instructions to Bank of America as to whether it should freeze 
those accounts. Therefore, EDD did not direct the bank to protect 
the money that it had already deposited into those accounts. 
Moreover, EDD neglected to mention what it had determined-
if anything-about the remaining 5,000 accounts that Bank of 
America originally provided for review. EDD explained to us that it 
was still verifying the identities of the majority of these claimants as 
of December 10, 2020. 
125 
BANA_EDD_MDL-00080324 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39913 
Page 32 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
Still more problematic have been difficulties that EDD and Bank of 
America have had in agreeing how to unfreeze accounts that belong 
to legitimate claimants. One complicating factor has been that, 
during our review, EDD did not know which accounts were frozen 
or needed to be unfrozen. In fact, EDD confirmed that it does not 
have a centralized process for tracking and monitoring these frozen 
accounts, making it unclear how many accounts in total were 
frozen. Therefore, it does not have a systematic way to ensure that 
it reviews all frozen accounts to determine whether the accounts 
should be unfrozen and returned to legitimate claimants. Without 
such a process, any attempt that EDD makes to address the problem 
of legitimate claimants with frozen accounts may be incomplete and 
potentially flawed. Further, Bank of America has required EDD to 
individually verify the identities of the claimants associated with the 
344,000 frozen accounts that EDD identified before it will unfreeze 
the accounts. An external consultant determined that 72,000 of 
the 344,000 frozen accounts were at low risk of being fraudulent 
claimants; however, EDD will need to manually verify these claims 
as legitimate before Bank of America will unfreeze those accounts. 
As of December 10, 2020, EDD had verified the identities of only 
about 7,500 affected claimants. Although EDD may find that it 
disqualifies some of these claimants-potentially from both the 
low-risk group of 72,000 accounts and the remaining population of 
the original 344,000 frozen accounts-for failing to respond to its 
requests for identity documentation, there will likely be a significant 
number still to be addressed. Therefore, it will be important for 
EDD to explore using ID.me or another type of expedited identity 
verification to avoid prolonging the process by which it resolves 
frozen benefit accounts that belong to legitimate claimants. 
When we presented EDD with our concerns about its interactions 
with Bank of America, EDD explained that it was concerned about 
correspondence it had received from the bank that predated the 
September freezing of 344,000 accounts. EDD cited examples of 
Bank of America contacting EDD with eight lists of problematic 
accounts from mid-July through mid-September 2020. However, 
our review shows that EDD also handled some of these cases 
poorly. Specifically, Bank of America shared a list of almost 66,ooo 
potentially fraudulent accounts with EDD in mid-July 2020 and 
requested ED D's review of these accounts. However, EDD was 
unable to provide any correspondence that demonstrated it 
ever answered Bank of America's request. In August 2020, Bank 
of America notified EDD that it was freezing approximately 
5,700 accounts due to fraudulent activity. Records show that EDD 
knew about those frozen accounts and no record we reviewed 
shows that EDD expressed concern that the bank had frozen 
the accounts without first consulting the department. In early 
September 2020, Bank of America again sent EDD a list of more 
than 150,000 accounts that the bank identified as having suspicious 
BANA_EDD_MDL-00080325 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39914 
Page 33 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
127 
activity, requesting EDD to review the accounts and determine if 
any are fraudulent and should be frozen by Bank of America. Again, 
EDD was unable to provide any correspondence that demonstrated 
that it ever answered Bank of America's request. These earlier 
requests are evidence of yet another warning about potential fraud 
that EDD does not appear to have comprehensively addressed. 
EDD Was Unprepared to Detect and Handle the Hundreds of Millions 
of Dollars in Fraudulent Claims Associated With Incarcerated 
Individuals 
As we show in Figure 7, EDD left itself especially vulnerable to fraud 
associated with incarcerated individuals-which law enforcement 
officials have said has totaled hundreds of millions of dollars in 
fraudulent payments during the pandemic. In late November 2020, 
nine county district attorneys signed a letter announcing that the 
Department of Labor identified roughly 35,000 unemployment 
claims filed from March 2020 through August 2020 using data 
that matched individuals incarcerated in state prisons against UI 
information. According to November 2020 correspondence from 
the deputy secretary of communications at the California Labor 
and Workforce Development Agency, 21,000 of these claims 
received payments that totaled $400 million. EDD later 
estimated that between January 2020 and November 2020, it paid 
about $810 million in benefits to roughly 45,000 claimants with 
information that matched incarcerated individuals, based on both 
state prison data and a December 2020 analysis by a private vendor 
that used data from state and local correctional facilities across the 
country. EDD noted that most of the problematic claims were for 
PUA; as we note in the Introduction, the CARES Act relaxed some 
requirements for receiving these benefits, such as extending the 
benefits to individuals who had been self-employed and therefore 
would not have had a third-party employer to report their wages. 
EDD was unprepared to guard against inmate fraud in this program 
because it lacked a system to cross-match all incoming claims 
against incarceration data. 
EDD estimated it paid $810 million in 
benefits to 45,000 claimants who were 
incarcerated. 
.lam.iary 2021 
BANA_EDD_MDL-00080326 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39915 
Page 34 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Figure 7 
Because It Delayed Obtaining Critical Information, EDD Was Unprepared for UI Fraud by Incarcerated Individuals 
2016 
November 
2018 
2020 
April 
July 
August 
October 
November 
December 
2021 
January 
A national survey shows that UI administrators in 35 states cross-match claims against 
incarceration data. 
EDD notifies the Legislature that it is considering adopting a cross-match against 
incarceration data. 
EDD again notifies the Legislature that it is considering adopting a cross-match 
against incarceration data. 
EDD begins receiving PUA claims. 
EDD again notifies the Legislature that it is considering adopting a cross-match 
against incarceration data. 
PUA claims begin to spike. EDD's criminal investigators communicate with local law 
enforcement about specific cases of UI fraud related to incarcerated individuals. 
EDD reaches out to CDCR to request information that would allow it to cross-match 
data on incarcerated individuals against claim data. 
EDD develops a contract with a private vendor that claims it can provide 
access to incarceration records, such as data from local jails. 
Nine county district attorneys sign a letter announcing UI fraud involving tens of 
thousands of inmates and hundreds of millions of dollars. 
EDD and CDCR sign a data sharing agreement for CDCR to provide EDD with data 
on individuals incarcerated in state prisons. 
Based on data from CDCR and the private vendor, EDD estimates it paid about 
$810 million in claims associated with incarcerated individuals. 
Source: Emails from and interviews with staff at EDD, EDD claims data and vendor analysis, rnrYs annual fraud reports to the Legislature, a letter from 
nine district attorneys, EDfYs data sharing agreement and contract inforrnation, and a national survey ot state unemployment programs. 
CONFIDENTIAL 
BANA_EDD_MDL-00080327 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39916 
Page 35 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
129 
ED D's failure to institute this type of cross-match is of special 
concern given the wide use of this approach throughout the rest 
of the country. According to a 2016 report on the results of a 
survey from the National Association of State Workforce Agencies, 
35 states were cross-matching unemployment claims with state 
prison data and 28 states were cross-matching claims with county 
jail data at that time. For example, Washington state's Employment 
Security Department reported in December 2016 that it was 
cross-matching electronic jail records against its database of 
unemployment benefits three times per week and that it was 
examining the feasibility of creating a more robust cross-match 
using real-time data. In that report, Washington's department 
noted that since it had begun cross-matching these records, from 
March 2015 through July 2016 it denied benefits on nearly 1,500 
such cases and recovered almost $250,000 in related overpayments. 
Given the prevalence and usefulness of the incarceration data 
cross-match, it is troubling that EDD failed to implement this 
fraud prevention tool previously. According to ED D's annual 
report to the Legislature on fraud deterrence from June 2020, it 
already had processes to cross-match its records against other 
types of data, such as a monthly cross-match with mortality data 
and a real-time verification of claimants' SSNs with the Social 
Security Administration. By contrast, the report noted that 
EDD was "considering" new options for sharing data, such as 
incarceration data, with government agencies-language that it 
had also included in its 2018 and 2019 reports. However, according 
to the chief of ED D's Investigation Division, since starting his 
position in April 2016 and until recent conversations on this 
topic in 2020, he was not part of or aware of discussions with the 
California Department of Corrections and Rehabilitation ( CDCR) 
about sharing state prison data to cross-match against UI claims. 
During the pandemic, when EDD became aware that this gap in 
its safeguards was allowing a substantial amount of fraud to occur, 
EDD spent months negotiating access to CDCR's state prison 
data after an EDD investigator initially reached out to CDCR 
in August 2020 about sharing information to identify potential 
fraud. CDCR originally took a stance that, except in limited 
circumstances, it was prohibited from providing the information 
to EDD, but it indicated that the Attorney General authorized it to 
provide the inmate information to EDD in early December 2020. 
Since it became apparent during the pandemic that its failure 
to cross-match claims against incarceration data was allowing 
illegitimate benefits payments, EDD has pursued two solutions 
to address this gap in its fraud prevention efforts. First, according 
to ED D's chief information officer, EDD has recently expanded 
its cross-checking capabilities through a private vendor to 
cross-reference inmate data from prisons and jails in multiple states. 
.lam.iary 2021 
BANA_EDD_MDL-00080328 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39917 
Page 36 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
This vendor provided the December 2020 analysis that contributed 
to EDD concluding that it had paid about $810 million in benefits 
associated with incarcerated individuals. A contract between EDD and 
this vendor with a term of October 2020 through June 2021 includes 
access to what the vendor calls "real-time incarceration and arrest 
records:' An EDD IT Branch staff member confirmed that, although 
the vendor's analysis for EDD has largely been retrospective, EDD is 
considering using the vendor in the future to perform more timely 
checks of new incoming claims against incarceration records. The 
chief information officer noted that she had not been in her position 
before May 2020 and, therefore, could not speak to why EDD had not 
pursued this option before the pandemic. Second, in early December 
2020, EDD and CDCR established a data sharing agreement for 
CDCR to provide inmate data to EDD's investigators at least monthly 
for two years. State law authorizes the Office of the Attorney General 
(Attorney General) to share criminal offender information with EDD 
when there is a compelling need and allows CDCR to provide this 
information on the Attorney General's behalf. 
Despite these new efforts, the Legislature should take action to help 
ensure that the State prevents future fraud by inmates. Although EDD 
has established a data sharing agreement with CDCR and a contract 
with a private vendor that likely will provide additional local data, 
such as from county jails, the CDCR partnership is dependent on the 
Attorney General determining that EDD has a compelling need for 
the information. Because of ED D's fraud prevention deficiencies that 
we discuss here and elsewhere in this report, and because EDD must 
rely on other entities such as CDCR to provide inmate data, legislative 
action is necessary to ensure that EDD can regularly access and use 
data from state and local correctional facilities to prevent future 
fraud. A mandate to share information and use that information to 
check incoming UI claims for potential fraud related to incarcerated 
individuals would address what has been a longstanding gap in ED D's 
fraud prevention approach that allowed significant fraud to occur 
during the pandemic. 
Recommendations 
Legislature 
To ensure that EDD prevents fraud associated with incarcerated 
individuals, the Legislature should amend state law to do the 
following: 
• Require EDD to regularly cross-match UI benefit claims against 
information about individuals incarcerated in state prisons and 
county jails to ensure that it does not issue payments to people 
BANA_EDD_MDL-00080329 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39918 
Page 37 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
I 31 
who are ineligible for benefits. The Legislature should specify 
that EDD perform the cross-matches as quickly as possible after 
individuals file claims and with as little disruption of legal and 
eligible claims as possible. 
• Require CDCR and any other necessary state or local 
government entities to securely share information about 
incarcerated individuals with EDD to enable EDD to 
prevent fraud. 
• Require EDD to include, in its annual report to the Legislature 
about fraud, an assessment of the effectiveness of its system of 
cross-matching claims against information about incarcerated 
individuals. The assessment should include how regularly EDD 
performs the cross-matches, how successful the cross-matches 
are in detecting and preventing fraud, and whether the 
cross-matches negatively affect eligible claimants attempting to 
legally obtain benefits. 
EDD 
To ensure that it provides legitimate claimants with benefits but 
does not pay benefits related to fraudulent claims, EDD should 
immediately obtain from Bank of America a comprehensive list 
of claimants' accounts that are frozen. EDD should immediately 
thereafter evaluate the list-including considering using ID.me to 
verify claimants' identities-to identify accounts that should be 
unfrozen. By March 2021, it should direct Bank of America to take 
action to freeze or unfreeze accounts as appropriate. 
To ensure that it reviews each account that Bank of America reports 
to it as suspicious or potentially fraudulent, by February 2021, EDD 
should establish a centralized tracking tool that allows it to review 
and stop payment on claims, as appropriate. EDD should use this 
tool to monitor its own internal decisions and track whether the 
claimant responds to its requests for identity information and 
should, therefore, have their account unfrozen. 
.lam.iary 2021 
BANA_EDD_MDL-00080330 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39919 
Page 38 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Blank page inserted for reproduction purposes only. 
CONFIDENTIAL 
BANA_EDD_MDL-00080331 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39920 
Page 39 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
EDD Has Relied on Uninformed and Disjointed 
Techniques to Prevent Impostor Fraud 
Key Points 
.lam.iary 2021 
• EDD's disjointed approach to fraud prevention has placed its UI program at a higher risk 
for fraudulent activity. It has not established a centralized unit to manage its fraud detection 
efforts, and it does not reliably track suspicious claims to ensure that it is taking appropriate 
action to resolve any issues, including those that suggest fraud has occurred. 
• Best practices for fraud prevention suggest that government agencies should have 
a dedicated unit to mitigate the risk of fraud. Until EDD designates such a unit and 
develops a comprehensive approach to preventing and detecting fraud, it is at a greater 
risk for paying benefits on fraudulent claims. 
• EDD does not measure or monitor any of its fraud prevention or detection tools to 
determine how effectively each one detects fraud. As a result, it may be using ineffective 
fraud prevention and detection techniques that fail to prevent fraudulent payments or 
delay payments to legitimate claimants. 
EDD's Approach to Fraud Prevention Is Disjointed and Ineffective 
In nonrecessionary years, EDD is responsible for the oversight and administration of a UI program 
that pays more than $5 billion annually in benefits to Californians who qualify for assistance. An 
essential element of effective management of such a program is prevention of attempts to receive 
benefits fraudulently. Not only is maintaining the integrity of the UI program a federal expectation, 
it is critical to ensuring that it provides assistance only to those who genuinely need it rather than 
those who misrepresent themselves to obtain money illegally. Given the importance of fraud 
prevention, we expected that EDD would have a cohesive and centrally managed fraud prevention 
effort, that it would track potential fraudulent activity from detection to resolution, and that it 
would ensure coordination between the fraud prevention and detection initiatives it uses. Because 
these practices are lacking, ED D's UI program is at a higher risk for fraud. 5 
EDD has not assigned responsibility to any single departmental unit for ensuring that its fraud 
detection efforts operate as intended, contributing to its disjointed approach to stopping fraud. As 
we note in the Introduction, many different divisions and offices have roles related to detecting 
fraud. These individual EDD units forward reports or allegations of fraud to one another and-
in the process-do not remain involved in the resolution of the allegations. Figure 8 shows key 
units within EDD and the independent responsibilities they have related to fraud. As the figure 
shows, ED D's fraud detection approach is highly dependent on a variety of units all coordinating 
effectively with one another. Separation of responsibilities may be an appropriate way for EDD 
to divide its labor. However, that separation also increases the risk that units will not coordinate 
s Federal law requires EDD to perform regular audits of randomly selected claims in an effort to determine its improper payment rate. Those 
audits also identify the causes for EDD's improper payments. However, those efforts differ from a focused attention on individual claims and 
are, therefore, only part of the solution to preventing fraud in the UI program. 
133 
BANA_EDD_MDL-00080332 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39921 
Page 40 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
effectively with one another. For example, EDD has assigned primary 
responsibility for receiving and reviewing fraud allegations to the 
Criminal Intelligence Unit within its Investigation Division. However, the 
chief of the Investigation Division stated that the Criminal Intelligence 
Unit cannot stop payment on claims that it identifies as suspicious. It 
must refer any potentially fraudulent claims to other units or divisions for 
further investigation or administrative action. This delay may allow EDD 
to continue paying UI benefits on fraudulent claims, even after EDD staff 
have identified them. 
We observed that a key mechanism EDD's units use to communicate 
about potentially fraudulent claims is dedicated email accounts that 
are managed by multiple staff Referral and tracking of potential fraud 
by email increases the risk that EDD will mishandle a fraud report. For 
example, the Criminal Intelligence Unit's hotline operator monitors 
and receives reports of fraud from the public. If the hotline operator 
finds that an allegation has merit, the operator forwards the report to 
a dedicated email address for the UI Integrity and Legislation Unit. 
The UI Integrity and Legislation Unit reviews the claim associated 
with the fraud report and then passes the fraud report to the UI 
Identity Verification and Technical Support Section for further work. 
We attempted to follow two fraud reports that the hotline operator 
emailed to the UI Integrity and Legislation Unit in April and July 2020 
to determine what action the unit took. In neither case could the UI 
Integrity and Legislation Unit locate the original emailed referral from 
the hotline operator, and the unit could only demonstrate that it had 
reviewed one of the two fraud reports. These examples demonstrate the 
gaps in the way EDD manages reports of potential fraud. 
Referral and tracking of potential fraud 
by email increases the risk that EDD will 
mishandle a fraud report. 
In another example, EDD has not coordinated its identity verification 
efforts, leading to duplicated effort with no discernible benefit. Since 
its implementation in October 2020, EDD has touted ID.me-an 
identity verification program that we describe in the Introduction-
as one of its primary methods for preventing identity thieves from 
filing false claims. However, EDD confirmed that it continues to 
implement fraud detection tools that require claimants to verify 
their identities even after successfully completing ID.me verification, 
essentially requiring claimants to verify their identities twice. 
During a single day in November 2020, for instance, one of its other 
fraud detection tools flagged 352 claims for identity verification. 
BANA_EDD_MDL-00080333 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39922 
Page 41 of 60

CONFIDENTIAL 
(J\l_!FOi1NIA STATE AUD!TOi1 
Report2020-618.2 
.lam.iary 2021 
Figures 
EDD Has Convoluted Its Fraud Prevention and Detection Approach by Spreading Key Efforts Among Its Different Units 
z 
0 
..... 
w. 
s: s 
z 
0 
~ 
0 
..... 
E-t 
w. 
ri:I 
~ 
,_, 
Reviews reports of fraud from ED D's on line 
fraud reporting tool. Determines whether to: 
l Close the report without further action. 
2. Forward 
3. Route to the('l'ltf1:Jfu1t1£1)1fl)To.1111!1fil1] 
~\_~\_~\_~ 
for administrative action. 
UI Support Division 
INTEGRITY AND LEGISLATION UNIT 
Reviews reports of potential fraud 
forwarded by the 
by 
Assesses whether an impostor filed a 
claim; reports 
Generally monitor for suspicious activity 
and forward weekly reports of 
potentially fraudulent claims to the 
Jllilh1-l~lk~llh'1Iffil\11Wlli1lhl Staff may 
1%i8i.dhl&@i&%i,·th~· 
stop payment on claims and require the 
claimants to provide identity information 
for the 
review. 
Investigates allegations of fraud to pursue 
criminal charges against impostors. May 
request that theill.m~ 
mark claims as suspicious in database. 
Also, the Investigation Division may inform the 
(?JwhPn it identifies 
impostor claims. 
UI Integrity and Accounting Division 
Reviews identity documentation from 
potentially fraudulent claimants to resolve 
whether it can establish their identity. 
Assesses whether an impostor filed a 
claim; reports 
Assigns new unique identifiers to 
those claims that other units have 
reported to it as likely fraudulent. This 
process also removes the claim from 
the compromised SSN that the 
impostor used to file the claim in order 
to protect the true owner of the SSN. 
Source: Review of EDD's organizational chart, EDD's policy and procedure documents, and interviews \i\lilh EDD staff. 
135 
BANA_EDD_MDL-00080334 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39923 
Page 42 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
When we asked EDD why it continued to require secondary identity 
verification even after implementing ID.me, staff asserted that ID.me 
may have verified an individual's identity, but that individual may 
have exhibited indicators of fraud that ID.me was not designed to 
detect. However, as of mid-November 2020, EDD stated that it had 
not performed any analyses to determine whether this secondary 
verification step detects fraud that ID.me missed. Further, this 
secondary verification tool initially requires claimants to provide 
identity information similar to what they used for ID.me before EDD 
then further evaluates their eligibility. As such, ED D's secondary tool 
may delay payments to legitimate claimants by requiring them to 
verify their identities twice. 
During our review, EDD asserted that it was taking steps to improve 
coordination between the different units that take action to prevent 
and detect fraud. In mid-November 2020, EDD hired a new deputy 
director to oversee its Policy, Accountability, and Compliance Branch. 
This deputy director has been tasked with establishing a fraud working 
group across the department. However, as of December 30, 2020, this 
group had not yet held its initial meeting or fully formed a charter 
to define its purpose. Because best practices for fraud prevention 
and detection suggest that government agencies should have a 
dedicated unit to identify fraud risk and determine the activities that 
the agency will engage in to mitigate that risk, we have concerns that 
EDD's approach does not seem headed in this direction. The U.S. 
Government Accountability Office (GAO) recommends that fraud 
prevention units have sufficient authority, be the central repository 
for knowledge about the agency's fraud prevention activities, and be 
the central coordinator of those activities. ED D's new working group 
may be an improvement to its current approach to preventing fraud, 
but it would be an even greater improvement for EDD to centralize 
fraud prevention into a single unit with proper authority to adopt and 
manage a fraud prevention strategy. Although the scope of our review 
was limited to fraud prevention practices within the UI program, it 
would be consistent with GAO guidance and efficient use of resources 
for EDD to centralize its fraud mitigation efforts in one unit for all of 
its major programs. 
EDD Has Not Determined the Effectiveness of Its Fraud Prevention and 
Detection Methods 
Although EDD employs a variety of tools to prevent and detect 
potential fraud-such as matching claims against employment 
records and death records-it has not conducted any analysis of the 
effectiveness of these tools to determine how well they detect fraud. 
State law requires EDD's director to periodically review its policies 
and practices to identify, in part, those that provide little or no value 
in preventing fraud or abuse in the UI program. However, EDD could 
BANA_EDD_MDL-00080335 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39924 
Page 43 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
137 
not demonstrate that it had performed any such reviews since it 
reported the results of its first review to the Legislature in 2015. State 
law also requires EDD to report to the Legislature annually on its 
fraud detection and deterrence efforts, which it has done. Because 
of these two requirements, we expected that EDD would measure 
the effectiveness of each of its fraud prevention and detection 
tools to ensure that it is balancing its need to provide prompt 
payments to legitimate claimants with its need to prevent fraudulent 
payments. Although EDD annually reports on its fraud detection 
and deterrence efforts to the Legislature, it has not determined how 
reliably its tools and methods actually detect fraud. ED D's lack of 
a single unit with the authority to oversee its fraud prevention and 
detection activities may be one of the reasons that no one at EDD 
has measured or assessed these tools' effectiveness. 
Understanding the effectiveness of its fraud detection tools is 
paramount to ED D's success at balancing timely payment of benefits 
with reduced risk of fraud. For example, if EDD knew that most 
of the claims one tool flagged were indeed fraudulent, it would be 
reasonable for EDD to continue to rely on that tool. However, if 
another tool flagged many potentially fraudulent claims that turned 
out to be legitimate, it would be advisable to alter or remove it since 
the tool would delay payments to real claimants without detecting 
actual fraud as well as perhaps wasting valuable EDD resources. 
No one at EDD has measured or assessed 
its fraud detection and prevention tools' 
effectiveness. 
ED D's chief information officer asserted that EDD has collaborated 
with other departments, such as the California Department of 
Technology, to assess the effectiveness of ED D's fraud prevention 
efforts. However, EDD was unable to provide any evidence of such 
an analysis or of any efforts to comprehensively understand the 
effectiveness of ED D's fraud prevention and detection efforts. Such 
an analysis is critical to informing and continuously improving 
ED D's approach. By evaluating outcomes of UI claims it identifies 
as having increased fraud risk, as well as identifying claims it did 
not flag as suspicious but later learned to be fraudulent, EDD can 
assess the frequency with which individual fraud detection efforts 
are successful. This will allow the department to update its fraud 
prevention strategy to prioritize the tools and techniques that prove 
most effective at stopping fraud and reduce or eliminate those that 
cause claimants unnecessary delays and yield little benefit. 
.lam.iary 2021 
BANA_EDD_MDL-00080336 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39925 
Page 44 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
CONFIDENTIAL 
EDD recently received additional federal funding to bolster its fraud 
prevention and detection efforts. In September 2020, the Department 
of Labor awarded EDD $2,4 million in grant funding to prevent and 
detect fraud in the UI programs implemented in response to the 
pandemic. Guidance associated with the grant provides examples of 
uses for these funds, including data mining and analysis. The guidance 
also suggests the use of the National Association of State Workforce 
Agencies' Integrity Data Hub, a centralized, multistate data system that 
allows states to perform cross-matches of claims, provides a national 
fraud alert system, and supports data analytics on multistate claims. In 
December 2020, EDD developed a draft spending plan with possible 
uses for the $2,4 million grant. Regardless of what it decides to do with 
the newly allocated funds, EDD must ensure that its fraud prevention 
and detection approach aligns with best practices. Until it does so, it 
cannot ensure that it appropriately protects the funding intended for 
qualified unemployed Californians from those who would defraud 
the State. 
As we describe throughout this report, ED D's approach to fraud 
prevention and detection demonstrates the weaknesses caused by 
its poor planning and program management. Had it implemented 
a centralized fraud unit responsible for overseeing its overall fraud 
approach, it would not have needed to rely on its several units to 
balance the decision-making process and modifications it made early in 
the pandemic. It would have already had a dedicated unit responsible 
for advising it about and implementing those program changes to 
bolster its approach. Similarly, in nonpandemic times, this unit could 
likely have ensured that EDD's approach to fraud was informed by 
evidence of effectiveness, which would provide greater assurances to the 
public and Legislature that delays in payments to legitimate claimants 
were appropriate delays. However, because EDD neglected to employ 
these best practices to mitigate fraud, its weaknesses in detecting and 
preventing fraud have been exposed during the pandemic. To address 
these weaknesses, EDD will need to take strategic and urgent steps to 
coordinate and strengthen its approach moving forward. 
Recommendations 
Legislature 
To ensure that EDD effectively protects the integrity of the UI 
program, the Legislature should amend state law to require EDD to 
do the following: 
• By January 2022 and biannually thereafter, assess the effectiveness 
of its fraud prevention and detection tools and determine the 
degree to which those tools overlap or duplicate one another 
BANA_EDD_MDL-00080337 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39926 
Page 45 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
without providing any additional benefit. EDD should then 
eliminate any fraud prevention and detection approach for 
which it lacks clear evidence of effectiveness. It should include 
this assessment in its annual report to the Legislature on fraud 
detection and deterrence efforts. 
• By July 2021, provide the Legislature with an update on its 
progress in performing this analysis. 
EDD 
To ensure that it maintains a robust set of safeguards against fraud, 
EDD should do the following: 
• By March 2021, designate a unit as responsible for coordinating 
all UI fraud prevention and detection. EDD should assign that 
unit sufficient authority to carry out its responsibilities and align 
the unit's duties with the GAO's framework for fraud prevention. 
• By May 2021, develop a plan for how it will assess the 
effectiveness of its fraud prevention and detection tools. 
.lam.iary 2021 
We conducted this performance audit in accordance with generally accepted government auditing 
standards and under the authority vested in the California State Auditor by Government Code 8543 
et seq. Those standards require that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and conclusions based on the audit objectives. We 
believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on 
our audit objectives. 
Respectfully submitted, 
ELAINE M. HOWLE, CPA 
California State Auditor 
January 28, 2021 
139 
BANA_EDD_MDL-00080338 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39927 
Page 46 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Blank page inserted for reproduction purposes only. 
CONFIDENTIAL 
BANA_EDD_MDL-00080339 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39928 
Page 47 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
I 41 
APPENDIX 
Scope and Methodology 
State law authorizes the California State Auditor (State Auditor) to 
establish a program to audit and issue reports with recommendations 
to improve any state agency or statewide issue that we identify 
as being at high risk for the potential of waste, fraud, abuse, and 
mismanagement or that has major challenges associated with its 
economy, efficiency, or effectiveness. In August 2020, we issued a 
report that designated the State's management of federal COVID-19 
funds as a high-risk statewide issue in California. Because EDD 
administers the UI program and specifically the CARES Act federal 
funding related to COVID-19 unemployment, we performed an 
audit of ED D's oversight of these funds. The objective of this audit 
was to evaluate EDD's recent fraud prevention efforts related to its 
UI program. In conducting this audit, we interviewed staff at EDD, 
reviewed public and confidential documents related to EDD's efforts 
to detect benefit and impostor fraud, and collected documentation 
from EDD pertaining to the steps it has taken to address increased 
fraud during the pandemic, including fraud issues raised by the 
public. To assess how EDD communicates reports or allegations 
of fraud internally, we selected five fraud reports from ED D's fraud 
reporting portal and evaluated documentation about the resolution 
of these reports. We also reviewed a selection of claims in ED D's 
internal database to assess whether the fraud detection tools EDD 
described to us had effectively detected fraud and stopped payments 
to those claims. In addition, we reviewed payment information to 
assess the amount of benefits paid on potentially fraudulent claims 
as a result of actions taken by EDD. Last, we reviewed guidance and 
best practices published by the Department of Labor and GAO to 
inform efforts that EDD should take in developing a comprehensive 
approach to fraud prevention and detection. 
Assessment of Data Reliability 
The GAO, whose standards we are obligated to follow, requires us 
to assess the sufficiency and appropriateness of computer-processed 
information that we use to support our findings, conclusions, or 
recommendations. In performing this audit, we relied on electronic 
data files that we obtained from ED D's UI and IT branches. To evaluate 
the data, we reviewed existing information about the data, interviewed 
staff knowledgeable about the data, and assessed documentation to 
validate general details about the data. Because we performed only 
limited testing of the data, we found them to be of undetermined 
reliability. Although we recognize that this determination may affect 
the precision of the numbers we present, there is sufficient evidence in 
total to support our audit findings, conclusions, and recommendations. 
.lam.iary 2021 
BANA_EDD_MDL-00080340 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39929 
Page 48 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Blank page inserted for reproduction purposes only. 
CONFIDENTIAL 
BANA_EDD_MDL-00080341 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39930 
Page 49 of 60

CONFIDENTIAL 
.,,,,,,.,------..... Employment 
EDD 
Development 
Department 
....::.._.,,,.,...., _____ _ 
State of California 
January 11, 2021 
Elaine M. Howle, CPA* 
California State Auditor 
621 Capitol Mall, Suite 1200 
Sacramento, CA 95814 
Dear Ms. Howle: 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
Cavin Newsom, Covernor 
California Labor and t-Votkt()rce Dt•veloprnenl Agency 
.lam.iary 2021 
Thank you for working with our team to complete a thorough review of the 
challenges EDD has faced since the COVID-19 pandemic. We appreciate the 
recommendations offered, as this has been a public health and economic event 
without precedent in American history. EDD is prepared to implement all seven of 
the fraud recommendations put forward in the audit report. 
Like many states, California was unprepared for the impact the COVID-19 
pandemic had on both unemployment claims and fraud. California went from 
record employment rates to record unemployment rates -- seemingly overnight. 
The new federal Pandemic Unemployment Assistance (PUA) program presented 
particular challenges, as it did not have the same safeguards as California's 
143 
unemployment program. While in a September letter from the Department of 
G) 
Labor acknowledged that the new program is a "target for criminal enterprises 
and other bad actors deploying advanced technologies, stolen or synthetic 
identities, and other sophisticated tactics," the Trump Administration provided 
insufficient support to states to address the aggressive attacks by domestic and 
international criminal syndicates. 
In 2010, the worst full year of the Great Recession, EDD paid $22.9 billion in benefits 
on 3.8 million processed claims. Since March 2020 more than $112 billion in 
unemployment benefits has been paid on 18.8 million processed claims. Of the 
CD 
$112 billion in benefits paid out, the state has identified $10.4 billion as fraudulent 
of which approximately 92% of which are PUA claims. EDD has put new 
0 
safeguards in place flagging an additional $19 .5 billion as suspicious, triggering 
stop payments and outreach to more than 1.2 million claimants to verify identity 
and over 150,000 to verify other eligibility criteria. In addition, during that same 
time frame, EDD successfully identified 1.6 million claims as potentially fraudulent 
PO Box 826880 • Sacramento, CA 94280-0001 • edd.ca.gov 
* 
California State Auditor's comments begin on page 51. 
BANA_EDD_MDL-00080342 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39931 
Page 50 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Ms. Howle 
January 11, 2021 
Page 2 
and stopped them from proceeding. Based on an average weekly benefit 
© 
amount and the average number of weeks of benefits, this represents $7 billion in 
average fraudulent payment prevented to date, which does not take into 
account PEUC or Fed-Ed extensions or the Lost Wages Assistance program ($17.4 
billion - $10.4 billion)). 
In the face of such a drastic increase in claims and unprecedented fraud, EDD 
undeniably struggled to timely distribute benefits to the millions of newly 
unemployed Californians and simultaneously prevent fraudulent claims. 
This year, EDD took additional steps to detect and prevent fraud including: 
CD 
• Stopping 1.6 million fraudulent claims before being paid; identified through 
EDD's manual identity verification process. 
• 
Stopping the automatic backdating of PUA claims in September 2020 - an 
action the Trump Administration later advised all states to take. 
• 
Worked with the California Cybersecurity Integration Center to 
adopt 
additional cybersecurity protocols. 
• 
Deploying a Strike Team to look at recommendations and solutions to 
transform the customer experience of applying for and receiving UI benefits 
with a focus on addressing the backlog of claims. 
o One of the top recommendations of the Strike Team, launched ID.me 
a third-party identify verification program that helps stop 30% identity 
fraud at the beginning of the process and helps process claims more 
quickly compared to the previous manual verification process. 
CD 
• Working with a contractor, initiated additional fraud detection criteria to 
weed out fraudulent claims which have flagged 1.4 million claimants as 
high risk for fraud. 
• 
Creating a new task force led by the Governor's Office of Emergency 
Services (Cal OES) that includes the State's District Attorney's, the US 
Attorney's Office, the Employment Development Department, the 
California Department of Corrections and Rehabilitation (CDCR), the 
California Department of Justice focused on investigating fraud, holding 
people accountable and identifying resource needs including: 
CONFIDENTIAL 
BANA_EDD_MDL-00080343 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39932 
Page 51 of 60

CONFIDENTIAL 
Ms. Howle 
January 11, 2021 
Page 3 
(J\l_!F0!1NIA STATE AUD!TO!1 
Report2020-618.2 
.lam.iary 2021 
145 
o 
Data sharing agreements between EDD and the Departments of 
© 
Corrections and Rehabilitation and State Hospitals. 
o 
$5 million to support and enhance investigative efforts of the regional 
District Attorney task forces. 
o Collaborating with the California Cybersecurity Integration Center to 
leverage the State cyber security threat intelligence, big data 
analysis and threat assessment capabilities to support investigative 
efforts. 
• 
Coordinating with other states through the National Association of State 
Workforce Agencies (NASWA) for a unified voice in Washington DC and 
contracting with NASWA's UI Integrity Center to identity, detect and 
prevent fraud. 
EDD will use all seven fraud related recommendations provided by the State 
Auditor to continue making improvements and strengthening protection of our 
unemployment 
system. 
We 
look 
forward 
to 
implementing 
these 
recommendations, providing updates as requested, and our continued 
collaboration. 
Sincerely, 
Rita Saenz 
Director 
BANA_EDD_MDL-00080344 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39933 
Page 52 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
Public Release Date: January 28, 2021 
CSA Audit: EDD Significant Weaknesses in EDD's Approach to Fraud Prevention Has led 
to Billions of Dollars in Improper Benefit Payment 
CSA (JLAC) Recommendations - Fraud Report 2 
Recommendation #1 
To ensure its recession planning encompasses its fraud prevention efforts, EDD should 
develop an evaluation of the fraud prevention efforts that it can adjust during periods of 
high demand for UI benefits. It should ensure that it accounts for all probable 
consequences of the adjustments, and design procedures that appropriately balance 
the need to provide prompt payment during a recession and the need to guard against 
fraud in the UI program. 
EDD Response to Recommendation #1: 
The EDD agrees with this recommendation. 
During the COVID-19 pandemic, EDD has experienced unprecedented attacks on the 
unemployment programs- including from domestic and international crime rings. These 
(j) 
attacks primarily targeted the federal PUA program In response to the significant fraud, 
the EDD has initiated additional fraud prevention and detection efforts, such as the 
implementation of ID.me in October 2020 and cross matching CDCR and DSH inmate 
and patient records, as well as contracting with Thomson Reuters to review EDD data 
against industry-standards fraud measures in December 2020. EDD will continue to 
evaluate, monitor, and if needed implement new tools as fraud continues to evolve. It is 
the goal of the EDD to be proactive and nimble as necessary to stop fraud before claims 
are paid while also continuing to investigate fraud that has occurred. EDD is also 
committed to applying lessons learned during the pandemic to the future. 
Recommendation #2 
To prepare to respond to victims of identity theft who receive incorrect tax forms, EDD 
should, by mid-February 2021, provide information on its website and set up a separate 
email box for such individuals to contact EDD and receive prompt resolution. 
CONFIDENTIAL 
BANA_EDD_MDL-00080345 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39934 
Page 53 of 60

CONFIDENTIAL 
EDD Response to Recommendation #2: 
(J\l_!F0!1NIA STATE AUD!TO!1 i Report2020-618.2 
.lam.iary 2021 
The EDD agrees with this recommendation and is confident that we will meet the 
proposed mid-February 2021 date. In preparation for calls related to the tax form that 
claimants receive (Form 1099G) and mailings related to potential fraud, the department 
is updating the EDD website and enabling the ability for customers to submit a question 
online through the public-facing Ask EDD portal and on their UI Online account. The 
EDD will also temporarily increase staffing in the Integrity and Accounting Division (IAD) 
contact center by 300 agents by February 1, 2021. 
In addition, all UI Contact Center agents will receive training regarding 1099G calls. Any 
reports of fraud will be identified and analyzed through the Identity Verification process, 
ID.me and Thomson Reuters tools, or elevated to the Investigations Division. Claims 
with reported identity theft that are identified and confirmed as imposters will have re-
computations completed and an amended 1099G will be provided. Additional hiring is in 
place to build resources in the Identity Verification and Re-computation areas to meet 
the increase in workload. 
Additionally, the EDD is committed to ensuring victims of identity theft in our benefit 
programs are provided information and resources to assist them in reporting fraud and 
dealing with the aftermath of identity theft. Customers who wish to report fraud visit our 
EDD public website at https://edd.ca.gov/ and select "Report Fraud" under our Ask EDD 
link. 
The EDD is committed to reviewing our online services to improve the customer 
experience, especially during the unprecedented outbreak of fraud associated with the 
federal Pandemic Unemployment Assistance program. 
Recommendation #3 
To ensure that it provides appropriate assistance to victims of identity theft who report 
fraud through its online fraud reporting portal, EDD should, by March 2021, establish a 
working group to coordinate the work needed to resolve each complaint of identity theft 
and make decisions about staffing levels necessary and add staffing to accomplish the 
work. 
EDD Response to Recommendation #3: 
EDD agrees with this recommendation. An enterprise Fraud Workgroup has been 
formed with representation of all benefit program areas of the EDD. The purpose of this 
workgroup is to document and evaluate current fraud prevention processes and fraud 
policies, including how individuals can report and resolve identity theft related to a 
147 
BANA_EDD_MDL-00080346 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39935 
Page 54 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
benefit program. As part of the Fraud Workgroup, a subcommittee will be established to 
evaluate the resources and expertise needed to resolve complaints of identity theft and 
make recommendations to accomplish the work. 
Recommendation #4 
To ensure that it provides legitimate claimants with benefits but does not pay benefits 
related to fraudulent claims, EDD should immediately obtain from Bank of America a 
comprehensive list of claimants' accounts that are frozen and unfrozen. EDD should 
immediately thereafter evaluate the list-including considering using ID.me to verify 
claimants' identities-to identify accounts that should be unfrozen or frozen. By March 
2021, it should direct Bank of America to take action to freeze or unfreeze accounts as 
appropriate. 
EDD Response to Recommendation #4: 
The EDD agrees with this recommendation. The EDD remains committed to ensuring 
that legitimate UI claimants timely receive the benefits for which they are eligible. 
EDD has been working with Bank of America to determine appropriate actions on lists 
of frozen accounts received from Bank of America. As the vendor for the prepaid debit 
cards, Bank of America has its own obligations to prevent fraud. Bank of America has 
access to cardholders' transactional history data, which is an additional fraud detection 
tool. Because EDD and Bank of America have different tools and information for 
identifying fraud, we have engaged in many conversations to understand how to 
leverage each set of tools to enhance our collective fraud detection efforts. These 
communications continue. 
EDD is in the process of reconciling all of the lists it has received from Bank of America 
® 
to date. A centralized tracking tool has also been created to track action taken on each 
of the frozen cards and the status of the account. To ensure accountability and 
completion in review of these lists, procedures have been documented with specific 
roles and responsibilities and completion timeframes. EDD is also in the process of 
contacting claimants whose accounts were flagged for identity verification through a 
separate data cross-match, to verify their identity through ID.me for any claim filed prior 
to October 1, 2020, including those who may have a frozen debit card. 
Recommendation #5 
To ensure it reviews each claim that Bank of America reports to it as suspicious or 
potentially fraudulent, by February 2021, EDD should establish a centralized tracking 
tool that allows it to review and stop payment to claims, as appropriate. EDD should use 
CONFIDENTIAL 
BANA_EDD _MDL-0008034 7 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39936 
Page 55 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!TO!1 i Report2020-618.2 
.lam.iary 2021 
this tool to monitor its own internal decisions and track whether the claimant responds to 
its requests for identity information and should, therefore, have their account unfrozen. 
EDD Response to Recommendation #5: 
149 
EDD agrees with this recommendation and in December 2020, the Information 
® 
Technology Branch created a central repository to store, track and maintain the lists 
provided to and from the Bank of America. These lists and their status will be updated 
regularly to enable EDD to track the appropriate action taken on each account and the 
outcome of each claim. To ensure accountability and completion in review of these lists, 
procedures have been documented with specific roles and responsibilities and 
completion timeframes. 
Recommendation #6 
By March 2021, designate a unit as responsible for ensuring coordination of all UI fraud 
prevention. EDD should assign that unit sufficient authority to carry out its 
responsibilities and align the unit's duties with the GAO's framework for fraud 
prevention. 
EDD Response to Recommendation #6: 
The EDD agrees with the recommendation in principle and will explore how best to 
® 
address this recommendation through the Fraud Workgroup. Part of the Fraud 
Workgroup's charge will be to identify opportunities and provide recommendations to 
centralize fraud prevention efforts, where appropriate, including the creation of a unit 
whose duties are aligned with the U.S. Government Accountability Office's framework 
for fraud prevention. 
Recommendation #7 
By May 2021, develop a plan for how it will assess the effectiveness of its fraud 
prevention tools. 
EDD Response to Recommendation #7: 
The EDD agrees with this recommendation. Despite challenges, the EDD was able to 
prevent a significant amount of fraudulent benefits from being paid in 2020. During the 
CD 
year EDD successfully identified 1.6 million claims as potentially fraudulent and stopped © 
them prior to payment which represents an estimated $7 billion in fraudulent payments 
prevented (using an average of 16.1 weeks and an average benefit amount of $282.39, 
plus $600 in Federal Pandemic Unemployment Compensation for a third of the weeks, 
minus the $10.4 billion paid out). Additionally, based on an independent review of all 
BANA_EDD_MDL-00080348 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39937 
Page 56 of 60

so I 
CD 
0 
Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
Jam.1,wy2021 
9.7 million unique claims in December 2020, EDD put a stop payment on 1.4 million 
claims that were flagged for high probability of fraud. 
Throughout this pandemic EDD has taken additional steps to detect and prevent fraud 
using a layered approach including: 
• 
Launching ID.me - a third party identity verification tool that helps stop fraud at 
the front door. 
• 
Contracting with a vendor to assess and apply industry standard fraud criteria to 
EDD claims. 
• 
Entering into MOUs with CDCR and DSH to share and crossmatch identifying 
information. 
These are new tools initiated in response to the unprecedented fraud seen over the 
course of the pandemic. EDD is currently evaluating the inventory of these, and other, 
tools and organizational resources to align our efforts in improving reporting metrics 
through benchmarking and continual analysis, including historical analysis and trending 
reports that can provide quantitative analysis of the effectiveness of our fraud 
prevention tools. Our goal is by May 2021, to have developed a plan on how to assess 
the effectiveness of our fraud prevention tools. 
CONFIDENTIAL 
BANA_EDD_MDL-00080349 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39938 
Page 57 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
I 51 
COMMENTS 
CALIFORNIA STATE AUDITOR'S COMMENTS ON THE 
RESPONSE FROM EDD 
To provide clarity and perspective, we are commenting on EDD's 
response to the audit. The numbers below correspond to the 
numbers we have placed in the margin of its response. 
EDD does not acknowledge earlier warnings about potential fraud 
and its own failure to respond quickly to those warnings. We note 
on page 9 how the Department of Labor warned states about fraud 
in the early months of the pandemic and reminded states to take 
reasonable and customary precautions to deter and detect fraud. 
On the same page we also note that in May 2020, the Department 
of Labor's Office of the Inspector General warned EDD that-based 
on fraud trends in the UI program-California was likely to see at 
least $1.2 billion in potential fraud from 2.9 million new claims that 
EDD had received in March and April 2020. Further, on page 26 we 
describe how in July 2020 Bank of America shared with EDD a list 
of almost 66,ooo potentially fraudulent accounts. However, because 
EDD did not take prompt action to enhance its safeguards against 
fraudulent benefit payments, it paid about $10,4 billion for claims 
from March through December 2020 that it has since determined 
could be fraudulent. 
To clarify, we requested that EDD analyze its data to determine very 
specific information about the total paid to potentially fraudulent 
claims. EDD did not attempt to determine this amount until we 
asked about it. Absent our request, it is not clear whether EDD 
would have identified this amount. EDD did not provide us with 
support for its claim that 92 percent of the $10,4 billion was for 
PUA claims, and therefore we do not opine on that figure. 
This action is indicative of ED D's slow approach to bolstering its fraud 
detection efforts during the pandemic. EDD states that it has placed 
new safeguards in place that have flagged an additional $19.5 billion 
in claim payments going to over 1 million claimants as suspicious 
and clarifies later in its response that it identified these claimants 
by working with a contractor. However, EDD did not take action to 
identify these claims as potentially fraudulent or stop payment to them 
until December 2020-almost eight months into the pandemic and 
four months after EDD asserts it observed an increase in fraudulent 
PUA claims. That EDD identified so many claimants as potentially 
fraudulent only after paying them $19.5 billion in benefits is troubling 
and a sign that ED D's fraud prevention approach was lacking the rigor 
it needed at the start of the pandemic. 
.lam.iary 2021 
CD 
BANA_EDD_MDL-00080350 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39939 
Page 58 of 60

Report 2020-628.2 I CAL!FOflNIA STATE AUD!TOfl 
January 2021 
CONFIDENTIAL 
On the day ED D's response to our draft report was due, it shared its 
estimate that it had prevented an estimated $7 billion in potential 
fraud. After reviewing EDD's estimate, we determined that the 
method we used to develop a $12.8 biIIion estimate was preferable 
because it aIIowed for a direct comparison to the amount EDD 
paid to potentia!Iy fraudulent claims. \Ve shared our estimate with 
EDD after it submitted its response and it agreed that it should 
be reflected in the report. Further, we explain on page 17 that we 
expect the $10-4 billion that EDD has paid to potentially fraudulent 
claims to continue to grow as EDD performs additional work to 
verify questionable claimant identities. As we note on page 15, 
analysis of the effectiveness of ED D's fraud prevention approach 
should compare the amount paid to potentially fraudulent claims 
to the amount of improper payments prevented. Accordingly, 
EDD cannot know at the time whether it stopped more potentially 
fraudulent payments than it issued because it is still accounting for 
all potential fraud. 
Although EDD identified 1.6 million potentially fraudulent claims 
before paying those claimants, its fraud prevention efforts failed 
to stop payments totaling $10-4 billion to about 597,000 claims, 
as we explain on page 15. Further, we state on page 17, and as EDD 
acknowledges in its response, EDD has flagged an additional 
1.2 million claimants to whom it has already paid $19.5 billion in 
benefits as suspicious. It is unlikely that EDD will vedfy the identity 
of all of these claimants. 'Therefore, although the 1.6 million claims 
represent some level of success, it cannot yet be compared to the 
rate at which EDD failed to prevent fraud because it is still verifying 
the identities of some claimants it has already paid, leaving open 
the possibility that the number of claimants with unconfirmed 
identities to whom EDD paid benefits will grow. 
EDD cites its partnership with CDCR as a positive step it took to 
combat fraud during the pandemic. However, it is troubling that 
EDD failed to implement a cross-match between claim data and 
incarceration data well before the pandemic began. \Ve describe on 
page 29 how EDD spent months during the pandemic negotiating 
access to CDCR's state prison data. However, we note a national 
survey showed that 35 states were cross-matching unemployment 
claims with state prison data in as early as 2016. Further, EDD has 
reported to the Legislature that it was "considedng" new options 
for obtaining incarceration data since at least 2018. Fina!Iy, as we 
state on page 30, the CDCR partnership is dependent on the State 
Attorney General determining that EDD has a compelling need for 
the information. Because of ED D's fraud prevention deficiencies 
that we discuss in this report and because EDD must rely on other 
entities such as CDCR to provide inmate data, legislative action 
is necessary to ensure that EDD can regularly access and use data 
from state and local correctional facilities to prevent future fraud. 
BANA_EDD_MDL-00080351 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39940 
Page 59 of 60

CONFIDENTIAL 
(J\l_!F0!1NIA STATE AUD!T0!1 
Report2020-618.2 
153 
Had EDD taken action before the pandemic, as many other states 
had done, this critical safeguard would have already been in place 
and would have prevented some of the $810 million in fraudulent 
payments in claims associated with incarcerated individuals. 
EDD describes the actions it took to combat the "unprecedented 
attacks" on the UI program. However, EDD began taking the 
actions it describes in October 2020, more than six months into the 
pandemic, despite earlier warnings about this fraud. Further, these 
steps-though laudable-evidence how unprepared EDD was to 
combat fraud at the outset of the pandemic as each of these steps 
would have reasonably benefited EDD in the years before 2020 
and better prepared it to respond to the pandemic-related surge 
in claims. 
EDD describes actions it is in the process of implementing. \Ve 
expected that, before our audit began, EDD would have a method 
for comprehensively tracking the status of benefit accounts that 
have been frozen. However, as we note on page 26, during our 
review EDD did not appear to know the status of all of the claimant 
accounts that have been frozen and confirmed that it did not have 
a centralized tracking process for the status of these accounts. EDD 
now asserts that it has established a centralized way to track these 
matters. We look forward to reviewing its progress as part of our 
regular recommendation follow up process. 
EDD indicates that it will use its recently formed work group to 
explore how to implement our recommendation. EDD should act 
quickly to address the problems we highlight in Figure 8 on page 35 
where we show the fragmented responsibility for fraud prevention 
at EDD. Because EDD's approach does not align with best practices 
for fraud prevention, we recommended that it centralize fraud 
prevention responsibility and authority in a single entity. Moreover, 
as we note on page 36, the working group had not yet held its 
initial meeting or fully formed a charter to define its purpose as 
of December 30, 2020. Therefore, its progress in exploring our 
recommendation to date has been minimal. We look forward to 
seeing the progress EDD makes in addressing our recommendation 
as part of our regular recommendation follow up process. 
.lam.iary 2021 
0 
® 
BANA_EDD_MDL-00080352 
Case 3:21-md-02992-GPC-MSB     Document 590-4     Filed 10/17/25     PageID.39941 
Page 60 of 60

File and source

File

gov.uscourts.casd.709615.590.4.pdf

Size

2,668,021 bytes

SHA-256

0d5fdb7dc0938e10bc72b3365851d389b04e3034a735a531afbe462ccd3c240e

Our copy

gov.uscourts.casd.709615.590.4.pdf

Original

PACER (login required)