Court filing
Exhibit SBA OIG Report June 2023 — USA v. Thomas et al. (Dkt. 987-2, N.D. Ga.)
Filed May 3, 2024 in USA v. Thomas et al.; one of 81 filings from this case.
Record facts
| Court | U.S. District Court for the Northern District of Georgia |
|---|---|
| Filed | 2024-05-03 |
U.S. District Court for the Northern District of Georgia · No. 1:20-cr-00296-JPB-CMS · Doc. 987-2 · 2024-05-03 · Docket on CourtListener
Full text
EXHIBIT “B” Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 1 of 44 U.S. SMALL BUSINESS ADMINISTRATION OFFICE OF INSPECTOR GENERAL COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape White Paper Report 23-09 June 27, 2023 Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 2 of 44 U.S. Small Business Administration Office of Inspector General EXECUTIVE SUMMARY White Paper: COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape What OIG Reviewed We conducted this review to provide a comprehensive estimate of the potential fraud in the U.S. Small Business Administration’s (SBA) pandemic assistance loan programs. Over the course of the Coronavirus Disease 2019 (COVID-19) pandemic, SBA disbursed approximately $1.2 trillion of COVID-19 Economic Injury Disaster Loan (EIDL) and Paycheck Protection Program (PPP) funds. The economic assistance was intended to help eligible small business owners and entrepreneurs adversely affected by the crisis. Office of Inspector General (OIG) reports issued very early on warned of the importance of a strong internal control environment to mitigate fraud risk. In the rush to swiftly disburse COVID-19 EIDL and PPP funds, SBA calibrated its internal controls. The agency weakened or removed the controls necessary to prevent fraudsters from easily gaining access to these programs and provide assurance that only eligible entities received funds. However, the allure of “easy money” in this pay and chase environment attracted an overwhelming number of fraudsters to the programs. OIG’s continuing reviews pertaining to oversight of SBA’s pandemic response have identified multiple weaknesses in controls that allowed fraudsters to take advantage of the economic crisis and divert funding intended for deserving, eligible American small business owners. Based on our previous reviews, we made recommendations to strengthen internal controls and to mitigate the impact of the pay and chase environment that was created at the onset of the pandemic. As a result, SBA has made progress to reduce fraud risks and prevent further losses in these programs. What OIG Found We estimate that SBA disbursed over $200 billion in potentially fraudulent COVID-19 EIDLs, EIDL Targeted Advances, Supplemental Targeted Advances, and PPP loans. This means at least 17 percent of all COVID-19 EIDL and PPP funds were disbursed to potentially fraudulent actors. Using investigative casework, prior OIG reporting, and advanced data analytics, we identified multiple schemes used by fraudsters to steal from the American taxpayer and exploit programs meant to help those in need. We believe loans identified as potentially fraudulent as part of our review warrant investigation by OIG and its investigative partners. OIG’s oversight and investigative work has resulted in 1,011 indictments, 803 arrests, and 529 convictions related to COVID-19 EIDL and PPP fraud as of May 2023. OIG collaboration with SBA, the U.S. Secret Service, other federal agencies, and financial institutions has resulted in nearly $30 billion in COVID-19 EIDL and PPP funds being seized or returned to SBA. OIG is working on tens of thousands of investigative leads on alleged fraud, waste, and abuse of taxpayer resources. Thousands of investigations will ensue for years to come because of swift congressional action to increase the statute of limitations to 10 years for COVID-19 EIDL and PPP fraud. We continue to identify fraud schemes, and we anticipate the overall potential fraud estimate could fluctuate; therefore, we may issue periodic updates to this report. Agency Response SBA provided formal comments that are included in their entirety in Appendix 2, and we have provided a formal response to those comments. We look forward to continuing to partner with SBA to combat fraud within these programs. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 3 of 44 OFFICE OF INSPECTOR GENERAL U.S. SMALL BUSINESS ADMINISTRATION MEMORANDUM 409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382 Date: June 27, 2023 To: Isabella Casillas Guzman Administrator From: Hannibal “Mike” Ware Inspector General Subject: White paper on COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Report 23-09) This white paper represents the results of our investigative casework, prior reporting, advanced data analytics, and additional review procedures to estimate the potential fraud in the COVID-19 Economic Injury Disaster Loan Program and the Paycheck Protection Program. We considered management comments on the draft of this white paper when preparing the final product. We appreciate the cooperation and courtesies provided by your staff. If you have any questions, please contact Andrea Deadwyler, Assistant Inspector General for Audits, at (202) 205-6586. cc: Arthur Plews, Chief of Staff Peggy Delinois Hamilton, Esq., Special Counsel for Enterprise Risk Bailey DeVries, Associate Administrator, Office of Investment and Innovation, and Acting Associate Administrator, Office of Capital Access Therese Meers, General Counsel, Office of General Counsel John Miller, Deputy Associate Administrator, Office of Capital Access Michael Simmons, Attorney Advisor, Office of General Counsel Katherine Aaby, Associate Administrator, Office of Performance, Planning, and Chief Financial Officer Tonia Butler, Director, Office of Internal Controls Cynthia Pitts, Acting Director, Office of Continuous Operations & Risk Management Melissa Atwood, Acting Deputy Chief Financial Officer, Office of Performance, Planning, and Chief Financial Officer Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 4 of 44 i Contents Introduction .................................................................................................................................... 1 OIG’s Multipronged Response to SBA’s Role in Providing Pandemic Relief Funds ................ 2 OIG Reviews Identified Significant Internal Control Weaknesses in SBA’s Pandemic Loan Programs ............................................................................................ 2 SBA OIG’s Investigative Work on Fraud in SBA’s Pandemic Relief Loan Programs .......... 6 OIG Identified Over $200 Billion in Widespread Potential COVID-19 EIDL and PPP Fraud.............. 8 Fraud Indicator 1: Hold Codes ............................................................................................. 12 Fraud Indicator 2: Internet Protocol Addresses .................................................................. 12 Case Example: Romance Scam ...................................................................................... 13 Fraud Indicator 3: Employer Identification Numbers .......................................................... 13 Case Example: Web of Deceit ........................................................................................ 15 Fraud Indicator 4: Bank Accounts ........................................................................................ 16 Case Example: Hidden in the Crowd ............................................................................. 16 Fraud Indicator 5: Defaulted/No Loan Forgiveness ............................................................. 17 Case Example: Skipping Out on the Taxpayer ............................................................... 17 Fraud Indicator 6: Hotline Complaints ................................................................................ 18 Case Example: Kickback Scheme ................................................................................... 18 Fraud Indicator 7: Sole Proprietors/Independent Contractors Without Employer Identification Numbers................................................................................................ 20 Case Example: Brothers in Crime .................................................................................. 20 Fraud Indicators 8 and 9: Suspicious Phone Numbers and Physical Addresses .................. 20 Case Example: A National Kickback Scheme ................................................................. 21 Fraud Indicator 10: COVID-19 EIDL Advances ..................................................................... 21 Case Example: The Perfect Storm for Fraud .................................................................. 21 Fraud Indicator 11: Suspicious Email Addresses ................................................................. 22 Case Example: A School for Fraudsters ......................................................................... 22 Conclusion ..................................................................................................................................... 23 Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 5 of 44 ii Evaluation of Agency Response ..................................................................................................... 24 SBA’s Fraud Control Improvements .................................................................................... 25 COVID-19 EIDL Repayment Data ......................................................................................... 26 Classification of Potential Fraud Versus Likely Fraud .......................................................... 27 Figures 1 Potential fraud in SBA’s pandemic loan programs ........................................................ 9 2 Fraud indicators........................................................................................................... 10 3 Summary of potentially fraudulent COVID-19 EIDLs by fraud indicator ...................... 11 4 Summary of potentially fraudulent PPP loans by fraud indicator ............................... 11 5 Fraud indicators tied to romance scam case example ................................................ 13 6 Web of pandemic assistance fraud and suspected fraud originating from one PPP case ........................................................................................................... 15 7 OIG Hotline complaint categorization ......................................................................... 18 8 Extensive network of PPP fraud uncovered using comprehensive investigative strategies ................................................................................................................. 19 Appendices 1 Scope and Methodology 2 Agency Response Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 6 of 44 1 Introduction In the wake of the Coronavirus Disease 2019 (COVID-19) pandemic, swift and decisive action was needed to avert an economic crisis caused by lockdowns, business closures, and other economic impediments. In March 2020, Congress passed, and the President signed into law, the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). This stimulus package was intended to provide emergency assistance to individuals and businesses affected by the pandemic. In April 2020, the U.S. Small Business Administration (SBA) implemented the Paycheck Protection Program (PPP), which provided fully guaranteed loans that are forgivable under certain circumstances to small businesses, individuals, and nonprofit organizations affected by COVID-19. This program provided small businesses with the resources they needed to cover payroll costs, including benefits; rent, utilities, and interest on mortgages. As part of the federal government’s ongoing response to the pandemic, SBA also offered a special COVID-19 Economic Injury Disaster Loan (EIDL) program and EIDL grant program to help small businesses and other entities. The agency was given the authority to make low- interest, fixed-rate, long-term COVID-19 EIDL loans to overcome the effects of the pandemic by providing borrowers with working capital to meet ordinary and necessary operating expenses. Congress authorized SBA to administer an unprecedented amount of funds through the COVID-19 EIDL program1 and PPP. SBA disbursed over $400 billion in COVID-19 EIDL funds, and borrowers obtained nearly $800 billion in PPP funds through third-party lending partners. COVID-19 EIDL and PPP funds were intended to help eligible small business owners and entrepreneurs adversely affected by the COVID-19 economic crisis. 1 The COVID-19 EIDL program includes COVID-19 EIDLs, emergency EIDL grants (also referred to as “advances” by SBA), targeted EIDL advances, and supplemental targeted advances. In this report, we refer to these different disbursement types as COVID-19 EIDLs. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 7 of 44 2 OIG’s Multipronged Response to SBA’s Role in Providing Pandemic Relief Funds Executive and legislative actions at the onset of the pandemic were designed to quickly address the economic fallout, which allowed SBA to reduce or eliminate key internal controls and rely on self-certification of eligibility to expedite aid. In turn, the SBA Office of Inspector General (OIG) quickly pivoted to provide oversight of SBA’s pandemic response programs. To date, we have issued 22 reports related to identified weaknesses in SBA’s control environment. OIG recognized at the onset of the pandemic that SBA would face a delicate balancing act of preventing widespread fraud while ensuring timely disbursement of relief funds to Americans in immediate need of assistance. The biggest concern was SBA’s quick delivery of capital to qualifying small businesses without first establishing the internal controls necessary to decrease fraud risk, such as verifying that the business did indeed exist before the onset of the pandemic and that it had been adversely affected by the economic downturn. This was why we issued two reports prior to the first PPP loan being disbursed. Our reports stressed the importance of up-front program controls to mitigate the risk of fraud. Because of the lessons learned from other disasters, OIG knew the weaknesses we found in the past would be greatly magnified with programs as large as the COVID-19 EIDL program and PPP. OIG Reviews Identified Significant Internal Control Weaknesses in SBA’s Pandemic Loan Programs OIG's rationale for sounding the alarm early came from our experience in oversight of SBA's Disaster Assistance Program and other lending programs such as the 7(a). As pointed out in our white paper, Risk Awareness and Lessons Learned from Audits and Inspections of Economic Injury Disaster Loans and Other Disaster Lending, SBA's disaster loan programs suffer increased vulnerability to fraud and unnecessary losses when loan transactions are expedited to provide quick relief. We anticipated that the dramatic increase in loan volume and amounts caused by the pandemic would place additional stress on existing controls. Therefore, it was important to provide SBA with risk information from prior audits and inspections related to increased loan volumes and amounts processed in expedited timeframes. We concluded that to ensure program integrity and mitigate the risk of financial loss, SBA must ensure first that loans are provided to eligible applicants and that borrowers meet all eligibility requirements. The agency also needed experienced and well-trained personnel to provide appropriate assistance and handle the increased loan volumes and expedited processing timeframes. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 8 of 44 3 We published the white paper, Risk Awareness and Lessons Learned from Prior Audits of Economic Stimulus Loans on April 3, 2020. In this report, we acknowledged that SBA had improved its internal control environment for the 7(a) and other lending programs in recent years to reduce improper payments and implement quality assurance in its processes. However, recognizing the size and scope of the PPP, we proposed several key considerations for mitigating financial loss when expediting loans to eligible small businesses, including establishing proper controls in the loan approval phase to ensure eligibility of participants. SBA’s tremendous role in the nation’s pandemic response is without precedent. However, OIG’s white paper reports unfortunately foreshadowed SBA’s internal control challenges in delivering PPP and COVID-19 EIDL grants and loans. It is noteworthy that SBA executed over 14 years’ worth of lending within 14 days, and this was just the beginning. As pandemic assistance programs swelled to more than $1 trillion, the risk to the taxpayer increased because SBA’s internal control environment was calibrated to expedite loans and grants. OIG utilized agile work products that delivered alarming findings and suggested recommendations for corrective action in nearly real time. We published a flash report on PPP in May 2020, which was just over 1 month of the program’s inception, which resulted in legislative changes to the program. Additionally, we sounded the alarm internally of rampant fraud in the COVID-19 EIDL program in June 2020. OIG actively engaged SBA leadership throughout the duration of the pandemic to notify them of preliminary findings so they could respond in real time to prevent loss to the taxpayer. In July 2020, we publicly detailed serious concerns of potential fraud in the COVID-19 EIDL program pertaining to the response to COVID-192 that had already been raised internally to SBA officials. OIG had been inundated with contacts to investigative field offices and its complaint Hotline. OIG received complaints of more than 5,000 instances of suspected fraud from financial institutions receiving COVID-19 EIDL deposits. OIG suggested swift management action to engage financial institutions immediately to identify disbursements that may have been obtained fraudulently, recover disbursed funds, and prevent additional taxpayer losses. OIG also sought to raise awareness of potential fraud by publishing a list of fraud schemes and scams to alert the public and SBA stakeholders. This information was made available on OIG’s 2 SBA OIG, 20-16, Serious Concerns of Potential Fraud in the Economic Injury Disaster Loan Program Pertaining to the Response to COVID-19 (July 28, 2020). Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 9 of 44 4 website and distributed broadly through established communication channels, including social media. OIG also sought assistance from organizations involved with SBA lending to distribute the information and raise awareness. Over the course of SBA’s pandemic response, OIG offered key recommendations to strengthen internal controls to prevent fraud in the COVID-19 EIDL program and PPP, such as: • implementing a process to ensure PPP lenders validate that (1) the loan amount does not exceed the maximum amount per employee, (2) the business was established before the mandated date, and (3) the loan amount does not exceed the maximum number of employees or other applicable standards; • working with the U.S. Department of the Treasury (Treasury) to develop a technical solution to enable the use of Treasury’s Do Not Pay portal to determine PPP loan applicant eligibility and prevent improper payments before the release of any federal funds; • updating the PPP borrower application to include a field for the North American Industry Classification System code for the business category and the business description to prevent potentially ineligible loan approvals; • revising the PPP application to include the demographic information of borrowers; • establishing or strengthening controls to ensure loan deposits are made to legitimate bank accounts for eligible borrowers only, preventing the change of loan application information post-approval without having that information reviewed again by a person; • strengthening or establishing controls to ensure multiple loans are provided only to eligible COVID-19 EIDL applicants and prevent the erroneous duplication of loans. At a minimum: obtain a photo ID of the applicant to verify their identity; verify the applicant is not on Treasury’s Do Not Pay List for delinquent child support and has not been suspended or debarred; verify the applicant is a legitimate business through tax returns, incorporation, not-for-profit records with Secretary of State offices, or another method; institute a “Rule of Two,” requiring two people to approve each loan application and eliminate the batch approval process; Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 10 of 44 5 require human contact with applicants who submit multiple applications from the same Internet Protocol (IP) addresses, email addresses, physical addresses, or bank account numbers to verify these applicants are legitimate; and ensure the system promptly identifies all risk factors (fraud, duplicate applications, and information flags) and require full mitigation of those issues before approval. • strengthening controls for verifying an entity’s start date to ensure applicants meet eligibility requirements. At a minimum: prevent illegitimate duplicate applications for applications with the same Employer Identification Number (EIN) or Social Security number (SSN); establish a system to freeze applications with the same EINs, SSNs, IP addresses, email addresses, physical addresses, or bank account numbers used by fraudsters to prevent additional fraudulent applications from being submitted; and ensure EINs were registered before the eligibility date. SBA has been responsive to OIG recommendations for corrective action. SBA has continually made progress to reduce fraud risks and prevent further losses in its pandemic loan programs, and our office’s ongoing work continues to make further recommendations for corrective action. Although we are confident that SBA’s implementation of our recommendations stemmed the tide of fraud, many of the improvements were made after much of the damage had already been done due to the lax internal control environment created at the onset of these programs. SBA’s corrective actions included: • requiring tax transcripts for COVID-19 EIDL borrowers; • flagging certain EIN prefixes; • requiring loan officer reviews for changed bank accounts prior to disbursement; • establishing a Fraud Risk Management Board in 2022; • developing a webpage dedicated to preventing fraud and identity theft, which includes a section entitled “Lenders and Fraud Response”; • developing aggregate review processes to identify different fraud scenarios; • developing and implementing a Master Review Plan that established guidelines for loan and forgiveness reviews; • increasing antifraud controls for loans originating in 2021, including checking application data against Treasury’s Do Not Pay database; Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 11 of 44 6 • developing and implementing SBA and contractor fraud risk management policy and framework; • increasing post-disbursement antifraud controls for loans that originated in 2020; • commencing manual loan and forgiveness reviews; • engaging a contractor with expertise in detection and identification of potential fraud; • using a contractor’s automated review tool and the SBA Paycheck Protection Platform to analyze loans for fraud and eligibility; • implementing machine learning functionality to focus on areas of higher risk; • providing outreach and training; and • implementing processes to refer potential fraud to SBA OIG. Notwithstanding SBA’s efforts, certain lenders added to the fraud risks by prioritizing quickness and potential profit over a thorough review of applicant eligibility for government aid. For example, we found one lender escalated its loan processing volume from 200 loans per year to almost 500,000 loans per year during the pandemic — without a substantial increase in staff or security measures. The desire for increased profits not only overshadowed their fiduciary duty, but it also resulted in a higher amount of associated fraud in the lender’s portfolio, harmed taxpayers, and compromised the economic aim of the PPP. We will continue to monitor and assess the effectiveness of agency-implemented controls through our ongoing and planned reviews for suspected fraud and suspicious activities. SBA OIG’s Investigative Work on Fraud in SBA’s Pandemic Relief Loan Programs SBA programs were not typically targeted by organized criminal syndicates or transnational gangs before the pandemic; however, these groups have been identified as wrongdoers in these pandemic relief programs. Our reviews and investigations have become more intricate, involving criminals spanning the globe, because fraudsters so egregiously exploited SBA’s weakened controls and lax lending practices by some lenders. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 12 of 44 7 The complexity of fraud schemes has made it more challenging to identify the perpetrators behind fraudulent loan applications and has necessitated not only extensive coordination and deconfliction among multiple agencies but increased evidence gathering, interviews, analytical work, and national and international law enforcement collaboration. To combat evolving and expanding fraud cases, we created SBA-centric task forces to collaborate with the U.S. Department of Justice (DOJ) and other law enforcement authorities. Consequently, our investigators have successfully conducted several large-scale arrest sweeps related to fraudulently obtained COVID-19 relief funds, including the recent arrest of more than 40 co-conspirators in Puerto Rico and 20 gang members in South Carolina who otherwise would have remained at-large. We also participate on DOJ COVID-19 Fraud Strike Force Teams, operating out of U.S. Attorney’s Offices in the Southern District of Florida, the District of Maryland, and a joint effort between the Central and Eastern Districts of California. SBA OIG has investigated over 1,000 cases since March 2020. We have about 570 open investigations, and as of May 2023, our oversight and investigative work related to COVID-19 EIDLs and PPP loans has resulted in 1,011 indictments, 803 arrests, and 529 convictions. Of the more than 250,000 OIG Hotline complaints we have received since the start of the COVID-19 pandemic, our data analytics team has identified more than 90,000 actionable leads, which represent more than 100 years of investigative case work. These enforcement actions and joint investigative efforts have resulted in $399 million in seized or forfeited assets and $509 million in restitution orders. In addition, OIG collaboration with SBA, the U.S. Secret Service, other federal agencies, and financial institutions has resulted in nearly $30 billion in COVID-19 EIDL funds being seized or returned to SBA. We also are aware of approximately $168 million in additional PPP seizures and PPP funds that may have been returned. However, due to the informal, ad hoc nature of SBA’s tracking, the full Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 13 of 44 8 scope of PPP seized and returned funds is unknown. We recently issued a management advisory to inform the SBA Administrator of this matter and facilitate immediate action to resolve the issue.3 For our data analysis, we used big data and cloud computing to closely mirror investigative techniques of case development through a variety of rule-based analytical methods. These techniques allowed us to identify and prioritize potential fraud schemes perpetrated against SBA’s COVID-19 EIDL program and PPP. In addition, we implemented link analysis to identify potential fraud clusters through commonly shared attributes in the data. Link analysis is distinct from simply identifying loans with duplicative values, such as sharing the same IP address. In contrast, link analysis refines basic duplicates analysis by only capturing additional loans that are associated with a source loan suspected of fraud. This reduces potential false positives and allows us to focus on loan clusters highly suspected of being fraudulent. This review represents our ongoing effort to provide a comprehensive estimate of the potential fraud in SBA’s pandemic loan programs. We present current estimates; however, OIG continues to work on obtaining additional datasets through partnerships with other government agencies, such as the Pandemic Response Accountability Committee (PRAC) and the U.S. Government Accountability Office (GAO), as well as through subpoenas of certain lenders and their third-party processors. As we receive and analyze additional datasets, we may issue future reports. OIG Identified Over $200 Billion in Widespread Potential COVID-19 EIDL and PPP Fraud Using OIG’s investigative casework, prior OIG reporting, advanced data analytics, and additional review procedures, we estimate SBA disbursed more than $200 billion in potentially fraudulent COVID-19 EIDLs and PPP loans (see Figure 1). This estimate represents approximately 17 percent of disbursed COVID-19 EIDLs and PPP funds — specifically, more than $136 billion COVID-19 EIDLs and $64 billion in PPP funds. Since SBA did not have an established strong internal control environment for approving and disbursing program funds, there was an insufficient barrier against fraudsters accessing funds that should have been available for eligible business owners adversely affected by the pandemic. 3 SBA OIG, 23-08, Serious Concerns Regarding the Return of Paycheck Protection Program Funds (May 31, 2023). Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 14 of 44 9 Figure 1: Potential fraud in SBA’s pandemic loan programs Source: OIG analysis of COVID-19 EIDL and PPP data Based on the various fraud schemes identified in our ongoing and adjudicated criminal investigations, we expanded rule-based analytics through link analysis — an investigative technique that identifies fraud clusters through shared data attributes. We automated a process in which we linked one-third of all OIG Hotline complaints to associated loan data by extracting the unique identifiers of tax ID, loan number, and Dun and Bradstreet business identifier (DUNS) number from complaint narratives. We incorporated previously unavailable PPP borrower intake data using administrative subpoenas, which are utilized in furtherance of our investigative work. This data was from a small number of PPP lenders and third-party processors and may be expanded upon as we obtain additional data. We conducted an additional review using nonstatistical sampling methods and professional judgment, as necessary. We took prior experience into consideration, along with investigative casework and previous OIG reports, to increase confidence in the results of our data analysis. As a result, we identified 11 fraud indicators, or fraud groups, which are almost like a fingerprint left behind at a crime scene. Figure 2 provides a brief description of each fraud group. We anticipate these estimates could fluctuate with additional review, investigative, and data analytics work, in addition to potentially expanding our link analysis investigative technique to include additional data fields after receiving more lender and government agency data. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 15 of 44 10 Figure 2: Fraud indicators Source: OIG methodology and analysis of COVID-19 EIDL and PPP borrower loan data Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 16 of 44 11 Our estimate of potential fraud within the COVID-19 EIDL program totaling more than $136 billion represents 33 percent of total disbursed funds. Figure 3 shows the total disbursed dollar value estimate of each fraud indicator. Figure 3: Summary of potentially fraudulent COVID-19 EIDLs by fraud indicator4 Source: OIG analysis of COVID-19 EIDL data Our estimate of potential fraud within the PPP totaling $64 billion represents 8 percent of total disbursed funds. Figure 4 shows the total disbursed dollar value estimate of each fraud indicator. Figure 4: Summary of potentially fraudulent PPP loans by fraud indicator Source: OIG analysis of PPP data 4 The aggregate of each group total in Figures 3 and 4 differs from the total potential fraud estimate because duplicates across groups may exist, while duplicates are removed from the total potential fraud estimate. See Figure 2 for a detailed description of each fraud indicator. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 17 of 44 12 Based on investigative casework, prior OIG reporting, and the use of advanced data analytics, OIG identified multiple schemes, depicted in the fraud indicators, that perpetrators used to steal from the American taxpayer. The groups listed below all possess the indicators we considered in our fraud landscape estimates. Together, they illustrate the types of schemes SBA OIG and other oversight agencies continue to unravel and then prosecute. Fraud Indicator 1: Hold Codes SBA and third-party lenders identify issues with loans and then SBA applies hold codes. COVID-19 EIDLs or PPP loans were flagged because they had one or more potential indicators of fraud.5 We analyzed all COVID-19 EIDLs and PPP loans to identify disbursed loans and grants that have unresolved, or active, hold codes associated with them. The specific hold codes used in our analysis are tied to multiple instances of either confirmed or potential fraud. Fraud Indicator 2: Internet Protocol Addresses As stated in a prior SBA OIG report,6 we found SBA disbursed COVID-19 EIDLs to individuals who submitted applications from foreign IP addresses. These applications are an indication of potential fraud that may involve international criminal organizations. To be eligible for a COVID-19 EIDL, a business must have been located in the United States or its territories. We analyzed all COVID-19 EIDLs and a portion of PPP loans from a small number of lending participants and used a private vendor geolocation tool to identify IP addresses located outside the United States and its territories. This analysis resulted in a list of loans we deemed as potentially coming from ineligible individuals or business entities. Additionally, we matched the IP addresses of COVID-19 EIDLs and PPP loans having a higher likelihood of fraud with all other COVID-19 EIDL and PPP loans to identify loans that were suspicious because of their connection to loans having a higher likelihood of fraud made using the same IP address. See Appendix 1 for a detailed explanation of the link analysis investigative technique. The strategic use of investigative casework, OIG Hotline complaints, and data analytics reveals how a single fraudulent loan can reveal a complex criminal web. 5 SBA OIG, 22-13, SBA’s Handling of Potentially Fraudulent Paycheck Protection Program Loans (May 26, 2022). 6 SBA OIG, 22-17, COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP Addresses (September 12, 2022). Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 18 of 44 13 Case Example: Romance Scam This case involving a fraud scheme started with individuals seeking companionship online with unfamiliar persons. It then progressed to identity theft and ended with coercion and blackmail. The victims were manipulated by scammers, some using foreign IP addresses, into sharing personal identifying information and financial accounts. The scammers then allegedly used the information to apply for PPP loans, COVID-19 EIDLs, and state unemployment benefits. The total estimated potential fraud loss for this investigation, in all pandemic assistance programs, was $10 million, which includes more than 250 PPP loans totaling approximately $6 million and over a dozen funded COVID-19 EIDLs and grants, totaling over $700,000. The loan applications associated with this case were prevalent in several of the fraud indicators discussed in this report (see Figure 5). Figure 5: Fraud indicators tied to romance scam case example Source: OIG generated from analysis of investigative case data Fraud Indicator 3: Employer Identification Numbers We analyzed all disbursed COVID-19 EIDLs and PPP loans to determine if the application shared an EIN with another application. We consider these loans to be potentially fraudulent because businesses are not allowed to receive duplicate loan funds for the same purpose. For PPP, borrowers could receive a Second Draw PPP loan that was given a different loan number than the first. Therefore, we only considered duplicates within first or second draws independently. This was not an issue for COVID-19 EIDLs because the additional loan requests had the same Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 19 of 44 14 unique number as the initial loan. We also conducted a frequency count for records with an EIN. Any EIN used more than once was considered a duplicate record. We acknowledge that some businesses could have multiple entities associated with a single EIN; however, our investigative work and review of loans in this indicator detected more fraud than legitimate businesses. We also analyzed all disbursed COVID-19 EIDLs to identify applications with invalid EINs. EINs are considered valid if they begin with a prefix designated by the Internal Revenue Service (IRS) as valid and have nine digits. We analyzed COVID-19 EIDLs for any EIN that started with a prefix that was not on the IRS list of valid EIN prefixes and that did not have the correct number of digits. We analyzed all disbursed COVID-19 EIDLs and PPP loans to determine if the EIN was registered after the eligibility cutoff dates. Businesses were only eligible for COVID-19 EIDLs if they had been in operation on January 31, 2020. For the PPP they had to have been in operation on February 15, 2020.7 In prior SBA OIG reports,8 we found approved loan recipients had registered their businesses after the enactment of the CARES Act, which indicated that some of the businesses were created to fraudulently gain access to program funds. In SBA OIG Report 21-07 we noted multiple borrowers who registered their EINs after February 15, 2020. We also cited how some borrowers had already been arrested and others were under investigation. The IRS added EIN prefixes 85–88 for internet assignment well after the cutoff dates for both programs.9 For this analysis, we excluded all sole proprietorships and independent contractors because those businesses could have been in operation for some time before the cutoff date and been eligible for a loan even though the EIN was registered after the COVID-19 EIDL and PPP cutoff dates. We then extracted loans with an IRS prefix that started with 85–88 to get the final list of potentially fraudulent EINs that were registered after the required cutoff date. 7 Pub. L. 116-136, Sec.1102 (a)(2)(36)(F)(ii)(II)(aa) for PPP (March 27, 2020) and Pub. L. 116-136, Sec. 1110 (c)(2) for COVID-19 EIDL (March 27, 2020). 8 SBA OIG, 21-02, Small Business Administration’s Initial Disaster Assistance Response to the Coronavirus Pandemic, (October 28, 2020); SBA OIG, 21-07, Inspection of SBA’s Implementation of the Paycheck Protection Program (January 14, 2021). 9 IRS Prefix 85, Internal Revenue Manual 21.7.13.2.4, effective 10/1/2020; IRS Prefix 86, Internal Revenue Manual 21.7.13.2.4, Internal Revenue Manual Procedural Update (IPU) 21U0577, issued on 4/13/2021; IRS Prefix 87, Internal Revenue Manual 21.7.13.2.4 IPU 21U0781, issued on 5/27/2021; IRS Prefix 88, Internal Revenue Manual 21.7.13.2.4 IPU 22U0384, issued on 3/16/2022. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 20 of 44 15 Case Example: Web of Deceit In one example of criminal cases tied to the use of stolen or fabricated EINs, a group of individuals used multiple EINs, along with other tax and business information, to commit a massive fraud against the American people and the government programs meant to help them. The group of eight submitted at least 150 fraudulent loan applications and obtained over $18 million in PPP and COVID-19 EIDL funds. The group used taxpayer funds to buy luxury homes, gold coins, diamonds, jewelry, luxury watches, fine imported furnishings, designer handbags, clothing, and a luxury motorcycle. Figure 6 shows the extensive network of fraud that began with this one case involving 62 PPP loans that then expanded to include multiple cases involving 101 COVID-19 EIDLs. Figure 6: Web of pandemic assistance fraud and suspected fraud originating from one PPP case Source: OIG generated from data analytics information Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 21 of 44 16 Fraud Indicator 4: Bank Accounts As detailed in a prior SBA OIG report,10 COVID-19 EIDL borrowers who received multiple loans or grants using the same bank account and routing number combination indicates suspicious activity and a strong possibility of fraud. We analyzed all disbursed COVID-19 EIDLs to identify applications with bank account and routing numbers identified as sharing a bank account and routing number with another application or loan. Additionally, we found that an applicant could use a legitimate bank account number to get their application through the controls in the subcontractor’s system, which includes a verification of the bank account information. Then, having bypassed the controls, the applicant later changed the account number before the loan was funded, which greatly increased the risk of undetected fraud. We analyzed all disbursed COVID-19 EIDLs to identify applications that changed their deposit account from the one included on their application to a different bank account or debit card after loan approval. In another analysis, we matched the bank accounts of COVID-19 EIDLs and PPP loans having a higher likelihood of fraud with all other COVID-19 EIDLs and PPP loans to identify loans that were suspicious because of their connection to loans having a higher likelihood of fraud made using the same bank account. See Appendix 1 for a detailed explanation of the link analysis investigative technique. Case Example: Hidden in the Crowd During a time of crisis, savvy fraudsters will exploit and profit from programs overwhelmed by need. Often, these fraudsters apply for varying loan amounts so they don’t attract as much attention. It can be more challenging to catch the potential fraud in a crowd of legitimate claims. These cases often involve multiple pieces of accurate and verifiable information — and may include as little as one fraudulent piece of information. 10 SBA OIG, 21-02, Small Business Administration’s Initial Disaster Assistance Response to the Coronavirus Pandemic (October 28, 2020). Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 22 of 44 17 In one case, we prosecuted two individuals who submitted multiple applications with the same financial information, confusing the system for their own benefit. They also submitted false and fraudulent tax documents to qualify for the loans and lied about their criminal histories. SBA disbursed over $800,000 in COVID-19 EIDL and PPP funds to the fraudsters who then spent the money on a home and two vehicles. Fraud Indicator 5: Defaulted/No Loan Forgiveness In a prior SBA OIG report,11 we noted that borrowers who fraudulently obtained PPP loans are unlikely to apply for loan forgiveness because they had already obtained the funds and had no intention of repaying or using loan proceeds appropriately. We analyzed all PPP loans to identify cases in which applicants had not applied for loan forgiveness or made any required principal repayments as of May 2023, resulting in borrower default of the loan. Case Example: Skipping Out on the Taxpayer Once a fraudster managed to scam the system and secure a fraudulent PPP, they had no accountability. The total outstanding balance of the loan is guaranteed by SBA — backed by the full faith and credit of the U.S. government. They can take the money and run. One U.S. Army soldier did just that and ended up in federal prison for leading a prolific fraud scheme in which she and several co-conspirators raked in millions from COVID-19 relief programs and federal student loan forgiveness. She managed to scam the system 150 times over, securing $3 million for herself and those involved in the conspiracy. These fraudsters either did not seek forgiveness for some of these loans, or the lenders did not approve forgiveness and submit to SBA. Some of the loans have since defaulted. 11 SBA OIG, 22-09, SBA’s Paycheck Protection Program Loan Review Processes (February 28, 2022). Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 23 of 44 18 Fraud Indicator 6: Hotline Complaints We have received more than 250,000 SBA OIG Hotline complaints and allegations of wrongdoing since the start of the pandemic. From that unprecedented number, our data analytics team has identified more than 90,000 actionable leads — representing more than 100 years of investigative case work. We matched COVID-19 EIDL and PPP OIG Hotline complaints to loans, where possible, and categorized each complaint into one or more topics (see Figure 7). Specifically, we used text mining to extract data, such as loan numbers, application numbers, and tax ID numbers from the complaint narratives. We then used topic modeling to group the complaints into types based on the complaint narrative. Some topics, such as a business misusing funds or identity theft, had a higher probability of being fraudulent and are included in this report. Figure 7: OIG Hotline complaint categorization Source: OIG generated from data analytics information Case Example: Kickback Scheme Several of our cases demonstrate how OIG Hotline complaints play an integral part in complex investigations (see Figure 8). For example, one case totaling $500,000 of COVID-19 EIDL and PPP fraud involving three suspects led us to trace the movement of funds among several co-conspirators. This ultimately revealed a sprawling conspiracy involving over 1,300 non-existent businesses and up to $140 million in potential fraud. Our data analytics team indicates this one case could further reveal about $625 million in potential fraud. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 24 of 44 19 Figure 8: Extensive network of PPP fraud uncovered using comprehensive investigative strategies Source: OIG generated from PRAC analysis of OIG case information Our comprehensive approach to this one case enabled us to close over 800 OIG Hotline complaints associated with the investigation. The fraudulent COVID-19 EIDL and PPP applications often featured identical employee numbers and average monthly payroll figures. The suspects used identical payroll summaries as supporting documentation, template IRS documents, and a complex kickback scheme to defraud the American taxpayer. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 25 of 44 20 Fraud Indicator 7: Sole Proprietors/Independent Contractors Without Employer Identification Numbers In the early stages of the pandemic, applicants were limited by SBA to receiving $1,000 per employee up to a legislated maximum EIDL advance amount of $10,000. These EIDL advances were essentially grants that did not need to be repaid. Grantees had to self-certify the number of employees they had — this number was not vetted by SBA. As revealed in a prior SBA OIG report,12 some fraudsters applied for and obtained grants greater than $1,000 by claiming multiple employees without having an EIN. Business owners with employees are required to register with the IRS for an EIN. We analyzed all COVID-19 EIDL advances to identify applications associated with sole proprietors or independent contractors who claimed more than one employee while not possessing the required EIN. Case Example: Brothers in Crime Using fictitious aliases, stolen identities, defunct corporate entities, or new business entities with no actual business operations, two brothers claimed to be sole proprietors or independent contractors who claimed more than one employee while not possessing the required EIN and tried to obtain over $1 million in COVID-19 relief loans and unemployment benefits. As part of the scheme, the defendants admitted they created and used multiple fake identities to submit fraudulent COVID-19 EIDL and PPP loan applications and used the personal identifying information of more than 20 people. They fraudulently obtained COVID-19 EIDLs and PPP loans and unemployment insurance claims that were deposited into the bank accounts opened in the names of the aliases. Fraud Indicators 8 and 9: Suspicious Phone Numbers and Physical Addresses We matched the phone numbers and physical addresses of COVID-19 EIDLs having a higher likelihood of fraud with all other COVID-19 EIDLs to identify loans that were suspicious because of their connection to loans having a higher likelihood of fraud made using the same phone number or physical address. See Appendix 1 for a detailed explanation of our link analysis investigative technique. 12 SBA OIG, 22-01, SBA’s Emergency EIDL Grants to Sole Proprietors and Independent Contractors (October 7, 2021). Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 26 of 44 21 Case Example: A National Kickback Scheme Using suspicious business and identity information, two defendants pled guilty to perpetrating a vast nationwide scheme to help others submit fraudulent COVID-19 EIDL and PPP loan applications and supporting documents. In multiple instances, these applications included identical phone numbers or physical addresses that were identified as suspicious because of their connection to loans having a higher likelihood of fraud. The defendants’ actions resulted in the fraudulent disbursement of over $15 million in COVID-19 EIDL and PPP loans. They helped several co-conspirators subvert the government trust in exchange for 25 percent of the total loan proceeds. Following the disbursement of PPP loans, the defendant instructed the co-conspirators on how to make it appear that PPP loans were being paid out to employees when, instead, the money was transferred back to the co-conspirator. The fraudulent payroll records were then submitted to SBA to obtain 100 percent loan forgiveness. Four of the co-conspirators have also pled guilty. Fraud Indicator 10: COVID-19 EIDL Advances EIDL advances aided millions of legitimate entrepreneurs during the early stages of the pandemic, but our prior audit work has found that fraudsters also took advantage of this vital component of the COVID-19 EIDL program. SBA provided us with a listing of EIDL advances and grants suspected or confirmed to be associated with fraudulent activity. Those EIDL advances that SBA suspected or confirmed but were connected to a COVID-19 EIDL are included in this fraud group. Case Example: The Perfect Storm for Fraud Two scammers were convicted for utilizing an elaborate telemarketing scheme in applying for over 400 fraudulent COVID-19 EIDLs and obtaining over $1.5 million in EIDL advances for ineligible applicants. In exchange for a fee, the defendants took personal identifying information from victims and promised to file an application for an agricultural grant; instead, the defendants filed fraudulent COVID-19 EIDL applications with SBA. This case was initiated based on information from a financial institution provided in response to a joint fraud alert issued by SBA OIG and the U.S. Secret Service. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 27 of 44 22 Fraud Indicator 11: Suspicious Email Addresses Borrowers can modify email addresses using various schemes that display anomalies indicating potential fraud. We analyzed all COVID-19 EIDL and PPP loans to determine if borrower email addresses displayed any of these anomalies: • Moving dots within the username portion of the email that resolve to the same base username (e.g., u.sername@gmail.com, u.s.ername@gmail.com, and u.s.e.r.n.a.me@gmail.com all resolve to username@gmail.com). • Using an alias technique to add an extension to an existing email address through use of a dash (-) or plus (+) that resolve to the same email (e.g., username-123@gmail.com or username+bob@gmail.com both resolve to username@gmail.com). • Using a disposable email service to remain anonymous by receiving emails at a temporary address that may self-destruct after a certain time elapses. We matched the email addresses of COVID-19 EIDLs having a higher likelihood of fraud with all other COVID-19 EIDLs to identify loans that were suspicious because of their connection to loans having a higher likelihood of fraud made using the same email address. See Appendix 1 for a detailed explanation of the link analysis investigative technique. Case Example: A School for Fraudsters After defrauding the American taxpayer using disposable and suspicious email addresses, one individual took his talents to the web, schooling other would-be fraudsters on how to rip-off programs meant for struggling entrepreneurs during a crisis. A forensic audit of recovered electronic devices revealed templates to create credit cards, fraudulent driver’s licenses, a link to lists of stolen identities available for purchase on the dark web, and expansive evidence of SBA loan fraud and unemployment benefit fraud. He was sentenced to 5 years in federal prison for fraudulently seeking more than $3.3 million in COVID-19 EIDLs. SBA issued him $328,700 in loans. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 28 of 44 23 Conclusion The pandemic presented a whole-of-government challenge. Fraudsters found vulnerabilities and coordinated schemes to bypass controls and gain easy access to funds meant for eligible small businesses and entrepreneurs adversely affected by the economic crisis. Based on the audit, data analytics, and investigative techniques used to analyze the 11 fraud indicators identified in this white paper, OIG was able to verify that SBA’s lack of, or weakened, up-front internal controls resulted in the disbursement of over $200 billion in potentially fraudulent COVID-19 EIDLs, EIDL Targeted Advances, Supplemental Targeted Advances, and PPP loans. Based on our work, we have confidence in our estimate of potential pandemic loan fraud. Further, we believe loans identified as potentially fraudulent as part of our review warrant investigation by OIG and its investigative partners. Moreover, a good indicator of loan fraud is nonpayment when payment is due. Not all past due, delinquent, in liquidation, or charged off loans will be fraudulent; however, most fraudsters do not intend to pay back the stolen funds. As of May 2, 2023, SBA data shows about 1.6 million COVID-19 EIDLs (54 percent of active performing loans) that are either past due, delinquent, or in liquidation for a total of $114.2 billion. Additionally, more than 69,000 COVID-19 EIDLs totaling $3.2 billion have already been written off. Furthermore, over 500,000 PPP loans have defaulted and were submitted to SBA for guaranty purchase by PPP lenders as of June 2023. SBA has made payments on over 425,000 PPP loans totaling $12.9 billion on these submissions. It is important to note that PPP loans were expected to be fully forgiven if used as intended. To date, OIG has issued multiple reports identifying weaknesses in SBA’s control environment. Based on our previous reviews, we made recommendations to mitigate the impact of the pay and chase environment that was created at the onset of the COVID-19 pandemic. In total, OIG has issued 77 pandemic-related recommendations, and SBA has taken corrective action to implement 38 of them. There are 39 open recommendations on which SBA is working to implement corrective action. As such, SBA has made progress to reduce fraud risks and prevent further losses in its pandemic loan programs, though the need to establish and use effective internal fraud controls is a continuing challenge. OIG’s investigations will root out fraud, waste, and abuse and will leverage and marshal the resources available across the federal law enforcement community to bring wrongdoers to justice. Our oversight and investigative work has resulted in 1,011 indictments, 803 arrests, and Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 29 of 44 24 529 convictions related to COVID-19 EIDL and PPP fraud as of May 2023. OIG collaboration with SBA, the U.S. Secret Service, other federal agencies, and financial institutions has resulted in nearly $30 billion in COVID-19 EIDL and PPP funds being seized or returned to SBA. Of the more than 250,000 OIG Hotline complaints we have received since the start of the COVID-19 pandemic, our data analytics team has identified more than 90,000 actionable leads. In addition, OIG is working on tens of thousands of other investigative leads on alleged fraud, waste, and abuse of taxpayer resources. Thousands of investigations will ensue for years to come because of swift congressional action to increase the statute of limitations to 10 years for COVID-19 EIDL and PPP fraud. As demonstrated in this review, the potential fraud estimates directly correlate to our investigative casework, adjudicated and ongoing criminal cases, and to schemes SBA OIG and other oversight agencies are continuing to unravel and then prosecute. Data analytics have bolstered our investigative capacity with findings that have led to the investigation and arrest of fraudsters across the nation. We will continue to work on obtaining additional datasets through partnerships with other government agencies as well as through subpoenas of certain lenders and their third-party processors. As we receive and analyze additional datasets, the fraud groups may be refined to identify additional fraudulent loans. Evaluation of Agency Response SBA management provided formal comments that are included in their entirety in Appendix 2. In its response, SBA expressed appreciation for the partnering efforts to strengthen all of SBA’s programs and concern that the report approach contains serious flaws that significantly overestimate fraud and unintentionally mislead the public to believe that work performed with OIG had no significant impact in protecting against fraud. SBA emphasized the following three areas of concern for our consideration: 1. SBA’s fraud control improvements; 2. COVID-19 EIDL repayment data; and 3. Classification of potential fraud versus likely fraud. We considered SBA’s formal response, and likewise, value the partnering efforts to promote integrity in all its programs; however, we remain confident in our estimates of potential fraud for the COVID-19 EIDL program and PPP. As stated in this white paper, our estimate is based on Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 30 of 44 25 OIG investigative casework, prior reports, and advanced data analytics. Our prior audit work includes 22 reports that not only identified significant internal control weaknesses but also provided SBA with recommendations intended to mitigate fraud risk. Regarding our investigative casework, fraudsters have been convicted for committing fraud that aligns with the fraud indicators presented in this report. If time and resources were available, OIG would open an investigation on every one of the loans identified as potential fraud presented herein. Further, as our report states, for our advanced data analytics, we used big data and cloud computing that closely mirrored investigative techniques of case development through a variety of rule-based analytical methods. These techniques allowed us to identify and prioritize potential fraud schemes perpetrated against SBA’s COVID-19 EIDL program and PPP. In addition, we implemented link analysis to identify potential fraud clusters through commonly shared attributes in the data. It’s important to note that link analysis is distinct from simply identifying loans with duplicative values, such as sharing the same IP address. In contrast, link analysis refines basic duplicate analysis by only capturing additional loans that are associated with a source loan suspected of fraud. This reduced the potential false positives and allowed us to focus on loan clusters highly suspected of being fraudulent. We recognize in this white paper that each fraud group may contain transactions that fully meet the criteria of potential fraud but may later be determined to represent a false positive detection. Any specific loan application, disbursement, or transaction may only be deemed actual fraud after being adjudicated. It is equally true that fraudulent loans remain undetected within the COVID-19 EIDL and PPP loan portfolios. As we continue to obtain additional datasets through partnerships with other government agencies, such as the PRAC and GAO, as well as through subpoenas of certain lenders and their third-party processors, in future iterations of this review we may refine the fraud groups to identify additional fraudulent loans and further reduce false positives and bring to light presently undetected fraud. As demonstrated in this white paper, our potential fraud estimates are sound based on relative OIG audits, investigations, advanced data analytics, other reviews, and prudent professional judgment. SBA’s Fraud Control Improvements SBA stated that this white paper only minimally acknowledges a critical aspect of the agency’s fraud controls—the material fact that their fraud controls improved dramatically over time. We acknowledge in this report that SBA has been responsive to OIG recommendations for corrective action related to internal controls and gave specific examples of the agency’s actions. It is vital to Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 31 of 44 26 understand OIG performs its work in an independent and objective manner. OIG’s oversight of SBA’s pandemic response is ongoing, to include verification reviews to assess implementation of more robust internal controls and the effectiveness of these and other controls, in assuring only eligible entities gained access to the COVID-19 EIDL program and PPP. As stated in this white paper, we will continue to monitor and assess the effectiveness of SBA’s implemented controls through our ongoing and planned reviews, which will include the Restaurant Revitalization Fund and Shuttered Venues Operator Grant programs. COVID-19 EIDL Repayment Data SBA stated that only 12 percent of lending went to borrowers who are past due and have yet to make payments. Further, SBA stated that the remaining 88 percent has either fully repaid their loan, begun to do so, or is still in the allowed deferment period. In its response, SBA seeks to diminish its COVID-19 EIDL loan performance data, which they provided directly to OIG in May 2023. As reported in the “Conclusion” section of this white paper, SBA reported 54 percent of loans in the active portfolio are stressed — late, delinquent, defaulted — and another $3.2 billion have already been written off. While OIG believes the COVID-19 EIDL performance data is corroborative to its potential fraud estimate for the COVID-19 EIDL program, we did not use these stressed loan amounts in our determination of potential fraud in this program. It is also important to note that loans totaling over $50 billion are still in deferral and not included in the active portfolio totals, and it is unknown whether those loans will be repaid. SBA seeks to highlight OIG did account for repayment information as an indicator of potential fraud in the PPP and should be an equivalent in preparing the potential fraud estimate for the COVID-19 EIDL program. Unlike the COVID-19 EIDL program, which requires loans to be repaid, PPP was designed for borrowers that comply with the requirements to obtain 100-percent forgiveness of the loan amount. As such, there is a distinct difference in the repayment terms of these programs, and our methodology reflects these differences. OIG’s decades of oversight experience with SBA’s Disaster Assistance Program shows that fraudsters may make payments for a period, and subsequent to default, the fraud scheme is revealed. OIG believes it is prudent to rely on its methodology to arrive at its estimate of potential fraud in the COVID-19 EIDL program regardless of loan status. Once a fraud is perpetuated, repayment does not change these facts. While it is SBA’s position that it is unlikely that a loan in repayment is fraudulent, we have seen in our investigations that fraudulent actors try to rectify situations by paying back the money Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 32 of 44 27 before facing a more severe penalty, such as criminal prosecution or double civil fraud penalties. In addition, prosecutors may encourage fraudsters to pay back the money before entering plea agreements in order to process the agreement or to use cooperating defendants to prosecute a co-conspirator. We believe that repayment alone is not a factor in whether the underlying application was potentially fraudulent; however, failure to pay could possibly be an indicator of potential fraud. Classification of Potential Fraud Versus Likely Fraud SBA stated that this white paper leads the reader to mischaracterize the size of actual fraud in the COVID-19 EIDL program and PPP because OIG did not explicitly define “potential fraud.” SBA also states that it is important to differentiate between “potential fraud,” “likely fraud,” and “confirmed fraud.” We appreciate SBA’s concern regarding this matter. We refer to “potential fraud” throughout this report due to the increased confidence we have that fraud may exist within certain indicator groups based on our prior audits, investigative casework, and advanced data analytics. We believe loans identified as potentially fraudulent as part of our review warrant investigation by OIG and its investigative partners. Also in its response, SBA stated that it has reviewed all pandemic loans and found over $400 billion worth of loans that need further investigation for potential fraud. The agency conducted human-led reviews of over 3 million loans in this $400 billion universe, which equates to approximately 3,000 reviews per day. While SBA has the responsibility to ensure integrity in its programs, OIG independently defines fraud. Additionally, OIG performs its mission in an independent and objective manner to promote public trust in SBA’s programs. For context, the average OIG investigation takes more than 250 days. SBA’s human-led reviews do not reach the same level or degree of depth as SBA OIG investigations. Moreover, we only considered SBA’s active hold codes for our fraud estimates and not those that may have been cleared through SBA’s human-led reviews. We acknowledge SBA’s concerns regarding false positives. It is our opinion that SBA’s analysis of the 11 fraud indicators did not identify material issues that would impact the total potential fraud estimates presented in this white paper. For example, with regard to Fraud Indicator 5: Defaulted/No Loan Forgiveness, SBA stated that many of these borrowers are intimidated by the complexity of the PPP forms, processes, and the formality of the forgiveness process. OIG believes that legitimate borrowers who received PPP loans that were to be forgiven, if used as required, would act as quickly as possible to submit the forgiveness request to ensure they are Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 33 of 44 28 not financially liable for any remaining balance. Additionally, with regard to Fraud Indicator 11: Suspicious Email Addresses, SBA identified a scenario that OIG did not include in its analyses. Specifically, we analyzed email addresses that had moving dots, aliases using dashes and pluses, and disposable domains. As stated in this report, OIG’s potential fraud estimates directly correlate to our investigative casework, adjudicated and ongoing criminal cases, and to schemes our office and other oversight agencies are continuing to unravel and then prosecute. OIG’s investigations will continue to root out fraud, waste, and abuse and will continue to leverage and marshal the resources available across the federal law enforcement community to bring wrongdoers to justice. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 34 of 44 1-1 Appendix 1: Scope and Methodology This review presents our comprehensive estimate of the potential fraud in the U.S. Small Business Administration’s (SBA) pandemic loan programs. We used a variety of analytical methods, including rule-based analytics and machine learning, to identify and prioritize potential fraud schemes perpetrated against the SBA pandemic loan programs. Our scope included all Coronavirus 2019 (COVID-19) Economic Injury Disaster Loans (EIDLs) and Paycheck Protection Program (PPP) loans disbursed throughout the COVID-19 pandemic. Our analyses expanded on findings from previous reports to identify fraud in the COVID-19 EIDL program and PPP. We used new computer search techniques, optimized our search techniques, and incorporated newly gathered data into the search. We tested a limited sample of COVID-19 EIDL and PPP loans identified as potentially fraudulent and, in some instances, tested against source documentation to provide greater confidence in our results. Moreover, we used a technique known as link analysis to assess and evaluate connections between data points. We matched the bank accounts, phone numbers, physical addresses, email addresses, and Internet Protocol addresses of loans having a higher likelihood of fraud with all other loans to identify suspicious loans based on their connection to loans having a higher likelihood of fraud. For COVID-19 EIDL, we considered all loans matched via bank accounts, phone numbers, physical addresses, and email and IP addresses as part of the bank account, suspicious phone number, suspicious physical address, suspicious email, and IP address fraud groups. For PPP, we considered only the loans matched via IP addresses and bank accounts as part of the IP address and bank account fraud group. Figure 1-1 on the following page is a representation of our link analysis. We prepared this review in alignment with the Office of Inspector General’s (OIG) quality control standards and the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Federal Offices of Inspector General, which require that we conduct our work with integrity, objectivity, and independence. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 35 of 44 1-2 Figure 1-1: Graphical demonstration of link analysis Source: OIG generated from data analytics information Limitations Each fraud group presented in our review may contain transactions that fully meet the criteria of potential fraud but may later be determined to represent a false positive detection. Any specific loan application, disbursement, or transaction may only be deemed actual fraud after being adjudicated. It is equally true that fraudulent loans remain undetected within the COVID-19 EIDL and PPP loan portfolios. In future iterations of this review, the fraud groups may be refined to reduce the false positives and identify additional fraudulent loans. Previous reports on PPP have identified weaknesses in SBA’s data for the program. We did not conduct additional data reliability testing on the fields that were used in the data analyses that were performed. In addition, certain data fields critical to fraud detection, such as the original application IP addresses and disbursement bank account and routing numbers, are not readily available across all PPP lenders at this time. Borrower intake data from a small number of PPP lenders and third-party processors was incorporated into our analysis and may be expanded upon as we obtain additional data through subpoena. As a result, our estimates in these groups are likely understated. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 36 of 44 1-3 Prior Audit Coverage The following lists OIG’s previous audit coverage related to the objective of this report: Report Number Report Title Report Date SBA OIG Report 20-11 White Paper: Risk Awareness and Lessons Learned from Prior Audits of Economic Stimulus Loans April 3, 2020 SBA OIG Report 20-12 White Paper: Risk Awareness and Lessons Learned from Audits and Inspections of Economic Injury Disaster Loans and Other Disaster Lending April 3, 2020 SBA OIG Report 20-14 Flash Report: Small Business Administration’s Implementation of the Paycheck Protection Program Requirements May 8, 2020 SBA OIG Report 20-16 Serious Concerns of Potential Fraud in Economic Injury Disaster Loan Program Pertaining to the Response to COVID-19 July 28, 2020 SBA OIG Report 21-02 Inspection of Small Business Administration’s Initial Disaster Assistance Response to the Coronavirus Pandemic October 28, 2020 SBA OIG Memorandum Key Recommendations Based on Lessons Learned from Prior COVID-19 Economic Injury Disaster and Paycheck Protection Program Loan Payments December 23, 2020 SBA OIG Report 21-06 Management Alert: Paycheck Protection Program Loan Recipients on the Department of Treasury’s Do Not Pay List January 11, 2021 SBA OIG Report 21-07 Inspection of SBA’s Implementation of the Paycheck Protection Program January 14, 2021 SBA OIG Report 21-09 Flash Report: Duplicate Loans Made Under the Paycheck Protection Program March 15, 2021 SBA OIG Report 21-15 SBA’s Handling of Identity Theft in the COVID-19 Economic Injury Disaster Loan Program May 6, 2021 SBA OIG Report 21-19 The Small Business Administration’s Implementation of Recommended Controls and the Economic Aid Act August 12, 2021 SBA OIG Report 22-01 SBA’s Emergency EIDL Grants to Sole Proprietors and Independent Contractors October 7, 2021 Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 37 of 44 1-4 Report Number Report Title Report Date SBA OIG Report 22-06 COVID-19 EIDL Program Recipients on the Department of Treasury’s Do Not Pay List November 30, 2021 SBA OIG Report 22-09 SBA’s Paycheck Protection Program Loan Review Processes February 28, 2022 SBA OIG Report 22-13 SBA’s Handling of Potentially Fraudulent Paycheck Protection Program Loans May 26, 2022 SBA OIG Report 22-16 SBA’s COVID-19 EIDL Program Data Migration Challenges July 19, 2022 SBA OIG Report 22-17 COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP Addresses September 12, 2022 SBA OIG Report 22-19 COVID-19 and Disaster Assistance Information Systems Security Controls September 27, 2022 SBA OIG Report 22-21 Paycheck Protection Program Eligibility for Nonprofit Organizations September 26, 2022 SBA OIG Report 22-22 Follow-up Inspection of SBA’s Internal Controls to Prevent COVID-19 EIDLs to Ineligible Applicants September 29, 2022 SBA OIG Report 22-25 SBA’s Guaranty Purchases for Paycheck Protection Program Loans September 30, 2022 SBA OIG Report 23-08 Serious Concerns Regarding the Return of Paycheck Protection Program Funds May 31, 2023 Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 38 of 44 2-1 Appendix 2: Agency Response U.S. Small Business Administration Response to Report Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 39 of 44 U.S. SMALL BUSINESS ADMINISTRATION WASHINGTON, DC 20416 Date: June 21, 2023 To: Hannibal “Mike” Ware, Inspector General From: Bailey DeVries, Acting Associate Administrator, Office of Capital Access Subject: Response to COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Project 23010) Thank you for the opportunity to review and respond to the Office of the Inspector General’s (OIG) Fraud Landscape white paper. The U.S. Small Business Administration’s (SBA) appreciates our partnership to strengthen all of SBA’s programs, and especially the significant work we have done together to address fraud in the Paycheck Protection Program (PPP) and COVID Economic Injury Disaster Loan (COVID EIDL) programs, as well as establish a strong fraud risk framework to strengthen SBA against future potential risks. However, we are concerned that the white paper’s approach contains serious flaws that significantly overestimate fraud and unintentionally mislead the public to believe that the work we did together had no significant impact in protecting against fraud. The concerns are as follows: 1) The paper only minimally acknowledges a critical aspect of SBA’s fraud controls—the material fact that SBA’s fraud controls improved dramatically over time. While the white paper highlights 16 measures the SBA put in place in 2021 to stem the tide of the fraud attacks that were prominent at the outset of COVID-EIDL and PPP, the white paper does not provide a clear accounting of when the largest amounts of fraud took place and when the efforts in early 2021 to address it were taken. The statement: “there was an insufficient barrier against fraudsters” does not clarify the applicable time period for this conclusion. SBA believes a full accounting of our work together would provide critical context for fraud in the programs and when that fraud occurred. The vast majority of the fraud, 86% by SBA’s estimate, occurred in the first nine months of COVID-EIDL and PPP. It is critical to clarify when SBA added controls and to emphasize which of those controls effectively protected against fraud. Such changes can provide valuable information to policymakers, as they consider effective controls for inclusion in legislation and at program launch for any future emergency program. You have previously highlighted this distinction. In January 2022 you stated: SBA is more prepared now than they've ever been in terms of the control environment… certainly much stronger than… at the onset of the pandemic… The agency has moved rather expeditiously to close out the majority of the [IG] recommendations. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 40 of 44 SBA acknowledges the prior administration made decisions to prioritize speed and unnecessarily deflated the control environment for PPP and COVID-EIDL for the first several months of the programs. However, SBA introduced additional fraud controls over time and implemented a strengthened anti-fraud control framework in 2021. For example, SBA introduced pre-award application screenings beginning in January 2021, including automated screenings for PPP, adding tax transcript verification for COVID-EIDL, and running applications through the Treasury Department’s Do Not Pay system. These controls saved billions. Additionally, SBA conducted a full review of all loans originated in 2020 to find likely fraud and refer it to your office. As a result of this work, SBA has found 86% of likely fraud originated in the first nine months of the programs. And while this white paper did not cover the Restaurant Revitalization Fund or Shuttered Venues Operator Grant programs, two new programs that were launched in 2021 had a combined fraud rate SBA estimates near half of one percent. 2) The white paper’s estimate of a 34% potential fraud rate for COVID-EIDL does not stand up against SBA’s current repayment data: Only 12% of lending went to borrowers who are past due and yet to make payments, most of which is likely accounted for by real businesses that closed or are unable to repay. Common-sense dictates that a bad actor would not fraudulently obtain a loan, only to repay it with interest. You have previously pointed out that fraudsters have no intention of repaying their loan (OIG Report 22-09), and that the true extent of fraud would become known once loans enter repayment (Deputy IG Testimony, March 2023). Now, in June 2023, an overwhelming majority of the portfolio by volume has passed deferral and is now obligated to repay. We recommend your office match the list of “potential fraudulent” COVID-EIDL borrowers with their actual repayment history, which OIG staff told SBA it considered but decided not to do as part of its white paper analysis. SBA would be happy to partner with your office in this analysis. As of June 2023, only 12% of loan dollars went to borrowers who have not yet begun, but still may begin, repayment after their loan came due. Every other business has either fully repaid their loan or begun to do so (74%), or is still in the allowed deferment period (14%). Importantly, most borrowers who do not repay their loans are not fraudulent; they are real businesses who did not make it through the turbulence of the pandemic and have no ability to repay. Indeed, early in the program, budget officials projected a default rate over one-third due to the likelihood of distress and closure under the unique, historic circumstances of the pandemic. Although SBA continues to estimate a higher-than-average non-repayment rate for the program overall, SBA’s modeling relied on structural elements of the programs, such as Congress’s decision to remove the requirement for personal guarantees for most loans, and the high likelihood of small business closures during the pandemic and years-long impact it had on the economy. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 41 of 44 3) Third, the white paper presents a summary of loans that are potential fraud as if they were loans that are likely fraud. The white paper provides an estimate of “potential fraud,” but does not explicitly define the term except mentioning that OIG believes all loans identified “warrant investigation.” It is important to provide clear definitions of terms like “potential fraud” to differentiate from “likely fraud” or “confirmed fraud.” This is important both for policymakers and for the small business owners who may consider participating in future federal emergency loan programs. SBA invites the opportunity to work together with OIG on this issue so we have a common framework which will benefit all program stakeholders. Without such, the white paper leads the reader to mischaracterize the size of actual fraud in these programs. SBA also reviewed all pandemic loans—and already conducted rigorous reviews of those with fraud indicators. SBA used automated screening similar to the tools used in the white paper to identify an initial set of files with anomalies, or “fraud indicators.” SBA’s first sweep found over $400 billion worthy of further investigation—more than twice the amount OIG identified of worthy of further scrutiny. However, SBA’s fraud identification and investigation did not stop there. SBA then interrogated those files with over 3 million human-led reviews by trained professionals, many with long prior careers in law enforcement, complemented by data analytics. This extensive analysis revealed that the body of loans likely to be fraudulent is approximately $36 billion across PPP and COVID-EIDL. The white paper highlights that OIG has conducted over 1,000 investigations of pandemic loans so far. As the OIG team further scrutinizes its batch of anomalous files, it will find the false positive rate is high and the set of potentially fraudulent files will narrow as it did when SBA conducted our reviews. To be clear, SBA believes that all the fraud indicators in OIG’s white paper can be helpful in determining which loans require further review and analysis to determine when there is actual fraud, and we have used many of the same indicators as OIG in our initial analysis. Nonetheless, SBA’s more than 3 million manual reviews to date have shown that many of these OIG indicators include a high percentage of false positives. While SBA has identified loans that were not fraudulent within all 11 of the OIG’s Fraud Indicators (e.g., typos, misunderstandings, circumstances for very small businesses, etc.), we focused the below examples on those indicators in the white paper for which a failure to acknowledge and account for a high propensity of false positives has the most material impact on OIG’s inflated fraud estimate. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 42 of 44 Examples of False Positives # Indicator Name Example 1 Hold Codes Hold code 8 (mismatch of entity name) identifies a business or entity where the company name provided does not match any of the listed identification credentials or provided application materials. Although this merits further review, SBA’s historical manual reviews of loans with hold code 8 show that around over 75% of those with hold code 8 would likely be resolved due to the clear existence of borrower or lender data entry errors, or other valid factors. SBA believes factoring in the historical results of the manual reviews of each hold code would help identify the “likely fraud” rather than just those loans with “fraud indicators.” 3 Employer identification numbers For EIDL loans, thousands of borrowers requested a loan increase that required approval from a different funding appropriation than the original loan. To manage this, the SBA opened a second loan with the same EIN to grant the increase using the correct appropriations. Many such loans, the total of which SBA estimates is valued at over $6 billion, would likely be counted as ‘potentially fraudulent’ under the white paper’s methodology. 4 Bank accounts The SBA encountered various data entry errors when reviewing loans associated with this hold code. For example, applicants would provide the standard routing information and the wire routing information, essentially providing the routing number twice without providing an account number. Additionally, the SBA found in its review of loans multiple instances of loans using the same bank account for legitimate reasons. 5 Defaulted/ No loan forgiveness Through coordinated outreach from the SBA and Lenders, it was determined that many of these borrowers are intimidated by the complexity of the PPP forms, processes, and the formality of the forgiveness process. To add complication, once PPP loan data was made public, many borrowers received a multitude of sales calls from both legitimate lenders and scammers. When the Lenders approached certain borrowers with routine communication alerting them to the need to file for forgiveness (email, US Mail, voicemail reminders, etc.) they were suspicious and untrusting. Below are a few examples of feedback the SBA has received from the Lenders in this process as to why certain borrowers have not yet applied for forgiveness: a) A change of email address, physical address, or phone numbers due to changes in personnel or life conditions (e.g., moving, marriage, etc.). Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 43 of 44 # Indicator Name Example b) Many borrowers incorrectly believed they did not need to apply for forgiveness because their loans were relatively small ($150,000 of less) or heard the headlines that “blanket forgiveness” had or would occur. c) A group of borrowers have passed away. d) Some businesses have failed, and the borrowers did not understand the necessity to request forgiveness. h) Borrowers who are suspicious they are being scammed. 11 Suspicious email addresses Some borrowers X’ed out a portion of their email (e.g., JoseSmith@gmail.com as Joxxxxxth@gmail.com) in their initial application, perhaps in an attempt to avoid unwanted email outreach or as a glitch in a copy-paste. Upon review, the full email appeared valid with no indicia of fraud identified. Case 1:20-cr-00296-JPB-CMS Document 987-2 Filed 05/03/24 Page 44 of 44
File and source
- File
- gov.uscourts.gand.279867.987.2.pdf
- Size
- 3,884,540 bytes
- SHA-256
- 0c7c893d845f2df575262a0a83ea7cb2d7b1b6fd484ffd27c594fb73d72d22ed
- Original
- PACER (login required)