GAO-24-107471 — Pandemic Unemployment Assistance: States’ Controls to Address Fraud (July 23, 2024)

Record facts

Summary

A Q&A report to congressional requesters from the U.S. Government Accountability Office, GAO-24-107471, issued July 23, 2024, on the controls states used to prevent and detect fraud in their Pandemic Unemployment Assistance programs. The report states the CARES Act created the PUA program in March 2020 and that it expired on September 6, 2021. It recounts a September 2023 estimate that the amount lost to fraud in the Department of Labor's unemployment insurance programs from April 2020 through May 2023 was likely between $100 billion and $135 billion. Officials from 14 selected states said implementing or expanding controls such as identity verification and cross-matching of external data sources helped address fraud risks. A key lesson stated is that failing to apply a new control to previously approved continuing claims may leave a state vulnerable to fraud.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Page 1 
GAO-24-107471 Pandemic Unemployment Assistance 
 
Fraud poses a significant risk to the integrity of federal programs and erodes 
public trust in government. The unemployment insurance (UI) system has faced 
long-standing challenges with effective service delivery and program integrity, 
which worsened during the COVID-19 pandemic because of historic levels of job 
loss, among other reasons. As a result of these long-standing challenges, in June 
2022 we designated the UI system as a high-risk area. 
The Department of Labor (DOL) oversees UI, and states design and administer 
their own UI programs within federal parameters. The CARES Act, enacted in 
March 2020, created three new federally funded temporary UI programs that 
expanded UI benefit eligibility, enhanced benefits, and extended benefit duration. 
One of these was the Pandemic Unemployment Assistance (PUA) program. 
The unprecedented demand for UI benefits and the need to quickly implement 
the new programs increased the risk of fraud. In February 2023, the Comptroller 
General of the United States testified before the Committee on Ways and Means 
of the U.S. House of Representatives that DOL and the states were not 
adequately prepared to handle UI fraud risks when the pandemic began. In 
March 2023, we were asked to continue our work to develop a comprehensive 
estimate of UI fraud during the pandemic and address DOL and states’ efforts for 
identifying and recovering UI overpayments. In September 2023, we estimated 
that the amount lost to fraud in DOL’s UI programs during the pandemic—from 
April 2020 through May 2023—was likely between $100 billion and $135 billion. 
Additionally, our analysis found higher fraud rates for PUA payments than for 
other UI program payments. In this report, we provide additional information on 
the controls that states used to prevent and detect fraud in their PUA programs. 
 
• 
States faced challenges in rapidly implementing their new PUA programs and 
in establishing effective antifraud controls in response to the unprecedented 
unemployment caused by the COVID-19 pandemic. 
• 
The controls used by states to manage fraud risk varied but, in general, all 
states within our review increased the variety of controls used in their PUA 
programs as the pandemic progressed. Sometimes states added new 
controls in response to the availability of new resources or after identifying 
program vulnerabilities. 
• 
State officials we spoke with from 14 selected states said that implementing 
new controls, or expanding existing controls, helped them to address fraud 
risks they identified in their state’s PUA program. 
• 
A key lesson learned is that failing to apply a new control to previously 
approved continuing claims may leave a state vulnerable to fraud and lessen 
the efficacy of the control at mitigating fraud risk in the program. 
 
 
 
U.S. Government Accountability Office 
Pandemic Unemployment Assistance: States’ 
Controls to Address Fraud 
GAO-24-107471 
Q&A Report to Congressional Requesters 
July 23, 2024 
Why This Matters 
Key Takeaways 

Page 2 
GAO-24-107471 Pandemic Unemployment Assistance 
 
The PUA program was one of several temporary federally funded programs 
created in March 2020 by the CARES Act to expand unemployment insurance 
benefits.1 The PUA program provided unemployment insurance benefits for 
workers not eligible under regular UI rules for benefits – such as self-employed 
workers and independent contractors – who were unable to work as a result of 
the COVID-19 pandemic.2 PUA benefits varied from state to state. According to 
our June 2022 analysis of 40 states, the average PUA compensation amount 
was $232 per week, with a low of $113 per week and a high of $326 per week.3 
See figure 1 for an overview of the timeline of the PUA program. 
Figure 1: Timeline of the Pandemic Unemployment Assistance (PUA) program 
 
 
As noted in figure 1, the passage of the Consolidated Appropriations Act of 2021 
in December 2020 substantially changed PUA requirements. The act added a 
requirement for PUA claimants to provide documentation substantiating their 
prior employment or self-employment. Previously, PUA claimants could self-
certify their employment history and eligibility. The act also required claimants to 
recertify with their state each week that they continued to meet the eligibility 
requirement of not being able to work as a result of COVID-19. Additionally, 
under the act, states were required to have procedures for identity verification or 
validation and for timely payment of PUA benefits, to the extent reasonable and 
practicable.4 States generally required individuals who received PUA benefits to 
which they were not entitled to repay those benefits, though states could waive 
that requirement under certain conditions.5 
While the PUA program expired on September 6, 2021, some states ended 
participation in this temporary federally funded program earlier.6 According to 
DOL, 20 states terminated participation in the PUA program between mid-June 
and late July 2021.7 In July 2021, DOL issued guidance to states regarding their 
responsibilities after they stopped participating in the CARES Act UI programs, or 
after the programs expired, whichever came first.8 For example, states were 
required to process and pay PUA benefits to eligible claimants for all weeks of 
unemployment before the program ended. In addition, for 30 days after the PUA 
program ended, states were required to continue accepting new PUA 
applications for weeks of unemployment before the program ended. 
What was the PUA 
program? 

Page 3 
GAO-24-107471 Pandemic Unemployment Assistance 
 
Program administration. The federal government and states work together to 
administer UI programs, including the PUA program.9 States are responsible for 
designing and administering their own UI programs, within federal parameters. In 
the UI system, program integrity is a shared responsibility between the federal 
and state governments. DOL provides general support and technical assistance, 
and states assume responsibility for determining eligibility, ensuring accurate 
benefit payments, and preventing fraud and other improper payments.10 During 
the pandemic, states continued to operate their regular UI programs while 
administering the pandemic UI programs—including the PUA program. 
Claims process. In general, to claim PUA benefits, individuals submitted an 
initial application (also referred to as an initial claim) to their state to receive a 
determination of basic eligibility for the program. The application included a self-
certification, required by law, that the applicant’s unemployment or inability to 
work was due to one of the COVID-19 related reasons identified in the CARES 
Act.11 Such reasons included that an individual’s place of work was closed due to 
COVID-19.12 After the initial application, individuals were required to complete 
weekly self-certifications of their continued eligibility for PUA benefits and to 
claim benefits for the prior week of unemployment (also referred to as continued 
claims). With the passage of the Consolidated Appropriations Act of 2021, the 
self-certification requirement was amended, and states were required to review 
documentation supporting an applicant’s self-certification of prior employment or 
self-employment. 
The process for verifying PUA claims was different than the process used for 
regular UI claims (see fig. 2). 
Figure 2: Comparison of Steps Used by States to Process Claims under the Regular 
Unemployment Insurance (UI) and the Pandemic Unemployment Assistance (PUA) 
Programs 
 
Notes: The process shown in this graphic changed with the Consolidated Appropriations Act of 2021, which 
required states to review documentation supporting an applicant’s self-certification of prior employment or self-
employment. 
Who was responsible 
for administering the 
PUA program, and how 
were claims 
processed? 

Page 4 
GAO-24-107471 Pandemic Unemployment Assistance 
 
For the purposes of this report, we use the term state to refer to the state, district, or territorial workforce agency 
that administers the UI programs, including the PUA program. PUA was also available in Guam, American 
Samoa, the Commonwealth of the Northern Mariana Islands, the Federated States of Micronesia, the Republic 
of the Marshall Islands, and the Republic of Palau. When we refer to states management of PUA these 
territories and freely associated states are included. 
 
Eligible PUA claimants were entitled to a minimum weekly compensation amount 
but could be eligible for a higher amount.13 As we have previously reported, DOL 
officials told us that to facilitate implementation of the new program, most states 
decided to initially pay PUA claimants the minimum allowable benefit and then 
recalculate their benefits later based on claimants’ documentation of their prior 
earnings.14  
An additional difference between the PUA program and the regular UI program 
was that when processing regular UI claims, states can confirm employment and 
other information with the employers. Many PUA applicants were self-employed 
or independent contractors, so states could not perform this verification control 
as they traditionally would. As discussed later, some of the unique processing 
steps for the PUA program and lack of antifraud controls may have made the 
program more vulnerable to fraud. 
 
Flexibility in how states implemented the PUA program allowed for variation 
across states in the systems states used for their PUA programs. For example, 
some states implemented the PUA program within their regular UI systems. This 
allowed those states to utilize some of the existing controls from those systems. 
While using legacy systems could allow states to leverage existing controls, if the 
legacy system had challenges, these could be worsened by the increased 
volume of new claims during the pandemic. In a December 2021 report, the 
Pandemic Response Accountability Committee (PRAC) cited that one state’s 
auditor found that the state’s system had unresolved deficiencies that created 
processing issues.15 For example, with the increase of claims during the 
pandemic, many applicants in that state encountered technical errors. Similarly, 
in the same report, the PRAC cited that another state’s auditor found that the 
state’s UI system was outdated and unable to detect and prevent fraudulent 
claims automatically. 
Other states worked with contractors to set up new systems dedicated to the 
PUA program with new functionality not available in the systems used for their 
regular UI programs. However, some states faced challenges when 
implementing new programs. For example, according to the December 2021 
PRAC report, one state’s UI system is based on a mainframe computer from the 
1970s.16 When integrating the newly developed PUA program to operate with the 
existing UI system, the state faced an increase in system errors that sometimes 
caused denials of eligible applicants’ claims or delays in processing the claims. 
We and the DOL Office of Inspector General (OIG) have previously reported on 
the risks and challenges that legacy systems pose for state UI programs, which 
have led to, among other things, reduced efficiency and effectiveness.17 
 
A variety of controls were available for states to use in their PUA programs to 
manage different fraud risks. 
Identity verification. Verification of government-issued identification, either 
directly or using a third-party service, enabled states to help ensure that the 
individual applying for benefits was who they claimed to be. While identity 
verification has been available to states for some time, DOL emphasized in its 
2024 UI transformation plan and earlier program letters that the pandemic 
emphasized the need for a robust identity verification strategy in state UI 
How did PUA program 
implementation vary 
across states? 
What antifraud controls 
were available for 
states to use in their 
PUA programs? 

Page 5 
GAO-24-107471 Pandemic Unemployment Assistance 
programs.18 Identity verification could include individuals presenting identity 
documents in person or through a virtual platform. 
Cross-matching external data sources. States could use the Social Security 
Administration’s (SSA) crossmatch to verify that the Social Security number used 
with a claim was real. States could use other controls, like the Systematic Alien 
Verification for Entitlement (SAVE) program to confirm an applicant’s immigration 
status and to help ensure that benefits were not going to ineligible individuals. 
Other tools, like the State Information Data Exchange System, provided 
assistance to states in verifying applicant information, such as employment 
separation information, and by digitizing many of the claims processing steps. 
The National Association of State Workforce Agencies (NASWA) UI Integrity 
Center’s Integrity Data Hub (IDH)—a multistate data system with data 
crossmatching and analysis capability—assisted states in reducing the risk of 
claimants applying for benefits in multiple states. Likewise, states could use the 
Interstate Connection Network to reduce the risk of applicants submitting claims 
in multiple states. The tool allowed states to share data and confirm that an 
applicant was not receiving UI benefits or wages in other states. States could 
similarly match application data against their state directory of new hires data to 
check whether the applicant was currently employed and earning wages in their 
state. 
In a prior review in March 2021, we also reported that, according to NASWA 
officials, crossmatching can identify potentially fraudulent UI claims, such as 
instances where a single bank account or email address is associated with 
multiple claims in multiple states, or when a deceased individual’s information is 
used to file a fraudulent claim for benefits.19 We saw examples of these types of 
flags in our own review of a sample of PUA payments from selected states in our 
September 2023 work on UI. The DOL OIG used data analytic procedures to 
identify the presence of fraud indicators for this sample and provided these flags 
to us for further review. This sample of payments included an email address that 
was associated with over 2,000 other payments. 
In December 2023, the DOL OIG updated its website to highlight multiple 
recommendations to Congress to improve UI program integrity, including that 
Congress should require states to perform crossmatching with certain federal 
data systems. The recommendations the DOL OIG highlighted in its December 
2023 website update include some that the DOL OIG made in February 2021—
for example, that DOL should work with Congress to establish legislation 
requiring states to crossmatch high-risk claims—which have not been 
implemented as of May 2024.20 Consistent with this recommendation to work 
with Congress, DOL included a legislative proposal in the fiscal year 2024 and 
fiscal year 2025 President’s budgets that would give DOL authority to require 
states to perform cross-matches. 
Analysis of claim data. Tools like Internet Protocol (IP) address verification or 
data analytics enabled states to flag unusual behavior across claims. An IP 
address is the numeric address of a computer on the internet. IP address 
verification could alert states when there were benefit applications for multiple 
individuals submitted from the same wireless connection or when applications 
were submitted from IP addresses outside the United States.  
States could also use data analytics to identify unusual characteristics of claims 
that might suggest the claim was fraudulent. In addition, states could use other 
antifraud tools, such as matching against SSA’s death master file to verify 
applicant identity and eligibility or address other vulnerabilities they identify. 
In September 2023, on the basis of its analysis of UI claims during the COVID-19 
pandemic, the DOL OIG recommended that DOL, in collaboration with states, 

Page 6 
GAO-24-107471 Pandemic Unemployment Assistance 
establish controls and perform data analytics to mitigate the fraud risk from 
claims paid to high-risk age categories: individuals under the age of 14 or over 
the age of 100.21 DOL did not concur with all of the DOL OIG’s September 2023 
recommendations and in its response cited concerns related to cost and 
feasibility of implementation and legal authority to obtain data. Additionally, DOL 
indicated in its response to the OIG that the agency believes it has already 
established controls to mitigate fraud through to UI through the agency’s UI 
Fraud Risk Profile and other activities. As of May 2024, the DOL OIG’s 
September 2023 recommendations to establish controls and perform data 
analytics have not yet been implemented.  
 
States used a variety of controls in the first 9 months of their PUA programs, with 
the number of controls being used increasing after the first few months. States 
had to rapidly implement their new PUA programs following passage of the 
CARES Act in March 2020. The PUA program expanded UI benefits to 
populations previously not covered by regular UI. At the same time, states were 
dealing with increasing unemployment due to the COVID-19 pandemic. 
April 2020 was the first full month after the PUA program was created, and most 
states had begun paying PUA claims by the end of May 2020. This initial rapid 
program development, and the December 2020 passage of the Consolidated 
Appropriations Act of 2021—which changed many program requirements—led to 
distinct operating environments for the PUA program in the first 9 months 
(through December 2020) and the latter half of the pandemic (post-December 
2020). 
We surveyed state officials to understand the controls they initially implemented 
in their PUA programs. According to the survey responses from officials at states, 
the variety of controls used increased significantly in the first few months of PUA 
program implementation (see table 1). States continued to increase their 
utilization of controls as the pandemic further progressed (see the peak month 
column in table 1). For example, states increased their participation in the IDH—
a multistate data system with data crossmatching and analysis capability—to 
identify potential fraud in PUA and other programs within the UI system, 
according to DOL and NASWA officials. According to DOL, states have 
continued increasing participation in the IDH even after the end of the PUA 
program to assist in addressing fraud risk in their regular UI programs. As of 
2024, all states and territories are now participating in the IDH. 
Table 1: Controls That States We Surveyed Reported Using Early in Their Pandemic 
Unemployment Assistance (PUA) Programs 
Control description 
Percentage of responding states that reported 
using the control by that month or earlier 
 
April 2020 
May 2020 
June 2020 
Peak montha 
Verification of government-issued ID 
35.4b 
54.2 
58.3 
85.4 
Third-party vendor-provided identity 
verification service 
18.8 
25.0 
29.2 
79.2 
National Association of State Workforce 
Agencies Integrity Data Hub 
47.9 
54.2 
62.5 
83.3 
Systematic Alien Verification for 
Entitlement 
72.9 
89.6 
93.8 
97.9 
Interstate Connection Network 
54.2 
58.3 
62.5 
70.8 
State Information Data Exchange 
System 
41.7 
43.8 
43.8 
45.8 
Social Security Administration cross-
match 
52.1 
66.7 
66.7 
75.0 
What antifraud controls 
did states use initially 
in their PUA programs? 

Page 7 
GAO-24-107471 Pandemic Unemployment Assistance 
State Directory of New Hires cross-
match 
58.3 
60.4 
60.4 
72.9 
Internet Protocol address 
47.9 
60.4 
68.8 
87.5 
Data analytics 
43.8 
54.2 
58.3 
91.7 
Other fraud prevention toolsc 
64.6 
79.2 
85.4 
100 
Source: GAO analysis of state survey responses.  |  GAO-24-107471 
Note: In spring 2023, we surveyed the state workforce agencies in 50 states and the District of Columbia. Three 
states did not respond to our survey by the deadline. The results of our survey reflect responses from 47 states 
and the District of Columbia. For the purposes of this report, when we refer to states’ administration of the PUA 
program, we include states, territories, and freely associated states.  
 
aPeak month refers to the month in which the highest number of states surveyed responded that they used a 
control in their PUA program. The specific month may vary by control. 
 
bThe percents displayed refer to the percentage of responding states and the District of Columbia that reported 
using the control at any point in the specified month for their PUA programs. We did not independently verify the 
information states reported on when controls were used or whether controls were used on all PUA claims, or 
only a subset of claims. 
 
cOther fraud prevention tools include, but are not limited to, additional controls, such as the Social Security 
Administration’s death cross-match, Vital Statistics cross-match, Department of Motor Vehicles cross-match, 
fictitious employer cross-matches, and other comparisons that detect shared applicant characteristics (e.g., 
phone numbers or banking information) on multiple claims. 
 
While each state’s PUA program varied to meet the needs of that state’s 
population and any related state regulations, states used some common controls 
to manage fraud risk in their PUA programs. See figure 3 for additional 
information on antifraud controls that states reported using in their PUA 
programs. 
For example, almost all the states we surveyed reported using the SAVE 
program. SAVE helps federal, state, tribal, and local government agencies verify 
the applicant’s authorization to work in the United States.22 Over 85 percent of 
the states that responded to our survey reported using IP address verification in 
their PUA programs. IP address verification can alert states when there are 
benefit applications for multiple individuals submitted from the same wireless 
connection or when applications are submitted from IP addresses outside the 
United States. 
Figure 3: Percentage of Surveyed States Reporting Use of Particular Antifraud Controls in 
their Pandemic Unemployment Assistance (PUA) Programs  
 
Notes: In spring 2023, we surveyed 50 states and the District of Columbia. Three states did not respond to our 
survey by the deadline. The results of our survey reflect responses from 47 states and the District of Columbia. 
For the purposes of this report, when we refer to states’ administration of the PUA program, we include states, 
territories, and freely associated states. 
 
The percents displayed refer to the percentage of responding states and the District of Columbia that reported 
What antifraud controls 
were most commonly 
used by states during 
the pandemic? 

Page 8 
GAO-24-107471 Pandemic Unemployment Assistance 
using the control at any point for their PUA programs. We did not independently verify the information states 
reported on when controls were used or whether controls were used on all PUA claims, or only a subset of 
claims. 
 
Other fraud prevention tools include, but are not limited to, additional controls. such as the Social Security 
Administration’s death cross-match, Vital Statistics cross-match, Department of Motor Vehicles cross-match, 
fictitious employer cross-matches, and other comparisons that detect shared applicant characteristics (e.g., 
phone numbers or banking information) on multiple claims. 
 
Using a variety of controls is critical in managing program risk because a single 
control may not be able to prevent or detect all types of fraud. For example, we 
identified a case in our review of PUA claim files obtained from states in which an 
identity verification control and a residency control were both needed to identify 
potential fraud. Specifically, for a claim submitted in February 2021, the state 
used a third-party service to verify the applicant’s identification. The applicant’s 
identity was verified without issue. However, when asked for verification of 
income and residency, the applicant submitted documentation indicating work in 
a different state and earnings less than what was listed on the application. The 
applicant continued receiving PUA benefits until July 2021, totaling over $13,000, 
when benefits were suspended because the applicant failed to provide evidence 
of state residency. 
A control’s efficacy can depend on the rigor of the control’s implementation. For 
example, collecting Form W-2, Wage and Tax Statements (W-2), or other proof 
of work history from a claimant can be an effective control to ensure applicant 
eligibility. However, we identified an instance where the state accepted a W-2 
with multiple fonts in different portions of the document and Social Security 
numbers that did not match the applicant’s, suggesting that the W-2 was likely 
edited. 
 
States identified many risks in their PUA programs—including the use of false 
identity documents and benefits hijacking. States implemented new controls to 
address the risks identified. Officials we interviewed from 14 selected states said 
that when they identified risks in their PUA programs, they sometimes 
implemented additional antifraud controls in response. For example: 
• 
Officials at one state we spoke with explained that they implemented a new 
identity verification service upon observing a surge in suspected fraudulent 
PUA claims in July 2020. Officials explained that as the pandemic 
progressed, they continued to improve their fraud detection controls – such 
as by adding a check for duplicate banking or address information across 
claims. 
• 
Officials from another state noticed an increase in instances of benefits 
hijacking – when the benefits from a valid PUA claim were misappropriated 
and taken by someone other than the eligible claimant. The state 
implemented additional identity verification steps, which helped eliminate the 
surge in benefits hijacking they had observed. This trend was also observed 
by officials from another state, who similarly saw some success in preventing 
benefits hijacking by using additional identity verification checks. 
• 
Officials from one state explained that staff evaluated PUA claims throughout 
the pandemic to identify patterns or trends in claims. For example, the state 
was able to flag and investigate claims using the same identifying information 
– such as address or phone number. From these investigations, the state 
was able to add additional controls to block claims using the suspicious 
information. 
What risks did states 
identify in their PUA 
programs, and how did 
they respond? 

Page 9 
GAO-24-107471 Pandemic Unemployment Assistance 
• 
Officials from one state described their controls as multilayered. As the state 
learned more about the fraud and any vulnerabilities, it layered on additional 
verification tools to better control risk. 
Some states that implemented identity verification did not apply the control to 
continuing claims that had been previously approved. This approach could detect 
fraud on new claims but allowed for continued payments on claims approved in 
the past. For example, one claimant did not undergo the third-party identity 
verification because the claim was submitted in July 2020, and the state did not 
start using identity verification until August 2020. The state paid over $13,000 on 
the claim across 65 weeks. The claim had several indicators of fraud, including 
an unusually high number of PUA claims at the single-family address, no 
connection between the Social Security number on the claim and the state where 
the claim was filed, and a record of consistent income in a nonneighboring state. 
In November 2023, GAO testified that agencies have the opportunity to learn 
from the experiences during the pandemic and ensure that they are strategically 
managing their fraud risks in the future.23 Doing so will enable agencies to carry 
out their missions, better protect taxpayer dollars from fraud during normal 
operations, and prepare them to face the next emergency. Also, as reported by 
PRAC in April 2024, it is important to understand how UI fraud occurred during 
the pandemic so that agencies can be better prepared to respond for future 
emergencies while managing fraud risk. Consistent with GAO’s testimony and 
the PRAC’s reporting, states may take lessons from the PUA program when 
considering future temporary UI programs. One lesson is that failing to apply a 
new control to continuing claims may leave a state vulnerable to fraud and lessen 
the efficacy of the control at mitigating fraud risk in the program. 
 
Policy decisions by Congress, DOL, and states concerning applicant self-
certification and the use of automatic backdating in processing claims heightened 
PUA program risks. In a December 2021 report, the PRAC cited that state 
auditors had found that the PUA eligibility requirements decreased internal 
controls and that states’ control weaknesses for eligibility verification negatively 
impacted the states’ ability to manage fraud.24 
Eligibility self-certification. The DOL OIG reported in October 2020 that the 
PUA program, in particular, was at high risk for fraud due to its unique program 
rules and eligibility requirements.25 Similarly, our analysis in September 2023 
found higher fraud rates for PUA payments than for other UI program 
payments.26 Specifically, the CARES Act required states to allow PUA applicants 
to self-certify their eligibility and did not require them to provide any 
documentation of self-employment or prior income. The PUA program’s initial 
reliance on self-certification increased the risk for opportunities to commit fraud. 
In October 2021, we reported that relying on program participants to self-report 
and self-certify information on agency forms, instead of verifying such information 
independently, could cause an agency to miss opportunities to prevent program 
fraud and abuse.27 
To help address this risk, the Consolidated Appropriations Act of 2021, enacted 
in December 2020, required individuals to submit documentation of employment 
or self-employment when applying for PUA benefits. However, in an April 2024 
report, the PRAC found that states had limited means to verify the reported 
income of gig workers or self-employed individuals applying for PUA benefits.28 
Benefit amount self-certification. Additionally, self-certification was used by 
some states when setting an initial benefit amount above the minimum PUA 
benefit amount. As we reported in June 2022, DOL officials said they initially 
advised states to rely on self-certification when initially setting a benefit amount, 
What policy decisions 
affected the risk that 
states faced? 

Page 10 
GAO-24-107471 Pandemic Unemployment Assistance 
rather than defaulting to the minimum benefit amount.29 This guidance was later 
updated in July 2020 to clarify that proof of net income was required for self-
employed applicants to qualify for a higher benefit than the weekly minimum. In 
its December 2021 report, the PRAC cited DOL’s initial guidance on accepting 
self-certifications as a partial cause for why the PUA program did not include the 
typical verification required for regular UI benefits.30 
As the DOL OIG has previously reported, self-certification is a top fraud 
vulnerability for states administering the PUA program.31 In an example 
illustrating the risk of relying on self-certification, we identified an instance in our 
review of a sample of PUA payments from selected states where the applicant 
self-certified that they had to stop their lawn service business in early February 
2020 due to COVID-19. However, at that time in the applicants’ state, there were 
no reported cases of COVID-19, nor were there any restrictions in place that 
would impact the business. From our review of the claim, we identified no actions 
taken by the state to verify the applicant’s self-certification across the 28 weeks 
the claim was paid, resulting in more than $4,000 in PUA benefits being paid out. 
Automatic backdating. The CARES Act provided that states could automatically 
backdate claims to cover the period of eligible unemployment prior to the 
submission of the claim. For example, if Applicant X submitted a claim on May 1 
indicating that the applicant became unemployed and met the eligibility criteria 
for PUA beginning on April 1, Applicant X’s claim would be backdated to include 
this period of eligibility prior to the date the claim was submitted. Through May 
2020, about 2 months after the CARES Act was enacted, states reported 
receiving 8 million initial applications for PUA benefits. Backdating of claims 
allowed for applicants to receive benefits despite delays states faced in 
processing claims. 
Backdating claims could leave programs vulnerable by paying benefits to a 
claimant before eligibility is fully verified. The backdating process amplified the 
risk in the program by increasing the amount of money that was issued. An 
applicant could submit a PUA claim to include weeks prior to when the claim was 
first submitted. 
For example, in our review of a sample of PUA payments from selected states, 
we identified one instance where a state rejected a claim about a month after it 
was filed due to the failure of the claimant to complete the identity verification 
process. However, due to the backdating, the individual was paid over $9,000 in 
PUA benefits before being disqualified through controls in place. 
 
Officials from three of the 14 selected states we spoke with highlighted identity 
verification services, including third-party identity verification, as being especially 
helpful in their administration of PUA programs and managing risk. Identity 
verification being especially helpful to states in managing risk aligns with the 
PRAC’s April 2024 finding that a substantial proportion of pandemic UI fraud 
cases it sampled involved the use of stolen identities.32 
Improving identity verification was also one of the recommendations that DOL’s 
expert Tiger Teams made to many of the states they reviewed. Through 
December 2023, according to DOL, Tiger Teams engaged with 36 states to 
identify areas for improvement in operational process and proposed solutions to 
combat fraud support equitable access for eligible claimants. Tiger Teams are 
multidisciplinary expert teams funded by DOL grants using American Rescue 
Plan Act of 2021 funding. Tiger Teams analyzed a state’s UI system and 
processes to identify areas of improvement customized to that state. Officials at 
one of the 14 states we spoke with highlighted that their state’s use of multifactor 
authentication—using multiple factors to verify identity—was particularly helpful 
What antifraud controls 
did selected states 
identify as being 
especially helpful? 

Page 11 
GAO-24-107471 Pandemic Unemployment Assistance 
in combating potential fraud related to identity theft. The percentage of states that 
reported verifying government-issued identification increased prior to, and 
continued to increase after, the passage of the Consolidated Appropriations Act 
of 2021 in December 2020 (see fig. 4). 
Figure 4: Reported Use of Government-Issued Identification Verification by States in Their 
Pandemic Unemployment Assistance (PUA) Programs 
 
Notes: In spring 2023, we surveyed 50 states and the District of Columbia. Three states did not respond to our 
survey by the deadline. The results of our survey reflect responses from 47 states and the District of Columbia. 
For the purposes of this report, when we refer to states’ administration of the PUA program, we include states, 
territories, and freely associated states. 
 
The percents displayed refer to the percentage of states and the District of Columbia reporting using the control 
at any point of a month for their PUA programs. We did not independently verify the information states reported 
on when the control was used or whether the control was used on all PUA claims, or only a subset of claims. 
 
Officials from another state we spoke with explained that, during the pandemic, 
they began using software that they found helpful in identifying suspicious IP 
addresses associated with claims. Related to UI and prior to the pandemic, the 
DOL OIG has identified many cases of fraudulent UI activity, where hundreds of 
false UI claims are filed from the same IP addresses. In July 2015, the DOL OIG 
recommended that DOL should recommend that states perform additional 
verification on claims filed from anonymous IP addresses. Further, the DOL OIG 
recommended that states should conduct analyses to identify multiple claims 
originating from the same IP addresses and claims originating from foreign IP 
addresses.33 According to DOL officials, the agency has taken actions to 
implement these recommendations, however as of July 2024 these 
recommendations have not yet been implemented. 
 
There were a variety of PUA fraud schemes observed in court-adjudicated cases. 
These cases reflected the variety of fraud risks that states faced due to 
differences in the fraud schemes being used. See figure 5 for examples of court-
adjudicated cases of PUA fraud. 
What are examples of 
PUA fraud schemes? 

Page 12 
GAO-24-107471 Pandemic Unemployment Assistance 
Figure 5: Examples of Court-Adjudicated Pandemic Unemployment Assistance (PUA) Cases 
and Related Fraud Risks, Charges, Sentences, and Restitution Amounts 
 
 
We provided a draft of this report to DOL for review and comment. We 
incorporated technical comments from DOL as appropriate. 
Additionally, we provided portions of this report to the states we interviewed and 
the DOL OIG for technical comment. We incorporated any technical comments 
they provided, as appropriate. 
 
To obtain basic information about the operation of the PUA program, including 
the fraud prevention tools implemented by the states, we surveyed 50 states and 
the District of Columbia. Three states did not respond to our survey by the 
deadline. Analyzing information from this survey, we identified when states 
began using specific fraud prevention tools and changes in use over time. We 
also interviewed officials from 14 states to obtain information about states’ PUA 
application process, job search requirement, and implementation of identity 
verification services.34  
Further, we reviewed relevant PRAC, DOL OIG, and prior GAO reports on the 
PUA program; other temporary UI programs; and other COVID-19 pandemic 
programs for (1) the status of related recommendations and (2) examples of 
relevant vulnerabilities and fraud controls identified in earlier work. We reviewed 
public statements from the Department of Justice from March 2020 through 
Agency Comments 
How GAO Did This 
Study 

Page 13 
GAO-24-107471 Pandemic Unemployment Assistance 
March 2024 to identify federal fraud-related cases in the PUA program. We also 
analyzed corresponding court documentation available in Public Access to Court 
Electronic Records to describe various examples of these cases. 
To identify examples of potentially fraudulent PUA claims, in conducting the 
review for our September 2023 report, we obtained DOL’s sample of 2,540 PUA 
payments that DOL selected as part of DOL’s analytics efforts. We then selected 
a subsample of 260 PUA payments for further review. The DOL OIG used data 
analytic procedures to identify the presence of fraud indicators in the sample of 
2,540 PUA payments and provided them to us.35 To identify the presence of any 
additional fraud indicators, we crossmatched our sample with the SSA Death 
Master File to identify potentially deceased individuals and with the National 
Directory of New Hires to identify claimants’ unreported wages.36 For the sample 
of 260 PUA payments, we then followed up on matches by reviewing the state 
case files; discussing cases with the DOL OIG; and reviewing publicly available 
information, when applicable, to determine the risk of fraud on those matches.37 
We also matched information from the case files against SSA’s Enumeration 
Verification System to identify claimants with invalid personal information. As part 
of our September 2023 work, we assessed the reliability of all data used and 
determined they were sufficiently reliable for our purposes. 
We conducted this performance audit from March 2024 to July 2024 in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions based on 
our audit objectives. 
 
The Honorable Mike Crapo  
Ranking Member  
Committee on Finance  
United States Senate  
The Honorable Jason Smith  
Chairman  
Committee on Ways and Means  
House of Representatives 
 
For more information, contact Seto J. Bagdoyan, Director, Forensic Audits & 
Investigative Service, BagdoyanS@gao.gov, (202) 512-6722 and Jared B. Smith, 
Director, Applied Research and Methods, SmithJB@gao.gov, (202) 512-2700. 
Sarah Kaczmarek, Acting Managing Director, Public Affairs, 
KaczmarekS@gao.gov, (202) 512-4800. 
A. Nicole Clowers, Managing Director, Congressional Relations, 
ClowersA@gao.gov, (202) 512-4400. 
Staff Acknowledgments: Gabrielle Fagan (Assistant Director), Dae Park 
(Assistant Director), Brenda Mittelbuscher (Analyst in Charge), Ying (Sophia) Liu, 
Colin Fallon, Barbara Lewis, Maria McMullen, and Sabrina Streagle. 
Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Subscribe to our 
RSS Feeds or Email Updates. Listen to our Podcasts. 
Visit GAO on the web at https://www.gao.gov. 
This is a work of the U.S. government but may include copyrighted material. For 
details, see https://www.gao.gov/copyright. 
List of Addressees 
GAO Contact 
Information 

Page 14 
GAO-24-107471 Pandemic Unemployment Assistance 
 
 
1Pub. L. No. 116-136, 134 Stat. 281. 
 
2The PUA program also covered workers with limited recent work history and others who were not 
covered by the regular UI program under some state laws. 
 
3GAO, Pandemic Unemployment Assistance: Federal Program Supported Contingent Workers 
amid Historic Demand, but DOL Should Examine Racial Disparities in Benefit Receipt, GAO-22-
104438 (Washington, D.C.: June 7, 2022). 
 
4Pub. L. No. 116-260, div. N, tit. II, §§ 241(a), 263(a), 134 Stat. 1182, 1959-1960, 1963. 
 
5Pub. L. No. 116-260, div. N, tit. II, § 201(d), 134 Stat. 1182, 1952. According to the Consolidated 
Appropriations Act of 2021, states can waive the requirement if the individual was without fault and 
repayment would be contrary to equity and good conscience. 
 
6For the purposes of this report, we use the term state to refer to the state, district, or territorial 
workforce agency that administers the UI programs, including the PUA program. PUA was also 
available in Guam, American Samoa, the Commonwealth of the Northern Mariana Islands, the 
Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau. 
When we refer to states management of PUA these territories and freely associated states are 
included. 
 
7The 20 states that terminated the PUA program early are Alabama, Arkansas, Georgia, Idaho, 
Iowa, Louisiana, Mississippi, Missouri, Montana, Nebraska, New Hampshire, North Dakota, 
Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, West Virginia, and Wyoming. 
In addition, according to DOL, Indiana and Maryland announced their intent to terminate 
participation in the PUA program early but, because of litigation at the state level, did not end their 
participation before the program expired. See GAO, COVID-19: Additional Actions Needed to 
Improve Accountability and Program Effectiveness of Federal Response, GAO-22-105051 
(Washington, D.C.: Oct. 27, 2021). 
 
8Department of Labor, State Responsibilities after the Temporary Unemployment Benefit Programs 
under the Coronavirus Aid, Relief, and Economic Security (CARES) Act, as Amended, End Due to 
State Termination of Administration or When the Programs Expire, Unemployment Insurance 
Program Letter (UIPL) 14-21, Change 1 (Washington, D.C.: July 12, 2021). 
 
9Across the 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, 53 
workforce agencies administer UI programs. For the purposes of this report, when we refer to 
states’ administration of the UI program, we include states, districts, and territories. PUA was also 
available in Guam, American Samoa, the Commonwealth of the Northern Mariana Islands, the 
Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau. 
When we refer to states management of PUA these territories and freely associated states are 
included. 
 
10Fraud involves obtaining a thing of value through willful misrepresentation. Willful 
misrepresentation can be characterized by making material false statements of fact based on 
actual knowledge, deliberate ignorance, or reckless disregard of falsity. Fraud risk (which is a 
function of likelihood and impact) exists when people have an opportunity to engage in fraudulent 
activity, have an incentive or are under pressure to commit fraud, or are able to rationalize 
committing fraud. Fraud risk includes existing circumstances that provide an opportunity to commit 
fraud. An improper payment is defined as any payment that should not have been made, or that 
was made in an incorrect amount (including overpayments and underpayments), under statutory, 
contractual, administrative, or other legally applicable requirements. It includes, but is not limited to, 
any payment to an ineligible recipient. See 31 U.S.C. § 3351(4). When an agency cannot 
determine whether a payment is proper for purpose of producing an improper payment estimate, 
due to lacking or insufficient documentation, the payment shall be treated as an improper payment. 
See 31 U.S.C. § 3352(c)(2). 
 
11Self-certification of PUA applicant eligibility was set by the CARES Act when the program was 
created. The requirement for self-certification of prior employment or self-employment was later 
amended by the Consolidated Appropriations Act of 2021 requiring applicants to provide 
documentation to support their self-certification. Prior to the enactment of the Consolidated 
Appropriations Act of 2021, in December 2020, DOL issued guidance in July 2020 to states that 
self-certification was not sufficient to qualify applicants for a higher PUA benefit than the weekly 
minimum amount. 
 
Endnotes 

Page 15 
GAO-24-107471 Pandemic Unemployment Assistance 
 
12For a complete list of reasons, see Department of Labor, PUA Program Operating, Financial, and 
Reporting Instructions, UIPL 16-20 (Apr. 5, 2020); and Department of Labor, Employment and 
Training Administration, Expanded Eligibility Provisions for the Pandemic Unemployment 
Assistance (PUA) Program, UIPL No. 16-20, Change 5 (Washington, D.C.: Feb. 25, 2021). The 
Consolidated Appropriations Act of 2021 added new requirements to the PUA program, including 
that individuals must generally provide documentation substantiating their prior employment or self-
employment. Pub. L. No. 116-260, div. N, tit. II, § 241(a), 134 Stat. 1182, 1959-60. 
 
13According to DOL, states must use the amounts set in UIPL 3-20 as the minimum PUA weekly 
benefit for all claims. See Department of Labor, Employment and Training Administration, 
Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 – Pandemic Unemployment 
Assistance (PUA) Program Reporting Instructions and Questions and Answers, UIPL No. 16-20, 
Change 1 (Washington, D.C.: Apr. 27, 2020); and Department of Labor, Employment and Training 
Administration, Minimum Disaster Unemployment Assistance (DUA) Weekly Benefit Amount: 
January 1 - March 31, 2020, UIPL No. 3-20 (Washington, D.C.: Dec. 12, 2019). 
 
14For more information, see GAO, COVID-19: Critical Vaccine Distribution, Supply Chain, Program 
Integrity, and Other Challenges Require Focused Federal Attention, GAO-21-265 (Washington, 
D.C.: Jan. 28, 2021). 
 
15Pandemic Response Accountability Committee, Key Insights: State Pandemic Unemployment 
Insurance Programs (Washington, D.C.: Dec. 16, 2021). 
 
16Pandemic Response Accountability Committee, Key Insights.  
 
17GAO, Unemployment Insurance: DOL Needs to Further Help States Overcome IT Modernization 
Challenges, GAO-23-105478 (Washington D.C.: Jul. 10, 2023).  
 
18Department of Labor, Building Resilience: A plan for transforming unemployment insurance 
(Washington D.C.: Apr. 2024). Examples of earlier DOL program letters highlighting the importance 
of identity verification in UI claims include: Department of Labor, Addressing Fraud in the 
Unemployment Insurance System and Providing States with Funding to Assist with Efforts to 
Prevent and Detect Fraud and Identity Theft and Recover Fraud Overpayments in the Pandemic 
Unemployment Assistance and Pandemic Emergency Unemployment Compensation Programs, 
UIPL No. 28-20, (Washington, D.C.: Aug. 31, 2020) and Department of Labor, Identity Verification 
for Unemployment Insurance (UI) Claims, UIPL No. 16-21, (Washington, D.C.: Apr. 13, 2021). 
 
19GAO, COVID-19: Sustained Federal Action Is Crucial as Pandemic Enters Its Second Year, 
GAO-21-387 (Washington, D.C.: Mar. 31, 2021). 
 
20Department of Labor, Office of Inspector General, The Employment and Training Administration 
Needs to Ensure State Workforce Agencies Implement Effective Unemployment Insurance 
Program Fraud Controls for High-Risk Areas, 19-21-002-03-315 (Washington, D.C.: Feb. 22, 
2021). 
 
21The DOL OIG identified over $1 billion in potentially fraudulent UI payments made during the 
pandemic to applicants filing claims associated with Social Security numbers of individuals under 
the age of 14 or over the age of 100. As workers do not typically fall into these age categories, the 
DOL OIG classifies them as high-risk age. Department of Labor, Office of Inspector General, ETA 
Needs to Incorporate Data Analytics Capability to Improve Oversight of the Unemployment 
Insurance Program, 19-23-012-03-315 (Washington, D.C.: Sept. 25, 2023). 
 
22Department of Labor, SAVE – Automated Secondary Verification of Aliens’ Status, UIPL No. 12-
03, (Washington D.C.: Jan. 2, 2003). 
  
23GAO, COVID-19: Insights and Actions for Fraud Prevention, GAO-24-107157 (Washington, D.C.: 
Nov. 14, 2023).  
 
24Pandemic Response Accountability Committee, Key Insights. 
 
25Department of Labor, Office of Inspector General, COVID-19: States Cite Vulnerabilities in 
Detecting Fraud While Complying with the CARES Act UI Program Self-Certification Requirement, 
Report No. 19-21-001-03-315 (Washington, D.C.: Oct. 21, 2020). 
 
26GAO-23-106696. 
 
27GAO-22-105051. 
 

Page 16 
GAO-24-107471 Pandemic Unemployment Assistance 
 
28Pandemic Response Accountability Committee, Why Unemployment Insurance Fraud Surged 
During the Pandemic (Washington, D.C.: Apr. 2024). 
 
29GAO-22-104438. 
 
30Pandemic Response Accountability Committee, Key Insights.  
 
31Department of Labor, Office of Inspector General, COVID-19: States Cite Vulnerabilities in 
Detecting Fraud While Complying with the CARES Act UI Program Self-Certification Requirement, 
19-21-001-03-315 (Washington D.C.: Oct. 21, 2020).  
 
32Pandemic Response Accountability Committee, Why Unemployment Insurance Fraud Surged. 
33Department of Labor, Office of Inspector General, Investigative Advisory Report: Weaknesses 
Contributing to Fraud in the Unemployment Insurance Program, 50-15-001-03-315 (Washington, 
D.C.: July 24, 2015). 
 
34We selected the 14 states—Arizona, California, Florida, Georgia, Illinois, Kansas, Michigan, 
Nevada, New Jersey, New York, Pennsylvania, Rhode Island, Texas, and Washington—to reflect a 
variety of DOL’s Benefit Accuracy Measurement program fraud rates and state population sizes.  
 
35Fraud indicators are characteristics and flags that serve as warning signs suggesting a potential 
for fraudulent activity. Indicators can be used to identify potential fraud and assess fraud risk but 
are not proof of fraud, which is determined through the judicial or other adjudicative system. The 
DOL OIG provided 18 indicators including, for example, multistate claims and shared or suspicious 
email addresses. 
 
36The National Directory of New Hires (NDNH) is a national repository of new hire, quarterly wage, 
and unemployment insurance information reported by employers, states, and federal agencies. 
NDNH is maintained and used by the U.S. Department of Health and Human Services for the 
federal child support enforcement program, which assists states in locating parents and enforcing 
child support orders. DOL does not have access to NDNH wage data; however, states have access 
to NDNH wage data. 
 
37In many cases, a fraud indicator may be explained by events other than fraud. The goal of the 
manual review was to account for alternative explanations of the observed fraud indicators. For 
example, an address may have a large number of claims because it is a multiunit dwelling and so, 
when assessing fraud risk associated with individual addresses, we examined the size of the 
dwelling and whether it was multiunit.

File and source

File

24-107471-pua-state-controls.pdf

Size

1,229,294 bytes

SHA-256

01ed3a9c1b3acec8c14031f7a4e08c506cbf677dfeb0e894c94595c1f3e81e81

Our copy

24-107471-pua-state-controls.pdf

Original

www.gao.gov