PRAC Fraud Alert Follow-Up — $38 Million in Pandemic Loans Tied to Deceased Individuals’ SSNs (May 2023)

Record facts

Full text

FRAUD ALERT FOLLOW-UP: Improved 
Sharing of Death Records and Use 
of the Do Not Pay System Would 
Strengthen Program Integrity and 
Better Protect the Public
PRAC Identifies $38 Million in Potentially Improper or Fraudulent 
Pandemic Loans Associated with Social Security Numbers of 
Deceased Individuals
This update expands on our January 2023 Fraud Alert that identified 69,000 questionable Social Security Numbers 
(SSNs) used to obtain $5.4 billion in potentially fraudulent loans made in the COVID-19 Economic Injury Disaster Loan 
(EIDL) program and Paycheck Protection Program (PPP). As detailed in that Fraud Alert, PRAC data scientists, using our 
Pandemic Analytics Center of Excellence, identified the questionable SSNs after determining that the names, SSNs, 
and/or dates of birth used in connection with a targeted selection of COVID-19 EIDL/PPP applications did not match 
information in Social Security Administration (SSA) records.1
We further noted in the Fraud Alert that a significant number of the targeted selection of applications used SSNs 
that were associated with individuals who, according to SSA records, were deceased as of the date of our verification 
results received from SSA. We did not include those deceased individuals’ SSNs in our January 2023 Fraud Alert 
because we first needed to determine if those individuals were alive at the time the COVID-19 EIDL/PPP applications 
were submitted. Therefore, following receipt of this information from SSA, we worked with the Department of the 
Treasury’s (Treasury) Do Not Pay (DNP) system to obtain the dates of death for this separate population of 20,404 
SSNs that SSA records indicated were associated with deceased individuals.2 The Treasury’s DNP system was able 
to provide the dates of death for 15,307 of the requested 20,404 SSNs. Using data available from DNP’s matching 
process and date of death information, the PRAC’s data scientists found that 3,222 of the 15,307 deceased 
individuals’ SSNs were used on COVID-19 EIDL/PPP applications across three analytic scenarios. 
$38 million in 
potential improper 
or fraudulent 
payments
20,404 SSNs of deceased 
individuals, verified by SSA, 
used on applications
15,307 SSNs matched 
by Treasury DNP
3,222 SSNs 
identified across 
all three scenarios
305 SSNs were paid 
EIDL/PPP money
xxx-xx-xxx
xxx-xx-xxx
xxx-xx-xxx
$38 
million
1 
We recognize that a data mismatch does not prove that an improper or fraudulent payment has occurred. Further review is necessary by the Small Business 
Administration (SBA).
2 
The Department of Treasury’s DNP working system is the executive branch’s designated source of centralized data and analytics services to help executive 
branch agencies verify eligibility for government payments and to help deter improper or fraudulent payments.
May 2023

2
Pandemic Response Accountability Committee | May 2023
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
These COVID-19 EIDL/PPP applications were submitted: (a) after the SSN owner’s date of death; (b) both before 
and after the SSN owner’s date of death; or (c) before the SSN owner’s date of death but were paid after the date 
of death. These potentially improper or fraudulent loans should be further reviewed to ensure payments did not go 
to ineligible recipients. We further determined that funds were disbursed in connection with applications using 305 
of the SSNs, resulting in nearly $38 million in potentially improper or fraudulent payments. Although 2,917 of the 
3,222 SSNs did not receive a loan disbursement, we are concerned they could be used to improperly obtain benefits 
from other government programs and, therefore, warrant further review by the SBA. 
As we detail below, Treasury’s DNP system does not have access to SSA’s full Death Master File (DMF). The full DMF 
uses data submitted from state level vital statistics agencies and matches them to SSA data to verify their identity. 
Because of the source of the information and this verification process, DMF data is considered a superior source 
of death information over the National Technical Information Service Limited Access Death Master File that DNP 
receives from SSA, as discussed below. This limitation may explain why DNP could only match 75 percent of the 
SSNs that we provided. Having access to the full DMF would have helped our PRAC data scientists identify whether 
potential improper or fraudulent payments were associated with the other 5,097 SSNs. More importantly, having 
such access would allow executive branch agencies to enhance their efforts to identify and prevent improper, and 
potentially fraudulent, payments to deceased individuals.
Verifying borrower information, including SSN and the date of death, helps prevent identity 
fraud and ensures government benefits are paid only to those who are eligible. 
As we previously reported, identity theft and identity fraud increased substantially since the start of the pandemic. 
According to a 2021 report from the Identity Theft Resource Center, pandemic-related payments were the most 
reported stolen payment, with SBA loans (e.g., COVID-19 EIDL and PPP) comprising some of the highest reports of 
misuse.3 Each of these programs permitted applicants to self-certify their eligibility. The reduction of controls in 2020 
to verify borrower information—coupled with expedited timeframes to disburse pandemic relief funds—increased 
opportunities for individuals to use stolen identities to commit or conspire to commit fraud.
The DNP system helps government program administrators 
identify and prevent improper payments by allowing agencies 
to check a variety of data sources to verify an applicant’s 
eligibility to receive federal funds.4 However, as noted above, 
the DNP system does not currently have access to SSA’s full 
Death Master File (DMF). DNP currently receives the National 
Technical Information Service Limited Access Death Master 
File from SSA, in addition to other death sources listed in 
“Our Approach and Analysis” section below. The full file of 
death information includes all death data that SSA receives, 
including state-owned data. SSA’s death records are cross 
checked with SSA’s system of records that houses identifying 
information on everyone that holds an SSN.5
Data Sharing Success Story
The Treasury Inspector General for Tax 
Administration (TIGTA) found that the Internal 
Revenue Service (IRS) had issued nearly 2.2 million 
payments totaling nearly $3.5 billion to individuals 
who per their records were deceased. To prevent 
additional payments to deceased individuals, TIGTA 
reported that the IRS shared Taxpayer Identification 
Numbers with Treasury’s Bureau of the Fiscal 
Service to prevent additional Economic Impact 
Payments to deceased individuals.
(TIGTA, “Implementation of Economic Impact 
Payments,” 2021-46-034, May 24, 2021).
3 
Identity Theft Resource Center, “2021 Trends in Identity,” August 2022.
4 
Do Not Pay is a service that agencies can use at no cost to check many federated data sources at one time to verify a recipient’s eligibility for payment. 
Agencies can check multiple DNP data sources related to debt, exclusions, and deceased individuals to assist in making payment eligibility decisions. 
Agencies have the right to access these data sources and are to work with Treasury’s Bureau of the Fiscal Service to identify the proper DNP data sources 
they need for their purposes.
5 
Social Security Advisory Board, “Social Security and the Death Master File,” June 2019.

3
Pandemic Response Accountability Committee | May 2023
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
As a result of a provision included in the 2021 Consolidated Appropriations Act, Treasury anticipates receiving the 
full DMF for a three-year period beginning December 27, 2023.6 The Government Accountability Office (GAO) has 
recommended that Congress accelerate and make permanent the requirement for SSA to share the full DMF with 
Treasury for inclusion in the DNP system.7 We concur with the GAO’s recommendation given how access to the DMF 
can help prevent deceased individuals’ identities being used to improperly apply for government benefits. A DNP 
system that contains the full DMF can give agencies a higher degree of certainty that a payee is legitimate and 
eligible before making an award or payment. 
Effective use of government information requires timely and effective program controls. 
As reported in our January Fraud Alert, both COVID-19 EIDL and PPP loans were susceptible to fraud because 
in 2020 SBA initially prioritized getting pandemic relief to those in need quickly with few safeguards to confirm 
eligibility. In some cases, agency officials relaxed or removed controls to expedite payments. The SBA’s Office of 
Inspector General (OIG) has identified the DNP system as a critical control that could have been implemented at the 
onset of these relief programs to prevent billions of dollars from being improperly disbursed. The Payment Integrity 
Information Act of 2019 dated March 2, 2020, requires agencies to evaluate fraud risks and use a risk-based 
approach to design and implement financial and administrative controls to counter identified fraud risks. The law 
reinforces the requirement for agencies to review pre-payment and pre-award procedures. At a minimum, and before 
issuing payment, agencies must review certain databases, statutorily mandated to be within the DNP Initiative, to 
verify eligibility of the payment.8 As discussed below, SBA began referencing the DNP system for PPP and COVID-19 
EIDL loan applications beginning in January 2021 and April 2021, respectively.9
6 
Consolidated Appropriations Act, 2021, Pub. L. No. 116-260. § 801, 134 Stat. 1182, 3201 (Dec. 27, 2020), amending 42 U.S.C. § 405(r). This provision 
will take effect three years after enactment and will be effective for a three-year period.
7 
GAO, “Emergency Relief Funds: Significant Improvements Are Needed to Address Fraud and Improper Payments,” GAO-23-106556, February 1, 2023.
8 
SBA OIG, “Paycheck Protection Program Loan Recipients on the Department of Treasury’s Do Not Pay List,” 21-06, January 11, 2021.
9 
SBA gained direct access to Treasury’s DNP system in March 2021 for PPP when Treasury issued its revised Computer Matching Agreement. According to 
SBA officials, from January to March 2021, SBA provided loans daily to Treasury to verify PPP borrowers on the DNP system.

4
Pandemic Response Accountability Committee | May 2023
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
What We Found
In connection with our January Fraud Alert, SSA informed us that 20,404 of the questionable SSNs we identified 
in our targeted selection were associated with deceased individuals. We excluded those SSNs and the associated 
loans from the Fraud Alert because we were in the process of using Treasury’s DNP system to determine if those 
individuals were alive when they submitted their COVID-19 EIDL/PPP application. Applications submitted after the 
recorded date of death raise the potential that an individual’s identity was being used improperly.10
The PRAC obtained from DNP the dates of death for 15,307 (75 percent) of the 20,404 SSNs that SSA verified 
were deceased. Next, PRAC data scientists analyzed the 15,307 SSNs and their associated COVID-19 EIDL/PPP 
applications to identify instances of potential improper or fraudulent payments. Our data scientists looked at three 
categories of applications associated with these 15,307 SSNs to assess potential fraud or improper payments: (a) 
applications filed after the SSN owner’s date of death; (b) applications filed both before and after the SSN owner’s 
date of death; and (c) applications submitted before the SSN owner’s date of death but paid after the date of 
death.11 See Table 1 for more details on the scenarios we considered.
Table 1. Potential Improper or Fraudulent Payments Identified Across 15,307 SSNs Matched Against 
the Treasury’s DNP System.
Scenario
Count of SSNs 
Associated with 
Applications
Count of SSNs 
Associated with 
Disbursements
Number of 
Disbursements
Disbursed 
Amount
1. SSNs used on applications
submitted after date of death
3,109
131
153
$10,425,461 
2. SSNs in Scenario 1 also
associated with applications
submitted before date of death*
169
92
184
$13,369,416 
3. SSN owner was alive at time of
application but deceased before
disbursement**
113
113
118
$14,098,357
Total***  
(Based on distinct counts)
3,222
305
455
$37,893,234
Source: PRAC analysis of 15,307 SSNs matched against Treasury’s DNP System.
* This scenario does not include applications/disbursements that are already included in analytic scenario 1.
** This scenario only focuses on disbursements and SSNs associated with undisbursed applications would not be included.
***The number of SSNs and applications are not a one-for-one match given that a distinct SSN could have been used across multiple 
COVID-19 EIDL and/or PPP applications that were disbursed and undisbursed. Therefore, a SSN can be associated with multiple applications 
and disbursements.
10 
According to DNP, the DNP is NOT a list of entities or people who should not be paid. It requires agencies to perform additional due diligence before 
awarding payments.
11 
The COVID-19 pandemic resulted in excess deaths in the United States. These results do not account for any time that may have lapsed between when the 
death occurred and when it was reported and recorded in SSA’s full Death Master File or DNP’s Limited Access Data File.

5
Pandemic Response Accountability Committee | May 2023
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
Scenario 1 | SSNs used on applications submitted after date of death: 
131 SSNs connected to $10.4 million in potential fraudulent payments.
In total, we identified 3,109 SSNs used in this manner on loan applications and believe these are likely instances of 
identity fraud. Of these applications, 131 SSNs received loan disbursements totaling $10.4 million. 
Although SBA in January 2021 (for PPP) and April 2021 (for COVID-19 EIDL) began to check applicants against 
DNP, our analysis found 41 deceased individuals’ SSNs were used on 45 loan disbursements after this control was 
implemented. This underscores the importance of GAO’s recommendation for Congress to accelerate and make 
permanent the requirement for SSA to share the full DMF with Treasury for inclusion in the DNP system.  Additionally, 
implementing DNP still requires agencies to do their own due diligence when they receive a positive match. 
Table 2. Timing of Disbursements for the 3,109 SSNs used on PPP/COVID-19 EIDL applications 
submitted after the SSN owner’s Date of Death
Timeframe*
SSNs used on 
applications submitted 
after death date
SSNs used on 
disbursements after 
death date**
Disbursements 
using these SSNs 
Total dollar value
Before Use of DNP
2,783
91
108
$ 7.47 million
After Use of DNP
375
41
45
$ 2.96 million
Total**
3,109
131
153
$10.43 million
Source: PRAC data analysis of SSNs used on PPP/COVID-19 EIDL applications after date of death.
*Pre-control update includes PPP loans between April 2020 and January 2021 and COVID-19 EIDL loans between March 2020 and April
2021. Post-control update includes PPP loans between January 2021 and October 2022 and COVID-19 EIDL loans between April 2021 and
October 2022.
**The number of SSNs and applications are not a one-for-one match given that a distinct SSN could have been used across multiple COVID-19 
EIDL and/or PPP applications that were disbursed and undisbursed. Therefore, an SSN can be associated with multiple applications.
We also identified particularly egregious examples in Scenario 1 where SSNs had an associated date of death one 
year prior or earlier to the declaration of the pandemic – March 11, 2020. Specifically, 30 SSNs were used in this 
manner on applications that received $1.3 million in total. These examples suggest these identities may have been 
exploited for years by wrongdoers in attempts to fraudulently obtain other government benefits. 

6
Pandemic Response Accountability Committee | May 2023
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
Scenario 2 | SSNs identified in Scenario 1 also used on applications submitted 
before individual’s date of death:  
92 SSNs connected to $13.4 million in potential fraudulent payments.
We further examined the SSNs identified in the scenario above and found that 169 of these 3,109 SSNs had been 
used on loan applications that were submitted both before and after the associated individuals’ date of death, and 
that 92 SSNs received loan disbursements totaling an additional $13.4 million.12 We believe these are instances of 
potential identity fraud.  
Scenario 3 | SSNs used on applications belonging to individuals alive at time of 
application but deceased before disbursement:  
113 SSNs associated with $14.1 million in improper payments.
We found an additional 113 SSNs used in this manner on 118 loan applications that received a loan disbursement. 
We believe these are potentially improper payments, but not necessarily fraudulent.13
While PPP loans were disbursed by lenders to applicants in a lump sum, COVID-19 EIDL loans could be distributed 
in incremental or partial payments.14 In programs like this, continuous monitoring and recertification of eligibility 
through additional DNP checks can help prevent and deter improper payments. For example, in 2021, SBA added a 
control in its COVID-19 EIDL program to detect late-stage bank account changes prior to disbursement. Beginning in 
2021, SBA also conducted one last fraud check in its loan system of record to identify any duplicate and/or potential 
suspicious loans prior to disbursement and issuance of a loan number. This approach is consistent with GAO’s fraud 
risk management framework, which requires agencies to automate data-analytic tests to monitor fraud indicators on 
a continuous, real-time basis.15
12 
While applications submitted while the SSN owner was still alive are not inherently fraudulent, because they were also used on applications following their 
associated date of death, this could indicate that these SSNs may have already been exploited while the individuals were still alive, indicating potentially 
fraudulent activity.
13 
While these individuals were alive at the time the applications were submitted, DNP sources show that they were deceased at the time federal funds were 
released to them. The Payment Integrity Information Act of 2019, which authorizes and governs DNP, requires agencies to use DNP sources as a control 
before the release of federal funds.
14 
The PPP data the PRAC received from SBA does not include a disbursement date. According to SBA guidance, the lender must disburse the loan no later 
than 10 days from the date of loan approval. Therefore, we derived the disbursement date as 10 days after the application date.
15 
GAO, “A Framework For Managing Risk in Federal Programs,” GAO-15-593SP, July 2015: The objective of fraud risk management is to ensure program 
integrity by continuously and strategically mitigating the likelihood and impact of fraud and facilitate achievement of the program’s broader mission and 
strategic goals by helping to ensure that funds are spent effectively, services fulfill their intended purpose, and assets are safeguarded. Additionally, in the 
context of fraud risk management, the objective is to mitigate fraud risks—in general, to have a very low level of fraud.

7
Pandemic Response Accountability Committee | May 2023
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
Our Approach and Analysis
As discussed in our January 2023 Fraud Alert, the PRAC’s data scientists identified a targeted selection of 2.7 
million SSNs associated with COVID-19 EIDL loan applications that fell under two rule sets:
1. potentially invalid SSNs; and
2. SSNs potentially “not issued” prior to June 2011
Due to limited access to the necessary government information for proper verification, we used our CARES Act 
authorities to request SSA’s assistance to provide several verification results on this cohort of 2.7 million SSNs. One 
such request was for SSA to verify if any of the SSNs used on associated loan applications were associated with 
deceased individuals. SSA could only provide the death indicator information for fully verified SSNs. The SSA was 
able to determine that 20,404 out of the 2.7 million SSNs belong to deceased individuals.
What Did We Ask DNP to Do? 
As the date of death was not provided in SSA’s verification output, we requested Treasury DNP to provide the date 
of death for the 20,404 deceased individuals’ SSNs to perform additional analysis.  DNP provided the information 
using several data sources available to them including: 
1. Electronic Verification of Vital Events Fact of Death (EVVE);16
2. Department of State;
3. American InfoSource Obituary;
4. American InfoSource Probate;
5. Limited Access Death Master File; and
6. Department of Defense Death Data
What Analyses Did We Perform?
Using the date of death results returned from DNP, the PRAC data scientists identified 15,307 SSNs where at least 
one of DNP’s data sources returned a date of death. From this data set, the PRAC identified 5,640 distinct SSNs tied 
to deceased individuals who received payments from 8,536 PPP loans and/or COVID-19 EIDL applications, totaling 
$374 million.17 Of these, we identified 3,222 SSNs used on applications across the three scenarios. The 3,222 is a 
subset of the 15,307 containing both disbursed and undisbursed SSNs.18
16 
This data set from NAPHSIS | Electronic Verification comes from 44 states and jurisdictions and, therefore, helps cover the state protected records that are 
missing from the Limited Access DMF.
17 
The PRAC identified COVID-19 EIDL applications and PPP loans using only the deceased SSNs, including applications where the associated first name, last 
name, and date of birth may not have matched with the respective data attributes in the deceased SSN data set. We determined that this was appropriate 
as all identified SSNs in this population had been confirmed as deceased by SSA. Therefore, any instance with one of these SSNs is questionable and 
warrants inclusion in our analysis.
18 
The remaining 9,667 SSNs (15,307-5,640) are undisbursed SSNs.

8
Pandemic Response Accountability Committee | May 2023
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
The data scientists conducted time-based analysis to better understand the timing of the applications and 
disbursements in relation to the dates of death, including:
1. SSNs used in COVID-19 EIDL/PPP applications where the date of death preceded the submission date;
2. SSNs used in multiple COVID-19 EIDL/PPP applications both before and after the date of death; and
3. SSNs used in COVID-19 EIDL/PPP applications where the date of death was after the submission date but
preceded the payment date
Of the 15,307 SSNs returned by DNP, there are 191 SSNs where DNP’s data sources returned different dates of 
death. According to DNP Analytics, the EVVE death source has a higher degree of certainty; in cases where there 
are multiple dates of death with the same SSN, DNP Analytics recommends using the EVVE death date. In the 191 
SSNs with multiple dates of death, there are 62 SSNs where the earliest date of death available does not match the 
EVVE death date. For 53 of these 62 SSNs, the earliest death date is within 30 days of the EVVE death date. For the 
remaining 9 SSNs, the earliest death date differs by 31 days or more from the EVVE death date. We determined that 
this is not a significant margin of error. Therefore, for trends and patterns analysis that require date comparison, the 
PRAC used the earliest date of death returned by DNP data sources for applicable SSNs. 
PRAC’s Commitment to Quality and Integrity
We conducted this review using agile oversight principles that require we adhere to the professional standards 
of independence, due professional care, and quality assurance and follow procedures to ensure accuracy of the 
information presented. These principles are embedded in the Council of the Inspectors General on Integrity and 
Efficiency’s Quality Standards for Federal Offices of Inspectors General.

For more information:
Lisa Reijula
Associate Director, Outreach and Engagement
Lisa.Reijula@cigie.gov
Visit us at:
PandemicOversight.gov
Follow us at:
@COVID_Oversight
Report Fraud, Waste, Abuse, or Misconduct:
To report allegations of fraud, waste, abuse, or  
misconduct regarding pandemic relief funds or programs 
please go to the PRAC website at
PandemicOversight.gov.
A Committee of the
Council of the Inspectors General
on Integrity and Efficiency

File and source

File

2023-05-follow-up-deceased-ssns-do-not-pay-fraud-alert.pdf

Size

337,822 bytes

SHA-256

21c1036ee086c1bf8b53ba6e058cdb1b1145a1dabc99cb6bdf8630a57b1bb4ef

Our copy

2023-05-follow-up-deceased-ssns-do-not-pay-fraud-alert.pdf

Original

www.pandemicoversight.gov