Court filing
SBA OIG Report 22-17 — COVID-19 EIDL Applications from Foreign IP Addresses
Filed September 12, 2022 in SBA OIG 22 17 EIDL Foreign Ip Applications, the only filing from this case in the archive.
Record facts
| Court | SBA Office of Inspector General |
|---|---|
| Filed | 2022-09-12 |
Full text
COVID-19 ECONOMIC INJURY DISASTER LOAN
APPLICATIONS SUBMITTED FROM
FOREIGN IP ADDRESSES
REPORT NUMBER 22-17 | SEPTEMBER 12, 2022
S B A I N S P E C T O R G E N E R A L E V A L U A T I O N R E P O R T
E
S
XECUTIVE UMMARY
COVID-19 ECONOMIC INJURY DISASTER LOAN
APPLICATIONS SUBMITTED FROM FOREIGN IP ADDRESSES
Report 22-17
September
12, 2022
What OIG Reviewed
Our objective was to assess the U.S. Small Business
Administration’s (SBA) controls to flag or prevent
potentially fraudulent Coronavirus Disease 2019
(COVID-19) Economic Injury Disaster Loan (EIDL)
applications submitted from foreign Internet Protocol
(IP) addresses.
We reviewed SBA policies and procedures, interviewed
agency and contractor officials, and analyzed SBA’s
COVID-19 EIDL data.
What OIG Found
Although the agency implemented several layers of
controls to prevent or reduce fraud from foreign
countries, individuals at foreign IP addresses were able
to access the COVID-19 EIDL application system.
SBA received millions of attempts to submit COVID-19
EIDL applications from foreign IP addresses and
stopped most of them; however, the agency processed
more than 233,000 of these applications from March
20, 2020 to November 12, 2021, our review period. Of
this amount, SBA approved and disbursed 41,638
COVID-19 EIDLs, advances, and grants for $1.3 billion.
Although applicants that reside overseas may qualify
for this assistance, transnational crime entities in
foreign countries have fraudulently obtained funding
from this and other U.S. programs in the past.
The numerous applications submitted from foreign IP
addresses are an indication of potential fraud that may
involve international criminal organizations. OIG has
ongoing investigations into international organized
crime operations that applied for and stole pandemic
relief funds.
SBA officials were aware of and concerned about the
potential fraud from overseas. SBA hired a contractor
to process 27.8 million COVID-19 EIDL applications as
of December 31, 2021. SBA and contractor officials
designed a system of four layers of internal controls to
prevent loan applications from foreign IP addresses.
Control layers 1 and 2 were supposed to block (1) the
submission of applications from foreign IP addresses in
six countries deemed high risk and (2) the completion
of applications from foreign IP addresses in all foreign
countries. We found both controls did not always block
these applications.
If a loan application from a foreign IP address made it
past the first two controls, control layer 3 was for the
system to flag the application. Control layer 4 was to
have a loan officer thoroughly review the flagged
application to determine if the applicant was eligible.
We used a judgmental sample of 50 COVID-19 EIDL
applications submitted from foreign IP addresses to
test control layers 3 and 4. We found 16 applications
were not flagged by the system and another 15
applications were flagged by the system but were not
properly reviewed by loan officers before loans were
approved and disbursed.
SBA acknowledged that the controls did not perform as
intended and will not be used in future or current
application systems.
OIG Recommendations
We recommended the agency thoroughly review the
loans in our test sample and the $1.3 billion disbursed
to applicants from foreign IP addresses. The agency
should stop any further or future disbursements to any
applicants deemed to be ineligible or fraudulent. We
also recommended SBA recover any disbursed loans
and advances determined to be ineligible or fraudulent.
Additionally, we recommended that the agency
examine controls related to foreign IP addresses and
ensure these controls are more effective in future
disaster processing systems.
Agency Response
Management partially agreed with recommendation 1,
stating they would conduct a proactive review of
COVID-19 EIDL applications that received funds for
potentially ineligible or fraudulent businesses. They
will attempt recovery and continue to refer suspected
fraud to the OIG. Management also emphasized that the
applications approved from foreign IP addresses were
a small proportion of all applications. SBA agreed with
recommendation 2, stating the agency will examine
controls related to foreign IP addresses and ensure
these controls are more effective in future disaster
processing systems.
U.S. Small Business Administration
Office of Inspector General
DATE:
September 12, 2022
TO:
Isabella Casillas Guzman
Administrator
FROM:
Hannibal “Mike” Ware
Inspector General
SUBJECT:
COVID-19 Economic Injury Disaster Loan Applications Submitted from
Foreign IP Addresses
This report presents the results of our evaluation COVID-19 Economic Injury Disaster Loan
Applications Submitted from Foreign IP Addresses. We considered management’s comments
on the draft of this report when preparing the final report. Management partially agreed to
one recommendation and agreed with the other recommendation.
We appreciate the cooperation and courtesies provided by your staff. If you have any
questions, contact me or Andrea Deadwyler, Assistant Inspector General for Audits, at
(202) 205-6586.
cc:
Arthur Plews, Chief of Staff
Patrick Kelley, Associate Administrator, Office of Capital Access
Peggy Delinois Hamilton, Special Counsel for Enterprise Risk
Therese Meers, Acting General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Katherine Aaby, Associate Administrator, Office of Performance, Planning, and the
Chief Financial Officer
Erica Gaddy, Deputy Chief Financial Officer
John Miller, Deputy Associate Administrator, Office of Capital Access
Tonia Butler, Director, Office of Internal Controls
Table of Contents
Introduction ................................................................................................................................................................ 1
Background ............................................................................................................................................................. 1
Record-setting Funding Amounts ............................................................................................................ 1
Historic Application Volumes for COVID-19 EIDLs .......................................................................... 1
Overview of the COVID-19 Application Process ................................................................................ 2
Figure 1. SBA’s COVID-19 EIDL Application Process ....................................................................... 3
SBA Can No Longer Accept New Applications .................................................................................... 3
Objective .................................................................................................................................................................. 4
Results....................................................................................................................................................................... 4
Finding: SBA’s Controls Did Not Prevent All COVID-19 EIDL Applications from Foreign IP
Addresses ..................................................................................................................................................................... 5
Structure and Function of SBA Foreign IP Controls .............................................................................. 5
Figure 2. Four Layers of Control in SBA’s System ............................................................................. 5
Control Layer 1 = Firewall 1 – The Intake Point Control ............................................................... 6
Table 1. Attempts to Access COVID-19 EIDL Application System from IP Addresses
Located in Six Countries Deemed High Risk ........................................................................................ 7
Table 2. COVID-19 EIDL Funds to Applicants with IP Addresses Located in Six
Countries Deemed High Risk ...................................................................................................................... 8
Control Layer 2 = Firewall 2 - The Client Portal Control ................................................................ 8
Table 3. Applications Processed by Country ....................................................................................... 9
Control Layer 3 = Contractor System Flags ....................................................................................... 10
Table 4. Results of OIG Audit Test of System Flagging for Foreign IP Addresses ............. 11
Control Layer 4 = Loan Officer Review ............................................................................................... 11
Table 5. OIG Test Results of Loan Officer Review of Flagged Loan Applications from
Foreign IP Addresses .................................................................................................................................. 13
Conclusion ............................................................................................................................................................ 13
Recommendations ............................................................................................................................................ 14
Analysis of Agency Response ........................................................................................................................... 15
Summary of Actions Necessary to Close the Recommendations ................................................. 15
Appendix I: Objective, Scope, and Methodology ...................................................................................... 17
Appendix II: Prior Work ..................................................................................................................................... 19
Table 6. OIG Prior Oversight Work on SBA’s COVID-19 EIDL Program .................................... 19
Appendix III: Foreign IP Loan Data by Country ....................................................................................... 20
Appendix IV: Management Comments ......................................................................................................... 30
1
Introduction
The U.S. Small Business Administration’s (SBA) disaster assistance is the federal
government’s primary program for assisting small businesses, small agricultural
cooperatives, and most private, nonprofit organizations after declared disasters. The
program provides up to $2 million in disaster assistance loans to help eligible entities meet
financial obligations and operating expenses after a disaster.
Background
A series of national relief packages aimed at easing the economic effects of the Coronavirus
Disease 2019 (COVID-19) pandemic directed SBA, in accordance with the Small Business
Act, to provide COVID-19 Economic Injury Disaster Loans (EIDL) and additional funds in
three grant and advance programs, emergency EIDL grants, Targeted EIDL Advances, and
Supplemental Targeted Advances to affected eligible entities.1 We refer to the three
programs as EIDL grants and advances in this report.
The laws also expanded the types of organizations that qualified for the funding to small
businesses to include small agricultural cooperatives, most private, nonprofit
organizations, cooperatives, Employee Stock Ownership Plans, and tribal concerns, all with
no more than 500 employees, then to sole proprietorships, independent contractors, and
agricultural enterprises. Agricultural enterprises are small businesses in food and fiber
production, ranching and raising livestock, aquaculture, or other farming or agricultural-
related industries.2
To be eligible, an entity must have been in business on or before January 31, 2020,
adversely affected by the COVID-19 pandemic, and located in the United States or U.S.
territories.
Record-setting Funding Amounts
The national relief packages tasked SBA with quickly lending an enormous amount of
taxpayer funds: $500 billion in COVID-19 EIDLs; $20 billion in COVID-19 emergency EIDL
grants, up to $10,000 each; $30 billion in Targeted EIDL Advances, up to $10,000 each; and
$5 billion in Supplemental Targeted Advances, up to $5,000 each. Since the agency’s
inception in 1953, SBA has provided more disaster assistance funding through these
programs than in its entire history.
Historic Application Volumes for COVID-19 EIDLs
SBA suddenly had to process an unprecedented number of applications. On March 31,
2020, more than 680,000 applications were submitted to SBA, the highest number of loan
1 Public Law 116-123 - Coronavirus Preparedness and Response Supplemental Appropriations Act (March 6, 2020);
Public Law 116-136 - Coronavirus Aid, Relief, and Economic Security Act (March 27, 2020); Public Law 116-139 -
Paycheck Protection Program and Health Care Enhancement Act (April 24, 2020); and Economic Aid to Hard-Hit Small
Businesses, Nonprofits, and Venues Act (December 27, 2020); American Rescue Plan Act of 2021 (March 11, 2021).
2 Small Business Act 15 U.S.C. 647(b), section 18(b).
2
applications the agency had ever received in a day. By April 10, 2020, SBA had received
more than 4.5 million loan applications, well above the average of 65,000 per year before
the pandemic. By December 31, 2021, SBA had received 27.8 million COVID-19 EIDL
applications.
SBA hired a contractor to process COVID-19 EIDL applications and make recommendations
to approve or deny loan applications. SBA loan officers or team leads would give final
approval of each application.
Overview of the COVID-19 Application Process
EIDL relief eligibility, in accordance with U.S.C. Title 8, Chapter 14, Section 1611, is limited
to U.S. citizens, noncitizen nationals, and qualified aliens.3 Therefore, those applicants
located at foreign Internet Protocol (IP) addresses could be legitimate if they controlled at
least a 20 percent share of an eligible entity, were adversely affected by the COVID-19
pandemic, located in the United States or U.S. territories, and in business on or before
January 31, 2020.
Although individuals who reside overseas may qualify for the assistance if they meet the
eligibility requirements, the fraud risk was high because of the history of fraud originating
from transnational crime organizations that have stolen funds from U.S programs in the
past. SBA was concerned with potential fraud from overseas and elected to block or flag all
applications from foreign IP addresses. To reduce fraud and cyber threats, SBA and the
contractor designed four layers of technical computing controls, known as firewalls (two
digital entry blocks), electronic flags (alerts), and human intervention (loan officer review)
to prevent fraud (See Figure 1). SBA did not have a plan to address how qualifying
individuals overseas could apply for this relief.
3 Part of the Immigration and Nationality Act.
3
Figure 1. SBA’s COVID-19 EIDL Application Process
Source: SBA and its contractor
SBA Can No Longer Accept New Applications
As of January 1, 2022, SBA stopped accepting new COVID-19 EIDL applications. Because of
lack of funds as of May 6, 2022, SBA was no longer accepting requests for increases to
COVID-19 EIDLs or reconsiderations of previously declined loan applications. Finally, on
May 16, 2022, the COVID-19 EIDL portal closed.
4
Objective
Our objective was to assess SBA’s internal controls in place to flag or prevent potentially
fraudulent COVID-19 EIDL applications submitted from foreign IP addresses.
Results
Despite the four layers of controls SBA
and its contractor established, we found
that SBA disbursed 15,873 COVID-19
EIDLs totaling $1.2 billion and 25,765
EIDL grants and advances totaling $111.5
million, as of November 12, 2021, the end
of our review period, to individuals who
submitted applications from foreign IP
addresses. These were applications
missed by the first two layers of controls.
The third and fourth layers of controls
were designed to flag any applications
missed by the first two layers and ensure
SBA loan officers reviewed them. From a
judgmental sample of 50 COVID EIDL applications, we found the system did not flag 16
applications. The controls did flag the remaining 34 applications in our sample. However,
we found loan officers did not properly review 15 of the flagged applications in accordance
with written procedures to address and mitigate potential fraud indicators.
5
Finding: SBA’s Controls Did Not Prevent All COVID-19
EIDL Applications from Foreign IP Addresses
We found that as of November 12, 2021, SBA had disbursed approximately $1.2 billion in
COVID-19 EIDLs and $111.5 million in EIDL grants and advances to applicants whose initial
application came from a foreign IP address.
Although SBA’s contractor provided evidence that the controls prevented individuals
located at a foreign IP address from accessing the system millions of times, we determined
the controls did not prevent such access more than 233,000 times. In addition, we found
problems with the flagging of applications from foreign IP addresses and the vetting of
those applications. From a judgmental sample of 50 COVID-19 EIDL applications, we found
the system did not flag 16 applications. The controls did flag 34 applications in our sample.
However, we found loan officers did not properly review 15 of the 34 flagged applications
in accordance with policies and procedures in place to prevent potentially fraudulent
applications.
Structure and Function of SBA Foreign IP Controls
The contractor’s system to process COVID-19 EIDL applications comprised at least two
access portals (intake point and client portal). When a potential applicant went to SBA’s
website to apply for a COVID-19 EIDL, the system would redirect to one of the contractor’s
access portals, referred to here as the “intake point” for initial applications and the “client
portal” for the completion of applications (see Figure 2). In general, the intake point should
have blocked all applicants from six foreign countries deemed high risk (Layer 1 = Firewall
1) from accessing the contractor’s system and the client portal (Layer 2 = Firewall 2)
should have blocked all foreign applicants not deemed high risk from completing
applications submitted to the intake point from all foreign countries.
Figure 2. Four Layers of Control in SBA’s System
Source: OIG analysis of SBA’s COVID-19 EIDL control structure
SBA speculated that applicants could have used technology to subvert the controls. During
our review, SBA acknowledged that the controls did not perform as intended and will not
be in use in future or current application systems.
6
As we describe in detail below, applicants were able to submit COVID-19 applications from
foreign IP addresses although there were layers of controls intended to prevent this and to
address the potential fraud risk. In addition, we asked SBA why Layer 1 and 2 controls had
separate application blocking criteria designed to prevent applications from foreign
countries. SBA officials stated there were points in time in 2020 where the decision by SBA
was to not block all foreign IP addresses. SBA did not maintain any information as to why
they made the different blocking criteria decisions in 2020. Thus, it is unknown why Layer
1 control was designed to prevent applications from six high-risk countries and Layer 2
control was designed to prevent the completion of applications from all foreign countries.
Control Layer 1 = Firewall 1 – The Intake Point Control
The first control between the applicant and contractor’s access portal, called the “intake
point,” of the system was designed to prevent submission of COVID-19 EIDL applications
from IP addresses in six countries categorized as high risk by a third-party software vendor
used by SBA’s contractor.
If Firewall 1 did not find the IP address was geolocated in one of the specified countries
deemed high risk, the applicant was allowed to fill out a COVID-19 EIDL application and
submit it. Once an application was submitted, the system executed various controls, such as
checking the applicant’s credit score and other identifying information. If the application
passed these controls and checks, the applicant would then be invited back to finish
additional application requirements in a second access portal, called the “client portal,” on
return to the system.
Firewall 1 should have prevented anyone at IP addresses in countries deemed high risk
from accessing the intake point. The contractor stated the firewall blocked 110,549
attempts from the six countries in May 2021 alone (see Table 1). We were unable to get
information on the number of attempts for other time periods because SBA’s contractor did
not maintain more than 1 month of information on blocked attempts.
7
Table 1. Attempts to Access COVID-19 EIDL Application System from IP
Addresses Located in Six Countries Deemed High Risk
Country
Number of
Attempts
High-Risk Country 1
71,174
High-Risk Country 2
9,681
High-Risk Country 3
3,901
High-Risk Country 4
389
High-Risk Country 5
0
High-Risk Country 6
25,404
Total
110,549
Source: SBA contractor data for May 2021
Our analysis of SBA’s COVID-19 loan, grant, and advance data revealed that between March
20, 2020 and November 12, 2021, 3,097 applications from the six countries deemed high
risk were not blocked.
Those applications were processed, approved, and disbursed a total of $14.3 million in
COVID-19 EIDLs and emergency EIDL grants (see Table 2).
8
Table 2. COVID-19 EIDL Funds to Applicants with IP Addresses Located
in Six Countries Deemed High Risk
Country
Applications
Submitted
Total
Approved
Grants
and
Advances
Total
Approved
Amount,
Grants and
Advances
(dollars)
Total
Approved
EIDLs
Total
Amount,
EIDLs
(dollars)
Total
Disbursed
Amount
(dollars)
High-Risk Country
1
488
64
$316,000
26
$1,268,100
$1,584,100
High-Risk Country
2
1,338
187
1,040,000
108
7,475,600
8,515,600
High-Risk Country
3
112
8
26,000
4
139,900
165,900
High-Risk Country
4
104
6
36,000
0
0
36,000
High-Risk Country
5
0
0
0
0
0
0
High-Risk Country
6
1,055
100
448,000
47
3,568,800
4,016,800
Total
3,097
365
$1,866,000
185
$12,452,400
$14,318,400
Source: SBA COVID-19 EIDL, grant, and advance data as of November 12, 2021
We asked the contractor why the control did not block access from all six countries
completely and how applicants were able to subvert Firewall 1. Their response was that
they could not guarantee 100 percent effectiveness. The contractor speculated that the IP
addresses could be masked. Neither SBA nor its contractor knew why so many applications
were able to subvert Firewall 1.
During our evaluation, SBA transitioned the responsibility of the COVID-19 EIDL program
from the Office of Disaster Assistance to the Office of Capital Access on June 29, 2021. After
the transition, we asked the Office of Capital Access why the control was designed to block
applications from only six countries deemed high risk when the Layer 2 control was
designed to block the completion of all applications from all foreign countries. Again, SBA
officials did not know why this decision was made at the onset of the program. After our
questions, SBA and the contractor confirmed that SBA had directed the contractor on July
19, 2021 to block IP addresses of all foreign countries from accessing the intake point.
Control Layer 2 = Firewall 2 - The Client Portal Control
The control at the client portal was supposed to prevent applicants from all foreign IP
addresses from accessing the system and completing COVID-19 EIDL applications. The
contractor’s data showed Firewall 2 blocked more than 1.6 million attempts by applicants
located at foreign IP addresses from accessing the client portal in May 2021. Again, we
9
were unable to get information on the number of attempts for other time periods because
SBA’s contractor does not maintain more than 1 month of information on blocked attempts.
In addition to blocking foreign IP addresses, the contractor banned some IP addresses for
repeated attempts to access the system and various other reasons. In total, the contractor
banned more than 32,000 IP addresses located in foreign countries.
The blocking and banning of foreign IP addresses showed the system had some effect on
preventing applications from foreign countries. However, we found Firewalls 1 and 2 did
not prevent the completion of 233,872 applications submitted from foreign IP addresses at
the intake point and the disbursement of $1.3 billion in COVID-19 EIDLs and grants (see
Table 3).
Table 3. Applications Processed by Country
Country
Applications
Submitted
Total
Approved
Grants
and
Advances
Total
Approved
Amount,
Advances
(dollars)
Total
Approved
EIDLs
Total Amount,
EIDLs
(dollars)
Total
Disbursed
Amount
(dollars)
Nigeria
33,477
241
$1,109,000
496
$18,452,300
$19,561,300
Pakistan
29,290
632
3,353,000
483
43,862,300
47,215,300
Canada
20,500
3,755
19,236,000
2,062
164,071,090
183,307,090
Mexico
14,656
3,100
12,740,000
2,081
145,128,775
157,868,775
United
Kingdom
12,007
1,358
6,418,000
834
59,884,398
66,302,398
Philippines
9,762
658
3,399,000
335
25,902,800
29,301,800
Dominican
Republic
9,524
781
3,750,000
564
30,397,700
34,147,700
India
9,273
1,561
6,763,000
1,061
137,027,317
143,790,317
Germany
6,061
719
3,056,000
355
18,106,768
21,162,768
All other
countries
89,322
12,960
51,666,000
7,602
560,044,698
611,710,698
Total
233,872
25,765 $111,490,000
15,873 $1,202,878,146 $1,314,368,146
Source: OIG analysis of SBA’s COVID-19 EIDL, grant, and advance data from March 20, 2020 to November 12,
2021
We believe there is a significant risk of potential fraud in applications submitted from
foreign IP addresses. SBA was also concerned with this risk because agency officials
recommended blocking all applications from foreign IP addresses at program outset.
However, the control did not prevent all applications from foreign countries. Neither SBA
nor its contractor knew how so many applications were able to subvert Firewall 2.
10
Control Layer 3 = Contractor System Flags
If the software did not detect a foreign IP address, the applicant would be admitted to the
client portal to finish their application. To complete COVID-19 EIDL applications, the
applicant would verify their identity, submit any needed additional documents and
information, and eventually sign the loan agreement to receive the funds.
SBA and the contractor officials told us they had been concerned about the risk that
Firewall 1 and 2 controls might be bypassed. Technologically savvy ineligible applicants
might use computer technology, such as virtual private networks (VPNs), proxy servers, or
The Onion Router, commonly known as TOR, to mask their actual locations, enter the
system, and apply for American relief funds.
In case some applicants were able to bypass system controls, the contractor installed a
third-party software program to identify and flag attempts to mask the actual location of
applicants.
If the software identified a foreign IP address, it electronically flagged the COVID-19 EIDL
application with an alert warning of “Client location is international” or “high-risk IP
address.”
Client Location Is International. This flag alerted loan officers that the applicant
accessed the loan system from a location outside the United States and its
territories, indicating a high risk of fraud.
High-risk IP. This flag alerted the loan officer that a device used to electronically
submit the loan application may have been used in fraudulent activity. For example,
if the application came from a domestic IP address as a proxy or if a connection to
the “dark web” was detected. The dark web is the area of the internet that allows
users to be anonymous.
If the software did not detect an IP address, or the IP address was in some way suspect, the
software flagged the application with an alert of “suspicious online behavior.”
Suspicious Online Behavior. This flag alerted loan officers if different devices had
accessed the system, the data had been associated with possible online fraud, or if
there was an attempt to bypass fraud checks.
To test the third control layer, we judgmentally selected a sample of 50 approved and
disbursed COVID-19 EIDLs from the loan data from locations in 12 foreign countries
geographically dispersed across the world. We reviewed the selected loan files to
determine if the software had flagged them.
We found 34 applications, totaling $5.3 million, were properly flagged by the software.
However, 16 applications out of the 50 in our sample were not identified or flagged by the
contractor’s third-party software intended to alert loan officers to properly mitigate these
flags. These 16 applications were processed, approved, and disbursed for a total amount of
more than $3.1 million. Without the software alert flags, loan officers were unaware that
additional vetting was needed for approval (see Table 4).
11
Table 4. Results of OIG Audit Test of System Flagging for Foreign IP
Addresses
Country
Loans
Tested
Flagged
by
System*
System
Did
Not
Flag
EIDL
Amount
Not
Flagged
(dollars)
Grant
and
Advance
Amount
Not
Flagged
(dollars)
Total
Disbursed
Amount Not
Flagged
(dollars)
Afghanistan
4
2
2
$162,300
$6,000
$168,300
China
4
1
3
406,000
13,000
419,000
Dominican
Republic
5
4
1
174,400
5,000
179,400
India
5
2
3
897,400
5,000
902,400
Iraq
4
4
0
0
0
0
Israel
5
5
0
0
0
0
Nigeria
5
4
1
150,000
0
150,000
Russia
4
2
2
300,000
4,000
304,000
Syria
1
1
0
0
0
0
United
Kingdom
5
3
2
719,000
11,000
730,000
Venezuela
4
3
1
150,000
2,000
152,000
Yemen
4
3
1
150,000
1,000
151,000
Total
50
34
16
$3,109,100
$47,000
$3,156,100
Source: OIG analysis
*COVID-19 EIDL applications flagged by the system for any of these three fraud alerts: “Client location is
international,” “High-risk IP address,” and “Suspicious online behavior.”
Control Layer 4 = Loan Officer Review
The fourth layer of control established by SBA and the contractor required a review by the
loan officers to address or clear alert flags on the applications. SBA and the contractor
released written procedures on April 13, 2020 and revised them five times over the next
year, outlining specific loan officer actions on how to properly mitigate these alert flags. In
this layer, COVID-19 EIDL applications flagged by the system for any of these three fraud
alerts: “Client location is international,” “High-risk IP address,” and “Suspicious online
behavior” required review and approval by a loan officer.
SBA policy required the following:
12
Client Location Is International. The procedures required loan officers to confirm
the business was physically located within the United States or a U.S. territory
before approving the application. If not, the officer was supposed to deny the
application.
High-risk IP. This alert flag was not added until the written procedures were
revised on April 20, 2021. The written procedures required the loan officer to call
the applicant to verify the applicant’s identity, but there was no requirement for a
loan officer to obtain a copy of valid identification.
Suspicious Online Behavior. Prior to April 20, 2021, the written procedures
required the loan officer to automatically deny the loan.
SBA revised the written procedures on April 20, 2021, reversing the automatic denial. The
revision required loan officers to call the applicant to verify identity and request a copy of
valid identification within 7 days. If the applicant’s identity could not be verified, then the
loan would be denied.
To test these alert flags, we reviewed the 34 loan files in our testing sample flagged by the
system. These files were tagged in the system with the fraud alert flags, “Client location is
international,” “Suspicious online behavior,” or “High-risk IP address.”
We found 19 of the files, totaling about $2.9 million, had been properly reviewed before
loan approval. However, 15 loan files, totaling about $2.4 million, were not vetted by the
loan officers before loan approval and disbursement (see Table 5).
We asked SBA officials why applications with fraud flags were approved without a loan
officer addressing these alerts. SBA officials informed us that there were several factors:
• For five of the loan applications, “the file was sent to the approved queue by the
system” bypassing loan officer review;
• For seven of the applications, the reference guide did not provide direction for fraud
alerts. However, we found the reference guide did provide loan officer actions to
mitigate or deny the loan based on fraud alerts; and
• For six of the applications, the fraud alert did not exist at time of approval. However,
there is no data field for the date the alert flags were created, and it is uncertain
when the alert flags were created by the system. Therefore, the fraud flag may or
may not have existed at the time of loan office review.
The total number of exceptions exceeds the number of files because the response provided
for each file consisted of more than one of the factors or reasons listed above.
13
Table 5. OIG Test Results of Loan Officer Review of Flagged Loan
Applications from Foreign IP Addresses
Country
Flags
Loan
Officer
Mitigated
Loan
Officer Did
Not
Mitigate
EIDL
Amount
(dollars)*
Grant and
Advance
Amount
(dollars)*
Total
Disbursed
Amount
(dollars)*
Afghanistan
2
2
0
0
0
0
China
1
1
0
0
0
0
Dominican
Republic
4
3
1
150,000
1,000
151,000
India
2
2
0
0
0
0
Iraq
4
2
2
103,500
2,000
105,500
Israel
5
3
2
300,000
17,000
317,000
Nigeria
4
1
3
450,000
14,000
464,000
Russia
2
1
1
150,000
10,000
160,000
Syria
1
0
1
21,500
1,000
22,500
United
Kingdom
3
2
1
300,700
0
300,700
Venezuela
3
1
2
650,000
8,000
658,000
Yemen
3
1
2
213,800
3,000
216,800
Total
34
19
15 $2,339,500
$56,000
$2,395,500
Source: OIG analysis of SBA COVID-19 data
*For applications not mitigated by the loan officer.
Conclusion
The agency implemented several layers of controls to prevent or reduce fraud with
firewalls or alerts designed to prevent applications originating from foreign countries. We
believe the system blocked a majority of the applications from foreign IP addresses.
However, we found that applicants with foreign IP addresses were able to access the
system more than 233,000 times, resulting in $1.3 billion in COVID-19 EIDL funding to
applicants in foreign countries who may not have been eligible.
14
Recommendations
We recommend the Administrator direct the Associate Administrator for the Office of
Capital Access in conjunction with the Associate Administrator for Disaster Assistance and
Chief Information Officer to:
1. Thoroughly review each COVID-19 EIDL, grant, and advance application submitted
from foreign IP addresses that were approved and funded and verify eligibility. If
ineligibility or evidence of potential fraud is found, SBA should stop any further or
future disbursements, recover any disbursed funds, and refer fraudulent loans to
OIG for investigation.
2. Examine controls related to foreign IP addresses and ensure these controls are more
effective in future disaster processing systems.
15
Analysis of Agency Response
SBA management provided formal comments to the draft report, which are included in
Appendix IV. Management partially agreed with recommendation 1 and agreed with
recommendation 2. The proposed actions will resolve both recommendations and
management will provide implementation dates by separate correspondence. We
considered management’s comments when preparing this final report.
Regarding recommendation 1, management partially agreed and proposed actions that
were responsive to the recommendation. Specifically, management agreed that controls
initially in place to flag and prevent the applications from high-risk countries did not do so
consistently. However, they stated that “The $1.3 billion identified by the OIG that
originated from applications submitted from a foreign IP address represents less than .04
percent of the more than $342 billion approved by SBA for COVID EIDL advances and
loans.” OIG acknowledges that the percentage of disbursements identified may seem small,
however, we believe that $1.3 billion in taxpayer funds to individuals or businesses that
should not have received it is significant. We reported that the numerous applications
submitted from foreign IP addresses are an indication of potential fraud that may involve
international criminal organizations. Also, OIG has ongoing investigations into
international organized crime operations that applied for and stole pandemic relief funds.
Consequently, it is concerning that $1.3 billion intended to assist small businesses during
the pandemic potentially funded illegal activities worldwide, making it critical that proper
controls are in place and working as intended.
Summary of Actions Necessary to Close the Recommendations
Recommendation 1
Thoroughly review each COVID-19 EIDL, grant, and advance application submitted from
foreign IP addresses that were approved and funded and verify eligibility. If ineligibility or
evidence of potential fraud is found, SBA should stop any further or future disbursements,
recover any disbursed funds, and refer fraudulent loans to OIG for investigation.
Status: Resolved
Management partially agreed with our recommendation and stated SBA will conduct a
proactive review using additional data analytics of COVID EIDL applications that received
funds for potentially ineligible or fraudulent businesses. Management further stated SBA
will attempt recovery and continue to refer all suspected cases of fraud to OIG to be
investigated. Management’s proposed actions were responsive to the recommendation, and
we consider this recommendation to be resolved.
This recommendation can be closed when management provides evidence that the agency
has completed the review of the over 233,000 applications from foreign IP addresses and
then recovered, or at a minimum, attempted to recover funds and referred potentially
fraudulent loans to OIG.
16
Recommendation 2
Examine controls related to foreign IP addresses and ensure these controls are more
effective in future disaster processing systems.
Status: Resolved
Management agreed with this recommendation to examine controls related to foreign IP
addresses and ensure these controls are more effective in future disaster processing
systems. Management’s proposed actions were responsive to the recommendation, and we
consider this recommendation to be resolved.
This recommendation can be closed when management provides evidence that they have
examined controls related to foreign IP addresses and they have implemented a system
with adequate controls to prevent access from foreign IP addresses or to adequately vet
access from foreign IP addresses.
17
Appendix I: Objective, Scope, and Methodology
Our objective was to assess SBA’s controls in place to flag or prevent potentially fraudulent
applications for the COVID-19 EIDL program submitted from foreign IP addresses not in a
U.S. territory.
To meet our objective, we reviewed the following:
• Coronavirus Aid, Relief, and Economic Security Act
• Coronavirus Preparedness and Response Supplemental Appropriations Act
• SOP 50 30 9, Disaster Assistance Program
• SBA Rapid Decision Reference Guides (dated April 13, 2020 through April 20, 2021)
• SBA contractor data for COVID-19 EIDLs, grants, and advances
• U.S.C. Title 8, Chapter 14, Section 1611
We interviewed SBA officials at the Office of Disaster Assistance, Office of Capital Access,
and the Office of the Chief Information Officer. We also interviewed officials of the
contractor used by SBA to process COVID-19 EIDLs.
We obtained data for COVID-19 EIDLs from March 20, 2020 through November 12, 2021
from the contractor’s system and loan approval and disbursement data from SBA’s system,
known as ETRAN. Within this data, we used a private vendor geolocation tool to identify IP
addresses located outside the United States and its territories.
We attempted to assess the reliability of the data by performing limited testing. However,
neither SBA nor the contractor provided source information to us to perform data
reliability testing. As a result, the reliability of the ETRAN and subcontractor’s system data
is undetermined. But it produces the best available data, which SBA uses to manage the
program and derive program statistics.
Additionally, SBA and contractor officials told us the login records of the client portal were
not reliable to use in this review. SBA’s contractor told us the computer software at the
client portal was not updated to capture the increased number of characters of the newer
Internet Protocol version 6 addresses, but that it did not affect the login records of the
application intake point. Consequently, we were unable to reliably analyze the foreign IP
addresses that accessed the client portal. Based on the contractor’s statement, our analyses
about devices with foreign IP addresses accessing the initial application submitted at the
intake point remain reliable.
We ran the IP addresses in the loan data through a geolocation software tool from a private
vendor to identify the internet provider used by the applicant and the location of the device
used to submit the application. The geolocator tool that we used to identify the applications
received from outside the U. S. and its territories is used by OIG Investigations Division and
other government agencies. This geolocator tool asserts a 99.8 percent accuracy rate for
identifying the internet service providers and specific locations of the submitted IP
addresses.
We judgmentally selected 50 COVID-19 EIDL applications submitted from 12 randomly
selected countries. These specific loans were selected in order to provide a wide or
reasonable representation of countries. To confirm that the IP addresses used to submit
18
these 50 EIDLs were from outside the United States and its territories, we used a second
and distinct geolocator tool to retest them. This tool confirmed that all 50 EIDL applications
in our test sample had come from the foreign location identified by the first geolocator tool.
We selected a sample of 50 loans approved between April 20, 2020 and April 23, 2021,
totaling more than $8.4 million. These were judgmentally selected because they originated
from the 12 randomly selected countries. We tested the 50 EIDL files to determine whether
SBA had identified the foreign source of the loan application, and if so, whether a loan
officer reviewed the system flag to determine whether the application was legitimately
from an eligible applicant.
We conducted this evaluation in accordance with the Council of the Inspectors General on
Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. These standards
require that we plan and perform the inspection to obtain sufficient, appropriate evidence
to provide a reasonable basis for our conclusions and observations based on our objectives.
19
Appendix II: Prior Work
Table 6. OIG Prior Oversight Work on SBA’s COVID-19 EIDL
Program
Report Title
Report Number
Final Report Date
COVID-19 EIDL Program
Recipients on the Department of
Treasury’s Do Not Pay List
SBA OIG 22-06
November 30,
2021
SBA’s Emergency EIDL Grants
to Sole Proprietors and
Independent Contractors
SBA OIG 22-01
October 7, 2021
SBA’s Handling of Identity Theft
in the COVID-19 EIDL Program
SBA OIG 21-15
May 6, 2021
Serious Concerns About SBA’s
Control Environment and the
Tracking of Performance
Results in the Shuttered Venue
Operators Grant Program
SBA OIG 21-13
April 7, 2021
Inspection of Small Business
Administration’s Initial Disaster
Assistance Response to the
Coronavirus Pandemic
SBA OIG 21-02
October 28, 2020
Serious Concerns of Potential
Fraud in EIDL Program
Pertaining to the Response to
COVID-19
SBA-OIG 20-16
July 28, 2020
White Paper: Risk Awareness
and Lessons Learned from
Audits and Inspections of EIDLs
and Other Disaster Lending
SBA OIG 20-12
April 3, 2020
Source: SBA OIG
20
Appendix III: Foreign IP Loan Data by Country
The following table is a comprehensive list of COVID-19 EIDLs disbursed for approved loan applications submitted to SBA
from foreign IP addresses in descending order of total number of applications. The countries are listed from higher to lower
based on the number of applications submitted.
Country
Applications
Submitted
Total
Approved
Grants and
Advances
Total
Approved
Amount,
Grants and
Advances
(dollars)
Total
Approved
EIDLs
Total Amount,
EIDLs (dollars)
Total
Disbursed
Amount
(dollars)
Nigeria
33,477
241
$1,109,000
496
$18,452,300
$19,561,300
Pakistan
29,290
632
3,353,000
483
43,862,300
47,215,300
Canada
20,500
3,755
19,236,000
2,062
164,071,090
183,307,090
Mexico
14,656
3,100
12,740,000
2,081
145,128,775
157,868,775
United
Kingdom
12,007
1,358
6,418,000
834
59,884,398
66,302,398
Philippines
9,762
658
3,399,000
335
25,902,800
29,301,800
Dominican
Republic
9,524
781
3,750,000
564
30,397,700
34,147,700
India
9,273
1561
6,763,000
1061
137,027,317
143,790,317
Germany
6,061
719
3,056,000
355
18,106,768
21,162,768
Netherlands
4,583
337
1,812,000
218
15,422,400
17,234,400
Ghana
4,313
68
351,000
59
3,273,100
3,624,100
Colombia
3,956
811
2,776,000
588
38,187,300
40,963,300
France
3,632
438
1,885,000
248
16,639,600
18,524,600
Israel
3,198
917
3,460,000
656
72,275,200
75,735,200
Turkey
3,030
298
883,000
158
12,808,900
13,691,900
Spain
2,967
540
1,363,000
284
20,934,800
22,297,800
21
South Africa
2,723
127
591,000
126
9,275,300
9,866,300
Jamaica
2,525
191
812,000
168
8,596,500
9,408,500
United Arab
Emirates
2,459
183
748,000
92
9,900,800
10,648,800
Australia
2,315
330
1,284,000
184
12,920,800
14,204,800
Brazil
2,285
373
1,557,000
225
15,016,000
16,573,000
Japan
2,052
396
1,695,000
172
7,183,700
8,878,700
South Korea
1,830
397
1,295,000
159
11,609,000
12,904,000
Kenya
1,508
90
453,000
54
5,176,300
5,629,300
Italy
1,483
295
945,000
142
10,899,100
11,844,100
Switzerland
1,471
202
787,000
98
7,557,700
8,344,700
Costa Rica
1,458
389
1,356,000
280
23,914,000
25,270,000
Egypt
1,338
187
1,040,000
108
7,475,600
8,515,600
Thailand
1,231
311
1,174,000
167
9,080,900
10,254,900
Argentina
1,146
317
1,403,000
135
7,625,900
9,028,900
Hong Kong
1,124
224
1,021,000
97
6,698,300
7,719,300
Vietnam
1,099
312
1,050,000
127
9,011,300
10,061,300
Romania
1076
90
331,000
45
4,018,500
4,349,500
Russia
1055
100
448,000
47
3,568,800
4,016,800
Singapore
933
156
707,000
70
4,767,200
5,474,200
Ecuador
923
159
501,000
96
6,217,800
6,718,800
Venezuela
874
187
526,000
70
5,014,400
5,540,400
Taiwan
827
230
656,000
89
6,328,400
6,984,400
Morocco
822
83
511,000
39
1,898,400
2,409,400
Burkina
Faso
816
7
64,000
10
610,300
674,300
Ukraine
812
106
419,000
74
6,834,500
7,253,500
Portugal
781
116
360,000
78
3,736,800
4,096,800
22
Bulgaria
768
89
338,000
64
4,837,400
5,175,400
Ethiopia
740
50
422,000
47
3,149,100
3,571,100
Peru
692
204
652,000
140
7,186,400
7,838,400
Jordan
680
96
410,000
57
4,578,500
4,988,500
Greece
607
101
355,000
76
4,954,900
5,309,900
Austria
603
71
299,000
43
2,958,700
3,257,700
Haiti
597
41
201,000
33
1,281,100
1,482,100
Malaysia
589
43
179,000
30
1,840,900
2,019,900
Nicaragua
557
122
497,000
108
12,241,800
12,738,800
Belgium
550
87
389,000
38
2,114,900
2,503,900
Bangladesh
538
81
688,000
58
5,621,200
6,309,200
Indonesia
532
98
329,000
62
4,207,399
4,536,399
Ireland
520
109
557,000
62
6,241,100
6,798,100
Senegal
507
45
300,000
30
1,243,200
1,543,200
Sweden
497
83
285,000
51
3,094,800
3,379,800
China
488
64
316,000
26
1,268,100
1,584,100
Bahamas
479
75
332,000
49
2,768,100
3,100,100
Poland
472
90
273,000
55
2,549,000
2,822,000
Panama
444
105
426,000
82
7,678,400
8,104,400
Cyprus
437
14
51,000
12
378,100
429,100
New
Zealand
428
139
489,000
78
6,085,200
6,574,200
Chile
384
82
323,000
38
3,475,200
3,798,200
Serbia
378
78
273,000
62
7,088,500
7,361,500
Georgia
369
43
142,000
23
1,023,700
1,165,700
Guatemala
366
87
302,000
47
2,238,400
2,540,400
Afghanistan
358
70
299,000
31
1,289,700
1,588,700
Honduras
350
67
317,000
44
3,491,100
3,808,100
23
Saudi Arabia
342
86
340,000
32
1,742,500
2,082,500
Armenia
313
45
197,000
27
2,084,900
2,281,900
Belize
301
35
173,000
29
966,900
1,139,900
Denmark
294
64
397,000
35
1,438,500
1,835,500
Albania
290
19
96,000
11
1,073,600
1,169,600
Benin
289
2
16,000
2
67,300
83,300
Kuwait
285
72
371,000
25
1,160,100
1,531,100
Lebanon
268
57
235,000
46
4,608,600
4,843,600
Czechia
263
49
148,000
23
1,100,600
1,248,600
El Salvador
256
32
149,000
22
2,603,100
2,752,100
Iraq
256
26
148,000
16
538,800
686,800
Norway
252
38
83,000
28
845,500
928,500
Antigua and
Barbuda
240
17
75,000
12
2,177,000
2,252,000
Palestine
225
27
78,000
16
1,401,500
1,479,500
Finland
223
18
63,000
15
1,542,300
1,605,300
Cambodia
216
29
105,000
18
944,900
1,049,900
Bahrain
211
30
195,000
18
648,400
843,400
Somalia
210
15
144,000
4
208,000
352,000
Luxembourg
207
25
147,000
6
287,300
434,300
Hungary
201
39
116,000
29
2,814,000
2,930,000
Uganda
199
21
130,000
11
720,100
850,100
Barbados
198
26
131,000
21
1,514,499
1,645,499
Tanzania
195
9
30,000
8
276,800
306,800
Trinidad
and Tobago
194
47
185,000
31
2,043,500
2,228,500
Uzbekistan
192
26
108,000
12
1,470,500
1,578,500
Algeria
181
20
117,000
4
57,100
174,100
24
Cameroon
179
13
88,000
10
553,700
641,700
Sudan
178
10
69,000
5
530,300
599,300
Croatia
177
41
255,000
21
1,161,000
1,416,000
Cuba
175
28
82,000
8
194,200
276,200
Ivory Coast
172
8
38,000
8
403,900
441,900
Liberia
169
11
69,000
11
517,000
586,000
Nepal
167
26
91,000
13
588,100
679,100
Moldova
154
27
84,000
12
802,600
886,600
Tunisia
154
12
60,000
8
648,100
708,100
Yemen
154
10
77,000
5
629,600
706,600
Togo
153
2
2,000
6
215,800
217,800
Guinea
151
9
107,000
3
208,500
315,500
Qatar
142
34
126,000
17
679,600
805,600
Mali
139
8
79,000
5
858,700
937,700
Iceland
137
18
76,000
15
1,168,900
1,244,900
Sri Lanka
136
26
119,000
16
1,148,300
1,267,300
Guyana
132
13
63,000
6
328,100
391,100
Bolivia
131
39
151,000
18
648,500
799,500
Gambia
131
7
54,000
5
578,000
632,000
Sierra Leone
121
9
20,000
3
171,000
191,000
Azerbaijan
118
9
12,000
4
177,000
189,000
Belarus
118
28
129,000
10
742,000
871,000
Iran
112
8
26,000
4
139,900
165,900
Cayman
Islands
111
32
103,000
15
2,361,000
2,464,000
Aruba
110
10
31,000
8
251,200
282,200
North
Macedonia
110
27
108,000
13
1,477,400
1,585,400
25
Lithuania
108
20
53,000
9
910,600
963,600
Slovakia
106
17
98,000
8
834,200
932,200
Uruguay
106
21
72,000
11
801,800
873,800
Eritrea
104
8
26,000
4
181000
207,000
Mauritania
104
6
36,000
0
0
36,000
Mongolia
101
11
72,000
4
731,600
803,600
Estonia
96
12
39,000
6
246,500
285,500
Latvia
89
21
122,000
11
629,800
751,800
Bosnia and
Herzegovina
88
14
75,000
14
1,116,300
1,191,300
Myanmar
83
40
226,000
10
835,300
1,061,300
Kyrgyzstan
74
13
49,000
7
729,200
778,200
DR Congo
70
2
5,000
1
150,000
155,000
Saint Lucia
68
15
66,000
7
277,700
343,700
Sint Maarten
68
16
55,000
16
1,154,500
1,209,500
British
Virgin
Islands
64
12
30,000
13
975,500
1,005,500
Rwanda
62
5
26,000
6
870,200
896,200
Seychelles
61
4
23,000
4
110,900
133,900
Bermuda
57
11
52,000
9
367,100
419,100
Curacao
57
20
64,000
14
791,500
855,500
Anguilla
53
8
12,000
5
271,600
283,600
Turks and
Caicos
Islands
52
12
54,000
6
839,700
893,700
Kazakhstan
50
6
12,000
3
164,000
176,000
Grenada
47
7
37,000
5
103,300
140,300
26
Oman
46
6
20,000
4
60,500
80,500
Tajikistan
46
7
65,000
3
62800
127,800
Botswana
43
1
1,000
0
0
1,000
Saint
Vincent and
the
Grenadines
43
7
26,000
4
348,000
374,000
Djibouti
42
6
18,000
5
98,000
116,000
Saint Martin
38
7
49,000
3
217,500
266,500
St Kitts and
Nevis
38
6
32,000
5
727,000
759,000
Montenegro
36
4
21,000
3
186,500
207,500
Mauritius
35
4
13,000
0
0
13,000
Zimbabwe
34
1
1,000
0
0
1,000
Cabo Verde
31
1
15,000
1
69,900
84,900
Malta
30
4
4,000
4
1,261,900
1,265,900
Dominica
29
4
14,000
5
243,600
257,600
Slovenia
28
6
39,000
1
20,000
59,000
Laos
27
4
33,000
1
24,000
57,000
Zambia
24
0
0
1
13,000
13,000
Paraguay
23
4
21,000
3
107,700
128,700
Macao
21
4
13000
2
58,900
71,900
Libya
19
2
2,000
0
0
2,000
Niger
19
0
0
0
0
0
Guadeloupe
18
4
17000
2
98500
115,500
Reunion
18
0
0
0
0
0
French
Polynesia
15
2
2,000
1
11600
13,600
27
Gabon
15
1
10000
0
0
10,000
Angola
13
0
0
1
24,400
24,400
Maldives
13
1
15000
1
4,800
19,800
Syria
13
2
2,000
1
21,500
23,500
Namibia
12
1
4,000
1
76,500
80,500
Samoa
12
1
15000
2
106,000
121,000
Malawi
11
0
0
3
147,300
147,300
Lesotho
10
2
12,000
0
0
12,000
Mozambique
10
3
15,000
2
183,900
198,900
Principality
of Monaco
9
3
3,000
2
88,000
91,000
Greenland
8
0
0
0
0
0
Saint
Barthelemy
8
1
1,000
1
301300
302,300
Andorra
7
2
3,000
2
154700
157,700
Fiji
7
2
11,000
0
0
11,000
Burundi
6
0
0
0
0
0
Eswatini
6
1
1000
0
0
1,000
Isle of Man
6
1
5000
0
0
5,000
Sao Tome
and Principe
6
2
2000
0
0
2,000
Bhutan
5
1
1,000
1
107,000
108,000
Bonaire, Sint
Eustatius,
and Saba
5
1
1,000
1
150,000
151,000
Brunei
5
0
0
0
0
0
Chad
5
0
0
0
0
0
Congo
Republic
5
1
1000
0
0
1,000
28
French
Guiana
5
0
0
0
0
0
Palau
5
3
9000
1
36,400
45,400
Tonga
5
0
0
0
0
0
Martinique
4
0
0
1
549900
549,900
Central
African
Republic
3
0
0
0
0
0
Guernsey
3
1
10000
1
500000
510,000
Jersey
3
0
0
0
0
0
New
Caledonia
3
0
0
0
0
0
British
Indian
Ocean
Territory
2
0
0
0
0
0
Gibraltar
2
0
0
0
0
0
Kosovo
2
0
0
0
0
0
Papua New
Guinea
2
2
21,000
0
0
21,000
Suriname
2
0
0
0
0
0
Cook Islands
1
0
0
0
0
0
Equatorial
Guinea
1
1
8000
0
0
8,000
Madagascar
1
1
1000
0
0
1,000
Marshall
Islands
1
0
0
0
0
0
Montserrat
1
1
1000
1
10100
11,100
29
Pitcairn
Islands
1
0
0
0
0
0
Total
233,872
25,765
$111,490,000
15,873
$1,202,878,146 $1,314,368,146
Source: OIG analysis, SBA COVID-19 loan data as of November 12, 2021
30
Appendix IV: Management Comments
SBA RESPONSE TO EVALUATION REPORT
[1]
To:
Hannibal “Mike” Ware
Inspector General
Office of Inspector General (OIG)
From:
Patrick Kelley /Patrick Kelly
Associate Administrator
Office of Capital Access
Subject:
Response to OIG Draft Report entitled “COVID-19 Economic Injury Disaster Loan
Applications Submitted from Foreign IP Addresses” (Project 21803)
Date:
August 24, 2022
Thank you for providing the Office of Capital Access (OCA) the opportunity to respond to OIG’s Draft
Report entitled, “COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP
Addresses,” dated July 21, 2022. The objective of this audit was to assess the U.S. Small Business
Administration’s (SBA) controls internal controls in place to flag or prevent potentially fraudulent
COVID-19 EIDL applications submitted from foreign internet protocol (IP) addresses.
It is important to remember that the COVID-19 Pandemic posed a national health and economic crisis
of historic proportions equivalent to very few events in our country’s history. As a result, the initial
focus of SBA’s COVID relief programs had to be on providing financial assistance as quickly as possible
to respond to the crisis.
While it is true that great speed was needed when developing the COVID EIDL program and to deliver
this economic assistance to millions of small businesses impacted by the pandemic; we do not believe
there is a tradeoff between speed and fraud controls. SBA Administrator Isabella Guzman has directed
the agency to operate with both speed and certainty.
The scope of the audit evaluates COVID EIDL applications received from March 20, 2020, through
November 12, 2021. During this time, SBA received and processed over 21 million COVID EIDL
applications and approved over 3.8 million loan requests totaling more than $296 billion. SBA also
approved 5.8 million EIDL Advances totaling $20 billion, 486,000 Targeted EIDL Advances for $4.2
billion, and 390,000 Supplemental Targeted EIDL Advances for $2 billion. All together SBA provided
over $342 billion across 10.5 million COVID EIDL advances and loans.
Only one percent of all COVID EIDL applications successfully submitted to SBA originated from a
foreign IP address, and just .01 percent were associated with a foreign country deemed high risk.
As mentioned in the OIG report, the initial system control established by the contractor and the
previous administration was intended to block incoming applications from foreign IP addresses
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
[2]
originating from six foreign countries deemed high risk. The system control successfully blocked
millions of attempts from foreign IP addresses to access the application intake portal. However, the
control was not 100 percent successful; out of millions of failed attempts, 3,097 applications
originating from an IP address associated with one of six foreign countries deemed high risk were able
to access the application intake portal and submit a COVID EIDL application. The represents just .01
percent of the 21 million COVID EIDL applications submitted through the intake portal through
November 12, 2021.
Less than .04 percent of all COVID EIDL advances and loans approved were associated with an
application submitted from a foreign IP address, and less than .005 percent were associated with a
foreign country deemed high risk.
As stated earlier, the COVID EIDL program provided millions of small businesses with hundreds of
billions of dollars in direct assistance to help them with emergency working capital needs through the
pandemic. As of November 12, 2021, SBA had approved over 3.8 million loan applications totaling
more than $296 billion. During this same period, the SBA also approved 6.7 million advances totaling
more than $26.2 billion across three separate advance programs, including the EIDL Advance,
Targeted EIDL Advance and Supplemental Targeted Advance. Less than .04 percent of all COVID EIDL
advances and loans approved through the scope of the audit were associated with an application
submitted from a foreign IP address. Furthermore, just 185 loans equating to less than .005 percent of
loans and advances approved during this period originated from a foreign IP address from one of the
six countries deemed a high risk by the previous administration when setting up the control. Our
teams are reviewing the 185 loans to ensure the proper holds were put in place and stop any further
disbursements from being made to the applicant. Already we have found that funds were returned by
the bank to SBA on four of the loans, which means loan funds did not reach those accounts.
The $1.3 billion identified by the OIG that originated from applications submitted from a foreign IP
address represents less than .04 percent of the more than $342 billion approved by SBA for COVID
EIDL advances and loans.
Out of the $342 billion approved by the SBA through November 12, 2021, the OIG report found that
$1.3 billion was associated with an application that originated from a foreign IP address, which
accounts for less than .04 percent of all funds approved for the COVID EIDL program during this
period. Furthermore, the total dollar amount of COVID EIDL funds approved to the six foreign
countries deemed high risk – $14.3 million – represents .004 percent of the total advance and loan
funds approved by the SBA during the scope of the audit.
OIG Recommendation 1 – Thoroughly review each COVID-19 EIDL, grant, and advance application
submitted from foreign IP addresses that were approved and funded and verify eligibility. If
ineligibility or evidence of potential fraud is found, SBA should stop any further or future
disbursements, recover any disbursed funds, and refer fraudulent loans to OIG for investigation.
SBA Response: SBA partially agrees with the recommendation. We have already initiated a thorough
review of the COVID EIDL applications that originated from a foreign IP address from one of the six
countries deemed high risk, which should have been blocked by the established system controls
during the scope of the audit. SBA will flag and conduct a proactive review using additional data
[3]
analytics on the approximately 35,000 unique files and stop any possible future disbursements on
COVID EIDL applications that originated from a foreign IP address. Based upon the results of the data
analytics, SBA will attempt recovery of improperly disbursed funds and will continue to refer all
suspected cases of fraud to the OIG to be investigated and will support those criminal investigations
and prosecutions conducted by the OIG, DOJ, and other law enforcement agencies.
The Office of Capital Access (OCA) has the following comments with respect to the OIG
recommendation 1:
SBA partially concurs with this recommendation. Based on our initial review, we found there were
approximately 35,000 unique COVID EIDL applications that originated from a foreign IP addresses and
funds were disbursed. SBA will conduct a proactive review of COVID EIDL applications that received
funds for potentially ineligible or fraudulent businesses using additional data analytics.
The system control established during this period was designed to block access to the application
intake portal for six foreign countries deemed to be high risk. The total number of advances and loans
approved that originated from applications submitted from foreign IP addresses from these six
countries account for less than .005 percent of all COVID EIDL advances and loans approved during the
scope of the audit. Furthermore, as the OIG acknowledged in the draft report, a business is not
outrightly ineligible for COVID EIDL assistance simply because the individual who accessed the
application intake portal did so from a foreign IP address. There are many scenarios where business
owners, officers, accountants, or other representatives of an eligible business entity needed to apply
for the COVID EIDL program from overseas, either out of necessity or convenience. It is important to
remember that in the early months of the COVID-19 Pandemic, strict quarantine rules and travel
restrictions delayed some people from returning to the United States. Because of the limited funds
available for the COVID EIDL Advance program, there was a real sense of urgency to apply as soon as
possible for business owners out of fear the funds would be exhausted quickly. Those concerns were
validated when the SBA approved 5.8 million COVID EIDL advances and exhausted the full $20 billion
appropriated by Congress in just over 90 days.
SBA will attempt recovery and will continue to refer all suspected cases of fraud to the OIG to be
investigated and will support those criminal investigations and prosecutions conducted by the OIG,
DOJ, and other law enforcement agencies. We were pleased to see President Biden sign bipartisan
legislation – the COVID–19 EIDL Fraud Statute of Limitations Act of 2022 – which doubles the statute of
limitations for criminal investigations and prosecutions of fraudsters that stole taxpayer-funded
assistance intended to help legitimate small businesses.
OIG Recommendation 2 – Examine controls related to foreign IP addresses and ensure these controls
are more effective in future disaster processing systems.
SBA Response: SBA concurs with this recommendation and agrees to examine controls related to
foreign IP addresses and ensure these controls are more effective in future disaster processing
systems.File and source
- File
- 22-17-eidl-foreign-ip-applications.pdf
- Size
- 1,092,815 bytes
- SHA-256
- 525e2e6156283b0d8d253b19cedd663fb7e817a73b3758985bb2859b9e516c2d
- Original
- smallbusiness.house.gov