Explainer · Pandemic-relief fraud

Lying on the form worked: two-thirds of PPP dollars were approved before full checks ran

Pandemic-relief fraud was rarely a hack. The application worked the way it was built to work: you certified the truth under penalty of perjury, clicked submit, and days later the money arrived. More than $200 billion was later flagged as potential fraud across the two big loan programs; DOJ has publicly announced charges covering about $2 billion in alleged loss so far. Below are seven ways it was done, and the specific check that was switched off for each. A flag is not a conviction, and most relief went to real businesses; the cases named here are the ones that ended in one.

2026-09-1712 min read · interactiveSources: SBA OIG, GAO, DOJ, PRAC, DOL-OIG, TIGTA — listed below

>$200B

flagged as potentially fraudulent, PPP + EIDLSBA OIG 23-09

~$36B

SBA's own “likely fraud” estimate, across PPP and COVID-EIDLSBA, June 2023

>$2B

alleged loss in announced charges; more than 3,500 defendants chargedDOJ Task Force, 2024

~$1.2M

median amount per prosecuted PPP defendant (charged or convicted)PD prosecution database · n=1,416

1 · The only lock on the door was your signature

Every relief program asked the applicant to certify — that the business existed, that the payroll was real, that the money was needed — under penalty of perjury. In a normal loan, a lender then verifies those claims. In 2020, for most of the money, almost nobody did. Congress told the SBA to accept self-certification instead of verifying documents, and the program was built to disburse in days. Flip the year toggle to watch which checks were actually running — and which never switched on at all.

Fig. 01 · interactive

Six checks a normal loan runs — and how many were live when the pandemic money went out

Green = a real check ran before the money left. Amber = a weak or partial check. Red = self-certified only; the applicant's word was the control. Toggle 2020 and 2021.

The 2021 controls were a Treasury Do Not Pay match plus 19 fraud-detection rules, and SBA told the Senate the 2021 process “eliminated instant approval of applications.” But by GAO's accounting they went live only after ~$525 billion — about 66% of all PPP — had already been approved. And the check that mattered most for lying about money never reached the lender: PPP lenders were never given IRS transcript access. SBA says its own 2021 front-end checks verified income with the IRS; the lender making the loan still could not. Source: CARES Act · SBA OIG 22-13 / 23-09 · GAO-25-107267 · SBA testimony, Senate Small Business Cmte, Aug 2 2022 · SBA Procedural Notices 5000-20083 / 5000-20092

2 · Seven playbooks, from the applicant's chair

Fraud took a handful of recognizable shapes, and they map onto which program was easiest to fool and which check was missing. Pick one to see how it was done, the loophole it turned, and the real case that ended in a conviction.

Read it straightThese seven are the documented shapes of applicant-side fraud — invented businesses, faked payroll, stolen identities. The dollar figures on each card are the amounts charged or the sums an inspector general flagged, not a single audited loss. Where a whole category (like the 2021 self-employed surge) was mostly legitimate, the card says so.

3 · Why nobody stopped it — the loophole ledger

Each playbook above turned a specific, documented gap. None of them was a secret; most were written into the rules on purpose, to move money fast in a genuine emergency. This is the ledger of what was switched off, which decision switched it off, and what inspectors general later estimated it cost. Filter by program.

The check that was off	The decision behind it	What inspectors general estimated it cost

4 · The same shape, more exposed at each program

In this case set, identity theft concentrated where verification was thinnest. PPP at least had a lender and a business; unemployment's Pandemic Assistance had a self-certifying worker with no employer to verify anything.

Fig. 02

Identity theft climbs as the program gets easier to fake

Share of prosecuted cases in which stolen or synthetic identities were the mechanism, by program (1,977 classified DOJ cases; 1,740 tagged PPP, 849 EIDL, 88 unemployment).

Pandemic Unemployment Assistance let non-traditional workers qualify by self-certifying a COVID reason, with no employer to verify it — so an undocumented claim could keep paying. In four states DOL-OIG tested, $30.4B of $71.7B in PUA and FPUC benefits was paid improperly — 42.4 percent, DOL-OIG's own figure, across March–September 2020. Source: PD DOJ-case classification · DOL-OIG (Sept 2022) · PRAC

The caveat. The three headline numbers — >$200B flagged, ~$36B likely, >$2B charged — are measured at three different bars: a statistical flag, a reviewer's judgment, and a prosecutor's charging decision. The >$200B and the ~$36B both cover PPP and COVID-EIDL; DOJ's charged total spans every pandemic program. Most relief money reached real businesses and real workers, and most of the 2021 self-employed surge was genuine borrowers finally made eligible. This page maps how the documented fraud was committed and why the controls didn't catch it — not an accusation against any borrower, lender, or platform not named in a filing. Who facilitated fraud — and whether the popular “fintech fraud” label fairly swept in the banks and nonprofit lenders it hit — is a separate, contested question, handled in its own analysis.

Method & sources

Every scheme card pairs a documented mechanism with an adjudicated case — a guilty plea, conviction, or sentence in the federal record. Case facts (defendant, amount, sentence) are drawn from Department of Justice charging documents and press releases and a database of prosecuted relief-fraud cases. The loophole ledger draws on inspector-general and oversight reporting: SBA OIG, GAO, the Pandemic Response Accountability Committee (PRAC), DOL-OIG, and TIGTA. Dollar figures are labeled by their evidentiary bar — a Documented conviction amount is not the same as an Estimate of “potential” or “improper” payments, which are indicator- or sample-based and much larger than what has been proven.

MethodThe seven playbooks are the applicant-side fraud types the project documents across PPP, EIDL, unemployment/PUA, and the Employee Retention Credit; the project also tracks facilitator, lender-insider, preparer, and grant-program (SVOG/RRF) variants not foregrounded here. “Potential fraud,” “likely fraud,” and “improper payment” are estimates, not audited losses; the underlying agency PDFs control for exact figures and quotations.

Sources. SBA OIG Report 23-09 (original: sba.gov · stored capture), COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Jun 27 2023); SBA OIG 22-13, 24-06, 25-04 (original: oversight.gov · stored capture) (non-bank lender oversight), 25-18; GAO-23-105331 (original: gao.gov · stored capture) (DOJ-charged fraud-scheme taxonomy), GAO-25-107267 (original: gao.gov · stored capture) (front-end control timeline); DOJ COVID-19 Fraud Enforcement Task Force 2024 Report; PRAC fraud alerts (69,323 questionable SSNs / $5.4B; deceased-SSN follow-up); DOL-OIG 19-22-006-03-315 (original: oversight.gov · stored capture) (Sept 30 2022 — the $30.4B of $71.7B / 42.4% improper-payment estimate); TIGTA 2024-400-068 (ERC pre-refund examination). Federal Register: first PPP Interim Final Rule 85 FR 20811 (Apr 15 2020); Schedule C gross-income rule 86 FR 13149 (Mar 3/8 2021). Case facts from DOJ charging documents / press releases. Program totals: PPP 11,468,210 loans / $792.6B; EIDL 3,680,124 loans / $370.3B.

In the archive

PPP fraud, by year & draw PPP guide EIDL guide Fraud prosecutions All interactives