Two-thirds of PPP dollars were approved before SBA expanded fraud screening in January 2021
Three federal bodies size PPP fraud at figures two orders of magnitude apart: SBA’s Inspector General flags >$200B across PPP and EIDL (~$64B, ~8%, in PPP alone), the agency itself calls ~$36B “likely” across its pandemic programs, and prosecutors have charged >$2B in alleged loss. None of them splits the fraud number by program year or by first- versus second-draw loan. What the record can show: the weakest controls and most of the dollars were front-loaded into 2020, while 2021’s rule and lender changes moved fraud’s shape — toward a self-certified, fintech-routed sole-proprietor wave — more than its total.
“How much PPP fraud was there?” has no single answer because the three institutions that count it are answering three different questions. The Inspector General counts every dollar that touched a statistical fraud indicator. The agency counts dollars a human reviewer judged likely enough to refer. Prosecutors count dollars they can prove in court. Ask whether 2021 was worse than 2020, or second-draw loans worse than first, and a second problem appears: only one of these three lenses can even see the calendar, and none can see the draw.
1. Three lenses on the same program
Select a source to see its number, its standard of proof, and, for a year-or-draw question, what it is structurally able to break out.
2. 2020 vs 2021: the money went first, the controls came later
PPP’s automated front-end fraud screening — Do Not Pay, the “in operation on 15 Feb 2020” check, and a set of 19 detection rules — did not exist for most of the program. By GAO’s accounting, more than $525 billion — about 66% of all PPP dollars — was approved before those controls went live in early 2021. Toggle a year to see its profile.
The two PPP vintages had different control regimes — and opposite fraud signals
2020 (Round 1) disbursed most of the money before SBA expanded its fraud screening; 2021 (Round 2) ran under the expanded screening but is where fintech “suspicious lending” indicators rose sharpest. The two credible directional signals point opposite ways because they measure different things.
The controls got stronger in 2021 and the fraud indicators got worse in 2021. Both are true, because the first is about the door and the second is about who walked through it.The 2021 paradox — stronger screening, weaker channel
3. First draw vs second draw: same door, different applicants
Congress created second-draw loans in the Economic Aid Act of 27 Dec 2020: a borrower could return for a second PPP loan only if it had a first-draw loan already and could certify a 25% revenue drop. GAO found the two draws faced the same Round 2 screening. Second-draw applicants were pre-vetted and had to clear a revenue test; the 2021 first-draw wave was overwhelmingly new, self-certified sole proprietors. Toggle a draw to see the structural profile and the fraud vector each one opens.
Within 2021, first-draw and second-draw loans were almost mirror images
The 2021 round split into many small first-draw loans (new borrowers, $18,181 average) and fewer, larger second-draw loans (returning borrowers past a revenue-loss test, $72,703 average). Figures recomputed loan-by-loan from the SBA PPP FOIA file.
ProcessingMethod (PPP = first draw, PPS = second draw), reconciled to the 11,468,210 / $792.6B program total. Within 2021: first-draw 3.48M / $63.2B (avg $18,181) vs second-draw 2.86M / $207.6B (avg $72,703). Program-wide first-draw = 8.61M / $585.0B (all 2020 loans are first-draw by definition); second-draw = 2.86M / $207.6B (2021 only). GAO-21-577 established the two draws faced the same Round 2 screening; no source scores their realized fraud rate separately.
Source: SBA PPP FOIA loan file (Sept 30 2024 release) · GAO-21-577 · Economic Aid Act (Dec 27 2020)4. What kind of fraud — the type mix neither year nor draw resolves
Type is the one dimension the evidence does support. GAO coded 330 DOJ-charged PPP/EIDL cases through 2021; our own conviction database codes the dominant scheme in 1,794 PPP cases. The two records disagree on which scheme leads: GAO's indicator coding puts fictitious or inflated employees (73%), document falsification (69%) and non-operating businesses (67%) far ahead of identity theft (19%), while in the conviction database identity theft (11.9%) is the largest specified scheme — almost three times fabricated business and inflated payroll combined (1.8% and 2.3%). Three-quarters of that database is coded unspecified, so its specified subset is small. Switch the source — and note that neither can be split by program year or draw: charged cases carry no reliable loan-origination date, and press releases recite “Congress created PPP in March 2020” boilerplate that contaminates any text-based year cut.
Which scheme leads depends on which record you read
Two records, two coding schemes. GAO codes any indicator present in a charged case (rows sum past 100% — cases carry several). Our conviction database codes the single dominant scheme (rows are near-exclusive; three-quarters of press releases never specify a scheme).
5. Why the two years diverged: program, population, lender
Three changes fired between January and early April 2021 and pulled partly against each other. A real front-end identity gate went up at the same moment a new self-certified population was routed through two thinly-capitalized aggregators. Pick a driver.
- Mar 27 2020CARES Act stands up PPP.No front-end fraud gate; the lender’s certification is the only control.
- Apr 14 2020Self-employed rule sizes sole props on net profit.The “net-profit trap” held the self-employed surge shut for all of 2020.
- Dec 27 2020Economic Aid Act creates second-draw loans.Adds a 25% revenue-reduction test, a $2M cap, and a ≤300-employee limit — a second gate that first-draw never had.
- Jan 2021Front-end controls go live: Do Not Pay + 19 fraud rules, no instant approval.The key prevention change — but it arrived after ~66% of all PPP money was already out the door.
- Mar 3 2021Gross-income rule lets Schedule C filers use gross income (cap ~$20,833).The regulatory engine of the sole-prop surge — and its self-certified-income abuse vector. Prospective only.
- May 31 2021Application window closes.
- 2020 baseBorrowers are payroll businesses; gig/self-employed presence is tiny.Rideshare + delivery: 40,461 loans. All gig-adjacent: 539,318.
- 2021 surgeRideshare + delivery jumps to 409,313 loans — a 10.1× rise, 289,589 of them first-draw.All gig-adjacent: 1.84M loans, 1.29M first-draw. ~97% are person-type filers; ~95–99% report ≤1 job.
- Size signature2021 self-employed loans cluster below the cap, not at it.Consistent with genuine workers claiming what they earned rather than maximizers gaming the ceiling. A distribution clustering below the cap does not settle the question either way: no primary source resolves the realized-fraud rate of the 2021 surge.
- Rule-specificOnly Schedule C segments surged; Schedule E (landlords) did not; Schedule F (farmers) did.The population moved exactly where the gross-income rule opened a door — evidence the rule, not chance, drove it.
- Theft gradientAcross DOJ prosecuted cases, identity-theft prevalence rises across programs: PPP ~9% → EIDL ~17% → PUA ~40%.Context for where identity theft concentrated — PPP is the lower end of that gradient.
- Apr 4 2020Womply registers as a PPP loan agent.
- Jan 11 2021Blueacorn pairs with Capital Plus for the 2021 round.Capital Plus collected ~$0 in PPP lender fees in 2020 and ~$937M in 2021 — a fintech intake funnel switching on.
- Feb 23 2021Womply launches “PPP Fast Lane” — 6 partner lenders in 8 weeks.
- Early Apr 2021Blueacorn documented downgrading identity verification (IDology → Onfido) as fees peaked.
- ConcentrationTwo aggregators carried 74.1% of 2021 rideshare/delivery loans; 11 partner banks made 26.7% of all PPP loans, almost none in 2020.The 2021 first-draw wave flowed through a handful of channels.
- Dec 1 2022House Select Subcommittee reports on how fintechs facilitated PPP fraud.
Method & caveats
Every figure on this page is either a verified primary-source number or a computation from a named project file; each is tagged with its evidentiary bar. The three dollar totals in Section 1 are not rival estimates of one number — they are the same program measured at an indicator bar (OIG), a referral bar (SBA), and a charging bar (DOJ), and the gap between them is mostly time and standard of proof. No source we found publishes a PPP fraud rate split by program year or by draw; Sections 2–3 therefore assemble the temporal and draw story from what is published — loan-volume splits, the control-change timeline, one SBA temporal statement, and one academic indicator trend — and label the direction of each. Prosecution and conviction data (Section 4) are a biased, 2–4-year-lagged sample: DOJ selects large, clear cases, and 2021 second-draw loans have had the least time to be charged, so even a clean year split would be confounded by prosecutorial lag.
Sources. SBA OIG Report 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Jun 27 2023); GAO-21-577 (PPP program controls, 2021); GAO-25-107267 (front-end control timeline); GAO-23-105331 (330 DOJ-charged PPP/EIDL cases, fraud-type coding); DOJ COVID-19 Fraud Enforcement Task Force 2024 report; Griffin, Kruger & Mahajan, “Did FinTech Lenders Facilitate PPP Fraud?” (2023). Vintage totals recomputed from the SBA PPP FOIA loan file. Program total: 11,468,210 PPP loans / $792.6B.