Pandemic Darlings The pandemic economy, in original documents
Home Profiles Deloitte

Profiles · Companies and entitiesControversial

ProfileCompany or group

Deloitte

Vendor or contractor

Unemployment insurance
Type
Company or group
Role
Vendor or contractor
Programs
Unemployment insurance
Updated

The profile

Individuals and companies whose conduct was challenged or called into question during or after the pandemic. See sources.

  • Type: Global professional-services partnership; here, the dominant private builder and operator of state unemployment-insurance (UI) claims systems during the pandemic. Relevant entity is the U.S. consulting arm, Deloitte Consulting LLP.
  • Legal entity: Deloitte Consulting LLP (a subsidiary of Deloitte LLP, the U.S. member firm of Deloitte Touche Tohmatsu Limited). Privately held partnership; no public ticker.
  • Founded: Deloitte traces to 1845 (William Welch Deloitte, London); the modern U.S. partnership dates to the 1989 Deloitte–Touche Ross merger.
  • HQ: New York, NY (U.S. member firm).
  • Key people: Karen Walsh (spokesperson quoted on the pandemic UI record). Government-technology work sat within Deloitte Consulting's public-sector practice.
  • Role: Built and, in several states, operated the online UI/Pandemic Unemployment Assistance (PUA) systems that processed benefit claims — chiefly its branded uFACTS platform (Unemployment Insurance Framework for Automated Claims and Tax Services) and, in Florida, the bespoke uFACTS build named CONNECT — and ran attached teleservices call centers. Deloitte marketed "AI-driven fraud detection" and "identity proofing" as part of these systems.

Pandemic-role map

  • Reader shorthand: the systems integrator that built the state UI/PUA claims portals millions of claimants filed through in 2020–2021.
  • What Deloitte did for claimants: stood up online claims portals (often in weeks) so newly eligible self-employed and gig claimants could file PUA and regular UI, and ran call centers to handle the resulting volume.
  • What Deloitte sold to governments: the uFACTS/CONNECT claims-and-tax platforms, systems integration, identity-proofing and anti-fraud tooling, and teleservices capacity — under contracts held by state labor departments.
  • Who plugged into Deloitte's systems: the identity-verification and fraud-analytics vendors sit on top of the systems Deloitte built and operated — ID.me, Socure, Thomson Reuters / Pondera, and LexisNexis Risk Solutions supply parts of the verification layer that states bolted onto UI intake.
  • Where responsibility sat: state labor agencies owned the programs, the eligibility rules, and the anti-fraud configuration; Deloitte built and in several states operated the software and call centers under those agencies' direction. The federal PUA design — self-certification with minimal early identity or employment verification — set the baseline the systems were built atop.

Before the pandemic

Deloitte's public-sector consulting practice had long built and integrated large government IT systems, including state UI modernization projects. Its uFACTS platform predates COVID-19: Florida's CONNECT system, a bespoke uFACTS build, was procured in the early 2010s. Per contemporaneous reporting, the Florida Department of Economic Opportunity contract was signed in 2011 and, through work-order changes, grew before the 2013 launch; Deloitte handed CONNECT to the state to operate in 2015. (Reported cost figures for that build vary by source and scope; see "Reconciling the numbers" below.) Several other states ran on uFACTS or on Deloitte-modernized legacy UI infrastructure entering 2020.

Pandemic role (2020–2022)

When the CARES Act created PUA in March 2020 and unemployment filings surged to record levels, states leaned on Deloitte to stand up or scale online claims systems, often within weeks. Forbes reported that Deloitte was asked to build up IT and staff for an unprecedented leap in claims "within a matter of weeks," atop a federal program that, per Illinois's employment-security department, "the Trump administration designed" with self-certification and limited up-front verification.

Scale and marketing. Forbes reported that Deloitte held pandemic UI contracts across eight states worth "at least a combined $410 million" (Forbes; the article also gives the per-state contract list and the Virginia update). In a presentation to the Kansas Department of Labor, Deloitte claimed it had "prevented $100 billion in pandemic unemployment fraud" and cited "advanced AI-driven fraud detection" and "identity proofing." Those claims come from Deloitte's own marketing, not from any independent finding.

The company's own account. Asked by Forbes about the fraud that flowed through those systems, Deloitte spokesperson Karen Walsh said the company had helped states pay out "more than $200 billion" in state and federal unemployment benefits and had stopped "millions of fraudulent unemployment claims." Walsh said Deloitte "incorporated all identity proofing solutions and anti-fraud technologies authorized by the states and, as signs of criminal activity emerged, recommended additional methods and tools... to stop billions of dollars in fraud."

The 2020 data breach. In May 2020, at the launch of the PUA rollout, a Deloitte error exposed the personal information of PUA applicants on state benefits websites. Between roughly May 18–21, 2020, claimants in Ohio (ODJFS), Illinois (IDES), and Colorado (CDLE) could view other claimants' names, Social Security numbers, and addresses. States acknowledged the exposures at the time: Illinois said a "glitch" exposed the information of about 44,000 first-day applicants; Colorado described a "limited and intermittent data access issue" affecting about 72,000 people; Ohio put its figure near 130,000 applicants. Deloitte offered 12 months of free credit monitoring to affected applicants. A class action, Alexander v. Deloitte Consulting, LLP, No. 1:20-cv-04129 (S.D.N.Y., filed May 29, 2020), followed and settled for a non-reversionary fund of $4.95 million covering a class of 237,675 people, with no admission of liability.

What state inspectors, auditors and Forbes found
  • What the state audits record

    • Florida (CONNECT). When CONNECT collapsed under load in mid-March 2020, locking out hundreds of thousands of newly jobless Floridians, Governor Ron DeSantis ordered Chief Inspector General Melinda Miguel to investigate and publicly called the system "designed to fail." The Chief IG's findings faulted the vendor's work: reporting on the IG record states the system was "never properly tested in accordance with the contract with Deloitte" and that Deloitte ran "insufficient stress testing." Forbes, citing the IG, reported the finding that "Deloitte's delivered uFACTS solution was substandard compared to their proposed solution," failing to deliver the contractual capacity for at least 200,000 concurrent users. Deloitte's response was that it had handed CONNECT to the state to operate in 2015 and had no control thereafter. Florida's Auditor General released an audit of CONNECT in March 2021. It reported that many findings from its earlier audits of the system remained uncorrected, among them the lack of a process for finding and fixing system defects that blocked or slowed claims, and design documentation that was out of date (Florida Auditor General, Report No. 2021-169). That audit covers the department's operation of the system and does not mention Deloitte. Florida's later CONNECT-related fraud totals were reported in the press.

    Ohio. Forbes reported that Deloitte's Ohio contract grew from $10 million in 2020 to $122 million as of October 2022 and that the state auditor and ODJFS reported large fraudulent PUA payments through the period (Forbes). The lead case study in the Forbes reporting was a call-center representative employed through Deloitte subcontractor Randstad who, per federal search-warrant records, allegedly took kickbacks to remove fraud flags on PUA applications and could still unflag applications after being fired (Forbes).

    In Michigan, Deloitte's 2020 review flagged that a teleservices representative, Brandi Hawkins, could remove fraud flags after termination; Hawkins pleaded guilty in the Eastern District of Michigan and on October 28, 2021 was sentenced to 58 months in prison and ordered to pay $3,793,186 in restitution to the State of Michigan.

    California. Forbes reported on Deloitte's EDD contracts and call-center performance, quoting Assemblymember David Chiu's criticism, and on the state auditor's January 2021 findings about EDD's potentially fraudulent payments (Forbes). Those totals are EDD's and the state auditor's, and concern the program EDD ran, not sums attributed to Deloitte.

    Illinois. Forbes reported on Deloitte's Illinois uFACTS and call-center contracts and on state auditor Frank Mautino's finding that the deployment was "inadequate" (Forbes).

    The Forbes correlation. Forbes reported that in the states where Deloitte helped prevent fraud, provided security, or ran the system, there was "as much as $22.2 billion" in fraud, with uFACTS systems alone seeing "up to $3.2 billion." Those are Forbes's figures, drawn from state and local government data, and describe fraud that flowed through Deloitte-touched systems built atop a self-certification federal program, not fraud audited as caused by Deloitte.

    What the state audits record

    State auditors in Illinois, Ohio and Michigan have since published their own accounts of Deloitte's pandemic work. They measure different things: contract spending in Illinois, the controls around a Deloitte-hosted system in Ohio, and, in Michigan, fraud that Deloitte was hired to estimate.

    StateDeloitte workFinal contract value (spent)Auditor
    IllinoisuFACTS for PUA$33,834,194 ($27,694,784)Auditor General, July 2023
    IllinoisCall center, 200 agents raised to 800$98,472,182 ($76,231,114)Auditor General, July 2023
    OhiouFACTS for PUA and federal supplements; hosting; call centerNot given; uFACTS processed about $8.1 billion in benefitsAuditor of State, October 2021
    MichiganFraud-control review and fraud estimateNot givenAuditor General, January 2023

    Illinois. The Illinois Auditor General's performance audit of the Department of Employment Security, released July 26, 2023, lists the department's pandemic contracts from state comptroller data as of January 2023. The uFACTS contract, signed April 28, 2020 for $9,490,000, grew through amendments to $33,834,194; the call-center contract went from $12,736,700 to $98,472,182. Department officials told the auditors they chose Deloitte because it "came to them first" and was also doing work in Ohio and Colorado. uFACTS began taking PUA applications on May 11, 2020. Until July 18, 2020 it did not check whether an applicant had filed a regular unemployment claim; from that date applicants had to be denied regular benefits before they could apply for PUA.

    Ohio. Ohio's Auditor of State covered unemployment fraud from March 2020 through February 2021 in a report dated October 22, 2021. It says the Department of Job and Family Services contracted with Deloitte, effective May 14, 2020, to run uFACTS for PUA, Federal Pandemic Unemployment Compensation and Lost Wages Assistance. Deloitte designed the system with the department's input, hosted it, provided training and security, and ran a call center; uFACTS processed about $8.1 billion in pandemic benefits over the period. The department had not obtained a SOC 1 Type 2 report on uFACTS, an independent auditor's test of whether a service provider's controls are designed and working. For fiscal 2020 the Auditor of State could not obtain reasonable assurance about the unemployment compensation amounts in the state's financial statements and modified its opinions. Ohio's replacement for its legacy claims system went to another vendor: the department contracted with Sagitec, whose system was still in development in August 2021.

    Michigan. The state's auditors cite Deloitte as an examiner. By May 2020 the Unemployment Insurance Agency knew it faced large fraud exposure, and the Department of Labor and Economic Opportunity engaged Deloitte for a cybersecurity and forensics assessment; Deloitte reported in November 2020 and delivered a fraud estimate in December 2021. The Auditor General's January 2023 report cites that estimate: $2.7 billion, or 9.5 percent, of the $28.3 billion paid on claims filed from March 1 to October 2, 2020 likely went to impostors. For claims filed after the agency restored its fraud controls, the estimate was less than 0.5 percent of $6.2 billion. As of March 2022 the agency had confirmed intentional misrepresentation on 28 PUA claims, about $342,000. The Auditor General's December 2023 report gives Deloitte's overall estimate as $5.6 billion in fraudulent claims and says the agency had not yet identified most of the claims behind it (Michigan Auditor General, December 2023).

    Reconciling the numbers

    The Florida CONNECT build cost is reported inconsistently across The Center Square and Forbes. Likewise, the "$100 billion prevented" (Kansas presentation) and "$200 billion paid / millions of claims stopped" (spokesperson) figures are Deloitte's own; the per-state fraud figures are the states' auditors' and Forbes's. The Illinois figures are contract values and state spending, not Deloitte's revenue after costs.

    • ID.me — identity-verification vendor layered onto state UI intake.

    Sources

    Primary and oversight documents

    Sources (summaries)

    • 01-forbes-anti-fraud-systems-billions-fraud
    • 01-forbes-deloitte-anti-fraud-systems-billions-fraud
    • 02-deloitte-pua-portal-data-breach-class-action
    • 02-pua-data-breach-4.95m-settlement
    • 03-florida-connect-inspector-general Company statements
    • Deloitte spokesperson Karen Walsh on-record statement ("$200 billion" paid, "millions of fraudulent claims" stopped, "incorporated all identity proofing solutions and anti-fraud technologies authorized by the states"), quoted in Forbes.4
    • Deloitte presentation to the Kansas Department of Labor claiming it "prevented $100 billion in pandemic unemployment fraud," as reported in Forbes.4

    Reporting

    Notes

    1. Florida Chief Inspector General findings on CONNECT and Gov. DeSantis's April 2020 probe order, as reported by The Center Square, Florida Politics, and WFLA, and the "substandard" quote via Forbes. We do not have a copy of the underlying IG report PDF. ↩
    2. Alexander v. Deloitte Consulting, LLP, No. 1:20-cv-04129 (S.D.N.Y.); state acknowledgments by ODJFS, IDES, and CDLE of the May 2020 PUA-portal exposure. ↩
    3. Deloitte Consulting PUA Data Security Incident Litigation settlement — $4.95M non-reversionary fund; class of 237,675; no admission of liability. ↩
    4. Forbes (Thomas Brewster), Oct. 31, 2022. The $410M combined-contract figure, per-state contract amounts, the Ohio/Michigan control-failure narrative, the "$22.2B" / "$3.2B" fraud correlations, and Deloitte's on-record statements are all drawn from this feature and the state-auditor / search-warrant records it cites. ↩
    Back to top