SBA's Handling of Identity Theft in the COVID-19 Economic Injury Disaster Loan Program (2021-05-06)

Summary

SBA Office of Inspector General Evaluation Report Number 21-15, SBA's Handling of Identity Theft in the COVID-19 Economic Injury Disaster Loan Program, dated May 6, 2021, from Inspector General Hannibal "Mike" Ware to Administrator Isabella Casillas Guzman. The report states that as of January 31, 2021, SBA had referred 846,611 COVID-19 EIDL applications to the OIG, and that SBA disbursed 112,196 COVID-19 EIDLs totaling $6.2 billion and 98,613 Advance Grants for $468 million for those applications. It states that bank account numbers for 29,435 of the disbursed loans, totaling $1.7 billion, were changed from the number on the application, an additional indicator of potential fraud, and that SBA did not provide status updates to those reporting identity theft. James E. Rivera of the Office of Disaster Assistance gives each recommendation's status.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

SBA’S HANDLING OF IDENTITY THEFT IN THE
COVID-19 ECONOMIC INJURY DISASTER LOAN
PROGRAM
REPORT NUMBER 21-15 | May 6, 2021
S B A   I N S P E C T O R   G E N E R A L   E V A L U A T I O N   R E P O R T

Office of Inspector General

U.S. Small Business Administration

1

DATE:
May 6, 2021
TO:

Isabella Casillas Guzman
Administrator
FROM:
Hannibal “Mike” Ware

Inspector General
SUBJECT:
SBA’s Handling of Identity Theft in the COVID-19 Economic Injury Disaster
Loan Program
The Office of Inspector General (OIG) is issuing this Evaluation report to notify Small
Business Administration (SBA) officials of significant matters regarding its handling of
complaints of identity theft in the Coronavirus Disease 2019 (COVID-19) Economic Injury
Disaster Loan (EIDL) program.
As of January 31, 2021, SBA has referred 846,611 COVID-19 EIDL applications to the OIG,
which is the loan application related to an identity theft complaint (individuals who indicate
that they did not apply for a loan and believe they are a victim of identity theft) and any
related applications (applications with the same email address, phone number, or physical
address). SBA officials did not know the exact number of individuals who have filed an
identity theft complaint because they did not track each complaint.
For the 846,611 applications, SBA disbursed 112,196 COVID-19 EIDLs totaling $6.2 billion
and 98,613 Advance Grants for $468 million. We found bank account numbers for 29,435 of
the 112,196 disbursed loans, totaling $1.7 billion, were changed from the original number
submitted on the application to another number used for disbursement, which is an
additional indicator of potential fraud.
At the time of our review, we found SBA did not provide status updates to those reporting
COVID-19 EIDL identity theft. Some complainants have contacted SBA multiple times, which
further distorts the total number of identity theft complaints.1 These individuals have been
waiting a long time, some of them for months, for a resolution on potentially fraudulent
loans in their names that could negatively affect their ability to obtain credit.
Many of the complainants are shocked to receive an SBA loan statement, which is one way
they find out about the fraudulent loans. Potentially more victims are still unaware of these
loans because the fraudsters used fake addresses on the loan applications. As of January
2021, an SBA official estimated the agency has received over 150,000 returned loan
statements because of incorrect or fraudulent addresses, raising the possibility that more

1 For the identity theft allegations that we have been able to corroborate, we have encouraged SBA to provide status
updates to the victim.

2
cases of identity theft are going unreported.
Regarding SBA’s handling of the 846,611 loan applications, we determined the agency
conducted a review to assess the possibility of identity theft prior to referring the
application and related applications to OIG.
In this review, SBA examined the subcontractor system’s notes in the loan file.2 Agency staff
compared the possible victim’s addresses and phone number to the application information
using Google and LexisNexis. Agency staff also performed a public record search to confirm
the existence of the business, often checking online information from the appropriate
Secretary of State and county tax assessor.
After receiving identity theft complaints, SBA stopped the processing of loan applications in
the approval process, put a hold on and cancelled approved loans before disbursement, and
attempted to recover any disbursed loans.3 An SBA official stated that as of February 4,
2021, the agency has stopped the disbursement of 15,345 loans, totaling $809.9 million, and
canceled these loans. When SBA cancels loans the billing statements, payment demands,
delinquency notices, and collection actions are stopped.
For disbursed loans, if the funds are returned, SBA will change the status of the loan to not
interested or duplicate. The cancellation of the loan or marking the loan as not interested or
duplicate releases the victim from loan liability. As of January 31, 2021, the loan data shows
that SBA and OIG combined have recovered $1.1 billion in 12,813 loans that were disbursed
based on false application information.
However, at the time of our review, SBA did not have a process to protect or resolve credit-
related issues for the identity theft victims. Specifically, SBA did not have a process to:
• Maintain and track identity theft complaints,
• Provide status updates to the victim, and
• Release any Uniform Commercial Code (UCC) liens on the victim’s assets.
For loans that were disbursed and had not been fully returned, SBA did not have a process
to:
• Cease billing fraudulent loans to the victims,
• Prevent collection actions, and
• Release the victim from the loan liability.4
Finally, SBA did not have a process to charge-off or remove the fraudulent loans when the
funds have not been returned and remove the UCC filing fees associated with any collateral

2 The subcontractor’s system performs electronic checks of loan applications and will add notes to indicate potential fraud.
The system will also flag duplicate loan applications and provide additional information found by the system checks.
3 SBA officials stated that sometimes the hold on the loan application does not prevent the disbursement of funds. This is
due to timing and a limited number of individuals that can place a hold on the pending disbursement in the financial
system.
4 On March 16, 2021, SBA announced extended deferments periods for all disaster loans, including the COVID-19 EIDLs. All
SBA disaster loans made in calendar year 2020, including COVID-19 EIDLs, will have a first payment due date extended
from 12-months to 24-months from the date of the note. All SBA disaster loans made in calendar year 2021, including
COVID-19 EIDLs, will have a first payment due date extended from 12-months to 18-months from the date of the note.

3
for loans made using stolen identities.
During the review, SBA proposed to update their process to validate identity theft. On
February 2, 2021, SBA officials approved a letter to provide to identity theft victims,
requesting a copy of their police report or Federal Trade Commission (FTC) complaint,
signed declaration of identity theft, and a copy of the victim’s government-issued photo
identification. SBA also provided the letter to LifeLock, a private company working with
customers reporting identity theft and the FTC to place on their website IdentityTheft.gov.
Background
The SBA’s Disaster Assistance Program is the federal government’s primary program for
assisting small businesses, small agricultural cooperatives, and most private, nonprofit
organizations after disasters. SBA provides up to $2 million in EIDLs to help those who are
eligible meet financial obligations and operating expenses. A series of COVID-19 relief
packages directs SBA, in accordance with the Small Business Act, to provide EIDLs and up to
$10,000 in an Advance Grant to affected eligible entities in declared disaster areas.5 These
laws also expanded the types of organizations that qualify as eligible entities. Eligible
entities were defined as small businesses; small agricultural cooperatives; most private,
nonprofit, organizations; businesses, cooperatives, Employee Stock Ownership Plans, and
tribal concerns with no more than 500 employees; sole proprietorships; independent
contractors; and agricultural enterprises.6
As of December 31, 2020, SBA has received over 17 million COVID-19 EIDL applications and
approved about 3.7 million, totaling $184 billion, and 5.8 million Advance Grants for $20
billon. SBA is using a subcontractor to assist in the processing of the historic number of loan
applications. To address the unprecedented demand for these loans and to ensure funds
were provided to the maximum number of entities, SBA lowered the COVID-19 EIDL
maximum amount to $150,000.
A 2020 OIG report found that in expediting the EIDL process to make emergency capital
available to struggling small businesses, SBA “lowered the guardrails,” or relaxed internal
controls, significantly increasing the risk of fraud in the program.7
We initiated this review after receiving over 192,000 hotline complaints, which included
reports of alleged COVID-19 EIDL identity theft. We also received over 3,000 requests for
investigative support from other law enforcement agencies investigating fraud, including
alleged identity theft. SBA officials stated that the hotline complaints and investigative
referral requests were included in the over 840,000 COVID-19 EIDL application identity
theft referrals from SBA to OIG.

5 Public Law 116-123 - Coronavirus Preparedness and Response Supplemental Appropriations Act, March 6, 2020; Public
Law 116-136 - Coronavirus Aid, Relief, and Economic Security Act, March 27, 2020; and Public Law 116-139 - Paycheck
Protection Program and Health Care Enhancement Act, April 24, 2020
6 An agricultural enterprise is a small business engaged in the production of food and fiber, ranching and raising of
livestock, aquaculture, and all other farming and agricultural-related industries. Small Business Act, Section 18(b) 15 U.S.C.
647(b)
7 SBA OIG, Inspection of SBA’s Initial Disaster Assistance Response to the Coronavirus Pandemic, October 28, 2020

4
Objective
Our objective was to assess SBA’s handling of identity theft in the COVID-19 EIDL Program;
actions SBA has taken to provide relief to the victims; and actions SBA has taken to mitigate
the risk of financial loss.
SBA Processes for Receiving COVID-19 EIDL Identity Theft
Complaints
Most of the potential victims of identity theft do not report the fraudulent loan until they
notice the SBA credit check on their credit report or when they receive an EIDL monthly
statement. The loan billing statements are intended to notify COVID-19 EIDL borrowers of
their payment responsibilities on these loans beginning in 2021. Identity theft complainants
generally contact SBA by calling or emailing (1) the SBA’s Customer Service Center, (2)
SBA’s Disaster Assistance Processing and Disbursement Center, (3) their local SBA District
Office, or (4) SBA OIG’s Hotline (see Figure 1).
Figure 1. SBA Process for Identity Theft Complaints

Source: SBA Office of Disaster Assistance

5
As shown in Figure 1, there are four main communication channels that SBA can receive
identity theft complaints.8
• Channel 1 - The Customer Service Center receives a telephone call alleging
identity theft. The Customer Service Center instructs the complainant to
notify the credit bureaus, file a police report, file a complaint with the Federal
Trade Commission, and contact the OIG Hotline. The Customer Service Center
collects information about the complaint and emails it to the Processing and
Disbursement Center’s identity theft mailbox.
If the allegation is received by email, the Customer Service Center will provide
the above instructions via email.
The Customer Service center will also provide the email complainant a form
to complete with sufficient information for SBA to review regarding the
identity theft. These email identity theft complaints and completed forms are
emailed to the Processing and Disbursement Center’s identity theft mailbox.
• Channel 2 - Identity theft complainants contact their local SBA District Office.
District office personnel emails the identity theft complaints to the Processing
and Disbursement Center’s identity theft mailbox.
• Channel 3 - When the Processing and Disbursement Center receives an
identity theft complaint via telephone, the complaint is recorded on an Excel
spreadsheet.
• Channel 4 – Identity theft complainants contact the OIG Hotline. These
complaints are forwarded to the Processing and Disbursement Center. In
addition, our investigators consider these complaints for potential
investigations.
After answering the initial call to the Customer Service Center, Processing and
Disbursement Center, or district offices, or responding to the initial email sent to the
Customer Service Center, SBA generally did not provide status updates to the complainants.
Potential victims of identity theft were subsequently left receiving loan billing statements
and having no information pertaining to credit reporting concerns or the fraudulent debt.
Many complainants subsequently reached out repeatedly to SBA, with many reporting
difficulties in speaking with officials who could assist them or provide responsive
information.
We selected and interviewed 18 identity theft complainants to better gauge SBA’s response.
All of them stated that after they made their initial complaints, they did not receive any
status updates from SBA. They all expressed frustration that our call was the first time they
had heard from anyone after submitting their complaint.
Without status updates, the potential identity theft victims were frustrated and did not
know what was happening with their complaint. This led many of them to contact SBA
multiple times, further expending resources. In one case, complainant filed 41 duplicative
complaints. Potentially fraudulent loans could also negatively affect the complainants’

8 In this report, we describe the four main channels in which identity theft complaints are received. In addition to these
channels, SBA receives congressional inquiries and complaints through other channels not depicted in this report.

6
credit, including delaying mortgage applications and other credit-related activity.
Of the 18 complainants we interviewed, 9 learned about the SBA loan when they received a
credit monitoring alert. Two received loan billing statements from SBA. One applied for an
EIDL for their business and when they called to follow-up, SBA said the person had already
received an SBA EIDL Advance Grant. Six received a call, email, or letter from SBA providing
or requesting additional information for loans they didn’t apply for.
SBA Fraud Teams
Prior to June 26, 2020, SBA had only one fraud team, the OIG liaison team. To address the
growing number of fraudulent complaints in the COVID-19 EIDL program, SBA expanded
the OIG liaison team and split it into six fraud teams, one of which was the Identity Theft
Fraud Team. It consisted mostly of loan officers. The suspected fraud team handled all fraud
allegations that did not involve an identity theft complaint.
The Identity Theft Fraud Team consisted of 5 team leads and 67 staff. There were
approximately 12-14 team members assigned to each team lead. According to SBA, they
reviewed about 80-100 identity theft complaints per person per day on average. On June 26,
2020, SBA also established an internal email address for the district offices and Customer
Service Center to email identity theft complaints to the Identity Theft Fraud Team.
As of January 12, 2021, SBA had received a total of 80,810 emails in the identity theft email
box. Separately, complaints received by the Processing and Disbursement Center were
recorded on an Excel spreadsheet and were not included in the totals related to the identity
theft email box. SBA officials did not know how many additional complaints have been
received by the Processing and Disbursement Center’s call center and entered on the
spreadsheet.
The Identity Theft Fraud Team reviewed each identity theft complaint to determine if the
complaint is valid. The review entailed examining the subcontractor system notes in the
loan file, comparing the possible victim’s addresses and phone numbers to the application’s
information using Google and LexisNexis, and performing public records searches of
information contained in the Secretary of State websites and county tax assessor’s offices.9
According to Identity Theft Fraud Team staff, they attempt to find all applications related to
the alleged stolen identity; however, the subcontractor’s system capabilities were limited to
20 related files. If a fraudster has submitted more than 20 related COVID-19 EIDL
applications, all the applications would not be reflected in the query results, and SBA may
not be able to identify all the related loan applications.
SBA officials stated they run other system queries to identify all the related loan
applications. SBA did not know the exact number of unique identities associated with the
streams of complaints received because they did not track this information.

9 The subcontractor’s system performs electronic checks of loan applications and will add notes to an application that
indicate potential fraud, document similar or duplicate loan applications, and provide additional information found by the
system checks.

7
Handling of Fraudulent Loans and Returned Funds
SBA takes several actions following receipt of an identity theft complaint. When there is an
identity theft claim and the loan has not been funded (funds obligated), SBA places a hold on
the loan to prevent funding. As of February 4, 2021, an SBA official stated that the agency
has stopped the disbursement of 15,345 approved loans for $809.9 million and canceled
these loans. As of January 31, 2021, the loan data shows that SBA has recovered about $530
million linked to identity theft and disbursed based on false application information.
If the loan is already funded and disbursed, SBA does not pro-actively contact the banks. If
the bank contacts SBA, the Agency will request a return of the funds. If the bank returns the
full loan disbursement, SBA marks the loan as not interested or duplicate.
Some banks have attempted to require SBA to sign a hold harmless agreement before
agreeing to return the funds.10 SBA’s Office of General Counsel has not agreed to the signing
of these agreements, so some banks are not returning the funds. Without hold harmless
agreements, SBA must refer these loans to OIG for enforcement actions.
OIG does not have independent administrative seizure authority; however, OIG has had
success in collaborating with other federal law enforcement partners. These partners have
exercised their administrative seizure authority by issuance of a warrant to force the return
of suspected fraudulent EIDLs and Advance Grants to SBA. This collaborative process can
take up to a year, in contrast to the banks voluntarily releasing the funds back to SBA.
Such delays can allow fraudsters the opportunity to move or spend funds before the referral
even takes place. Without independent administrative seizure authority by OIG, the
forfeiture action itself is contingent upon the availability of other federal law enforcement
resources. Through the seizure warrants, OIG has collaboratively recovered more than $540
million in fraudulent loans from the banks as of January 2021.11
Resolution of Identity Theft Complaints Made to SBA
At the time of the review, SBA did not have a process to restore the victims to the place they
were before the fraud by:
• Removing any UCC liens on the victim’s assets to avoid any future
repossession efforts,
• Ceasing loan statements,
• Preventing collection actions, and
• Releasing the victim from the loan liability.
Additionally, SBA did not have a process to write off the loan without affecting the victim’s
credit and remove the UCC related filing fees.
All of the 18 complainants we interviewed expressed concerns regarding the negative
effects the potentially fraudulent loans will have on their ability to obtain home loans and

10 Hold harmless agreements release the bank from any legal or financial liability if the bank account owner disputes the
return of funds.
11 This figure includes all types of fraudulent loans.

8
credit. One small business owner stated they were denied a COVID-19 EIDL because a
fraudster had stolen the business owner’s identity and maliciously accessed the resources
the eligible applicant may have been entitled to receive. Untangling the fraud and seeking
resolution further encumbered the business owner, who was already dealing with adverse
effects from the pandemic.
In addition, SBA’s Office of Performance Management and the SBA Chief Financial Officer
have received over 150,000 returned loan statements possibly because the mailing
addresses for these loans were incorrect. Additional potential identity theft victims could be
unaware of fraudulent loans in their names. SBA should determine whether any of these
loans were fraudulent and take steps to recover the funds and resolve any identity theft.
During our review, SBA stated it was developing a process to address these issues. On
November 23, 2020, SBA officials said they would begin to request police reports or FTC
complaints, declaration of identity theft, and identification from each complainant. On
February 2, 2021, SBA approved a letter and declaration of identity theft to request this
information from the complainants. The letter provided a public email address,
IDTheftRecords@SBA.gov, to receive the documentation.
SBA planned to send the letter to only complainants where the loan was disbursed.
However, because SBA did not track all identity theft complaints, it did not have a contact
list for the potential identity theft victims. As such, ODA is requesting individuals to file a
new complaint using this new process to collect the contact information and obtain the
signed declaration of identity theft.
SBA has shared the letter and declaration of identity theft with its East and West Field
Operations Centers, regional and district offices, and SBA resource partners so they can
distribute the information. SBA management also stated they were leveraging external
stakeholders like the FTC and LifeLock to increase awareness regarding the letter and
declaration of identity theft. SBA has also requested a contact list of potential identity theft
victims who contacted the OIG Hotline.
SBA officials reported they were developing a process to charge-off the loans. The agency
also plans to stop mailing victims loan statements, prevent any payment requests or
delinquency collection in 2021, and remove the associated UCC liens and filing fees.
However, SBA has not implemented this process.
During our review and as discussed early in this report, SBA did not have a process to
address credit-related issues related to these potentially fraudulent loan applications and
SBA officials stated it was developing a process to protect or resolve credit-related issues
for the identity theft victims. On March 15, 2021, SBA officials stated it did have a process to
address or resolve credit-related issues for the identity theft victims that was approved on
February 2, 2021 and later updated on February 7, 2021.
We received the new undated and unsigned process on March 15, 2021. However, SBA did
not provide evidence that this new process has been distributed to staff and made
operational. The new process does seem to address our recommendations. Without
evidence of implementation, our recommendations are as follows.

9
Recommendations
We recommend the Administrator to direct the Associate Administrator for the Office of
Disaster Assistance, the Chief Financial Officer for the Office of Performance Management
and Chief Financial Officer, and the Associate Administrator for the Office of Capital Access
to:
1. Develop a process to maintain and track all identity theft complaints.
2. Develop a process to provide status updates to each complainant alleging identity theft.
3. Complete and formalize a process to restore identity theft victims to their condition
prior to the fraud. The process should include steps to stop the loan billing statements,
prevent delinquency collections, release them from loan liability and UCC liens.
4. Develop a process to remove any fraudulent loans and related UCC filing fees from its
financial records.
5. Review over 150,000 returned billing statements and resolve any that involve identity
theft, then refer fraudulent loans to OIG.
Analysis of Agency Response
SBA management provided formal comments to the draft report. We have included those
comments in their entirety in Appendix I. Management did not explicitly indicate in the
formal comments whether they agreed with the findings and recommendations in the
report; however, in separate correspondence, they indicated they partially agreed with all
the findings and recommendations. While management stated they partially agreed with all
of the recommendations, management’s formal comments state they took actions to address
each of them. We considered management’s comments when preparing this final report.
Management’s partial agreement is based on the audit team’s testing and reporting of
results covering the period prior to the changes they stated were implemented on February
2, 2021. We began this review in October 2020 after receiving numerous hotline complaints
alleging identity theft in the COVID-19 EIDL program and a lack of response from SBA to
these allegations.
At the outset of our review, SBA officials indicated that their process to address the
allegations were to refer these matters to OIG. Toward this end, SBA had draft policies in
place to track identity theft allegations, place a hold on any loan applications related to
these allegations and any related loan applications, and refer the loan applications to the
OIG. However, we found SBA tracking was insufficient to be able to identify the number of
identity theft allegations it had received. SBA’s system was unable to delineate between loan
applications referred to the OIG as part of the allegation and loan applications referred to
OIG that were related (similar information, e.g. address, email, etc.) to those loan
applications. As a result, it was unknown how many alleged victims of identity theft had
contacted SBA.
On February 2, 2021, SBA established an Identity Theft Letter to be sent to alleged victims of
identity theft. It also created a form—Declaration of Identity Theft—for the identify theft
victims to complete. SBA admitted that it did not have sufficient contact information for all

10
the individuals that previously reported identity theft. As a result, SBA’s plan was to
leverage internal and external stakeholders to increase awareness of the Identity Theft
Letter. Upon receipt of OIG’s initial draft of this report on March 3, 2021, SBA provided a
formal version of its process on March 15, 2021 and indicated it was implemented on
February 2, 2021.
We agree that management’s actions in February and March 2021 and the implemented and
proposed actions to address the recommendations in this report are a step in the right
direction; however, additional actions are needed to fully resolve all of the
recommendations. Based on the information SBA management has provided OIG regarding
the changes they have implemented, recommendations 1 through 4 remain open and
unresolved, and recommendation 5 remains open and resolved.
SBA’s process implemented on February 2, 2021 does not retroactively address the
hundreds of thousands of prior complaints received. Specifically, there was no description
of how SBA will incorporate allegations or complaints of identity theft that were submitted
to SBA prior to February 2, 2021.
Additionally, the implemented process does not address whether the disbursed portion of
the loans will be cancelled and whether a special designation will be used for the fraud-
related charge-offs. Furthermore, SBA’s new process does not address whether SBA will file
the UCC lien termination document to release the collateral filed with these loans or simply
mail the termination documents to the complainants for subsequent filing, and whether SBA
will pay the costs to file the UCC lien releases.
In the following section, we are providing more specific details for each of the five
recommendations.
Summary of Actions Necessary to Close the Recommendations
The following provides the status of the recommendations and necessary actions to close
them.
1. Develop a process to maintain and track all identity theft complaints.
Unresolved. Management stated they implemented the recommendation on February 2,
2021. The information provided to us described the new process including where new
allegations of Identity theft may be submitted online and how these allegations will be
validated, processed, and resolved.
The new process only applies to or affects allegations or complaints of identity theft
submitted to the SBA after the implementation date of its new process. Management has
not formally addressed how prior allegations or complaints of identity theft will be
addressed. No plan was provided that would detail whether previous complaints need to
be refiled under the new process and how that will be communicated to the previous
complainants.
This recommendation can be fully resolved and closed when management provides a
description and evidence of the system’s monitoring or tracking capabilities as well as
evidence that indicates they have a process to maintain and track all identity theft
complaints, including prior allegations or complaints.

11
2. Develop a process to provide status updates to each complainant alleging identity theft.
Unresolved. Management indicated that they implemented a new system on February 2,
2021, for handling and processing allegations or complaints of identity theft. This new
system included communicating that each identity theft allegation had been received
and providing status updates at each phase of processing up to and including final
resolution.
While this is a major improvement from the previous system that did not provide any
information, management did not state how they will incorporate allegations or
complaints of identity theft that were submitted to SBA prior to February 2, 2021.
The recommendation can be fully resolved and closed when management provides
evidence that the new system is operational and provides notification of receipt and
status notifications for all allegations of identity theft.
3. Complete and formalize a process to restore identity theft victims to their condition
prior to the fraud. The process should include steps to stop the loan billing statements,
prevent delinquency collections, and release them from loan liability and UCC liens.
Unresolved. Management indicated that they implemented a new system on February 2,
2021, for handling and processing allegations or complaints of identity theft. This new
system attempts to restore identity theft complainants to their condition prior to the
fraud by permanently suspending billing statements, preventing collections for
delinquent loan accounts, releasing the loan debt, and reversing or removing general
security agreement UCC lien filings.
However, the new process does not specify whether SBA will file the collateral releases
or simply mail them to the complainants for subsequent filing, and whether SBA will pay
the costs to file the UCC lien release documents.
This recommendation can be fully resolved when management addresses the process for
UCC releases in SBA’s procedures. Recommendation 3 can be closed when management
provides evidence that they have implemented all procedures to restore complainants to
their condition prior to the identity theft.
4. Develop a process to remove any fraudulent loans and related UCC filing fees from its
financial records.
Unresolved. Management indicated that they implemented a new system on February 2,
2021, for handling and processing allegations or complaints of identity theft. The new
system included a process to cancel unapproved applications and approved loans that
have not been disbursed.
However, the new system does not address whether or how fully disbursed loans or the
partially disbursed loans will be charged off to remove them from the agency’s financial
records. The new process is also silent about addressing the charge-off or removal of
related UCC filing fees.
This recommendation can be fully resolved when management addresses the charge-off
of these loans and the removal of the UCC liens. Recommendation 4 can be closed when
management provides evidence that they have implemented the process to remove
fraudulent loans and related UCC filing fees from SBA’s financial records.

12
5. Review over 150,000 returned billing statements and resolve any that involve identity
theft, then refer fraudulent loans to OIG.
Resolved. Management stated that ODA will coordinate with Office of Capital Access to
review the over 150,000 returned billings statements and resolve any that involve
identity theft, then refer fraudulent loans to the OIG. Management provided a final action
date of September 30, 2021, for completing this task.
This recommendation can be closed when management provides evidence that they
have completed the review of the over 150,000 returned billing statements and referred
any potentially fraudulent loans to OIG.
Objective, Scope, and Methodology
Our objective was to assess SBA’s handling of identity theft in the COVID-19 EIDL program;
actions SBA has taken to provide relief to the victims; and actions SBA has taken to mitigate
the risk of financial loss. Our review is based on SBA’s data as of January 31, 2021.
We used limited loan and grant data from SBA and its subcontractor in our analysis. We
obtained loan data from SBA’s ETRAN system and application data from the subcontractor’s
system. As noted in our earlier work, Inspection of SBA’s Initial Disaster Assistance
Response to the Coronavirus Pandemic (Report 21-02), we attempted to assess the
reliability of the data by performing limited testing.
However, SBA and its subcontractor did not provide source information to us to perform
data reliability testing. As a result, the reliability of the ETRAN and subcontractor’s system
data is undetermined, but it is the best available data, and SBA uses the data to manage the
program and derive program statistics.
Other application information provided by SBA was manually generated. Specifically, SBA
provided COVID-19 loan application numbers. We conducted limited testing by comparing
the loan application numbers to loan and grant data in the subcontractor’s system. We were
unable to match 22 of these loan application referrals to loan applications in the
subcontractor’s system.
We believe these unmatched records were caused by SBA’s manual referral process as the
unmatched loan application numbers did not contain the correct number of digits or the
application number was incorrectly recorded. We do not believe the data we obtained from
ETRAN, the subcontractor’s system, or the low number unmatched applications alter our
findings. Therefore, we believe the evidence obtained provides a reasonable basis for our
findings and conclusions based on our objectives.
We performed this review in accordance with the Council on Inspectors General on Integrity
and Efficiency’s Quality Standards for Inspection and Evaluation. Those standards require
that we plan and perform the review to obtain sufficient and appropriate evidence to
provide a reasonable basis for our conclusions and observations based on our objective. We
believe the evidence obtained provides a reasonable basis for our conclusions and
observations based on our objectives.
We appreciate the cooperation that we received during this review. If you have any
questions, please contact me or Andrea Deadwyler, Assistant Inspector General for Audits,
at (202) 205-6586.

13
CC:
Antwaun Griffin, Chief of Staff
Arthur Plews, Deputy Chief of Staff
Steve Kong, Acting Chief Operating Officer
James Rivera, Associate Administrator, Office of Disaster Assistance
Barbara E. Carson, Deputy Associate Administrator, Office of Disaster Assistance
Patrick Kelley, Associate Administrator, Office of Capital Access
Peggy Delinois Hamilton, General Counsel
Martin Conrey, Attorney Advisor, Legislation and Appropriations
Michael Simmons, Attorney Advisor, Office of General Counsel
Rafaela Monchek, Director, Office of Continuous Operations and Risk Management
Tonia Butler, Director, Office of Internal Controls
Erica Gaddy, Deputy Chief Financial Officer

14
Appendix 1: Management Comments
SBA RESPONSE TO EVALUATION REPORT

15
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, D.C. 20416

Date:
April 30, 2021
To:

Hannibal “Mike” Ware
Inspector General
From:
James E. Rivera
Associate Administrator
Office of Disaster Assistance
Subject:
SBA’s Handling of Identity Theft in the COVID-19 Economic Injury Disaster Loan
Program
We have reviewed the OIG Management Advisory “SBA’s Handling of Identity Theft in the
COVID-19 Economic Injury Disaster Loan Program” (Project 21801) dated March 26, 2021.  Our
response to the Management Advisory findings and corresponding five recommendations are
included in the letter.  Thank you for the opportunity to respond.
The OIG’s review of SBA’s handling of identity theft in the COVID-19 EIDL program began in
early October 2020 but only covered our activities through the end of January 2021. During
this same period, the Office of Disaster Assistance (ODA) led a working group with
representatives from multiple SBA program offices, including the Offices of General Counsel,
Chief Financial Officer and Capital Access. The working group met weekly to develop and
implement a process for handling loans associated with identity theft to ensure that
individuals whose information was used to obtain a loan without their knowledge or
permission could be released without causing undue financial harm to the individual.
The SBA’s new process for handling reported cases of identity theft in the COVID-19 EIDL
program was finalized on February 2, 2021 and instructions were immediately
distributed to all SBA program offices.
ODA received a copy of the Management Advisory discussion draft on March 3, 2021 and we
provided feedback to the audit team that included documentation of the new process for
handling identity theft cases that was implemented on February 2, 2021. The audit team
advised us that because they concluded most of the audit work and interviews with ODA staff
in December 2020, their findings and recommendations did not cover the new process for
handling identity theft in the COVID-19 EIDL program. We also advised the OIG audit team that
recommendations 1-4 were no longer necessary because actions taken by SBA to develop and

16
implement the new process for handling identity theft fully addressed those
recommendations. Despite receiving this information during the review period, the final draft
of the Management Advisory still includes recommendations that were completed in February
2021. We respectfully request that the OIG close recommendations 1-4.
SBA established a simple process for individuals reporting cases of identity theft for the
COVID-19 EIDL program to follow.
Individuals reporting cases of identity theft are directed to email the following items for SBA
review to IDTheftRecords@sba.gov: 1) a copy of a Federal Trade Commission (FTC) identity
theft claim or police report; 2) a copy of federal of state photo ID; and 3) a completed and
signed copy of SBA Form 3513 Declaration of Identity Theft (attached). These instructions are
outlined in the SBA COVID-19 Economic Injury Disaster Loan and Identity Theft Letter that was
released to SBA program offices on February 2, 2021. In addition to releasing the instructions
to SBA staff, the instructions are available online at http://www.sba.gov/eidl-id-theft. SBA also
shared a copy of the letter with stakeholders, including SBA resource partners, FTC
(IdentityTheft.gov) and LifeLock, and encouraged them to direct individuals reporting cases of
identity theft to the instruction letter.
On March 24, 2021, SBA’s Office of Online Media coordinated with the Assistant Inspector
General for Management and Operations to replace the OIG Hotline page content for identity
theft with a redirect to a new section on identity theft on SBA.gov/relief so that site visitors can
more easily find instructions on how to report cases of identity theft to SBA.
SBA has a team of 16 staff that reviews cases of identity theft and documentation submitted
by individuals to IDTheftRecords@sba.gov. Upon completing the review, and if all required
documents have been provided, the team responds to the individual to confirm that SBA will
release the loan debt due to identity theft. For loans over $25,000, SBA will also take the
necessary actions to remove the general security agreement UCC filing. In all cases where SBA
approves a request to release a loan debt due to identity theft, the monthly billing statements
are permanently suspended and the individual’s information will be disassociated from the
loan debt in our databases, including public COVID-19 EIDL data that SBA is required to report
on USASpending.gov. These actions directly address recommendations 1-4 in the
Management Advisory and we respectfully request that OIG close them
COVID-19 EIDL funds approved and disbursed that are associated with identity theft
represent less than 0.7 percent of all loan application activity.
The Management Advisory states that as of January 31, 2021, SBA has disbursed 112,196 loans
totaling $6.2 billion that are associated with identity theft. It is important to put these
occurrences of reported identity theft in the context of the unprecedented level of application
activity for the COVID-19 EIDL program. As of January 31, 2021, SBA has received over 17.8
million COVID-19 EIDL applications, of which just 0.64 percent resulted in a disbursed loan
potentially associated with identity theft. During this same period, SBA approved over 3.7
million loans for a total of more than $199.2 billion. Compared to the total amount of loans

17
approved, the loans associated with identity theft represents just 3 percent of the total
number of loans and funds approved as of January 31, 2021. The Advisory also reported that
98,683 EIDL Advances totaling $468 million was associated with identity theft. During this time,
SBA received over 10 million EIDL Advance applications, of which 0.98 percent were associated
with identity theft. SBA disbursed 5.8 million EIDL Advances totaling $20 billion, of which 1.7
percent of the number of EIDL Advances and 2.3 percent of the total funds disbursed were
associated with identity theft. SBA is committed to mitigating fraud, waste and abuse to the
fullest extent possible, and no amount of identity theft or other forms of fraud are deemed as
acceptable no matter how low the percentage.
Agency Response to Recommendations 1-5
1. Develop a process to maintain and track all identity theft complaints.
Current Status: Completed – SBA developed a process to maintain and track identity
theft complaints for the COVID-19 EIDL program that are submitted to
IDTheftRecords@sba.gov, which was implemented on February 2, 2021.
2. Develop a process to provide status updates to each complainant alleging identity
theft.
Current Status: Completed – SBA developed a process to provide status updates to
complainants reporting identity theft for the COVID-19 EIDL program that are
submitted to IDTheftRecords@sba.gov, which was implemented on February 2, 2021.
3. Complete and formalize a process to restore identity theft victims to their condition
prior to the fraud. The process should include steps to stop the loan billing statements,
prevent delinquency collections, release them from loan liability and UCC liens.
Current Status: Completed – SBA developed a process to restore identity theft
complainants to their condition prior to the fraud by permanently suspending billing
statements, releasing the loan debt, removing general security agreement UCC filing,
and preventing collections for delinquent loan accounts on confirmed cases of identity
theft, which was implemented on February 2, 2021.
4. Develop a process to remove any fraudulent loans and related UCC filing fees from its
financial records.
Current Status: Completed – SBA developed a process to remove fraudulent loans
due to identity theft and the related UCC filing fees from our financial records, which
was completed on February 2, 2021.
5. Review over 150,000 returned billing statements and resolve any that involve identity
theft, then refer fraudulent loans to OIG.
Current Status: In Process – ODA will coordinate with the Office of Capital Access to
review returned billing statements and resolve any loans that involve identity theft. We
continue to refer all applications of suspected or attempted fraud to the OIG to support

18
their investigative activities. The targeted date to complete this recommendation is
September 30, 2021.
Sincerely,
James E. Rivera
Associate Administrator
Office of Disaster Assistance

File and source

File

21-15-eidl-identity-theft-handling.pdf

Size

638,877 bytes

SHA-256

6043c9d0aa629db5599ec260e5ae1118aad398a1e9da0fbb65d5d55096e80a73

Our copy

21-15-eidl-identity-theft-handling.pdf

Original

www.sba.gov