Home/Source documents/Risk Advisory — Potential Identity or Other Fraud in SBA Pandemic Relief Programs
Risk Advisory — Potential Identity or Other Fraud in SBA Pandemic Relief Programs
Issuer
Small Business Administration
Document type
PDF source document
Date
2022-09-20
Full text
September 19, 2022
Mr. Patrick Kelley
Office of Capital Access, Associate Administrator
Small Business Administration
409 3rd Street, SW
Washington, DC 20416
SUBJECT: Risk Advisory — Potential Identity or Other Fraud in SBA Pandemic Relief Programs
Dear Mr. Kelley:
The Pandemic Response Accountability Committee (PRAC) is issuing this Risk Advisory to
notify Small Business Administration (SBA) management of potential identity or other fraud
related to or involving minors and the elderly in its Coronavirus-2019 (COVID-19) Economic
Injury Disaster Loan (EIDL) program, EIDL Advance program, and Paycheck Protection
Program (PPP). The potential identity or other fraud cuts across SBA and the U.S.
Department of Housing and Urban Development (HUD) program boundaries.1 Given the
potential consequences, we urge management to consider additional safeguards to protect
these vulnerable segments of the population.
Through a multi-tiered data matching process, the PRAC’s Pandemic Analytics Center of
Excellence (PACE) identified possible identity or other fraud in one or more of these SBA
programs involving 945 minors (under 18 years old) and 231 elderly individuals (80 years
and older).
These minors and elderly individuals are listed as household members in the HUD Low Rent
and/or Housing Choice Voucher Program (Section 8 Program) and their identities are used
with or without their knowledge to apply for/on applications/submissions for SBA PPP loans
and/or EIDL loans and grants.
1 The HUD programs are the Low Rent and/or Housing Choice Voucher program. These programs are federal programs run
by HUD that help low and very low-income families, the elderly, and the disabled to afford decent, safe, and sanitary
housing.
2
As the PRAC’s Identity Fraud Reduction and Redress Working Group has previously reported,
preventing identity fraud and supporting victims of identity fraud is a critical challenge for
the federal government and one that has a significant impact on the American public. For
example, identity fraud has serious impacts on victims that can lead to frustrating efforts to
reclaim their identities, clean up their credit scores and financial records, expunge
erroneous data, and address any tax consequences. When these victims are minors, they
may not discover the misuse of their personal information until years later when they apply
for employment, a driver’s license, student loans, or other credit. The elderly population is
particularly vulnerable to identity theft and sometimes can experience greater challenges in
clearing their credit. Given these potential consequences to two vulnerable segments of the
population, we urge SBA to:
(1) Further examine the potential identity fraud we have detected using SBA’s own
verification methods to determine which instances are fraud and, if confirmed
identity or other fraud, place a hold code or other flag on the associated loan(s);2
(2) Take appropriate action if it is determined that a minor’s Social Security Number
(SSN) was fraudulently used—including routing them through the identity theft
validation process—to prevent a credit report action; and
(3) Take appropriate action if it is determined that an elderly individual's SSN was
fraudulently used---including routing them through the identity theft validation
process— so they can take appropriate identity fraud redress steps.
While we understand that the information may not involve fraud or identity fraud in all
instances, we are offering to provide the supporting data directly to SBA because it strongly
indicates that further SBA management review is warranted.
In addition to the impacts of identity fraud on unsuspecting victims, significant amounts of
taxpayer funds are also put at risk for fraud, as technological advances have made it easier
for domestic and international criminals to use stolen or synthetic identities to
systematically steal large amounts of government relief funds that are intended for eligible
recipients.
We are providing management with a separate non-public version of this Risk Advisory to
share more details about our analysis and safeguards that can address identity fraud. The
suggestions contained in the restricted Risk Advisory do not constitute formal audit
recommendations; therefore, no written management response is required.
2 Some of the loan applications and/or submissions related to potential identity fraud we detected had PPP and/or EIDL
hold codes; however, the hold codes may not have necessarily prevented further harm to the individuals’ identity. Also,
prior audit history has shown that hold codes and/other fraud filters do not necessarily prevent fraud from occurring and/or
or the loans from being paid out. Therefore, additional appropriate action, as described in (2) and (3) above should be
taken.
3
We will post this public version Risk Advisory on our website in accordance with our
responsibilities under the Coronavirus Aid, Relief, and Economic Security Act, also known as
the CARES Act, to keep the Congress and the public fully and currently informed about fraud
risks related to COVID-19 pandemic programs and operations.3
Sincerely,
Robert A. Westbrooks
Executive Director
cc:
The Honorable Hannibal “Mike” Ware, Inspector General, SBA
Peggy Delinois Hamilton, Special Counsel for Enterprise Risk, SBA
The Honorable Rae Oliver Davis, Inspector General, HUD
3 Section 15010 of the CARES Act establishes the PRAC to promote transparency and conduct oversight of funds provided
to respond to the coronavirus outbreak.