GAO-24-107122, COVID-19: Key Elements of Fraud Schemes and Actions to Better Prevent Fraud

PDF source document — GAO-24-107122, COVID-19: Key Elements of Fraud Schemes and Actions to Better Prevent Fraud, dated 2023-10-19, issued by Government Accountability Office.

Full text

COVID-19
Key Elements of Fraud
Schemes and Actions to
Better Prevent Fraud
Statement of Rebecca Shea, Director, Forensic Audits
and Investigative Service

Testimony
Before the Subcommittee on Oversight,
Committee on Ways and Means,
House of Representatives
For Release on Delivery
Expected at 10:00 a.m. ET
Thursday, October 19, 2023
GAO-24-107122

United States Government Accountability Office

 United States Government Accountability Office
Highlights of GAO-24-107122, a testimony
before the Subcommittee on Oversight,
Committee on Ways and Means, House of
Representatives

October 19, 2023
COVID-19
Key Elements of Fraud Schemes and Actions to
Better Prevent Fraud
What GAO Found
Most COVID-19 relief funds went to the intended recipients in the intended
amounts. In other instances, significant funds went to those who engaged in
fraud schemes. Federal fraud schemes consist of five key elements: (1) affected
program, (2) participants, (3) types of fraud activities, (4) mechanisms to execute
fraudulent activities, and (5) impacts. These elements represent the highest-level
components in GAO’s Conceptual Fraud Model. The model provides a common
language and structure for describing fraud schemes—including those affecting
COVID-19 relief programs—to support agency efforts to combat fraud.
Key Elements of an Example of a Fraud Scheme Involving Multiple COVID-19 Relief Programs
Federal agencies did not strategically manage fraud risks and were not
adequately prepared to prevent fraud when the pandemic began. While
eliminating all fraud is not a realistic goal, resources and requirements exist to
support strategic fraud risk management. For example, GAO’s Fraud Risk
Framework and Antifraud Resource provide leading practices and interactive
tools, respectively, to help agencies combat fraud. GAO’s 142 recommendations
to agencies to align their efforts with fraud risk management leading practices
also provide a roadmap for action. GAO has also suggested actions Congress
can take, such as reinstating agencies’ reporting on fraud risk management and
enhancing data analytic capabilities. These congressional actions and agencies’
use of GAO resources to strategically manage fraud risk would position them to
better prevent fraud in both normal operations and in emergencies.
View GAO-24-107122. For more information,
contact Rebecca Shea at (202) 512-6722 or
shear@gao.gov.
Why GAO Did This Study
Since March 2020, Congress and the
Administration have provided trillions of
dollars in COVID-19 relief funding to
help the nation respond to and recover
from the pandemic. Agencies across
the federal government acted quickly
to stand up new programs and greatly
scale up existing programs.
The unprecedented demand for
benefits and the need to quickly
implement or expand programs
increased the risk of fraud during the
pandemic. There have also been
cases of funds paid to those who
sought to defraud the government. For
example, from March 2020 through
June 2023, at least 1,399 individuals or
entities were found guilty or liable for
fraud-related charges in cases
involving federal COVID-19 relief
programs.
Managing fraud risk is the
responsibility of program managers
and includes assessing the potential
for fraud and implementing strategies
to appropriately mitigate related fraud
risks. Better understanding the nature
of federal fraud schemes and the
resources available to combat them
can enhance agency efforts to prevent,
detect, and respond to fraud risk during
normal operations and emergencies.
This testimony discusses (1) key
elements of federal fraud schemes and
examples of schemes involving
COVID-19 relief funds and (2) actions
agencies and Congress can take to
better prevent fraud during normal
operations and emergencies.
GAO reviewed its prior COVID-19
findings and recommendations on
internal controls and fraud risk
management practices.

Letter

Page 1
GAO-24-107122  COVID-19
Chairman Schweikert, Ranking Member Pascrell, and Members of the
Subcommittee:
I appreciate the opportunity to discuss key elements of fraud schemes
involving COVID-19 relief programs, as well as what can be done to
prevent fraud in the future.1
Since March 2020, Congress and the Administration have provided
trillions of dollars in COVID-19 relief funding to help the nation respond to
and recover from the pandemic. Agencies across the federal government
acted quickly to stand up new programs and greatly scale up existing
programs. Federal COVID-19 relief funds were distributed broadly to
tribal, state, local, and territorial governments; businesses; and individuals
to combat the effects of the pandemic on the public health system as well
as on the economy.
Most of these funds went to the intended recipients in the intended
amounts, providing needed assistance. However, in other instances,
funds were paid to those who sought to defraud the government. For
example, from March 2020 through June 2023, at least 1,399 individuals
or entities were found guilty or liable for fraud-related charges in cases
involving federal COVID-19 relief programs.2 More are facing charges.
Through June 30, 2023, federal charges were pending against at least
599 individuals or entities for attempting to defraud COVID-19 relief
programs. Cases that reach the prosecution stage in the fraud
identification lifecycle represent a fraction of the instances of fraud or all
possible fraud cases.
The unprecedented demand for benefits and the need to quickly
implement or expand programs increased the risk of fraud during the
pandemic. Managing fraud risk is the responsibility of federal program
managers and includes assessing the potential for fraud and
implementing strategies to appropriately mitigate related risks. Better
understanding the nature of federal fraud schemes and the resources

1Fraud involves obtaining something of value through willful misrepresentation.
2We consider cases closed upon acceptance of guilty pleas, guilty verdicts at trial, or findings of
liability based on our analysis of Department of Justice (DOJ) public statements and court
documentation. The federal government may enforce laws through civil or criminal action. Such
action may be resolved through a trial, a permanent injunction, a civil settlement, or a guilty plea. Our
analysis is limited to the cases we identified from public sources and may not include all criminal and
civil cases charged by DOJ as of June 30, 2023.
Letter

Page 2
GAO-24-107122  COVID-19
available to combat them can enhance agency efforts to prevent, detect,
and respond to fraud risk in normal operations and emergencies.
My comments today summarize key findings from our Conceptual Fraud
Model, Antifraud Resource, and fraud-related COVID-19 work.
Specifically, I will discuss the following:
1. Key elements of federal fraud schemes and examples of schemes
involving COVID-19 relief funds and
2. Actions federal agencies and Congress can take to better prevent
fraud during normal operations and emergencies.
In preparing this testimony, we reviewed findings from our prior work on
internal controls and fraud risk management practices in COVID-19 relief
programs. Given the government-wide scope of this work, we undertook a
variety of methodologies. These methodologies include examining federal
laws and agency documents, guidance, processes, and procedures. We
also interviewed federal and state officials. More detailed information on
the objectives, scope, and methodology that this statement is based on
can be found in the individual reports from which we obtained this
information.
We conducted the work on which this statement is based in accordance
with generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on
our audit objectives.
To better understand and assess the nature of known fraud—both
financial and nonfinancial—affecting federal programs and operations, we
developed a Conceptual Fraud Model (fraud model).3 While we
developed and released the fraud model during the COVID-19 pandemic,
it is applicable across federal programs during normal operations and
emergencies.

3The Conceptual Fraud Model is organized as an “ontology.” An ontology is an explicit description of
categories in a subject area and their characteristics, as well as the relationships among them. To
develop our fraud model, we collected, reviewed, and analyzed multiple sources of information,
including over 200 adjudicated federal criminal and civil fraud cases to validate and refine the fraud
model.
Federal Fraud
Schemes Include
Five Key Elements

Page 3
GAO-24-107122  COVID-19
The fraud model identifies five key elements of fraud schemes affecting
federal programs and operations. These include (1) the affected program
or operation, (2) participants, (3) types of fraud activities, (4) mechanisms
used to execute the activities, and (5) impacts of the fraud scheme, as
depicted in figure 1. The full model demonstrates the complexity of fraud
relationships that affect the federal government, such as how fraudsters
use mechanisms to execute fraud activities and their impacts on
individuals and the government.
Figure 1: Five Key Elements of Fraud Schemes Affecting the Federal Government

The five key elements reflect the highest-level components of the model.
Systematically organized subcomponents of the full model are available
for download and exploration from GAO’s Antifraud Resource website.4
The model was developed to help promote a common understanding of
fraud that affects the federal government. The model can also be used to
enhance data analytics by providing a common framework and

4GAO, “The GAO Antifraud Resource” (Washington, D.C.: Jan. 10, 2022), accessed Oct. 14, 2023,
https://gaoinnovations.gov/antifraud_resource/.

Page 4
GAO-24-107122  COVID-19
vocabulary to describe and classify fraud affecting the federal
government.
The federal government collects and spends funds to support a broad
range of programmatic and operational objectives. These include
objectives related to education, health care, research, infrastructure,
economic development, and national defense. This broad range of
activities, as well as the scope of those expenditures, makes government
functions a target for fraudsters. When federal programs or operations are
targeted by fraud, it also exposes federal employees and stakeholders to
other risks, such as program integrity challenges and organizational
reputational risks.
Affected COVID-19 relief programs. A variety of COVID-19 relief
programs were targets in fraud schemes, with some schemes involving
multiple programs. The majority of the 1,399 individuals or entities found
guilty or liable had charges related to the Small Business Administration’s
(SBA) Paycheck Protection Program (PPP) or COVID-19 Economic Injury
Disaster Loan (COVID-19 EIDL) program or the Department of Labor’s
(DOL) unemployment insurance (UI) programs. However, other targeted
programs include
•
Department of the Treasury and the Internal Revenue Service’s
economic impact payments;
•
Treasury’s Emergency Rental Assistance program and Coronavirus
Relief Fund;
•
Department of Agriculture’s federal child nutrition programs and
Coronavirus Food Assistance Program;
•
Department of Education’s Higher Education Emergency Relief Fund;
•
Department of Health and Human Services’ Health Resources and
Services Administration’s COVID-19 Uninsured Program and Provider
Relief Fund, and the Centers for Medicare & Medicaid Services’
Accelerated and Advance Payment Program; and
•
Federal Reserve’s Main Street Lending Program.
Some schemes involved multiple COVID-19 relief program targets, such
as one scheme to fraudulently receive funds from three programs—
COVID-19 EIDL, PPP, and UI (see sidebar).

Element 1: Affected
Programs or Operations
Multiple Affected Programs in a Fraud
Scheme Involving COVID-19 Economic
Injury Disaster Loan (COVID-19 EIDL)
Program, Paycheck Protection Program
(PPP), and Unemployment Insurance (UI)

Participants
Four defendants were sentenced for
conspiracy to defraud several COVID-19 relief
programs. The ringleader was sentenced to 4
years in federal prison and ordered to pay
$38,756 in restitution and a fine of $20,000.
Fraud scheme
Through her tax-preparation business, the
ringleader recruited at least five people to
prepare fraudulent tax returns and
applications to COVID-19 relief programs for
clients. She charged her clients up to 50
percent of the fraudulent COVID-19 EIDL
proceeds, paying her employees a flat fee for
each fraudulent application that received
funding. She also submitted fraudulent
COVID-19 EIDL applications in her own
name. She defrauded PPP by obtaining a
fraudulent PPP loan of $3,548. Finally, she
also claimed more than $33,000 in UI
payments to which she was not entitled.
Impacts
Instead of going to small businesses in need
or individuals facing unemployment during the
pandemic, the defendants redirected those
funds to their own purposes.
Source: GAO analysis of court documentation.   |
GAO-24-107122.

Page 5
GAO-24-107122  COVID-19
Every fraud scheme has at least one fraudster. The fraudster(s) may
attack from within or outside the affected federal program or operation
(see sidebar). A fraudster may be aided by one or more facilitators, who
provide assistance to the fraudster. Some facilitators knowingly
participate in fraud schemes by being complicit or coerced. Other
facilitators may unknowingly participate in fraud schemes, such as by
providing personal identifying information (PII) for one purpose, but that
PII is then used without their knowledge to further a fraud scheme. Fraud
scheme participants also include victims—participants directly hurt by the
scheme. See figure 2 for the different types of participants associated
with fraud schemes.
Figure 2: Types of Participants Associated with Fraud Schemes

Element 2: Participants
Fraudster Operating from Within to
Defraud the Unemployment Insurance
(UI) Program

Participants
A contract employee for a state workforce
agency was sentenced to almost 5 years in
prison and ordered to pay around $4 million
in restitution for wire fraud.
Fraud scheme
The employee was responsible for
reviewing, processing, and verifying the
legitimacy of CARES Act UI claims. Using
insider access, the employee disbursed to
personal accounts over $2 million in federal
and state funds intended for unemployment
assistance.
Impacts
Rather than ensuring unemployment funds
went to those in need, the employee used
her position to fraudulently obtain funds to
purchase high-end handbags and other
luxury goods.
Source: GAO analysis of court documentation. |

Page 6
GAO-24-107122  COVID-19
Participants in COVID-19 relief program fraud schemes. COVID-19
relief program fraud schemes included participants within and outside the
affected federal programs. These fraud schemes also involved
participants acting alone or in concert with others, involving domestic and
international actors, and leveraging complicit and unknowing facilitators
(see sidebar). COVID-19 relief program fraud schemes involved a wide
variety of victims.
Complicit facilitator – Our prior work illustrated schemes involving
complicit individuals who facilitated PPP and COVID-19 EIDL fraud for
others, sometimes in return for a kickback payment.5 For example, cases
involving registered agents charged with fraudulently obtaining PPP and
COVID-19 EIDL funds illustrate the role of complicit facilitators.6 As
professional service providers, registered agents have access to business
information, including shell companies, and business formation functions.
In our review of fraud in SBA pandemic programs, we found examples
where registered agents took advantage of their role, for themselves and
others, to obtain about $197.6 million in PPP and COVID-19 EIDL funds.
In a scheme that stole at least $180,000 in UI benefits, a fraudster
collaborated with prison inmates to submit fraudulent applications.7 The
fraudster pleaded guilty to charges including conspiracy to defraud the
United States and was sentenced to 2.8 years in prison. The fraudster
was also ordered to pay $142,069 in restitution.
Victims – Our prior work also illustrated schemes involving victims such
as identity theft victims who were directly hurt by a fraud scheme.8 For
example, a fraudster used stolen identities or PII from victims to apply for
UI benefits. The fraudster participated in a scheme to submit fraudulent
claims to multiple states using fake identification cards. The fraudster also
created financial accounts in the victims’ names to receive funds. The
fraudster pleaded guilty to charges including identity theft and was

5GAO, COVID Relief: Fraud Schemes and Indicators in SBA Pandemic Programs, GAO-23-105331
(Washington, D.C.: May 18, 2023).
6Registered agents are persons or entities authorized to accept service of process or other important
legal or tax documents on behalf of a business and are frequently involved in business formation.
7See GAO, Unemployment Insurance: DOL Needs to Address Substantial Pandemic UI Fraud and
Reduce Persistent Risks, GAO-23-106586 (Washington, D.C.: Feb. 8, 2023).
8GAO-23-106586.
Complicit Facilitators in an Economic
Impact Payments (EIP) Fraud Scheme

Participants
Two members of a family were sentenced to
federal prison, and a third to probation, for
their roles in a $530,293 scheme to file false
tax returns and steal EIPs sent to others. In
addition, the three were ordered to pay
$150,894 in restitution.
Fraud scheme
Acting as tax preparers, the family recruited
foreign individuals who had spent time in the
United States to file fraudulent returns for
education and other credits. To hide the
scheme, the family enlisted others to open
U.S. bank accounts to deposit the refunds,
ultimately opening 68 accounts across 16
banks in the names of 14 different individuals.
When EIPs were sent to qualifying individuals
with bank accounts on file, hundreds of
payments were made into the accounts under
their control based on the false returns they
had filed.
Impacts
While the EIP was intended to support
families in need, this family stole emergency
support funds to use on personal expenses
and to buy real estate. Approximately
$380,000 of stolen funds were recovered,
primarily through sales of the ill-gotten
property.
Source: GAO analysis of court documentation.   |
GAO-24-107122.

Page 7
GAO-24-107122  COVID-19
sentenced to 4 years in prison. The fraudster was also ordered to pay
$299,500 in restitution.
The activity describes the type of fraudulent behavior or actions. All fraud
schemes involve one or more types of fraud, such as tax fraud, health
care fraud, corporate fraud, and identity fraud. Fraudulent activities can
occur in federal programs and operations due to weak internal controls.
Activities can be financial or nonfinancial. Nonfinancial activities can
include trying to achieve prestige, circumvent regulations or rules, or
achieve a different status. For example, educational institutions at all
levels may inflate grades to show adherence to standardization goals.
Corporations may alter data to show they are in compliance with
environmental or workplace safety rules. Individuals may falsify
documents to gain citizenship or assume another identity. Fraud activities
are accomplished through the use of mechanisms, another key element
of fraud schemes.
COVID-19 relief program fraud activities. The types of fraud activities
present in COVID-19 relief program schemes varied, with multiple
activities often employed in a single scheme.
Beneficiary fraud – Beneficiary fraud—an activity that uses willful
misrepresentation in order to improperly obtain a benefit for a beneficiary
or at their expense—was a type of activity seen in COVID-19 relief
program schemes (see sidebar).
Identity fraud – Identity fraud—an activity that uses the theft of personal
information in order to fraudulently obtain benefits—was a key fraud
activity among COVID-19 relief program schemes. Our prior work
illustrated schemes involving use of various types of identity fraud to
obtain PPP and COVID-19 EIDL funds. Identity fraud can be
accomplished through mechanisms such as theft of personally identifiable
and business information or the abuse of shell companies.9 For example,
in one case of identity fraud, the fraudster used stolen personal
information (along with shell companies and false attestation) to obtain
PPP funds. The same fraudster also engaged in synthetic identity fraud
by fabricating an identity using fictitious information in combination with
stolen information such as a Social Security number.

9GAO-23-105331.
Element 3: Types of Fraud
Activities
Beneficiary Fraud Scheme to Obtain
Coronavirus Food Assistance Program
(CFAP) Funds

Participants
An individual was sentenced to 2.5 years in
prison and around $250,000 in restitution for
making a false claim to CFAP.
Fraud scheme
The individual claimed loss of livestock at a
commercial farming operation, despite not
owning or operating a farming operation. The
individual also submitted a fraudulent IRS
Form 7200 to request an advance payment of
employer credits under the Families First
Coronavirus Response Act.
Impacts
In total, the individual attempted to obtain
over $1.5 million in COVID-19 relief funding.
Source: GAO analysis of court documentation.   |
GAO-24-107122.

Page 8
GAO-24-107122  COVID-19
The mechanism is a process, technique, or system used by fraudsters to
execute fraudulent activities. A mechanism can be an individual action or
a group of actions working in concert, such as:
•
Misrepresentation
•
Cybercrime
•
Coercion
•
Document falsification
•
Data breach
•
Social engineering
Fraudsters may use considerable skill and innovation when employing
mechanisms. Fraud mechanisms are used to execute both financial and
nonfinancial activities. For example, contract fraud (type of fraud activity)
often occurs for financial gain and may use mechanisms that assist the
fraudster before or after the contract is awarded. Contract fraud
mechanisms can include actions like “bid-splitting,” billing manipulation,
and fictitious vendors.
COVID-19 relief program fraud mechanisms. Multiple and various
mechanisms were used in COVID-19 relief program fraud schemes (see
sidebar for a scheme using various mechanisms). The mechanisms used
in a fraud scheme have a close relationship to internal controls. For
example, mechanisms of misrepresentation, such as document
manipulation, false declarations, and fictitious entities leave agencies
open to significant fraud risk when they rely on self-certification as an
internal control for fraud prevention. Confirming the eligibility and identity
of individuals receiving payments, such as by confirming wage
information or verifying identity through data and other checks, are key
controls to prevent fraud schemes that rely on such mechanisms. We
found that federal and state agencies relied on self-attestation or self-
certification for individuals to verify their eligibility or identity to receive
assistance from some COVID-19 relief programs in order to disburse
funds quickly to those in need.10

10For example, one of the temporary UI programs—the Pandemic Unemployment Assistance (PUA)
program—initially allowed applicants to self-certify their eligibility and did not require them to provide
any documentation of self-employment or prior income. In addition, the CARES Act initially restricted
SBA from obtaining federal tax return transcripts as part of the COVID-19 EIDL application process.
As a result, SBA relied on self-certification when processing loan and advance applications. The

Element 4: Mechanisms
Multiple Mechanisms Used in a Federal
Child Nutrition Program Fraud Scheme

Participants
Three individuals associated with a nonprofit
organization pleaded guilty to their roles in a
$250 million scheme to defraud a federal child
nutrition program. Over 40 individuals have
been charged in the scheme.
Fraud scheme
Through the abuse of shell companies,
bribes, kickbacks, and fake invoicing,
individuals claimed reimbursement for
purportedly serving meals to hundreds or
thousands of children a day. In total, the
individuals claimed to have served over 1.3
million meals from December 2020 through
June 2021, and received over $3 million in
reimbursement.
Impacts
Rather than using funds to feed children in
need, the individuals used the proceeds for
their personal purposes.
Source: GAO analysis of court documentation.   |
GAO-24-107122.

Page 9
GAO-24-107122  COVID-19
Document falsification – Our prior work illustrated schemes involving
falsification of documents, such as tax forms, payroll documentation, and
bank statements to obtain PPP and COVID-19 EIDL funds.11 Additionally,
false information about other elements of PPP and COVID-19 EIDL loan
applications, such as employee counts and payroll amounts, were
prevalent in DOJ cases as well. For example, we found that more than
half of the PPP and COVID-19 EIDL cases we reviewed involved
falsification of payroll documentation or bank statements or allegations of
tax document falsification, showing that tax forms may have been
commonly forged or altered.
The impact of a fraud scheme describes the outcomes that resulted from
the fraud. One fraud scheme could have a narrow impact on a sole
individual, while another could affect multiple individuals or groups.
Impacts can be financial, nonfinancial, or both. Although sometimes
overlooked, nonfinancial impacts are equally as important because they
can threaten society, such as by affecting public health or national
security.
In addition to the public’s loss of trust, other effects of fraud at the federal
level may include:
•
Economic impacts
•
Public health and safety
•
National security implications
•
Program impacts (i.e., the ability of a program to achieve its mission)
•
Reputational impact
•
Impacts on the fraudster (if caught or detected)

Consolidated Appropriations Act, 2021, enacted in December 2020, addressed both of these
situations.
11GAO-23-105331.
Element 5: Impacts

Page 10
GAO-24-107122  COVID-19
Impacts of COVID-19 relief program fraud schemes. The impacts of
COVID-19 relief program fraud schemes are widespread and will continue
to unfold for years to come. The number of individuals or entities facing
fraud-related charges will likely continue to increase, as these cases take
time to develop. Also, one of the many challenges in determining the full
extent and impact of fraud is its deceptive nature. Programs can
experience fraud that is never identified and the related losses and
impacts are difficult to determine. Some of the impacts of COVID-19 relief
program fraud schemes were direct, such as the loss of taxpayer dollars.
Other impacts were less direct, such as from the loss of access to needed
funds because they were diverted by fraudsters (see sidebar).
Program and reputation impact – The impacts of fraud go beyond
financial losses. Public perception of widespread fraud in pandemic relief
programs can erode trust in government—including confidence in the
government’s ability to manage taxpayer dollars, to prevent fraud, and to
pursue justice. According to DOJ officials, instances of fraud can
normalize additional fraudulent behavior, which increases cynicism
among the public. A high incidence of fraud can lead to public perception
that pandemic relief funds are easy to obtain fraudulently and make the
government a target for further exploitation.

Impacts on Small Businesses from Fraud
in Paycheck Protection Program (PPP)

Participants
An individual was sentenced to more than 11
years in prison and ordered to pay over $17
million in restitution in connection with his
fraudulent scheme to obtain approximately
$24.8 million in PPP loans.
Fraud scheme
The individual submitted 15 fraudulent
applications to eight different lenders for
purported businesses he owned or controlled,
claiming these businesses had numerous
employees and hundreds of thousands of
dollars in payroll expenses when, in fact, no
business had employees or paid wages
consistent with the amounts claimed. The
individual received over $17 million in PPP
loan funds.
Impacts
As COVID-19 devastated companies around
the nation, this individual diverted millions of
dollars from the relief fund that could have
helped them. He used the funds to purchase
multiple homes, pay off mortgages on other
homes, and buy a fleet of luxury cars. He also
sent millions of dollars in PPP proceeds in
international money transfers.
Source: GAO analysis of court documentation.   |
GAO-24-107122.

Page 11
GAO-24-107122  COVID-19
Impacts on individuals – Identity theft inflicts damage to victims’
financial and emotional health. According to DOJ, victims of identity theft
have had their bank accounts wiped out, had their credit histories ruined,
and had jobs and valuable possessions taken away. In COVID-19 relief
program fraud cases, according to DOJ officials, identity theft affects
victims through (1) negative impacts on credit, (2) denial of entitlements
and other benefits (e.g., unemployment benefits) because of prior claims
filed using victims’ identities, (3) susceptibility to other types of fraud, and
(4) time and effort spent rectifying issues related to identity theft. Identity
theft can also affect victims’ physical and psychological health. Victims
may experience anxiety, sleeplessness, and depression, among other
symptoms. According to DOJ, the emotional trauma associated with
identity theft can be as devastating as many violent offenses. (See
sidebar for impacts of identity theft.)
Impacts on fraudster – Fraud also impacts those perpetrating the
scheme. Of the individuals found guilty, at least 1,051 had been
sentenced as of June 30, 2023. Sentences for these cases vary. The
range in length of prison sentencing varies, in part based on other
relevant factors such as prior convictions, and whether there were other
Impacts of Identity Theft from a COVID-19
Economic Injury Disaster Loan Program
(COVID-19 EIDL) Advance Fraud Scheme

Participants
Two individuals were sentenced to 121 and
66 months in federal prison, respectively, and
ordered to forfeit $680,710 and pay more than
$3.7 million in monetary penalties for their
roles in a COVID-19 EIDL fraud scheme.
Fraud scheme
The duo operated a telemarketing scheme
where, in exchange for a fee, they took
personal identifying information (PII) from
victims and promised to file an application for
an agricultural grant. Instead, they filed
fraudulent COVID-19 EIDL applications using
the victims’ PII. They received $1.56 million in
COVID-19 EIDL Advances and attempted to
receive an additional $1.44 million. They also
used a credit and debit card processing
service to charge third parties, from which
they obtained at least $700,000 in fees.
Impacts
The duo diverted needed funds from
legitimate businesses and used individuals’
PII without their consent. They transferred
stolen funds to their personal bank account.
Source: GAO analysis of court documentation.   |
GAO-24-107122.

Page 12
GAO-24-107122  COVID-19
charges in addition to COVID-19 related fraud.12 For example, in one
case of UI fraud, an individual was sentenced to 1 year of probation and
ordered to pay a $2,000 fine and over $16,000 in restitution. In another
case, an individual who pleaded guilty to PPP fraud was sentenced to
over 17 years in prison and 5 years supervised release and ordered to
pay nearly $4.5 million in restitution.
Federal agencies did not strategically manage fraud risks and were not
adequately prepared to prevent fraud when the pandemic began. We
recognize that eliminating all fraud and fraud risk is not a realistic goal.
However, a variety of resources and requirements for fraud risk
management were in place well before the pandemic. Had agencies
already been strategically managing their fraud risks, they would have
been better positioned to identify and respond to the heightened risks that
emerged during the pandemic. Agencies have the opportunity to learn
from the experiences during the pandemic and to ensure that they are
strategically managing their fraud risks. Doing so by leveraging available
resources and adhering to requirements will enable them to carry out their
missions and better protect taxpayer dollars from fraud during normal
operations and prepare them to face the next emergency.
One such resource is A Framework for Managing Fraud Risks in Federal
Programs (Fraud Risk Framework), issued in July 2015.13 This framework
provides a comprehensive set of key components and leading practices
to help agency managers combat fraud in a strategic, risk-based way.
The Payment Integrity Information Act of 2019 requires that the guidelines
for federal agencies established by the Office of Management and Budget

12Courts refer to the United States Sentencing Commission Guidelines Manual (Guidelines) to
determine the particular sentence in each individual case. Under 28 U.S.C. § 994, the Guidelines
should reflect a variety of factors and considerations to determine an appropriate sentence. The
Guidelines set a base offense level and then add or subtract levels due to aggravating or mitigating
circumstances, such as the dollar amount of the loss caused by offense, as well as the defendant’s
criminal history, ultimately arriving at a suggested sentencing range. Additionally, many of the
defendants we reviewed were convicted on additional charges beyond fraud against COVID-19 relief
programs, which would impact the length of their sentences.
13GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP (Washington,
D.C.: July 28, 2015).
Agencies and
Congress Can Take
Actions Now to Better
Prevent Fraud

Page 13
GAO-24-107122  COVID-19
(OMB)—which incorporate the leading practices from the Fraud Risk
Framework—remain in effect.14
As depicted in figure 3, the Fraud Risk Framework describes leading
practices for managing fraud risk and includes four components: commit,
assess, design and implement, and evaluate and adapt. These leading
practices are applicable during normal operations, as well as during
emergencies.

14Pub. L. No. 116-117, § 2(a), 134 Stat. 113, 131 - 132 (2020), codified at 31 U.S.C. § 3357. The act
requires these guidelines to remain in effect, subject to modification by OMB as necessary, and in
consultation with GAO. The Fraud Reduction and Data Analytics Act of 2015 required OMB to
establish guidelines for federal agencies to create controls to identify and assess fraud risks and to
design and implement anti-fraud control activities. The act further required OMB to incorporate the
leading practices from the Fraud Risk Framework in the guidelines. Pub. L. No. 114-186, 130 Stat.
546 (2016). In October 2022, OMB issued a Controller Alert reminding agencies that consistent with
the guidelines contained in OMB Circular A-123, which are required by Section 3357 of the Payment
Integrity Information Act of 2019, Pub. L. No. 116-117, they must establish financial and
administrative controls to identify and assess fraud risks. In addition, OMB reminded agencies that
they should adhere to the leading practices in GAO’s Fraud Risk Framework as part of their efforts to
effectively design, implement, and operate an internal control system that addresses fraud risks.
OMB, CA-23-03, Establishing Financial and Administrative Controls to Identify and Assess Fraud
Risk (Oct. 17, 2022).

Page 14
GAO-24-107122  COVID-19
Figure 3: The Four Components of the Fraud Risk Framework and Selected Leading Practices

Another resource is the Bureau of the Fiscal Service’s Antifraud Playbook
that provides a how-to guide for implementing the Fraud Risk
Framework’s leading practices.15 The Playbook consists of a four-phased
approach—aligned with the four components of the Fraud Risk
Framework—and 16 best-practice plays for combatting fraud.
We expressed concern in March 2022 about the pace and extent to which
agencies have implemented controls to prevent, detect, and respond to

15Bureau of the Fiscal Service, Program Integrity: The Antifraud Playbook (Oct. 17, 2018), accessed
Oct. 14, 2023, https://www.cfo.gov/assets/files/Interactive-Treasury-Playbook.pdf.

Page 15
GAO-24-107122  COVID-19
fraud in a manner consistent with leading practices since the Fraud
Reduction and Data Analytics Act’s enactment in 2016.16
In April 2023, we issued a retrospective review of GAO reports on
agencies’ efforts to manage fraud risks in alignment with leading practices
from the Fraud Risk Framework.17 Since we issued the framework in
2015, we have issued over 70 reports with recommendations to agencies
to align their efforts with leading practices. Among the 142
recommendations from these reports issued from July 2015 through
December 2022, agencies needed to take additional action to fully
address 74 of these recommendations, as of January 2023.18 Fully
addressing these recommendations can help ensure that federal
managers safeguard public resources, including while providing needed
relief during emergencies.
Our review highlighted five areas in which federal agencies need to take
additional actions to help ensure that they are effectively managing fraud
risks consistent with leading practices, as shown in figure 4.
Figure 4: Federal Agencies Need to Improve Fraud Risk Management Efforts in Five
Areas

16GAO, Emergency Relief Funds: Significant Improvements Are Needed to Ensure Transparency and
Accountability for COVID-19 and Beyond, GAO-22-105715 (Washington, D.C.: Mar. 17, 2022).
17GAO, Fraud Risk Management: Key Areas for Federal Agency and Congressional Action,
GAO-23-106567 (Washington, D.C.: Apr. 13, 2023).
18As of January 2023, of the 142 recommendations, 67 were closed as implemented, one was closed
as not implemented, 11 were open but had been partially addressed, and 63 were open and had not
been addressed. We follow up on recommendations we have made and update the status at least
once per year. Experience has shown that it takes time for some recommendations to be
implemented. Of the 142 recommendations, 21 were made on or after January 1, 2022, and 19 of the
21 remained open as of January 2023. Some recommendations relate to more than one area. For
example, we made a recommendation to the Department of Health and Human Service’s
Administration for Children and Families to conduct a fraud risk assessment to provide a basis for the
documentation and development of an antifraud strategy for the Child Care and Development Fund.

Page 16
GAO-24-107122  COVID-19
In addition to the Fraud Risk Framework, we have developed other
resources—specifically our web-based Antifraud Resource and A
Framework for Managing Improper Payments in Emergency Assistance
Programs (Managing Improper Payments Framework)—to help agencies
combat fraud and improve payment integrity.19 These resources can help
agencies better understand and combat the causes and impacts of fraud.
Antifraud Resource. Our prior work found that agencies have had
challenges effectively assessing and managing their fraud risks and
federal managers may not fully understand how fraud affects their
programs. GAO created the online Antifraud Resource to help federal
officials and the public better understand and combat federal fraud. The
Antifraud Resource is based on the previously discussed conceptual
fraud model and provides insight on fraud schemes that affect the federal
government, their underlying concepts, and how to combat such fraud.
Figure 5 references the online location of this antifraud resource.20
Figure 5: Reference to GAO’s Antifraud Resource

Managing Improper Payments Framework. When the federal
government provides emergency assistance, the risk of improper
payments may be higher because the need to provide such assistance
quickly can detract from the planning and implementation of effective
controls. Our past work has shown that federal agencies should better

19https://gaoinnovations.gov/antifraud_resource/ and GAO, A Framework for Managing Improper
Payments in Emergency Assistance Programs, GAO-23-105876 (Washington, D.C.: July 13, 2023).
Payment integrity includes efforts to minimize all types of improper payments—payments that should
not have been made or were made in the incorrect amount—whether from mismanagement, errors,
abuse, or fraud. While all payments resulting from fraudulent activity are considered improper, not all
improper payments are the result of fraud.
20https://gaoinnovations.gov/antifraud_resource/.

Page 17
GAO-24-107122  COVID-19
plan for and take a more strategic approach to managing improper
payments in emergency assistance programs. In response, in July 2023,
we published the Managing Improper Payments Framework.21
This framework is intended to help federal agencies mitigate improper
payments, including those stemming from fraud, in emergency and
nonemergency programs before they occur. It can also serve as a
resource for Congress when designing new programs or appropriating
additional funding in response to emergencies. It identifies five principles
and corresponding practices (fig. 6) that align with leading practices from
our Fraud Risk Framework, such as identifying and assessing fraud risks
that cause improper payments.

21GAO-23-105876.

Page 18
GAO-24-107122  COVID-19
Figure 6: Framework for Managing Improper Payments in Emergency Assistance
Programs

In addition, our prior work identified opportunities for Congress to take
action to focus agency attention on strategic fraud risk management.
These matters for congressional consideration remain open. We continue
to believe that such actions will increase accountability and transparency
in federal spending in both emergency and nonemergency periods.

Page 19
GAO-24-107122  COVID-19
Reinstate reporting requirements for fraud risk management. We
previously reported that Congress’s ability to oversee agencies’ efforts to
manage fraud risks is hindered by the lack of fraud-related reporting
requirements. The Fraud Reduction and Data Analytics Act of 2015 and
the Payment Integrity Information Act of 2019 required agencies to report
on their antifraud controls and fraud risk management efforts in their
annual financial reports. However, the requirement to report such
information ended with the fiscal year 2020 annual financial report. Since
then, there has been no similar requirement for agencies to report on their
efforts to manage fraud risks.22 In March 2022, we suggested that
Congress amend the Payment Integrity Information Act of 2019 to
reinstate reporting requirements.23
Establish a permanent analytics center for identifying fraud and
improper payments. Responsibilities for planning and implementing
fraud risk management and detection activities start with agency
management officials, however, the oversight community plays a critical
role in identifying and investigating suspected fraud. The importance of
this role in nonemergency periods is heightened during emergencies such
as the COVID-19 pandemic as agencies work to implement large-scale
relief efforts quickly.
At the outset of the pandemic, there was no permanent, government-wide
analytical capability to help inspectors general identify fraud. In March
2021, the American Rescue Plan Act of 2021 appropriated $40 million to
the Pandemic Response Accountability Committee, which subsequently
established the Pandemic Analytics Center of Excellence (PACE).24 The
role of PACE is to help oversee the trillions of dollars in federal pandemic-
related emergency spending. According to the Pandemic Response
Accountability Committee, the PACE applies best practices, with the goal
of building an “affordable, flexible, and scalable analytics platform” to
support Offices of Inspectors General during their pandemic-related work,
including beyond the organization’s sunset date in 2025.
In March 2022, we recommended that Congress consider establishing a
permanent analytics center of excellence to aid the oversight community

22The Payment Integrity Information Act of 2019 includes multiple ongoing reporting requirements for
agencies related to improper payments generally but none specifically mention fraud.
23GAO-22-105715.
24Pub. L. No. 117-2, 135 Stat.4.
Open Matter for Congressional
Consideration
Congress should amend the Payment
Integrity Information Act of 2019 to reinstate
the requirement that agencies report on
their antifraud controls and fraud risk
management efforts in their annual financial
reports.
Source: GAO-24-107122.
Open Matter for Congressional
Consideration
Congress should establish a permanent
analytics center of excellence to aid the
oversight community in identifying
improper payments and fraud.
Source: GAO-24-107122.

Page 20
GAO-24-107122  COVID-19
in identifying improper payments and fraud.25 Without permanent
government-wide analytics capabilities to assist the oversight community,
agencies will have limited resources to apply to nonpandemic programs
to ensure robust financial stewardship, as well as to better prepare for
applying fundamental financial and fraud risk management practices to
future emergency funding.
Amend the Social Security Act to make permanent the sharing of full
death data. Data sharing can allow agencies to enhance their efforts to
prevent improper payments to deceased individuals. To enhance identity
verification through data sharing, we have previously suggested that
Congress consider amending the Social Security Act to explicitly allow the
Social Security Administration to share its full death data with Treasury’s
Do Not Pay system, a data matching service for agencies to use in
preventing payments to ineligible individuals.26 In December 2020,
Congress passed, and the President signed into law the Consolidated
Appropriations Act, 2021, which requires the Social Security
Administration to share, to the extent feasible, its full death data with
Treasury’s Do Not Pay working system for a 3-year period, effective on
the date that is 3 years from enactment of the act.27 In March 2022, we
suggested that Congress accelerate and make permanent the
requirement for the Social Security Administration to share its full death
data with Treasury’s Do Not Pay working system.28
Chairman Schweikert, Ranking Member Pascrell, and Members of the
Subcommittee, this concludes my prepared statement. I would be
pleased to respond to any questions.

25GAO-22-105715.
26GAO, Improper Payments: Strategy and Additional Actions Needed to Help Ensure Agencies Use
the Do Not Pay Working System as Intended, GAO-17-15 (Washington, D.C.: Oct. 14, 2016) and
COVID-19: Opportunities to Improve Federal Response and Recovery Efforts, GAO-20-625
(Washington, D.C.: June 25, 2020).
27Pub. L. No. 116-260, div. M and N, 134 Stat. 1182 (2020).
28GAO-22-105715.
Open Matter for Congressional
Consideration
Congress should amend the Social
Security Act to accelerate and make
permanent the requirement for the Social
Security Administration to share its full
death data with the Department of the
Treasury’s Do Not Pay working system.
Source: GAO-24-107122.

Page 21
GAO-24-107122  COVID-19
For further information about this testimony, please contact Rebecca
Shea, Director, Forensic Audits and Investigative Service, at (202) 512-
6722 or shear@gao.gov. Contact points for our Offices of Congressional
Relations and Public Affairs may be found on the last page of this
statement. GAO staff who made key contributions to this testimony are
Gabrielle Fagan (Assistant Director), Lauren Kirkpatrick (Analyst-in-
Charge), Irina Carnevale, Leia Dickerson, Paulissa Earl, Maria McMullen,
Sabrina Streagle, and Nick Weeks.

GAO Contact and
Staff
Acknowledgments

This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.

The Government Accountability Office, the audit, evaluation, and investigative
arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at no cost is
through our website. Each weekday afternoon, GAO posts on its website newly
released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
Contact FraudNet:
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Automated answering system: (800) 424-5454 or (202) 512-7700
A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S.
Government Accountability Office, 441 G Street NW, Room 7125, Washington,
DC 20548
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707
U.S. Government Accountability Office, 441 G Street NW, Room 7814,
Washington, DC 20548
GAO’s Mission
Obtaining Copies of
GAO Reports and
Testimony
Order by Phone
Connect with GAO
To Report Fraud,
Waste, and Abuse in
Federal Programs
Congressional
Relations
Public Affairs
Strategic Planning and
External Liaison
Please Print on Recycled Paper.

File and source

File

24-107122-covid-19-key-elements-of-fraud-schemes.pdf

Size

1,646,955 bytes

SHA-256

24694c88d2511bfcd5844cecaec28243b552d02709d52f8ffcc50da94d79d34e

Our copy

24-107122-covid-19-key-elements-of-fraud-schemes.pdf

Original

www.gao.gov