Full text
U.S. SMALL BUSINESS ADMINISTRATION
OFFICE OF INSPECTOR GENERAL
SBA’s Handling of Identity Theft in the
COVID-19 Economic Injury Disaster
Loan Program
Verification Inspection
Report 24-04
December 19, 2023
Make a Difference
To report fraud, waste, or mismanagement, contact the U.S. Small Business Administration’s
Office of Inspector General Hotline at 800-767-0385 or visit https://www.sba.gov/oig/hotline.
You can also write to the U.S. Small Business Administration, Office of Inspector General,
409 Third Street, SW (5th Floor), Washington, DC 20416. In accordance with Sections 7 and
8L(b)(2)(B) of the Inspector General’s Act, confidentiality of a complainant’s personally
identifying information is mandatory, absent express consent by the complainant authorizing
the release of such information.
NOTICE:
Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023,
Public Law 117-263, Section 5274, any nongovernmental organizations and business entities
identified in this report have the opportunity to submit a written response for the purpose of
clarifying or providing additional context as it relates to any specific reference contained herein.
Comments must be submitted to AIGA@sba.gov within 30 days of the final report issuance date.
We request that any comments be no longer than two pages, Section 508 compliant, and free
from any proprietary or otherwise sensitive information. The comments may be appended to
this report and posted on our public website.
OFFICE OF INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
MEMORANDUM
409 Third St. SW, Washington, DC 20416 • (202) 205-6586 • Fax (202) 205-7382
Date:
December 19, 2023
To:
Isabella Casillas Guzman
Administrator
From:
Hannibal “Mike” Ware
Inspector General
Subject:
Verification Inspection of SBA’s Handling of Identity Theft in the COVID-19
Economic Injury Disaster Loan Program (Report 24-04)
This report presents the results of our verification inspection of the U.S. Small Business
Administration’s (SBA) corrective actions for the five recommendations from the Office of
Inspector General (OIG) evaluation report SBA’s Handling of Identity Theft in the COVID-19
Economic Injury Disaster Loan Program (Report 21-15). A verification inspection is a short review
that focuses on closed recommendations from prior OIG reports.
We determined OIG Report 21-15 recommendations 1, 2, 3, and 4 to be fully implemented;
however, SBA management has not fully implemented recommendation 5. We will track
management’s execution by reopening the recommendation and will work with SBA to establish
a target date for enacting corrective actions through the audit follow-up process.
We appreciate the cooperation and courtesies provided by your staff. If you have any
questions or need additional information, please contact me or Andrea Deadwyler, Assistant
Inspector General for Audits, at (202) 205-6586.
cc: Katie Frost, Associate Administrator, Office of Capital Access
Katherine Aaby, Associate Administrator, Office of Performance, Planning, and the Chief
Financial Officer
Therese Meers, General Counsel, Office of General Counsel
John Miller, Deputy Associate Administrator, Office of Capital Access
Tonia Butler, Director, Office of Internal Controls
Anna M. Calcagno, Director, Office of Program Performance, Analysis, and Evaluation
Michael A. Simmons, Attorney Advisor, Office of General Counsel
Peter Meyers, Senior Advisor, Office of Capital Access
Rachel Wilson, Program Analyst, Office of Capital Access
1
Background
In March 2020, Congress passed the Coronavirus Preparedness and Response Supplemental
Appropriations Act,1 which deemed the Coronavirus Disease 2019 (COVID-19) pandemic a
disaster, allowing the U.S. Small Business Administration (SBA) to issue Economic Injury Disaster
Loans (EIDLs) to eligible organizations. SBA provided EIDLs of up to $2 million to eligible entities
to help meet financial obligations and operating expenses. Also in March 2020, Congress passed
the Coronavirus Aid, Relief and Economic Security Act (the CARES Act),2 which provided funding
for emergency EIDL advance grants of up to $10,000 per eligible recipient. As noted in Report
Number 21-15, SBA’s Handling of Identity Theft in the COVID-19 Economic Injury Disaster Loan
Program, SBA had approved over $204 billion in COVID-19 EIDLs and advance grants as of
December 2020. That grew to over $385 billion in COVID-19 EIDLs and advance grants approved
by April 2022. Moreover, the Office of Inspector General (OIG) received over 250,000 hotline
complaints, which included allegations of COVID-19 EIDL identity theft, and over 3,000 requests
for investigative support from other law enforcement agencies investigating fraud, including
requests related to alleged identity theft.
In response, we evaluated SBA’s handling of identity theft pertaining to COVID-19 EIDLs and
EIDL advance grants, and issued Report Number 21-15, SBA’s Handling of Identity Theft in
the COVID-19 Economic Injury Disaster Loan Program on May 6, 2021. The objective of the
evaluation was to assess SBA’s handling of identity theft in the COVID-19 EIDL Program, actions
SBA had taken to provide relief to the victims, and actions SBA had taken to mitigate the risk of
financial loss.
We found SBA had insufficient processes in place to:
• Maintain and track identity theft complaints;
• Provide status updates to each complainant alleging identity theft;
• Restore identity theft victims to their condition prior to the fraud; and
• Charge off fraudulent loans and remove Uniform Commercial Code (UCC) filing fees for
loans associated with identity theft without affecting the victim’s credit standing.
1 The Coronavirus Preparedness and Response Supplemental Appropriation, Public Law 116-123, was signed into
law on March 6, 2020.
2 The CARES Act, Public Law 116-136, was signed into law on March 27, 2020.
2
Additionally, we noted SBA received over 150,000 returned EIDL billing statements, potentially
indicating identity theft had occurred. As a result, we made five recommendations to address
the issues noted above. All recommendations were all subsequently closed by SBA between
September 30, 2021, and December 2, 2022.
We initiated this verification inspection to determine whether the closed recommendations
were fully implemented or if further corrective actions were needed. Accordingly, our objective
was to determine the effectiveness of the corrective actions SBA implemented to 1) resolve
credit-related issues for COVID-19 EIDL identity theft victims, 2) charge-off fraudulent loans
and remove UCC filing fees for loans associated with identity theft, and 3) review over
150,000 returned billing statements and resolve any involving identity theft.
Summary of Results
Program officials effectively implemented corrective actions for four of the five
recommendations made by OIG. Specifically:
• Recommendation 1: SBA implemented processes using two software systems to
maintain and track all identity theft complaints.
• Recommendation 2: SBA implemented an effective process to review identity theft
complaints and send complainants letters notifying them of the outcome.
• Recommendation 3: For validated cases of identity theft, SBA developed an effective
process to suspend automated notices, disassociate the victims’ tax identification
numbers from the fraudulent loans, and mail victims a UCC-3 Termination Form.
• Recommendation 4: SBA developed an effective process that requires two reviewers to
charge off loans and UCC filing fees connected to validated identity theft complaints.
However, SBA corrective actions only partially addressed the fifth recommendation. Specifically:
• Recommendation 5: SBA implemented a campaign in which phone calls were made to
obtain updated mailing addresses for returned billing statements. However, the agency
did not implement a process to identify, resolve, and refer to OIG statements connected
to identity theft.
3
Report Number 21-15: SBA’s Handling of Identity
Theft in the COVID-19 Economic Injury Disaster
Loan Program
The following information details the original finding, recommendations, and SBA’s corrective
actions for recommendations 1–5.
Recommendation 1
OIG Finding
OIG Recommendation
SBA Corrective Actions
SBA officials did not know the
exact number of individuals who
have filed an identity theft
complaint.
Develop a process to maintain
and track all identity theft
complaints.
OIG closed this recommendation
on September 30, 2021, because
SBA provided documentation
explaining how they are tracking
identity theft complaints.
Inspection Result
We verified SBA developed a process to maintain and track identity theft complaints using two
systems. The first system collects and houses identity theft complaints submitted via SBA’s
website, by fax, or through the mail. Its counterpart, SBA’s Unified Lending Platform (ULP),
acquired the ability to receive complaints on March 31, 2023, and allows borrowers with
outstanding SBA loans to login to the ULP and submit identity theft complaints. SBA uses both
systems and then assigns the complaints to staff who then validates them and responds to the
complainants.
We held several meetings with, and requested documents from, SBA to verify the agency
implemented a process for maintaining and tracking all identity theft complaints. The meetings
allowed us to understand the distinction between the two systems, including under what
circumstances identity theft complaints would be recorded in one system instead of the other.
We received live demonstrations of the first system and ULP. Finally, we reviewed and used data
from both systems as the basis for the testing we performed related to recommendations 2–4.
We consider this corrective action fully implemented and effective.
4
Recommendation Number 2
OIG Finding
OIG Recommendation
SBA Corrective Actions
SBA did not provide status
updates to those reporting
COVID-19 EIDL identity theft.
Develop a process to provide
status updates to each
complainant alleging identity
theft.
OIG closed this recommendation
on September 30, 2021, after SBA
provided OIG with its written
process to inform complainants
after completing an internal
review of the identity theft
complaint. The agency also
provided a copy of the letter it
issues to the complainant
outlining SBA’s findings from the
internal review.
Inspection Result
We verified SBA developed a written process for providing status updates to complainants
alleging identity theft. This process begins when the complainant submits Form 3513, “U.S. Small
Business Administration Declaration of Identity Theft,” photo identification, and an official police
report or Federal Trade Commission complaint. SBA then reviews the documentation to
determine whether it is complete and, if so, whether the complaint can be validated. If SBA
validates identity theft occurred, the agency sends a letter to the victim informing them of
the results of its review. The letter also details the additional actions SBA will take, such as
disassociating the loan from the victim’s identity and stopping all notices and billing statements.
Should SBA be unable to confirm that identity theft occurred, or the complaint package lacks
required documentation, SBA sends the complainant a letter informing them of this.
After developing an understanding of SBA’s process for providing status updates to
complainants, we verified through testing that SBA effectively implemented the process.
Specifically, we judgmentally selected 50 identity theft complaints for review and found SBA sent
validation letters to complainants, where applicable, for all but one complaint. It is important to
note that even though the status letter was not sent to the victim, SBA disassociated the victim’s
social security number from the loan, stopped mailing billing statements to the victim, and
charged off the loan in a timely manner. After we brought this to SBA’s attention, program
officials sent the complainant a letter explaining that their identity theft complaint was validated.
We did not find this to be a systemic issue.
We consider this corrective action fully implemented and effective.
5
Recommendation Number 3
OIG Finding
OIG Recommendation
SBA Corrective Actions
SBA did not have a process to
restore the victims to the
financial condition they were in
prior to the fraud by:
•
Removing any UCC liens on
the victim’s assets to avoid
any future repossession
efforts;
•
Ceasing loan statements;
•
Preventing collection
actions; and
•
Releasing the victim from
loan liability.
Complete and formalize a
process to restore identity
theft victims to their
condition prior to the fraud.
The process should include
steps to stop the loan billing
statements, prevent
delinquency collections, and
release the victims from loan
liability and UCC liens.
OIG closed this recommendation
on September 30, 2021, after SBA
provided their written process to
restore identity theft victims to
their condition prior to the fraud.
This included mailing a UCC-3
Termination Form to the
complainant; permanently
stopping deferment notices,
billing statements, and all
collection or other derogatory
actions; and preventing any tax
notices from being distributed.
Inspection Result
We verified SBA completed and formalized a process to restore identity theft victims to their
financial condition prior to the fraud. This process includes taking several actions after validating
instances of identity theft, such as stopping loan billing statements, disassociating the victim’s
tax identification number, and resolving the UCC lien.
In order to stop the loan billing statements, the Automated Management System letters are
turned off in the Capital Access Financial System (CAFS). Further, the victim’s tax identification
number is replaced in CAFS with a “dummy” number, disassociating the victim’s identity from
the fraudulent loan. To resolve the UCC lien, SBA mails the victim a UCC-3 Termination Form. The
victim must then file the form with their state government to provide evidence that SBA does
not have a security interest in their assets as collateral.
We judgmentally selected 50 identity theft complaints for review and found SBA took
appropriate actions to restore identity theft victims to their financial condition prior to the
fraud, where applicable, for all but two complaints. Specifically, SBA had validated one identity
theft complaint but did not change the victim’s social security number to a “dummy” number in
ETRAN until we brought this to the agency’s attention. In addition, SBA had validated another
identity theft complaint but did not send the victim the UCC-3 Termination Form. We do not
believe these two cases represent a systemic issue.
We consider this corrective action fully implemented and effective.
6
Recommendation Number 4
OIG Finding
OIG Recommendation
SBA Corrective Actions
SBA did not have a process to
charge off or remove the
fraudulent loans when the funds
have not been returned or to
remove the UCC filing fees
associated with any collateral
for loans made using stolen
identities.
Develop a process to remove
any fraudulent loans and
related UCC filing fees from its
financial records.
OIG closed this recommendation
on December 2, 2022, after SBA
provided their written process to
charge off loans and remove UCC
filing fees when identity theft was
validated.
Inspection Result
We verified SBA developed a written process for removing fraudulent loans and related UCC
filing fees from its financial records. This process includes multiple steps for charging off loans
and UCC filing fees associated with validated claims of identity theft. After validating a complaint,
the relevant loan’s system status is changed to Confirmed Identity Theft in CAFS. Next, the
victim’s tax identification number is changed to a “dummy” number. The final act requires
two reviewers. The first reviewer updates the loan’s liquidation status to “litigation” with a
justification of “confirmed identity theft.” The second reviewer approves the task and finalizes
the charge-off of the loan, including any associated UCC filing fees.
We judgmentally selected 50 identity theft complaints for review and found SBA implemented
controls that required two reviewers to charge off loans and remove UCC filing fees connected
to validated identity theft complaints in all but two cases. Specifically, SBA had validated the
identity theft in two complaints but did not charge off the loans and remove UCC filing fees until
OIG brought it to the agency’s attention. We do not believe these cases represent a systemic
issue.
We consider this corrective action fully implemented and effective.
7
Recommendation Number 5
OIG Finding
OIG Recommendation
SBA Corrective Actions
SBA’s Office of Performance
Management and the Chief
Financial Officer have received
over 150,000 returned loan
statements. Additional potential
identity theft victims could be
unaware of fraudulent loans in
their names.
Review over 150,000 returned
billing statements, and resolve
any involving identity theft,
then refer fraudulent loans to
OIG.
OIG closed this recommendation
on December 2, 2022, after SBA
provided evidence they had
completed 50 percent of the
returned billing statement
reviews.
Inspection Result
SBA successfully addressed the first part of the recommendation by implementing a phone
calling campaign to obtain updated mailing addresses for over 150,000 returned billing
statements. However, the latter part of the recommendation directing SBA to resolve and
refer to OIG returned billing statements involving identity theft was not addressed.
We verified SBA has a thorough process for obtaining updated contact information when it
receives returned billing statements. First, SBA scans the returned billing statements and
sends the list daily to the Customer Service Center (CSC). Upon receiving the list, CSC uses an
automated system to call the listed individuals with the sole purpose of obtaining current
contact information, especially physical addresses. Assuming the system connects with an
individual, the call is forwarded to a live agent who requests an updated address. Should the
automated call fail, an automated messaging system emails the individuals. Multiple attempts
are made to contact the individuals listed on the loan account. The process is continuous, as
returned mail is a routine occurrence.
However, SBA did not implement a formal process to resolve billing statements involving identity
theft. The script SBA uses for the calling campaign does not include an inquiry to the caller
regarding identity theft. If the caller states they believe they are a victim of identity theft, the
SBA representative refers them to the identity theft reporting portal. However, SBA does not
track whether callers allege their identity was stolen. Lastly, SBA does not conduct a review to
determine if the returned billing statements involved identity theft.
As a result, we are reopening this recommendation for SBA to ensure that any returned billing
statements involving identity theft are subsequently resolved and referred to OIG.
8
Evaluation of Agency Response
While formal comments were not required and are not typical for verification inspections, the
agency elected to provide formal comments that are included in their entirety in appendix 1. SBA
management agreed to work with OIG to demonstrate that SBA is taking appropriate actions to
close Recommendation 5.
Recommendation 5
Review over 150,000 returned billing statements, and resolve any involving identity theft, then
refer fraudulent loans to OIG.
Status: Reopened
This recommendation is being reopened because SBA did not implement a formal process to
resolve billing statements involving identity theft. The recommendation can be closed when
management provides evidence that returned billing statements involving identity theft are
being resolved and referred to OIG.
9
Scope and Methodology
This verification inspection included all five recommendations from OIG Report 21-15. For the
five recommendations, we reviewed management’s justification and documentation of the
corrective actions implemented to close the recommendations. These recommendations were
closed because SBA provided evidence it had implemented corrective actions addressing the
issues we found during our prior audit.
Our inspection scope covered the period from issuance of the May 2021 report to July 2023. To
answer our objectives, we reviewed pertinent legislation and read SBA’s policies and procedures
for handling identity theft complaints, loan charge-offs resulting from complaints validated as
identity theft, and returned EIDL billing statements. Further, meetings were held with SBA
personnel to understand SBA’s processes and procedures implemented to review identity theft
complaints, provide complainants with the outcome of those reviews, and refer fraudulent loans
to OIG. In addition, we received demonstrations of the two systems SBA uses to track and
maintain identity theft complaints. We also reviewed reports and data showing the results of
SBA’s processes for remediating the recommendations, such as the results of identity theft
complaint reviews, status updates to complainants, and charged-off EIDLs. Finally, we performed
limited testing to determine whether SBA’s processes for addressing the recommendations were
effective and operating as intended.
We performed this review in accordance with the Council on Inspectors General on Integrity and
Efficiency’s Quality Standards for Inspection and Evaluation. Those standards require we plan
and perform a review to obtain sufficient and appropriate evidence to provide a reasonable basis
for our conclusions and observations based on our objective. We believe the evidence obtained
provides a reasonable basis for our conclusions and observations based on our objectives.
Use of Computer-processed Data
We relied on data from the two systems SBA uses to track, maintain, and resolve identity theft-
related matters, including identity theft complaints. More precisely, we used the records from
the two systems as the basis for our sample selection used to perform testing. Our data
reliability efforts for these systems included walkthrough demonstrations and reconciliation to
source documentation. As a result, we believe the information provided by SBA is reliable for the
purposes of this verification inspection.
1-1
Appendix 1: Agency Response
U.S. Small Business Administration
Response to Report
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
To:
Hannibal “Mike” Ware
Inspector General
U.S. Small Business Administration
From:
Jihoon Kim
Director
Office of Financial Program Operations
Office of Capital Access
Date:
12/18/2023
Subject:
Response to OIG Draft Report - Verification Inspection of SBA’s Handling of
Identity Theft in the COVID-19 Economic Injury Disaster Loan Program (Project
23802)
We appreciate the role the Office of Inspector General (OIG) plays in working with management
to ensure that our programs are effectively managed.
We offer the following comments to OIG Discussion Draft Report, “Verification Inspection of
SBA’s Handling of Identity Theft in the COVID-19 Economic Injury Disaster Loan Program
(Project 23802).” The response below is specific to Recommendation 5.
Recommendation 5: Review over 150,000 returned billing statements, and resolve any
involving identity theft, then refer fraudulent loans to OIG.
SBA Response: SBA will work with OIG to demonstrate that SBA is taking all appropriate
actions to close this item.