Dieffenbach Testimony

Summary

Written statement of Kenneth R. Dieffenbach, Executive Director of the Pandemic Response Accountability Committee, before the U.S. Senate Committee on Small Business and Entrepreneurship for a February 25, 2026 hearing titled From Fraud to Recovery: Restoring Integrity in Small Business Programs. The statement describes the PRAC's data analytics capability and states that it has supported over 1,200 pandemic-related investigations with a potential fraud loss of $2.5 billion. It describes a May 2025 alert comparing PPP loans with HUD housing data and a June 2025 alert estimating approximately $79 billion in potential fraudulent payments tied to potentially stolen or invalid SSNs. It closes by asking Congress to consider extending the statute of limitations for pandemic-related fraud from five to 10 years, renaming the PRAC and expanding its jurisdiction.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

              Statement of Kenneth R. Dieffenbach
Executive Director, Pandemic Response Accountability Committee


                          before the


                         U.S. Senate
      Committee on Small Business and Entrepreneurship


                         concerning




“From Fraud to Recovery: Restoring Integrity in Small Business
                         Programs”




                      February 25, 2026
Ken Dieffenbach, Executive Director, Pandemic Response Accountability Committee


Chair Ernst, Ranking Member Markey, and Members of the Committee:
Thank you for inviting me to testify at today’s important hearing about improving program
integrity in small business programs.
In March 2020, Congress created the Pandemic Response Accountability Committee (PRAC)
as part of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) to provide
independent oversight of the over $5 trillion in emergency spending disbursed through more
than 500 pandemic relief programs. Comprised of 19 federal Inspectors General (IGs), the
PRAC routinely collaborates with local, state, and federal oversight partners to promote
transparency in pandemic relief spending, reduce fraud, and hold fraudsters accountable.
With the support of and funding from Congress, the PRAC built a data analytics capability
that has proven to be extraordinarily successful in identifying billions of dollars in improper
payments and fraud in pandemic relief programs. The PRAC’s track record of success over
the past six years has validated the clear benefits of having an independent data-centric
entity focused on helping the oversight community and agencies in the prevention and early
detection of fraud, especially those risks that cross agency and program boundaries.
Fraudsters do not follow government organizational charts; they steal from whichever
program is most easy to penetrate. Inspectors general have one mission: to protect taxpayer
funds by preventing and detecting fraud, waste, and abuse. Agencies, on the other hand,
often prioritized speed of payment over reasonable due diligence in the pandemic. In the
Paycheck Protection Program (PPP)’s first 14 days in April 2020 alone, about 1.7 million PPP
loans were issued with disbursements of upwards of $343 billion.
To be clear, agencies that manage taxpayer-funded programs and the Department of the
Treasury (Treasury) that disburses these funds have the primary, first line of defense
responsibility to identify and mitigate fraud risks. The PRAC and IGs play a complementary
role focused on identifying and thwarting emerging threats. This includes uncovering
organized, often transnational criminal conspiracies, and complex trends, patterns, and
hidden connections only visible using advanced analytics, sensitive law enforcement data,
and fraud subject matter expertise.
I have served as the PRAC’s Executive Director since July 2024 where I am privileged to
work with 28 dedicated and talented federal employees and a team of contractors.
Operating on an annual budget of approximately $18.5 million, to date the PRAC team has
helped recover over $500 million for the taxpayer. Prior to this role, I spent over 29 years
fighting fraud as a federal law enforcement agent at multiple agencies, with a specific focus
on federal grant fraud.


                                              2
With the support of Congress and in recognition of the success of the PRAC model, in July
2025 the One Big Beautiful Bill (OBBB) Act (Public Law 119-21) extended the PRAC’s sunset
date until September 30, 2034, expanded our jurisdiction to programs funded in the bill,
and provided $88 million in funding to support our anti-fraud efforts. The entire PRAC team
looks forward to fulfilling this new mandate and demonstrating how to prevent fraud,
advance transparency and accountability, and improve government operations.
To facilitate our mission, we:

   •   prevent and detect fraud, waste, and abuse

   •   promote collaboration that enhances program integrity and protects taxpayer dollars

   •   ensure effective and efficient PRAC operations
We have collected key datasets and developed novel tools to enhance agency fraud
prevention going forward. Through our efforts, we now have over 1 billion records from more
than five dozen public, non-public, and commercial data sources. This includes over 15
million potentially compromised internet protocol addresses, email addresses, bank account
numbers, street addresses, Social Security numbers (SSNs), and Employer Identification
Numbers that pandemic fraudsters attempted to, or successfully used, to defraud federal
spending. Our graph analytics database has 622 million nodes—such as tax IDs, phone
numbers, internet protocol addresses, email addresses, and physical addresses—and 1.65
billion relationships, totaling 2.3 billion data points. Each dataset is subject to strict privacy
and security requirements outlined in applicable memoranda of understanding or data-use
agreements, and we rigorously adhere to those data governance standards. This data could
be used to flag future applications or payments that are associated with any of these same
attributes.
The PRAC is at the forefront of leveraging artificial intelligence, including machine learning,
network analysis, natural language processing, and robotic process automation to efficiently
collect, organize, and analyze text, documents, and other forms of data to provide rapid
insights into potential fraud and other compliance risks. The time is now to use this data to
prevent fraud schemes before taxpayer dollars are lost and hold wrongdoers accountable.


Investigating Pandemic Fraud
The PRAC’s data analytics support also has been a critical asset used by law enforcement to
root out issues like identity theft, multi-dipping, and organized schemes across multiple
states. We provide robust investigative support to law enforcement partners, offering data
management, advanced analytic capabilities, and investigative lead generation. The PRAC
has used our CARES Act authority to create new models of coordination among federal IGs
like the PRAC Fraud Task Force, a collection of over 50 agents from member IGs that

                                                3
investigate pandemic fraud. We have supported investigative requests related to PPP,
COVID-19 Economic Injury Disaster Loan (COVID-19 EIDL), unemployment insurance,
Restaurant Revitalization Fund (RRF), and Shuttered Venue Operators Grant programs.
The PRAC’s investigative support to more than 50 federal law enforcement and Office of
Inspectors General (OIG) partners has so far supported over 1,200 pandemic-related
investigations, with over 24,000 subjects and a potential fraud loss of $2.5 billion.
We continue to use graph analytics and other advanced tools to support ongoing pandemic
investigations for OIGs and law enforcement agencies, with a focus on identifying potential
organized fraud schemes, often resulting in increased financial recoveries and a higher
number of targets. The PRAC’s cross program, cross agency capability is unique within
government.
Case examples:

   •   The PRAC assisted in a case that led to an Alabama individual being sentenced to
       114 months in prison for defrauding the PPP, COVID-19 EIDL, and RRF programs for
       herself and others. She submitted false business information and fabricated
       documents to obtain relief funds, charged upfront fees to file applications for others
       regardless of eligibility and used the funds for personal expenses. In total she
       attempted to defraud these programs of over $14 million.

   •   Fourteen people were charged with defrauding PPP of $53 million. The defendants
       allegedly submitted at least 29 fraudulent PPP loan applications to financial
       institutions that included inflated payroll expenses, doctored bank statements, and
       false tax forms. This case relied on data analysis provided by the PRAC.

   •   In New York, a judge delivered a 25-year sentence to a recidivist fraudster who stole
       over $1 million in pandemic relief funds. He and his co-conspirator, who received a
       nine-year sentence, used stolen identities, sham tax records, and corporate
       documents to successfully obtain PPP and COVID-19 EIDL funds.

   •   We assisted with analytics in the investigation that led to the sentencing of the two
       co-founders of one of the largest financial technology companies (fintechs) to
       facilitate PPP loans. Our analysts utilized graph analytics to identify shared
       connections among borrowers to develop a more comprehensive view of the broader
       network and support the identification of additional targets. This work helped the
       Small Business Administration (SBA) OIG identify new subjects and associated loans
       and the increase in the total estimated fraud loss.

   •   The PRAC assisted in a case in which an individual was convicted of fraud for
       knowingly submitting falsified financial records to obtain more than $1 million in



                                              4
       COVID-19 relief funds through the Shuttered Venue Operators Grant program, despite
       being statutorily ineligible.

   •   Six Oklahoma residents were sentenced in a $1 million PPP fraud scheme, creating
       fake businesses and fake identities to obtain fraudulent loans and deposit them into
       their own bank accounts.

   •   Two individuals were sentenced to a combined six years in prison for fraudulently
       obtaining more than $7 million in PPP and COVID-19 EIDL loans by submitting
       falsified payroll records, fake tax returns, and fabricated revenue documents to
       lenders and the SBA, and using the stolen funds for personal gain.

   •   Two Ohio individuals were sentenced to 56 months and 27 months, respectively, for
       fraudulently obtaining more than $4.2 million in PPP and COVID-19 EIDL loans by
       submitting applications containing false information and falsified tax documents for
       multiple businesses and clients, receiving 15-20% of the loan proceeds as kickbacks.

   •   A former bank manager was sentenced to 10 years in prison for participating in a
       conspiracy that attempted to obtain nearly $25 million in PPP and COVID-19 EIDL
       funds by submitting more than 90 fraudulent loan applications to multiple banks
       including his employer and a former employer.
We provide our law enforcement and IG partners, as well as U.S. Attorneys’ Offices, with
access to the PRAC’s datasets, on-demand analytics, and investigative support. The statute
of limitations for the PPP and COVID-19 EIDL were extended to 2030 and we continue to
receive thousands of hotline tips from the public, generating leads for law enforcement
investigations.


The PRAC’s Fraud Prevention Focus
The PRAC recently issued our Strategic Plan for 2025 to 2030, highlighting our mission to
promote and support fraud prevention and detection efforts across federal programs by
leveraging innovation and data analytics. Of note is our objective to “demonstrate the value
and effectiveness of fraud prevention.” It is critical to show the clear and quantifiable
benefits that result from investment in fraud prevention. We look forward to using this
Strategic Plan to help inform the public, Congress, and other stakeholders about the
important mission of the PRAC and guide our delivery of high-quality and impactful services.
In furtherance of these goals, we recently issued two Fraud Prevention Alerts that
demonstrate the clear need to invest in and prioritize fraud prevention:

   •   In May 2025, we issued a fraud alert showing how we were able to compare data of
       individuals using similar identifying information who successfully received low-income

                                              5
       housing benefits from the Department of Housing and Urban Development (HUD) as
       well as Paycheck Protection Program (PPP) loans from the SBA. We found that in over
       40,000 cases, the applicant reported significantly higher income to SBA than to HUD.
       These anomalies indicated potential fraud in more than $860 million in PPP loans
       and an undetermined amount of fraud in low-income housing programs. These
       discrepancies may reflect intentional misreporting of income by individuals, or they
       could stem from identity theft involving one or both programs. As a result, individuals
       may have improperly obtained PPP loans or HUD housing benefits, effectively denying
       assistance to applicants who legitimately qualified.

   •   In June 2025, we issued another fraud alert outlining our findings regarding the use
       of potentially stolen or invalid Social Security numbers (SSNs) to obtain funds from
       three major pandemic relief programs: SBA’s COVID-19 Economic Injury Disaster
       Loan program, PPP, and the Department of Labor’s pandemic unemployment
       insurance programs. We randomly sampled identity records from 67.5 million
       applications that received funding from those three programs and provided the
       Social Security Administration (SSA) with the SSNs, name, and date of birth (DOB)
       from the randomly selected applications, and asked SSA to verify the validity of the
       data in the applications by answering three questions:
          (1) Was the SSN real?
          (2) If it was a real SSN, was the name and DOB provided by the applicant the
          same as the name and DOB in the SSA’s records for that SSN?
          (3) Was the person living or dead?
       Importantly, we did not ask SSA for its records; we only asked for yes/no answers to
       our three questions, which SSA was able to complete in a matter of days. Based on
       SSA’s responses, we estimated that these pandemic programs disbursed
       approximately $79 billion in potential fraudulent payments due to the use of over 1.4
       million potentially stolen or invalid SSNs. Had our analytics platform been in
       existence at the outset of the pandemic, we could have used this verification process
       to timely identify this potential fraud before it occurred and provided the program
       agencies with the information needed.
These Fraud Prevention Alerts highlight how the PRAC’s analysis can be used to verify
identities and flag potential anomalies in applications before money is disbursed—without
any undue delay in sending money to those in need. By using advanced data analytics to
detect red flags and prevent fraud and other types of improper payments, the PRAC helps
federal agencies learn from the past and prepare for future crises. These insights can guide
how future emergency and non-emergency funding is designed and distributed—ensuring
monies reach the right people at the right time.

                                               6
Support to the Oversight Community
The PRAC has also continued to support our oversight partners with impactful projects,
including:

   •   Risk Model for a $91 Billion PBGC Program: We continue to collaborate with the
       Pension Benefit Guaranty Corporation Office of Inspector General (OIG) to support a
       PRAC-developed risk scoring model to streamline the Special Financial Assistance
       application review process. This project includes 10 years’ worth of data to help the
       OIG identify risky applications among more than 1,000 multiemployer pension plans.
       This effort helped identify plans for OIG review, which directly resulted in $261.9
       million in civil and administrative recoveries to date.

   •   Risk Model for $11 Billion in FCC Programs: In collaboration with the Federal
       Communications Commission (FCC) OIG, we recently launched risk models related to
       three FCC pandemic programs [Emergency Connectivity Fund ($7.1 billion),
       Emergency Broadband Benefit ($3.2 billion), and COVID-19 Telehealth Program
       ($450 million)] and the 14,000 entities that participated in these programs. This
       project links and matches FCC data with existing PRAC data sources, including known
       pandemic fraud schemes, and identifies patterns, trends, and other risk indicators to
       help better target FCC OIG oversight efforts.

   •   Rick Model for SBA OIG Complaint Processing: This project helped the OIG triage the
       enormous increase in hotline complaints it experienced after the start of the
       pandemic. Prior to March 2020, the SBA OIG’s hotline typically received fewer than
       1,000 complaints per year. That rate increased to 6,000 complaints per week during
       the early months of the pandemic. Using the PRAC-designed risk model, SBA OIG
       investigators were better equipped to assess which of these complaints to pursue,
       saving them valuable time and resources.

   •   Analytic Center Expansion: This project involves expanding the PRAC’s shared
       analytics center to a broader set of users and adding system enhancements to help
       Offices of Inspectors General detect potential fraud in OBBB Act or pandemic
       programs. The program currently includes data from nine sources and specific risk
       flags to allow auditors and investigators to more efficiently detect anomalies and
       leads for audit or investigation.

   •   Administrative False Claims Act (AFCA) Referral Tool: We are creating a robotic
       process automation (RPA) capability that can automatically generate referral letters
       related to Administrative False Claims Act matters to facilitate the recovery of
       taxpayer funds. We previously created an RPA solution to automatically review user-
       provided judgment and indictment documents to generate debarment letters. The
       AFCA RPA tool can leverage our existing capability to save resources.

                                             7
Over the last five plus years, the PRAC has documented serious control weaknesses in
federal pandemic programs that led to billions of dollars in fraud. Some of the PRAC’s key
findings include:

          •   the need to use tools beyond self-certification to verify applicants’ identity and
              eligibility for funding.
          •   encouraging timely access to a consent-based verification system that would
              reduce the incidence of identity fraud, thereby helping protect victims of
              identity theft.
          •   ensuring key data elements such as applicant internet protocol addresses are
              retained to allow for pre- and post-award analysis.
          •   improving the tracking and reporting of subrecipient spending to increase
              transparency about the flow of federal dollars.
          •   leveraging existing federal data sources, such as the Treasury’s Do Not Pay
              (DNP) system, to determine eligibility.
          •   providing recipients and program administrators with timely and clear
              guidance to ensure funds are disbursed efficiently and effectively.
          •   conducting joint meetings between the agency and OIG during the program
              design phase to enhance opportunity to identify and mitigate risks related to
              fraud and other forms of improper payments.
These and other findings are documented in PRAC oversight reports, Lessons Learned in
Oversight of Pandemic Relief Funds and our Blueprint for Enhanced Program Integrity,
which shares lessons learned and best practices to help strengthen federal programs,
enhance stewardship of federal funds, and ensure that taxpayer-funded programs and
assistance are delivered to those that Congress intended to reach.


Fraud Prevention Engine
The PRAC has also developed an artificial intelligence-enabled “Fraud Prevention Engine”
that can review approximately 20,000 applications for federal funds per second to identify
anomalies, trends, and patterns before funds are disbursed.
The purpose of this proof-of-concept project was to determine if such a model could be
developed and to identify and address any technical hurdles. The model was trained using a
sample of approximately 5 million SBA COVID-19 EIDL applications. The Fraud Prevention
Engine includes modular components, including unsupervised machine learning models to
detect anomalies, supervised machine learning models to identify similar patterns and
identifiers as we have found in pandemic fraud cases, and rules-based flags such as invalid
SSNs and Employer Identification Numbers. These anomalies can often reveal hidden
connections such as a shared bank account amongst seemingly independent applicants. We

                                              8
are also building the capability to rapidly detect anomalies in supporting documentation
submitted by applicants.
The Fraud Prevention Engine can flag applications requiring additional due diligence and
applications with attributes indicative of organized criminal fraud rings, including those
operating across multiple federal programs, and newly emerging threats to program
integrity. In practice, the Fraud Prevention Engine will be adjusted for each distinct program
to account for their specific risk profile.
Once an application for federal funds is analyzed by this tool and assigned a risk score, the
PRAC would then provide feedback to the awarding agency and its OIG indicating one of
three primary outcomes: 1) no issues identified; 2) irregularities, such as an invalid
identifier, have been identified; or 3) significant issues have been identified that are
indicative of a fraud scheme.
Applications in the third category, where we have predication of a potential fraud scheme,
would be further analyzed by the PRAC and the applicable OIG to determine if a formal
investigation, fraud alert, or other proactive action is warranted. To keep with our
commitment to track and demonstrate the value of fraud prevention, we will track and share
the statistical outcomes of the Fraud Prevention Engine’s work.
We estimate that had our Fraud Prevention Engine been in use in March 2020 it would have
quickly identified a significant number of funding applications for further due diligence and
would have flagged potentially tens of billions of dollars in payments for further scrutiny
before the funds were disbursed. This model demonstrates how advanced analytics can
proactively identify high-risk applications, strengthen program integrity, and reduce the need
for resource-intensive “pay and chase.” The PRAC team looks forward to deploying this tool
with federal partners.


Helping Prevent Fraudsters from Receiving OBBB Act Funds
The OBBB Act provides hundreds of billions in new spending primarily through the
Department of Defense, the Department of Homeland Security, and the Department of
Agriculture. The majority of this funding is for the procurement of goods and services, with
some funding in the form of grants, direct assistance to individuals, or monies for agency
use such as hiring.
Given the PRAC’s expanded jurisdiction to the programs funded in OBBB Act, we are actively
engaging with our partner OIGs to identify opportunities to prevent fraud in OBBB Act
programs and ensure that the funding goes to those Congress intended. These projects will
include risk dashboards to present a more complete risk picture and the new PRAC Fraud
Prevention Engine to provide near instantaneous insights into patterns, trends, and
anomalies and other indicators of potential fraud schemes. We have identified several
                                              9
specific programs where our data and technology can provide valuable insights to program
officials and the oversight community to enhance due diligence efforts.
The PRAC is also exploring how we can add value to address a wider variety of fraud risks,
beyond identity theft and eligibility fraud issues, in OBBB Act programs including collusive
bidding, product substitution, Buy America Act violations, public corruption, foreign
influence, and hidden relationships. This broader set of risks requires more in-depth analysis
to identify such issues as suspicious bidding patterns and post-award schemes including
presenting false claims or failing to follow terms and conditions of an award.
Of particular focus will be cross-program risks, including some state-run federally funded
programs, as fraudsters rarely target just one government program but instead exploit
program vulnerabilities wherever they exist. This more comprehensive view of fraud risks will
help ensure that the right amount of money goes to the right person or entity for the proper
purpose and that taxpayer dollars are better protected.


Collaborating with Partners to Add Value
A key to the PRAC’s historic and future success lies in strategic partnerships across the
federal oversight community, with the Department of Justice, including their COVID-19 Fraud
Enforcement Task Force and the Antitrust Division’s Procurement Collusion Strike Force,
and the Government Accountability Office. This collaboration process also includes state and
regional governments, who manage over 80% of federal grant dollars via subgrants. This
flow of funds exacerbates existing fraud risks and adds additional risks. For example, most
state-run federal funding programs lack information sharing frameworks across states to
identify schemes impacting more than one state, such as when one Social Security number
is used in multiple states.
The PRAC also maintains a critical relationship with the Department of Treasury Bureau of
Fiscal Service’s Office of Payment Integrity and their Do Not Pay (DNP) platform. It is
important to note that the PRAC and Treasury’s DNP system are complementary platforms
that both work to protect taxpayer dollars from different angles, using different tools. The
PRAC and the Office of Payment Integrity regularly collaborate, explore potential joint
projects, and exchange information to ensure both organizations are efficient and effective
in the fraud prevention space.
The PRAC is dynamic, identifying and acting on the unique fingerprints of potential fraud
schemes and regularly identifying new risk indicators to use at the front end for prevention.
Other federal systems like DNP are more static, compiling “bad actor” lists of previously
identified entity or individual names that are already known to be suspicious, and allowing
agencies to check that list before approving payment. To be clear, having a “bad actor” list
that agencies can check against before sending out taxpayer funds is a valuable and

                                             10
important tool, and one that complements rather than duplicates what the PRAC provides.
One of the unique aspects of the PRAC is our entity resolution code which can identify and
determine that different stylings of an individual’s name, DOB, and other information
included in benefit applications across different federal benefits programs are all the same
person. Entity resolution is a key requirement to address fraud.
Using entity resolution code and other unique tools, the PRAC focuses on providing insights
into a broad set of risks, depending on the specific program, and identifies patterns, trends,
anomalies, and hidden connections across the population of all applications. The PRAC’s
access to over 119 million applications for pandemic aid and over 127,000 known or
suspected pandemic fraud cases result in comprehensive analysis of fraud and other
compliance risks, and serves as an early warning system for organized, often transnational,
criminal conspiracies and other emerging threats to program integrity.
Additionally, the CARES Act provided the PRAC the authority to store and leverage law-
enforcement sensitive data and conduct criminal investigations—tools critical to uncovering
hidden schemes and connecting bad actors.


Considerations for Congress
To further support the work of the PRAC, Congress should consider three additional
measures:
   1) extending the statute of limitations for all pandemic-related fraud from five to 10
      years given the enormous scope of the fraud that we have uncovered to date, so that
      investigators and prosecutors have time to effectively pursue and hold accountable
      those groups and individuals that targeted and defrauded these programs;
   2) updating the PRAC’s name to better reflect the fraud prevention mission and focus
      beyond the pandemic;
   3) expanding the PRAC’s jurisdiction to ensure our fraud prevention tools can be applied
      to a broader set of government spending that cuts across agencies, such as grant
      programs.


Prevention is the Way
In one of the tens of thousands of pandemic fraud cases, a PRAC investigation identified
one scheme involving more than 450 applications associated with $2.6 million in funded
loans from over 100 applicants across 24 states. This is but one example where the
proactive use of data and technology could likely have prevented or aided in the early
detection of a scheme, mitigated the need for a resource-intensive investigation, and helped
ensure taxpayer dollars are used as Congress intended.

                                              11
Prevention and early detection of fraud schemes are clearly better than relying solely on the
“pay and chase” model. Nevertheless, in addition to applying our tools to fraud prevention,
we will continue our efforts to investigate pandemic-related fraud to recover every penny we
can for taxpayers.
Thank you again for your continued strong support of the PRAC, the IG community, and
independent oversight. This concludes my prepared remarks, and I look forward to your
questions.




                                             12


File and source

File

Dieffenbach_Testimony.pdf

Size

201,850 bytes

SHA-256

b1aea5f7c7fb7601d810d6980e798431ee3b371d3e65e31529a4b1864196d149

Our copy

Dieffenbach_Testimony.pdf

Original

www.sbc.senate.gov