And Oig Reports of Fraud in Pandemic

Full text

U.S. GOVERNMENT PUBLISHING OFFICE
WASHINGTON :
52–559
2023
STOLEN TAXPAYER FUNDS: REVIEWING THE SBA
AND OIG REPORTS OF FRAUD IN PANDEMIC
LENDING PROGRAMS
HEARING
BEFORE THE
COMMITTEE ON SMALL BUSINESS
UNITED STATES
HOUSE OF REPRESENTATIVES
ONE HUNDRED EIGHTEENTH CONGRESS
FIRST SESSION
HEARING HELD
JULY 13, 2023
Small Business Committee Document Number 118–020
Available via the GPO Website: www.govinfo.gov

(II)
HOUSE COMMITTEE ON SMALL BUSINESS
ROGER WILLIAMS, Texas, Chairman
BLAINE LUETKEMEYER, Missouri
PETE STAUBER, Minnesota
DAN MEUSER, Pennsylvania
BETH VAN DUYNE, Texas
MARIA SALAZAR, Florida
TRACEY MANN, Kansas
JAKE ELLZEY, Texas
MARC MOLINARO, New York
MARK ALFORD, Missouri
ELI CRANE, Arizona
AARON BEAN, Florida
WESLEY HUNT, Texas
NICK LALOTA, New York
NYDIA VELA´ ZQUEZ, New York, Ranking Member
JARED GOLDEN, Maine
KWEISI MFUME, Maryland
DEAN PHILLIPS, Minnesota
GREG LANDSMAN, Ohio
MORGAN MCGARVEY, Kentucky
MARIE GLUESENKAMP PEREZ, Washington
HILLARY SCHOLTEN, Michigan
SHRI THANEDAR, Michigan
JUDY CHU, California
SHARICE DAVIDS, Kansas
CHRIS PAPPAS, New Hampshire
BEN JOHNSON, Majority Staff Director
MELISSA JUNG, Minority Staff Director

(III)
C O N T E N T S
OPENING STATEMENTS
Page
Hon. Roger Williams ................................................................................................
1
Hon. Nydia Vela´zquez .............................................................................................
3
WITNESS
Hon. Hannibal ‘‘Mike’’ Ware, Inspector General, United States Small Busi-
ness Administration, Washington, DC ...............................................................
4
APPENDIX
Prepared Statement:
Hon. Hannibal ‘‘Mike’’ Ware, Inspector General, United States Small
Business Administration, Washington, DC ................................................
36
Questions and Answers for the Record:
Questions from Hon. Williams to Hon. Ware and Responses from Hon.
Ware ...............................................................................................................
52
Questions from Hon. Vela´zquez to Hon. Ware and Responses from Hon.
Ware ...............................................................................................................
54
Questions from Hon. Phillips to Hon. Ware and Responses from Hon.
Ware ...............................................................................................................
63
Questions from Hon. Scholten to Hon. Ware and Responses from Hon.
Ware ...............................................................................................................
64
Additional Material for the Record:
SBA OIG Report ...............................................................................................
67
SBA OIG White Paper Excerpt .......................................................................
85
SBA Letter to CVD ...........................................................................................
90
SBA Protecting the Integrity of the Pandemic Relief Programs: SBA’s
Actions to Prevent, Detect and Tackle Fraud .............................................
92
SBA Letter to Hon. Williams ...........................................................................
123
SentiLink ...........................................................................................................
125

(1)
PANDEMIC
FRAUD
ACCOUNTABILITY:
RE-
VIEWING THE SBA INSPECTOR GENERAL’S
COVID-19 FRAUD REPORT
THURSDAY, JULY 13, 2023
HOUSE OF REPRESENTATIVES,
COMMITTEE ON SMALL BUSINESS,
Washington, DC.
The Committee met, pursuant to call, at 2:26 p.m., in Room
2360, Rayburn House Office Building, Hon. Roger Williams [chair-
man of the Committee] presiding.
Present:
Representatives
Williams,
Luetkemeyer,
Stauber,
Meuser, Van Duyne, Salazar, Mann, Molinaro, Alford, Bean, Hunt,
LaLota,
Vela´zquez,
Golden,
Phillips,
Landsman,
McGarvey,
Gluesenkamp Perez, Scholten, Thanedar, Chu, Davids, and Pappas.
Also Present: Representative Wenstrup.
Chairman WILLIAMS. Before we begin, we are going to take a
moment to say an opening prayer and the pledge, and I yield like
Congressman Bean to say the prayer, and then we will stand for
the pledge.
Mr. BEAN. Thank you, Mr. Chairman.
Good afternoon, Small Business Committee. Let’s go to the Lord
in prayer.
Heavenly Father, we say thank you. It is the Small Business
Committee saying thank you for small businesses. We know they
are the businesses that put food on the table and provide jobs for
Americans, and we know it is scary out there, and we know that
it is a challenge to run a small business. So today we ask a bless-
ing, a thank you, and protection for these businesses. May they
thrive. They are the backbone of America.
We are also grateful of a free country, those that protect it and
have protected it and will protect it. We ask a blessing on leaders,
that we have sense to do the right thing, and we continue to make
this the greatest country, one of the greatest countries and to con-
tinue to do great things around the world.
All this we ask in your name. Amen.
Please join me in the pledge of allegiance.
All. I pledge allegiance to the Flag of the United States of Amer-
ica, and to the Republic for which it stands, one nation, under God,
indivisible, with liberty and justice for all.
Chairman WILLIAMS. Good afternoon, everyone. I now call the
Committee on Small Business to order.
Without objection, the Chair is authorized to declare a recess of
the Committee at any time.

2
I now recognize myself for my opening statement.
Welcome to today’s hearing, which will focus on two recent re-
ports examining fraud in the COVID-19 pandemic-lending pro-
grams. These contradicting reports, one from the SBA’s Office of
Inspector General and the other from the Small Business Adminis-
tration were released within hours of one another on June 27th.
The SBA Inspector General report concluded the SBA disbursed
more than $200 billion in potentially fraudulent loans through pan-
demic relief programs while the SBA reported the fraud in these
programs is closer to $36 billion. This large discrepancy, more than
$160 billion, certainly demands answers.
And given the drastically different figures in these reports and
the lack of an adequate plan to recoup these stolen taxpayer funds,
we invited SBA Administrator Guzman to join us here today, but
as you can see by her empty seat, she declined the offer. You would
think that a report from a nonpartisan watchdog claiming hun-
dreds of billions of dollars were disbursed to criminals through the
SBA would warrant her showing up to this Committee today, but
that obviously isn’t the case for Administrator Guzman.
During the pandemic, the SBA oversaw an unprecedented
amount of lending. While there was an understanding that getting
money out quickly could lead to higher levels of fraud, nothing of
this magnitude was ever imagined. The OIG report estimates that
roughly one in five loans, I repeat one, one in five loans disbursed
through the pandemic programs have been labeled as potentially
fraudulent. This after-action report shows the SBA was not up to
the task when the American people needed their help the most,
and we must have this track record in the back of our minds as
the agency looks to take on additional responsibilities.
The American people need accountability and transparency, and
if a small business accounts receivable were as high as the SBA’s,
they would take all action possible to get this money back. It be-
longs to them. Unfortunately, it does not appear that the SBA is
taking every action possible to get these stolen funds from back
from the taxpayers.
So we cannot sweep this under the rug or write it off. All this
fraud is a loss for the taxpayers’ bottom line.
So Inspector General Ware, thank you for taking time to join us
today, and we look forward to your examination of these reports
and their discrepancies. And also, the Honorable Guzman is not
here, but her chair is there.
We understand the failures with the SBA are independent of you
and your office, but on behalf of Main Street America, it is our re-
sponsibility to hear about your findings and work toward a solution
to combat fraud moving forward. We must obtain a better under-
standing of what went wrong, how to fix these issues, and what we
can do to recover these stolen taxpayers’ dollars, which we must
begin to go forward and recover what we can.
We stand ready to work to ensure the SBA is the oversight
metrics in place to fairly report their past mistakes, and hopefully
to restore integrity in the agency.
In closing, I would like to take note that the SBA provided a for-
mal letter declining our invitation in which they, again, accused
the OIG of significantly overestimating the fraud and misleading

3
the public. Misleading the public, they say. I ask unanimous con-
sent for that letter, as well as the two reports we will be discussing
today, one from the OIG and one from the SBA, to be entered in
the record.
Without objection, it is so ordered.
So I also ask unanimous consent to waive the Chairman of the
Select Subcommittee on the Coronavirus Pandemic, Dr. Brad
Wenstrup, for the purpose of asking questions in his hearing.
Without objection, that will be so ordered.
So with that, I will yield to our distinguished Ranking Member
from New York, Ms. Vela´zquez.
Ms. VELA´ ZQUEZ. Thank you, Chairman Williams.
Welcome back to the Committee, Mr. Ware.
First, let me thank you and the federal employees who work for
the Office of the Inspector General. The past 3 years have been ex-
tremely challenging for the SBA and your office as well. The agen-
cy executed 14 years of lending in 14 days to help keep small busi-
nesses afloat in the pandemic. It is important to note the impact
of the agency’s effort on America’s small business.
Since President Biden took office, entrepreneurs have started a
record number of small businesses that have created jobs at a rapid
pace. Small firms have paved the way for some of the lowest unem-
ployment rates in recent times, and we got more good news yester-
day, as annual inflation dropped to 3 percent—its lowest rate since
2021.
Despite these successes, any program of the magnitude of SBA’s
COVID-lending measures is bound to encounter serious issues, and
your office has been working around the clock issuing reports and
launching investigations to combat the potential fraud in the pan-
demic relief programs.
Turning to your report, your office estimates that there is $200
billion in potentially fraudulent COVID, EIDL, and PPP loans,
which is unsettling. The SBA issued a report the same day and
found that $36 billion of the $1.2 trillion in pandemic relief was
likely obtained fraudulently. Further, 86 percent of the fraud oc-
curred in the first 9 months of the pandemic under the Trump ad-
ministration.
The findings in these two reports are widely different and, quite
frankly, confusing. I understand there will be discrepancies in the
reporting, but I am concerned over the degree to which the esti-
mates vary.
If our committee is going to conduct proper oversight of the SBA,
we need to be assured that the reports we are receiving, whether
from the OIG or SBA, are measured accurately. I also look forward
to continuing to work with the GAO on its findings as a non-
partisan entity. It is our duty to drill down and to ensure we are
prepared in the event of another global catastrophe.
To date, your oversight and investigative work has resulted in
over 1,000 indictments, over 800 arrests, nearly 550 convictions,
and approximately $30 billion in aid was seized or returned. Your
efforts are to be commended, but more work will need to be done
to hold wrongdoers accountable and recover taxpayers’ dollars.
As you know, I sponsored bipartisan legislation to extend the
statute of limitations for fraud in the PPP and EIDL programs,

4
which became law. This sent a strong message that unscrupulous
behavior will not be tolerated, and those that committed fraud will
be held accountable in the years to come.
To capitalize on these two new laws, I understand you will need
the full fiscal year 2024 budget request. Unfortunately, Repub-
licans in Congress want to pair funding back to fiscal year 2022
levels, and the most recent proposal provides $32 million for the
OIG, hindering your ability to recover fraudulent funds.
I appreciate your oversight and investigative work, and that is
why I am supportive of the President’s increased funding request
for your office. I am fully committed to working with my colleagues
to oppose any short-sided cutbacks. With that said, I fully expect
that you will work closely with the SBA to further refine this data
and help to close the gap between the two estimates.
In closing, I would like to request that the SBA’s response to
your invitation to testify before the Committee today and their re-
sponse to the OIG’s white paper be entered into the record.
Mr. Chairman?
Chairman WILLIAMS. So moved.
Ms. VELA´ ZQUEZ. Thank you, and I yield back.
Chairman WILLIAMS. Thank you.
Now it is my honor to introduce our witnesses. Of course, our
first witness, Isabella Guzman, as we heard, did not come today.
She chose not to come. She was asked more than once to attend
to defend her position. So she chose not to do that. So we have an
empty seat for her.
Secondly, the Honorable Mike Ware is here, and Inspector Gen-
eral Ware holds a Bachelor of Arts degree in accounting from the
University of the Virgin Islands. In May of 2018, following his con-
firmation by the U.S. Senate, Mr. Ware was sworn in as the In-
spector General of the Small Business Administration. Prior to his
appointment, Mr. Ware served as the Deputy Inspector General.
Mr. Ware has over 30 years of experience in the OIG community.
In 1990, he joined the Department of Interior, OIG’s Virgin Islands
field office as an auditor, and later became the field office super-
visor. Mr. Ware later moved to the DOI Office of Inspector Gen-
eral’s Office of Management and served as the Deputy Assistant In-
spector General for Management.
In his current role as Inspector General, Mr. Ware is responsible
for the independent oversight of the Small Business Administra-
tion’s programs and operations, which normally encompass more
than $100 billion in guaranteed loans and nearly 100 billion in fed-
eral contracting dollars.
Mr. Ware recently testified before the Committee in April, and
I would like to welcome him back. Inspector General Ware, thank
you for joining the Committee once again. I am looking forward to
our conversation.
STATEMENT OF HON. HANNIBAL ‘‘MIKE’’ WARE, INSPECTOR
GENERAL, UNITED STATES SMALL BUSINESS ADMINISTRA-
TION
Mr. WARE. Thank you.
Chairman Williams, Ranking Member Vela´zquez, and distin-
guished Members of the Committee. Thank you for inviting me to

5
testify before you today and for your continued support of the Of-
fice of Inspector General.
SBA’s role in the nation’s pandemic response presented an un-
precedented oversight challenge, one that we are continuing to
meet both independently and objectively to improve the perform-
ance of SBA’s programs and services for the benefit of the Amer-
ican people. I am more than proud of the accomplishments of the
hardworking men and women of my office in detecting, deterring,
and combating fraud while also keeping both the Congress and the
Administrator fully and currently informed.
Our office knew from the onset of pandemic relief that SBA
would face a delicate balancing act of preventing widespread fraud
while ensuring timely disbursement of relief funds to Americans in
immediate need. The biggest concern for our office was SBA’s quick
delivery of capital to qualifying small businesses without first es-
tablishing the internal controls necessary to decrease the risk of
fraud. This is why we issued two reports prior to the first PPP
loan, or EIDL, being disbursed, stressing the importance of upfront
program controls to mitigate the risk of fraud.
We proactively recommended internal control measures to SBA
and policymakers in real time to address the allure of easy money
that created the golden opportunity for even otherwise law-abiding
citizens to commit fraud. To date, we have issued 33 pandemic-re-
lated reports with dozens of recommendations and provided about
100 congressional briefings, both to supply corrective action and
strengthen the internal control environment.
Over the course of the pandemic, SBA disbursed approximately
$1.2 trillion of COVID-19 EIDL and PPP funds. Using our inves-
tigative casework, prior reporting, advanced data analytics, and ad-
ditional review procedures, we estimate SBA disbursed more than
$200 billion in potentially fraudulent loans. This estimate rep-
resents approximately 17 percent of disbursed funds in those pro-
grams.
In conducting the fraud landscape review, our office unleashed
the power of data analytics in our oversight function. Fueled by the
expertise and experience of our criminal investigators, auditors,
and analysts, the report identifies 11 fraud indicators that we use
to signal potential fraud. I have offered additional insights on the
various fraud indicators from the report in my written statement.
Our office was able to reduce potential false positives by using
link analysis. This allowed us to prioritize our focus on loan clus-
ters highly suspected of being fraudulent. Our auditors, analysts,
and investigators whittled down numbers by conducting additional
reviews using sampling and professional judgment, taking into con-
sideration prior experience and investigative casework across the
entire law enforcement spectrum.
The transparency afforded by the fraud landscape report and our
well-founded recommendations for corrective action served to miti-
gate fraud. In fact, SBA, indeed, made significant progress to re-
duce fraud risk and prevent further losses in its pandemic pro-
grams. We look forward to continuing to partner with SBA to com-
bat fraud within these programs.
Our collaboration with the SBA, the U.S. Secret Service, other
federal agencies and financial institutions has resulted in about

6
$30 billion in COVID-19 EIDL and PPP funds being seized or re-
turned to SBA. With our law enforcement partners, we have taken
the fraud directly to the doorstep of wrongdoers. Our investigative
work has resulted in over 1,000 indictments, over 800 arrests, and
over 550 convictions as of June this year.
And it is important to note that we aren’t alone in the fight. We
are on every Department of Justice national strike force, and mul-
tiple U.S. Attorney task forces across the country. We continue to
work hand in hand with the PRAC, the FBI, the Secret Service,
IRS Criminal Investigation, Homeland Security investigations, the
United States Postal Inspection Service, TIGTA, and OIG. Too
many to mention.
It is also important to note that our oversight capacity is depend-
ent upon the availability of sufficient budgetary resources to con-
tinue addressing the fraud within SBA’s pandemic response pro-
grams. Absent the total budgetary resources requested for us in the
2024 budget, we will not have a sufficient operating budget to com-
bat the fraud within SBA’s programs or to provide trusted and ef-
fective oversight over its flagship programs.
Critically, we would not have a sufficient operating budget to
capitalize on the new laws you wisely passed last year extending
the statute of limitations to 10 years for fraud in the PPP and
EIDL programs. The nation once again can depend on us to provide
independent, objective, and timely oversight of SBA.
Thank you for the opportunity to speak to you today. I am happy
to answer any questions you may have for me.
Chairman WILLIAMS. Thank you very much. And you know
that you—you know the drill. When the light turns red, your 5
minutes is up, okay?
We will now move to the Member questions under the 5-minute
rule. I recognize myself for 5 minutes.
Before I get started, I want to reiterate how disappointed I am
the Administrator did not show up today. This is a big deal. And
I would assume she would have an army of her staff here coming
to defend her work and the SBA as a whole, but not even the army
is findable. So, but today, we are having this hearing with her seat
as being empty.
Shortly after you released your fraud report, the SBA released a
statement that expressed its concern that the OIG’s approach con-
tained serious flaws that significantly overestimate fraud and mis-
leads the public. I don’t know if I ever remember a time an agency
ever accused their nonpartisan watchdog of misleading the Amer-
ican people and the congressional committees that are charged
with their oversight.
So Mr. Ware, question: Did you and all the employees within
your office put together this report to lie about what occurred with-
in these pandemic programs? Was that your goal?
Mr. WARE. Absolutely not. Our goal, as we have demonstrated
from the beginning of the pandemic is to keep—is to be inde-
pendent, and keep an objective eye so that you can properly over-
see these programs along with us, and I think that we have done
that. I am super confident in this report.
Chairman WILLIAMS. The two total fraud numbers that are
presented in these reports are drastically different, both unaccept-

7
able. Either one is wrong. Can’t accept it. The SBA claims that
they had a more diligent process that ruled out much of the fraud
that your team has flagged.
I have a few questions about these claims. First, who has access
to more data to more accurately find the levels of fraud? The OIG
or the SBA?
Mr. WARE. The Office of the Inspector General does.
Chairman WILLIAMS. Okay.
Secondly, your review of the estimated fraud didn’t start at $200
billion. What was the initial value of the potential fraud you looked
at before you got it down to $200 billion?
Mr. WARE. $650 billion.
Chairman WILLIAMS. Has your office ever communicated that
starting figure to the SBA?
Mr. WARE. We have.
Chairman WILLIAMS. Reporting from outside news organiza-
tions, researchers claim the levels of fraud were much higher than
even your number. Your report says that the $200 billion figure is
conservative. So do you think it is possible that you are under-
estimating the fraud numbers rather than overestimating, as SBA
is claiming?
Mr. WARE. I believe that as the datasets become available, more
and more datasets to us, that the number could be calibrated. It
could go up. It might go down. But I am telling you that we have
a cap on where we believe that fraud level is currently, and that
is at the two and—a little over $200 billion.
Chairman WILLIAMS. So we must get an accurate picture of
what money was obtained illegally so we can bring the criminals
who took advantage of taxpayers to justice and get money back to
the Treasury Department, and we are not just talking about this.
We are talking about doing this.
So while it is good to identify the fraud that occurred, it is going
to all be in vain if we don’t get this money back for the American
people and just talk about it and don’t deliver.
So Mr. Ware, we have seen the SBA take some deliberate actions
that will make it harder to get back some of the illegally obtained
funds, such as their decision not to collect on PPP or EIDL loans
under $100,000. Can you tell us what actions the SBA could take
immediately that would get more of these illegally obtained funds
returned for the taxpayers?
Mr. WARE. Let me state that we have partnered hand in hand
with the agency to pull back the $30 billion that we have pulled
back thus far. There is even more in the shoot right now. We are
just working through the agency to try to streamline the process
for getting that money back. We are still going after this. The Se-
cret Service is still working with us on our individual cases. To-
gether with the Secret Service, we pulled back $1 billion.
And there are, like I said, quite a bit still in the shoot. We will
be working with the U.S. Postal Inspection Services to do that as
well.
Chairman WILLIAMS. You know, to the taxpayers, $100,000 is
still a lot of money. So just to ignore it is another problem.
So I now recognize the Ranking Member for 5 minutes of ques-
tions.

8
Ms. VELA´ ZQUEZ. Thank you, Mr. Chairman.
Mr. Ware, the SBA asserts that 86 percent of the likely fraud
originated in the first 9 months of the pandemic under the Trump
administration. Does your report include such detailed information
on when the likely fraud occurred? Yes or no?
Mr. WARE. No.
Ms. VELA´ ZQUEZ. Does your report indicate that the Biden ad-
ministration put internal controls in place to combat fraud almost
immediately upon taking over?
Mr. WARE. Yes.
Ms. VELA´ ZQUEZ. Yes or no?
Mr. WARE. Yes.
Ms. VELA´ ZQUEZ. Do you agree that the vast majority of the
fraud occurred in the first 9 months of the pandemic? Yes or no?
Mr. WARE. Yes.
Ms. VELA´ ZQUEZ. Did the antifraud controls that the Biden ad-
ministration put into place successfully reduce the potential for
fraud? Yes or no?
Mr. WARE. Yes.
Ms. VELA´ ZQUEZ. Your approach puts an open limit on the po-
tential fraud. With future investigative work, you may weed out a
number of loans that produce a false positive. Yes or no?
Mr. WARE. Yes.
Ms. VELA´ ZQUEZ. Will you then lower the estimate? Yes or no?
Mr. WARE. It could lower or go up. It could go both ways. So
it is difficult for me to answer yes or no. I am going to tell the
truth. That is what I am going to do. Whatever the number is, that
is the number.
Ms. VELA´ ZQUEZ. We are all here for the truth so that we could
enact legislation to correct the shortcomings of what was in place.
Your estimate of potential fraud is much higher than SBA’s esti-
mate. In fact, SBA expressed concerns that the approach contains
serious flaws that significantly overestimate fraud and mislead the
public. How do you respond?
Mr. WARE. I respond that SBA is mistaken, and I think they
know that. We have—there are two main reasons for that. One, we
are the independent watchdog. We have demonstrated that
throughout the pandemic and long before that as one of your origi-
nal 12 Offices of Inspector General.
Ms. VELA´ ZQUEZ. Okay.
Mr. WARE. Secondly, we have access to datasets that they didn’t
have access to.
Ms. VELA´ ZQUEZ. Okay.
SBA conducted a four-part antifraud control framework to pre-
vent and detect fraud. SBA identified 3.4 million files totaling $400
billion as potentially fraudulent, and a human-led review lowered
this number to $36 billion in likely fraud.
Did your office conduct a manual review of each and every file
like SBA did?
Mr. WARE. I will assert that SBA’s manual review does not meet
the qualifications of a manual review for our office.
Ms. VELA´ ZQUEZ. SBA reported that it had 7,300 employees and
contractors reviewing these files, and some were easy to clear. For

9
example, if a borrower uploaded a fake driver’s license, SBA could
identify that loan as fraud quickly.
I also understand that SBA’s level of review will not be as in-
depth as the OIG review, which can take up to 250 days, but SBA’s
review honed in on the amount of likely fraud, as opposed to re-
porting on the upper limit of potential fraud.
Is there a reason you issued this report on potential fraud given
the significant discrepancies? You say that you have been working
hand in hand up to this point yet two reports show a clear discrep-
ancy in terms of the number. Rather than work with SBA to come
up with a better estimate for likely fraud, why did you issue the
report?
Mr. WARE. So this is not just semantics in terms of likely and
potential. Likely fraud for us is $650 billion. That is no assurance.
Potential fraud to us means that we will open an investigation on
every single one of them that we have identified if we have the re-
sources.
Ms. VELA´ ZQUEZ. Okay. That is the point. If you have the re-
sources going forward, we have 10 years, right, that we gave you
through the law that we enacted as a result of the work that we
did. Based on the budget that the Republicans are going to pass
that is calling for fiscal year 2022 levels, you will not have the re-
sources, would you?
Mr. WARE. I will not have if I don’t have my ’24 budget.
Ms. VELA´ ZQUEZ. Thank you.
I yield back.
Chairman WILLIAMS. Next I now recognize Representative
Luetkemeyer from the great State of Missouri for 5 minutes.
Mr. LUETKEMEYER. Thank you, Mr. Chairman.
And Mr. Ware, thank you. Inspector General, thank you for
being here today. I appreciate your hard work and the integrity of
that work.
I have got a quick question for you here with regards to—the
Chairman talked a little bit a minute ago about the $100,000 level
of—the SBA not going after those folks underneath that. Are you
going after that at all? Are you identifying those folks yourself?
Mr. WARE. Yes, well, if they show up as a fraudulent actor for
our office, they go through the same triage process as anything else
in terms of our prioritization on strategy. So, yes.
Mr. LUETKEMEYER. Okay. So they say it is not cost effective
to do this. They don’t have the manpower to do this. Is there any
thought to maybe handing these over to a collection agency?
Mr. WARE. I would have to yield to the SBA on this. Our posi-
tion on it in the PPP report on the same matter and coming in the
EIDL report is that they have not done a sufficient study to deter-
mine whether or not it is cost effective.
Mr. LUETKEMEYER. Well, okay. So we need to go back to the
SBA, Ms. Guzman, who conveniently is not here today, to be able
to ask that question. And if they don’t think it is cost effective for
them, hand it to a collection agency. And you have the IRS to be
able to also be a backup to be able to get those funds, do you not?
Do you have an idea roughly of what the recoverable amount would
be in that $100,000, less than $100,000 range?

10
Mr. WARE. No, that would be very difficult for me the to pro-
vide.
Mr. LUETKEMEYER. Thank you for that.
In your report, you say certain lenders added to the fraud risk
by prioritizing quickness and potential profit over a thorough re-
view of applicant eligibility for government aid. Can you tell me
who those certain lenders are?
Mr. WARE. I could definitely get back to you on the names of
the certain lenders, but they were in certain industries.
Mr. LUETKEMEYER. Certain industries. Okay, so in other
words, if I am not mistaken from previous testimony in this Com-
mittee, the Fintech industry was the main culprit here, was it not?
Mr. WARE. Right. In many instances, yes.
Mr. LUETKEMEYER. And I know that the SBA is getting ready
to expand some of the programs to allow Fintech to be able to par-
ticipate in them. Is that not correct?
Mr. WARE. This is true.
Mr. LUETKEMEYER. Are you working with the SBA to make
sure that the Fintech folks, that our problem children here are not
going to be problem children in the new program?
Mr. WARE. I am on record with SBA on this matter in ensuring
that they have the same rules that properly regulate the more tra-
ditional lending institutions to apply here as well. That is all we
are after. It doesn’t matter to me whether it is a Fintech or not a
Fintech. It matters to me that they are playing on a level playing
field, and the internal control environment is set correctly to avoid
what happened.
Mr. LUETKEMEYER. Well, I appreciate that, but it is very con-
cerning to me whenever they are allowing basically the folks who
were bad actors in the previous program to be able to participate
it in again. That makes no sense to me.
Another question for you here with regards to the money that is
clawed back. Is that money going to Treasury?
Mr. WARE. It depends. So for the EIDL program, that money
more went back to SBA, their account within the Treasury, right.
And for PPP, a lot of that money went to the banks. It goes back
to the banks as the lenders.
Mr. LUETKEMEYER. Okay. So are you tracking those dollars?
Mr. WARE. We are.
Mr. LUETKEMEYER. Are they all going back to where they
need to go? Have you tracked all $30 billion I guess is the ques-
tion?
Mr. WARE. Yes, that part is tracked, but we have others, and
we are still working with the agency on creating a better, more effi-
cient way to track the money that is clawed back.
Mr. LUETKEMEYER. So you’re telling me that you haven’t got
all the money tracked yet?
Mr. WARE. The agency does not have all the money tracked. We
know of money that is still in the pipeline. Where that money is
to go and exactly where to pull it back—we issued a report on this,
on giving them some recommendations on how better to do this. We
are still working with them.

11
Mr. LUETKEMEYER. Well, this is my concern is that we have
got $30 billion running around here and we don’t know where it
is at.
Mr. WARE. No, that $30 billion, we know where that is at.
Mr. LUETKEMEYER. You know where it is?
Mr. WARE. Yes.
Mr. LUETKEMEYER. On where it is headed?
Mr. WARE. Yes.
Mr. LUETKEMEYER. You know where it has been recovered?
Mr. WARE. Can I look back at one person real quick? If I could
look back.
Mr. LUETKEMEYER. All right.
Mr. WARE. Yes, we know. Yes. Yes, we know.
Mr. LUETKEMEYER. Okay. All right. I trust you, Inspector
General. I have been working with you long enough to know that
you are square shooter.
I have one more question before my time runs out here. In the
SBA’s data, in the May 22, ’23 report, it shows that about 1.6 mil-
lion COVID, EIDL totaling 54 percent of active performing loans
are past due, delinquent, or in liquidation, totaling $114.2 billion.
Are you aware of that number?
Mr. WARE. Yes. That is the number the agency provided to us.
Mr. LUETKEMEYER. Okay. So we have got $114 billion more
in these EIDL programs that while not being fraudulent, is in real-
ly big trouble. Would that be a way to——
Mr. WARE. I am not certain about that. I am just certain about
the number that——
Mr. LUETKEMEYER. Well, it says past due, delinquent, or in
liquidation. To me that means they have got some problems there.
Mr. WARE. Oh, no doubt.
Mr. LUETKEMEYER. And not just fraudulent problems, but we
have got some problems with the fact that those dollars are going
to people who either can’t pay it back or won’t pay it back.
Mr. WARE. Right.
Mr. LUETKEMEYER. Okay.
With that, I yield back. Thank you, Mr. Chairman.
Chairman WILLIAMS. Next I now recognize Representative
McGarvey from the great State of Kentucky for 5 minutes.
Mr. MCGARVEY. Thank you, Mr. Chairman.
Thank you, Mr. Ware, for being here. I know you are from the
Virgin Islands, but I understand you have some family in the great
Commonwealth of Kentucky. So two great places there.
Thank you for being here. I thank you for the incredibly impor-
tant work that your office carries out to protect the Small Business
Administration and, in this case, taxpayers’ dollars.
We are here today talking about fraud that happened during the
pandemic in fraud and pandemic relief programs. So I am glad that
you have an opportunity to talk about what kind of fraud controls
work and how we can recover fraudulent loans issued during the
pandemic. No one on this Committee wants money going out to
fraudulent businesses or fraudulent lenders.
So I also want to take a second to set the stage and remember
what it was like when the pandemic started. This was an unprece-
dented program where, you know, we were putting together things

12
literally in 2 weeks and saying we have got to get money out to
these businesses. I know the businesses in my community, many
of whom got this money, and that is why they are still here today.
Between the Biden and Trump administrations, the SBA set up
programs and issued over $1 trillion of loans. And according to
SBA’s analysis, only a small percentage of that money went to
fraudulent buyers. According to your analysis, even a vast, vast
majority of it went to people who needed it.
Just this week, I met with Headliners Music Hall in my office
as they were up here on another issue. Headliners Music Hall
would not be here today if it weren’t for a successful program like
this that enabled this business to be here. These programs saved
our economy, and they saved the businesses in our communities
that we cherish.
There are some bad actors that took advantage of this, and we
have got to make sure we go after them, but as you have already
testified today, the vast majority of the fraud took place in the first
9 months, and I will point this out, of 2020, so between March of
2020 and January of 2021.
Who was the small business administrator at that time, Mr.
Ware? It wasn’t Ms. Guzman, was it?
Mr. WARE. Oh, no.
Mr. MCGARVEY. No, it wasn’t? Okay.
Mr. WARE. Carranza. Carranza.
Mr. MCGARVEY. Was it——
Mr. WARE. No.
Mr. MCGARVEY. It wasn’t?
Mr. WARE. Ms. Carranza.
Mr. MCGARVEY. Ms. Carranza.
I guess there is an empty seat here for them, too, because they
are not here to answer why all of this fraud took place under their
watch, and so I am glad you point that out.
Mr. Ware, the SBA analyzed the EIDL repayment data and re-
ported that 74 percent of COVID EIDL borrowers already made a
payment, and once the 30-month deferral period lapses, the SBA
expects 85 percent of borrowers will have made a payment. This in-
formation contradicts your findings that $136 billion worth of
COVID EIDLs are potentially fraudulent.
Why didn’t you take into consideration the repayment data,
which would have lowered your estimate of fraud in the EIDL pro-
gram?
Mr. WARE. Let me say two things about that. That data that
you are talking about, they gave that to us probably like 2 days
prior, and then came with the other information after. But, so re-
payment data for us was not a factor for EIDL. It is a factor for
PPP, where those loans were intended to be forgiven and basically
become a grant. So if you don’t come back for forgiveness or you
don’t try to—you know, and don’t try to repay, clearly that is an
indicator. Within EIDL we are arresting people almost daily that
are making payments.
So our criminal investigations across the nation are telling us
that fraudulent actors do repay those loans and we know why.
They could be like businessmen that fraud is their thing, right. So

13
they are conducting business, and they are paying the loans back
never to be found.
Also, in the plea agreements, to try to get—to show good faith
to U.S. Attorneys and everything else, people pay their loans. And
with all the publicity that this is getting, that we are coming and
that there is a whole-of-government approach to this, people pay so
as not to be discovered.
Mr. MCGARVEY. I am glad you bring that up because, again, we
want to go after the fraudulent actors. We want to make sure that
we are getting this money back if it was used inappropriately, par-
ticularly by people who are taking advantage of a successful pro-
gram during a time we needed it.
So the vast majority of the fraud took place during the Trump
administration, and in 2021, Administrator Guzman and the Biden
administration reinstated the longstanding antifraud controls and
new safeguards while also reviewing the previously answered loans
flagged as fraudulent.
Can you take a moment to just let us know, are these security
measures like the SBA’s four-part antifraud control, are they being
effective, and are they combating fraudulent borrowing since imple-
mentation?
Mr. WARE. We do know that it has curved the tide. To what ex-
tent, we are still reviewing that, and we have reviews that are
coming to an end real shortly on exactly how those controls per-
formed. More importantly, if the controls promised were, indeed,
implemented as they promised.
Mr. MCGARVEY. And thank you. I appreciate that.
In our closing comments, I appreciate you being here. And, you
know, this is a Committee that works together to stop activities
like this. I hope your presence here is not a partisan attack on the
administrator.
Chairman WILLIAMS. Okay. I now recognize Representative
Meuser from the great State of Pennsylvania for 5 minutes.
Mr. MEUSER. Inspector General, great to be with you.
Mr. Chairman, thank you.
So we are not really trying to assign blame here over on this side
of the aisle. We would like to try to find some answers and solu-
tions. You know, the numbers that are being offered by my col-
leagues are not just accurate. I mean, the EIDL was the primary
loss from fraud. The PPP, as stated, was a heroic savior of our
economy. 70 percent of the PPP went out under the previous ad-
ministration where about slightly over 30 percent under the other.
So if we want to—you know, there is a lot of blame to go around,
but, my goodness, it is just a shame that that is the majority of
the time being spent.
Now, it does not, it does not dismiss the fact that the Adminis-
trator Guzman, under this terrible situation, okay, where fraud ex-
ists is not here. I know damn well if I was the SBA administrator,
if this was the case, I would be sitting there trying to help solve
the problem and explain it to the American people how this oc-
curred and where things are and what we are being—what is being
done to create the—to gain the collections and what is being done
to those who committed the fraud, whether it is institutions,
whether it is Republicans or Democrats.

14
That is why, Mr. Inspector General, we appreciate you being
here and your forthrightness and your honesty and your courage
in moving this to help solve some of these issues.
So let me ask you this, sir: Did you work with the banks and the
lending institutions to gain the information to figure out which
buckets the $200 billion in estimated fraud came from?
Mr. WARE. In some instances, yes, we were able to obtain lender
files and conduct reviews to validate our findings.
Mr. MEUSER. Okay. And so the banks, obviously, were coopera-
tive in saying even though I had known the customer or I didn’t
know the customer, you probably worked that data as well?
Mr. WARE. The banks were incredible partners to us to route
oversight of these programs. As a matter of fact, probably within
the first month the banks had given me 5,000 fraud referrals in the
first month.
Mr. MEUSER. Did you finally know the customer was better—
less fraud than the lack thereof?
Mr. WARE. Yes. Yes, I did. I found that that is how the banks
were able to quickly identify, and not only identify, but basically
gift wrap cases, or at least the evidence for the cases for us.
Mr. MEUSER. And that is probably why the EIDL was a heck
of a lot higher, right, $135 billion estimate out of I think 300. And
meanwhile, PPP was nearly almost $880 billion, and we had—still
a lot, a big number, but $60 billion or so of potential fraud.
Mr. WARE. Well, that was part of it for sure. Different rules as
well, different requirements for—you know, self-certification was
an issue.
Mr. MEUSER. So the SBA working in cooperation with banks
knowing the customers proven to show a tremendous level—less
percentage of fraud?
Mr. WARE. I think so.
Mr. MEUSER. Yes.
So what about the Fintech’s—one hearing we had it said that 85
percent of the Fintech’s fraud, that came from Fintech anyway,
came from five players. Have those players been arrested?
Mr. WARE. I cannot speak to the ongoing investigations, unfor-
tunately.
Mr. MEUSER. Some arrests have been made? Some have been
brought to justice?
Mr. WARE. The arrests that have been made are public. So they
are out there, and I can’t specify in this forum.
Mr. MEUSER. Okay. Thank you.
Mr. WARE. Sorry.
Mr. MEUSER. No, that’s fine.
So what would you like to see us help you with in order to claw
back and provide resources to you as we are working to bring these
fraudulent people to justice? As well, I would like to ask, can you
provide the data? I am sure you have to the SBA. Those are huge
discrepancies. I mean, that is another reason that Administrator
Guzman should be here. I mean, $160 billion in difference here.
Mr. WARE. There are a couple of things to point out.
Mr. MEUSER. 500 percent.
Mr. WARE. Administrator Guzman and I are normally in lock-
step. We have worked together. We work together very, very close-

15
ly. I actually was surprised about the report, about the report or
that like those words would be used. We meet every other week.
We discuss these things, and we are very transparent and open
with each other. We can have heated discussions.
Mr. MEUSER. And you probably were a little perplexed that
they so quickly refuted your findings.
Mr. WARE. Caught a little off guard, yes.
Mr. MEUSER. All right, sir.
Mr. WARE. But support. Let’s talk about—can we get to sup-
port?
Mr. MEUSER. Yes. Yes, please.
Mr. WARE. We obviously need full support for our 2024 budget,
but there is one other thing, and it is access to already available
government data.
Mr. MEUSER. I will call you on that, and we will discuss it if
it is all right with you. Thank you very much.
I yield back, Mr. Chairman.
Chairman WILLIAMS. I now recognize Representative Chu from
the great State of California for 5 minutes.
Ms. CHU. I have worked with Administrator Guzman on numer-
ous occasions at various events, and I have known her to be noth-
ing but conscientious when invited to meetings, and I certainly
know that had she been apprised of some alternate date, she would
have been here, as she has been at your numerous meetings during
this entire time. And, in fact, I would like to submit for the record
the letter to Chairman Roger Williams which says that Adminis-
trator Guzman was unable to testify due to previously scheduled
commitments that required her to be outside Washington, D.C. on
this date. So I would have hoped that there would have been some
consideration for her schedule.
So let me say, Mr. Ware, I do find it unsettling that your white
paper estimates $200 billion in potential fraud, and the SBA report
is so different with the $36 billion in likely fraud. Now, I know that
in the SBA’s letter, they state that nearly 86 percent of all pan-
demic funding originated under the previous administration with-
out important controls in place. That is why the Biden and Harris
administration took action to rebuild and strengthen antifraud con-
trols, such as checking the Treasury do-not-pay database and
verifying tax income.
SBA learned from the mistakes of the 2020 implementation of
PPP and COVID EIDL to design the two major relief programs
that launched in 2021, the shuttered venue operator grant program
and the restaurant revitalization fund, which both achieved esti-
mated fraud rates of well below 1 percent.
Mr. Ware, do you acknowledge that that is true?
Mr. WARE. I cannot validate—we are conducting work right now
on restaurant revitalization and shuttered venues. So our work will
dictate what that is.
But I could tell you that they had—they did implement many of
our recommendations like do not pay, like the taxes. These are rec-
ommendations that we made in writing to everyone, and they have
been a very willing partner in doing this.
Ms. CHU. Okay.

16
I would also say SBA’s first sweep actually found over $400 bil-
lion worth of further investigation, they would say, but then they
continued beyond that initial automated screening with additional
layers of review from data analytic treatment to human-led manual
review in order to weed out false positives, and that is where they
got their $36 billion figure. And they argue that your white paper’s
estimate of $200 billion is so high because that figure is based on
only an initial automated screening, and therefore, includes false
positives.
What do you say to that?
Mr. WARE. I think that is absolutely false. I think it is impor-
tant to be on record as stating that the only investigations that
SBA can conduct are those conducted by the investigative arm of
SBA. We are the law enforcement authority. Fraud is our—this is
our business. Fighting fraud is what we do. We are fully equipped
to opine on what the potential fraud and the program is.
SBA does not have access to the datasets that we have access to,
number one. Number two, they don’t sit in the middle of the fraud
fight across the nation and U.S. Attorneys’ Offices in every single
State and the Department of Justice working with the task forces,
working with all the different law enforcement entities.
Ms. CHU. Well, you do say that you periodically refine your over-
all fraud numbers to eliminate false positives, correct?
Mr. WARE. Which we did in this report.
Ms. CHU. But can your office reconcile the differences with the
SBA in order to provide the Committee with a more consistent esti-
mate of the likely fraud?
Mr. WARE. I believe like—honestly, with the reconciliation of
those numbers, they are never going to be possible. They cannot
have access to many of the datasets that we have access to for law
enforcement purposes. I could provide the SBA every loan number
that I can provide to them under the IG Act, and under U.S. Attor-
neys’ rules and everything else. That is what I can do.
However, more importantly, which is why it was surprising that
it would be such an attack on the number, I think we get a little
sidetracked with the number when we should be talking about the
controlled environment that is necessary in any future program
going forward and our ability to claw back as many—as much
funds as we possibly can.
I would be as upset and passionate if I found that the number
was $36 billion, but I am sitting in the middle of the fight, and
$30-something billion is just not a logical number.
Ms. CHU. I yield back.
Chairman WILLIAMS. I now recognize Representative Salazar
from the great State of Florida for 5 minutes.
Ms. SALAZAR. Thank you. Thank you, Mr. Chairman.
I am Maria Salazar. I represent the City of Miami, and you
know, the SBA and having a small business is so important be-
cause most of my constituents are first generation Americans and
they love the system. So I am going to talk to you as if I were one
of them.
You see, they listened on television what is happening. They
hear 36 versus $200 million. That is a big difference—billion, I
should say, $200 billion. So the SBA’s administrator, she is saying

17
that you are misleading the public and that they have a more dili-
gent process to investigate the fraud. In other words, that you are
an incompetent. That is basically what she is saying.
And you are the Inspector General for the U.S. Small Business
Administration. So I just want you to tell me how do you respond
when openly, in public, everyone is listening, that your report is
really not that good. What do you say to that?
Mr. WARE. I don’t believe that that is the administrator’s intent.
I meet with her often.
Ms. SALAZAR. Well, I am going to repeat the words. Misleading
the public. If someone tells me that I am misleading the public, I
am not really going to like it because that is putting a dent or a
sort of—compromising my reputation.
Mr. WARE. I get that, but I still would give her the benefit of
the doubt because I know her.
Ms. SALAZAR. Good. You know her, but if you know her and she
is not sitting next to you and she is the administrator, and we have
$36 billion here and $200 billion over there and you are the guy
that has the resources in order to find out what really happened
with the money.
Mr. WARE. Can I say this?
Ms. SALAZAR. No, tell me.
Mr. WARE. I think the Committee, based on my track record be-
fore this Committee, know that I am an independent broker of the
truth.
Ms. SALAZAR. I am not talking about that. I am talking about
the relationship you have with the administrator. And the adminis-
trator is questioning your report publicly, and on top of that, she
is not sitting next to you. What do you say to that?
Mr. WARE. I have spoken to the administrator up to last week.
Ms. SALAZAR. And what has she said to you?
Mr. WARE. The administrator and I have a passionate disagree-
ment on this subject. The administrator being here today would not
say I am misleading the public. I can tell you that.
Ms. SALAZAR. Well, she said it, that you are misleading the
public.
Mr. WARE. Well, I am an independent broker of the truth. I
have no reason——
Ms. SALAZAR. We know that. We know that but you said that
you do have to work with her. So for that—my constituent, they
are saying, I don’t quite get this. The guy who is supposed to be
the watchdog is doing his job, and then the lady who is supposed
to be supervised doesn’t like it. So there is something fishy here.
Don’t you think that the public will say that? All right.
Not only that, she has you, as you said, that the administrator
reached out to you to review the disparity between these two fig-
ures. So the question is, has she asked you, Hey, by the way, how
did you get to 200 and we only got to 36?
Mr. WARE. Yes, we have had these discussions, very heated dis-
cussions.
Ms. SALAZAR. And what did she say to you to prove her case
that you are wrong?

18
Mr. WARE. Well, it is evident that they cannot prove that case
based on their response to the report. If you read their re-
sponse——
Ms. SALAZAR. So if there is no proof, then what else is there?
If the empirical evidence does not accompany you, then what else
is there? My opinion?
Mr. WARE. It is difficult for me to say. It is difficult for me.
Mine is based on fact. Mine is based on cross-link analysis. It is
based on criminal investigative work. It is based on audit-sampling
technique.
Ms. SALAZAR. Sure.
Mr. WARE. It is not just a data analytic exercise.
Ms. SALAZAR. It is on rigor. It is on rigor. It is on evidence.
All right. So you forewarned her, sir, that so much money going
out so fast could be opened up for fraud. And what did she say?
Mr. WARE. Well, it wasn’t—she was not the administrator when
I was warning that at the beginning.
Ms. SALAZAR. Okay. All right.
Mr. WARE. Right. At the time, it was pretty much the same ar-
gument. You are not right.
Ms. SALAZAR. I am not sure if the public knows this, that 90
percent of the loans that were given by the SBA, 90 percent are
valued at less than $100,000, correct? Less than $100K, 90 percent.
And the SBA has decided not to put any effort in collecting the
money that you guys believe that was stolen, because that is the
only word we can say, 90 percent of those loans.
So how do you—explain to us that we are not going to pursue
to try to recoup that money on some of the money less than
$100,000—or any loans that is less than $100,000?
Mr. WARE. I should have clarified this earlier.
Ms. SALAZAR. Please do.
Mr. WARE. SBA asserts that any loan with a hold code, a fraud
code on it are not in the number that they will not pursue collec-
tions on of the hundred.
Ms. SALAZAR. Give it to me simpler because I didn’t get it.
Mr. WARE. So if there is a fraud, a potential fraud assigned to
the loan, $100,000 or less, they pursue those. Those do not go
away. That is what they have asserted.
Ms. SALAZAR. So okay. So basically they are going after every
penny.
The last one—thank you, Mr. Chairman.
SBA has created an ad hoc committee. That is their own inves-
tigation, and they are saying that they are interviewing——
Chairman WILLIAMS. The Member’s time is up.
Ms. SALAZAR.—3,000 people a day. Do they have the per-
sonnel——
Chairman WILLIAMS.—the Member’s time is up.
Ms. SALAZAR.—the rigor to do that in a rigorous fashion?
Chairman WILLIAMS. Time is up.
Ms. SALAZAR. Sorry.
Chairman WILLIAMS. I now recognize Representative Thanedar
from Michigan, the great State of Michigan for 5 minutes.
Mr. THANEDAR. Thank you, Mr. Chair.
Mr. Ware, thanks for your work and your testimony here.

19
Despite the fraud, which is certainly concerning, it being a dark
spot in the COVID relief program, our recovery has been nothing
short of remarkable. We are able to keep businesses afloat and
save jobs. As a result, our recovery has been faster than any other
industrialized economy. However, we must address concerns re-
garding fraud to prevent future abuse from transpiring.
You know, I represent—my name is Shri Thanedar. I represent
the city of Detroit and the 13th District, and I have spoken—I am
a city entrepreneur myself, having, you know, started small busi-
nesses, grown small businesses, and the pandemic has been espe-
cially hard on small businesses in my district.
And when I look at these fraud numbers, whether it is $35 bil-
lion or $200 billion, it worries me and bothers me that many of my
small businesses in my district were denied any kind of assistance
for one reason or the other, while billions of dollars got defrauded,
some domestic, some overseas.
And many of the genuine small, hardworking entrepreneur busi-
ness owners in my district suffered through because they could not
qualify or get any assistance. And some, unfortunately, lost their
livelihood, their businesses. So that is a concern of mine, and it just
doesn’t seem fair for the hardworking businesspeople who could not
get federal assistance while the bad actors walked away with bil-
lions of dollars.
My question to you is, how can the Small Business Administra-
tion restore confidence in its operation and rebuild trust among the
public following the massive fraud that occurred during the pan-
demic, particularly under the Trump administration? Because it
appears that a large majority of the fraud did happen under the
Trump administration.
Mr. WARE. So I tend to stay away from any discussion of admin-
istrations, right, because to me it really makes no difference.
Mr. THANEDAR. But you are agreeing, right? The majority of
the fraud happened under the previous administration.
Mr. WARE. It happened at the beginning when there were al-
most no controls. So that is just what happened. Everything was
calibrated to speed.
Mr. THANEDAR. Just the facts. Just the facts. It did happen in
that period.
Mr. WARE. It happened in that period, but I will tell you this.
Relative to restoring of the trust, I think that under Administrator
Guzman, working closely with our office, I think that we have built
an internal control environment that is vastly superior to what it
was all those couple years ago, right. So I believe that Adminis-
trator Guzman and her teams are moving towards that end.
However, we have not fully tested the controls, and more impor-
tantly, because of my experience with SBA, whether or not the con-
trols were actually followed and implemented thoroughly. So that
would be the test, and we have quite a bit of work that will be com-
ing to inform on this.
Mr. THANEDAR. All right. Thank you so much.
I yield back.
Chairman WILLIAMS. Now I recognize Representative Alford
from the great State of Missouri for 5 minutes.

20
Mr. ALFORD. Mr. Chair, I yield 30 seconds to the gentlelady
from Florida, Ms. Salazar.
Apparently she left. Sorry. I think she had a follow-up.
Thank you, Mr. Chair. And thank you, Ranking Member, for
holding this important hearing today. And thank you, Inspector
General Ware, for actually showing up and doing your job. We very
much appreciate that.
The stolen PPP and EIDL funds are stolen taxpayer dollars, and
that is money that is stolen from the constituents of everyone here,
the people that we represent. In my case, the Fourth Congressional
District of the great State of Missouri.
The Inspector General estimates the fraud as over $200 billion,
as you have said, and the SBA administrator says it is somewhere
in the neighborhood of $36 billion. This calls into question why the
SBA should increase their scope to oversee more lending, especially
with Fintech.
In November, America elected a Republican House majority be-
cause they were sick and tired of the incompetence and blatant dis-
regard shown by the Biden-Harris administration. A core job of this
Committee is to conduct oversight, and we all showed up today to
do our job. It is time for the administrator to show up and do hers,
to answer us, to answer to the American people.
The title on that name card starts with ‘‘Honorable.’’ There is
nothing honorable about not showing up to do your job.
So I am going to ask her questions anyway. She needs to be here,
and hopefully, wherever she is, she will hear these questions.
Administrator Guzman, the report you released estimates the
fraud to be around $36 billion while the Inspector General’s report
says it is closer to $200 billion. What is the reason for the large
discrepancy?
Administrator Guzman, the Inspector General’s Office has dec-
ades of experience doing this and are subject matter experts when
it comes to fraud, waste, and misuse. Why is your team no better
than the actual experts?
These concerning numbers, Administrator Guzman, come during
a time the SBA wants to oversee more Fintech lending, much of
what contributed to the fraud. Why should this Committee be con-
fident in the SBA’s ability to act as a regulator for Fintech?
Thank you, Administrator Guzman.
Now moving on to you, Inspector General Ware. Again, thank
you for showing up today.
Did President Trump cause this fraud, $200 billion worth of
fraud?
Mr. WARE. Not that I know of, no.
Mr. ALFORD. Thank you very much, because there seems to be
some in this room who want to blame Trump for everything. He did
not bring down the Hindenberg. He did not sink the Titanic. He did
not cause this fraud. We are here to get to the bottom of it and get
the money back to the taxpayers.
Do you feel the same way?
Mr. WARE. I feel that I want to get the money back to the tax-
payers and get to the bottom of the fraud, yes.
Mr. ALFORD. At the outset of COVID, the House and Senate
came together to get money out the door fast. The goal was to move

21
fast, so it was expected there would be some fraud. But that was
over 3 years ago, and Biden has taken minimal efforts to recoup
these funds during his 2 years in office.
In the last 2 years, from what you have seen in the investigation,
has the SBA enhanced any of their internal controls or improved
any of their efforts to mitigate, reassess, and get that money back
for the taxpayers?
Mr. WARE. Yes, they have. My report actually goes down a list
of the many things that they have done, especially in response to
the recommendations that we have worked hard to resolve with the
agency.
Mr. ALFORD. Do you feel confident that we are moving forward
and can move forward should this happen again, that we will have
the tools in place, the regulatory tools in place to limit and mitigate
fraud?
Mr. WARE. I feel confident that we are moving in that direction.
There has to be a focus on eliminating self-certification in these
type of government programs.
Mr. ALFORD. Well, Inspector General, again, I thank you for
being here today. It is very disappointing that someone that we pay
out of the federal taxpayers’ dollars, now the U.S. Treasury, cannot
be here to answer questions in the primary oversight, the capacity
that we have, to help us all do better, to help Americans, to help
small businesses. It is just a shame, and I am very disappointed.
I am very disgusted.
Thank you. And I yield back.
Chairman
WILLIAMS.
I
now
recognize
Representative
Gluesenkamp from Washington, the great State of Washington for
5 minutes.
Ms. GLUESENKAMP PEREZ. Thank you, Mr. Chair.
And thank you for being here, Inspector General Ware. It is
great to have you back.
I would like to start by asking about the fraud landscape.
Through your investigations, did you find any trends about the size
of loans that you determined to be potentially fraudulent? Like, are
we basically talking about mom and pops, or are we talking about
larger operations that receive more significant funding?
Mr. WARE. It ran the gamut. So it was all of it, but there was
quite a bit of larger—people that went after, you know, larger num-
bers. I don’t know if they even existed in many of the cases, right.
So but went after larger numbers that would be more large than
a mom-and-pop shop would get.
Ms. GLUESENKAMP PEREZ. Okay.
Did you consider the size of potentially fraudulent loans being
prioritized, which ones you are going to go after, or are there other
factors that you determined which allegations to pursue or how you
prioritized?
Mr. WARE. Size is one of the factors. So we have a prioritization
framework within our office. It takes into account our hotline data;
it takes into account the task forces that we are working on. But
we could look at, like, much smaller amounts, particularly if it is
involved in an intricate criminal ring.
Like, for example, one of the flags in the report was IP address-
es, right. And in an instance where we find that there was maybe

22
500 loans that went to one place, we would know that they gave
like 13,000 out here, 50 here. And ordinarily, we wouldn’t go after
them unless there were public trust issues, violent criminals or of
the like, but put them together and we have pulled down a whole
lot.
Link analysis helps us with that and data analytics. We have
cases that start with one person and explode out to 800.
Ms. GLUESENKAMP PEREZ. Wow. Thank you.
I also wanted to touch on the role of technology in your investiga-
tions. Last time you were here you spoke about the indicators of
pandemic relief fraud being durable. I believe you said something
about less like footprints in sand, and more like footprints in con-
crete.
In your testimony, you talk about the use of certain automated
technology to aid in your investigative work and about your office’s
recent establishment of the technology solution division to use ma-
chine learning and artificial intelligence to identify outliers in the
portfolio for investigation.
Could you expand on the kind of data that you are using to in-
vestigate these cases of potential fraud and how your office has uti-
lized or may continue to improve upon the use of certain kinds of
technology to go after fraudsters?
Mr. WARE. Yes. Thank you for that.
Well, the way we use it the most right now, the only place that
we are using the machine learning right now is within the hotline,
because we went from 800 hotline complaints a year to 250,000. So
we needed to be able to get to the bottom of that, and Pandemic
Response Accountability Committee really helped us a great deal
with that in first giving us bodies and then giving us access to
their data analytics group before we were able to stand up ours
and move on our own.
That is how we were able to find common identifiers, based on
the casework. So that is what we are using, the loan files and ev-
erything like that, overlaying them with the hotline information
and being able to determine what is actionable, most likely action-
able. So that is one way in which we are doing it.
But in terms of data analytics, the link analysis, which really
helps to validate the numbers in this report because it deals with
common fraud clusters that start maybe in one place and then we
could put it to the next program. Because fraudsters didn’t start
and stop with just PPP, right. If we found it there, you will find
it in EIDL. And to be quite frank, you will find it in unemployment
insurance, and you will find it in the other programs as well.
Ms. GLUESENKAMP PEREZ. Could you—so well, thank you
very much for being here. I am deeply appreciative of the work
that you are doing and your office. Thank you very much. As a tax-
payer, as a small business owner, I sincerely appreciate the leader-
ship you are showing here.
Mr. WARE. Thank you.
Ms. GLUESENKAMP PEREZ. So thank you very much.
Mr. Chair, I yield back.
Chairman WILLIAMS. Yields back.
And now I recognize Representative Bean from the great State
of Florida for 5 minutes.

23
Mr. BEAN. Thank you very much, Mr. Chairman. Good after-
noon to you. Good afternoon Small Business, and welcome Inspec-
tor General Ware. Glad to have you here.
Mr. WARE. Thank you.
Mr. BEAN. A few weeks ago, a few months ago we had a meeting
here where SBA came to talk about changes to the SBA program,
and I labeled Washington, D.C. crazy town, because only in crazy
town would an agency that has lost billions of dollars come before
us and ask for more to expand programs and go forward. So only
in crazy town would you ask for more money when you can’t han-
dle the money that is has given to you. Sorry.
Only in crazy town would you ask for more money—thank you—
more money when you can’t handle the money we are giving you
now and do it with a straight face. That is crazy.
One of the most disturbing stories to come out of the SBA during
COVID is the PPP and EIDL scams that involve the Barbie face
doll scam. Now, everybody knows one of America’s favorite dolls is
Barbie. We love Barbie. We love Malibu Barbie, presidential
Barbie. You know, you can get Doctor Barbie or even lawyer
Barbie.
But it seems con men have hijacked Barbie, and I present to you
swindler Barbie. How about that? This is actual faces, Committee
Members and ladies and gentlemen, actual faces. Barbie was taken
hostage and created swindle Barbie where people up to no good
used Barbie and other dolls to create fake identities to steal tax-
payer monies.
So clearly, someone at SBA is living in swindler Barbie world. I
say before you that we are not just living in crazy town, but we
have moved into Barbie’s $200 billion crazy town dream house on
Looney Toon Lane.
So IG Ware, I appreciate you coming forward with your testi-
mony, and I love that you are a man of truth.
I think we all know that it is going to take a lot of work to claw
back all of this money. In fact, according to your own report, of the
more than 250,000 hotline complaints you have received since the
start of the pandemic, more than 90,000 of them were actionable
leads. This represents, according to your data, 100 years of inves-
tigative casework. Let me say that again. It is 100 years of inves-
tigative casework. Only in crazy town does this happen.
Will you be able to, IG Ware, to keep the Committee updated on
how much money is clawed back as you begin this century’s long
casework load?
Mr. WARE. Absolutely.
Mr. BEAN. Very good.
What is your plan? We talked a little bit before and you said
there is a plan. What is the plan to begin clawing back this money?
Mr. WARE. So our plan—it is important to be on record with
this. The numbers that I have given in terms of what the results
of our office are, are not the only results in government. There is
more. So the FBI has their own cases, Secret Service, FDIC, OIG.
I can go on and on and on and on. The PRAC has some.
So the number is really a lot larger and it is magnified—maybe
even exponentially more impactful with the DOJ strike forces and
the U.S. Attorney task forces.

24
Relative to my office, though, right, we have a prioritization
framework that allows us to go after the most egregious actors fast,
and that is how we have been doing this.
Mr. BEAN. Right. And some of these egregious actors have hun-
dreds of loans under their name or under a single fake number. Is
that correct?
Mr. WARE. Correct. A single case. And we have had a single
case cause 800 hotlines, hotline complaints. So it could work like
that.
Mr. BEAN. Should—for those that have stolen money from the
taxpayers, should they be worried right now?
Mr. WARE. I think you should be worried. We have a 10-year
statute of limitations and we are bringing—I am just one part of
the enforcement activity that is taking place across the nation.
Mr. BEAN. Now, we have been told. We have been told that if
you stole less than 100 grand, we are not going to worry about you
anymore. We are just going to let it go and a pretend it didn’t hap-
pen.
What say you to somebody that stole—still stole but below that
threshold? Are we going to go after them, too, Inspector Ware?
Mr. WARE. I believe we had a recent, a very recent press release
with 13,000. So it depends on where it falls, right, but we weigh
it all.
Mr. BEAN. Are you familiar with swindler Barbie now? Have
you heard that before?
Mr. WARE. Not in that way, but I did get pulled up to speed on
this today.
Mr. BEAN. Inspector Ware, thank you so much for coming for-
ward.
I yield back the remainder of time, Mr. Chairman.
Chairman WILLIAMS. The gentleman yields back.
And now I recognize Representative Phillips from the great State
of Minnesota for 5 minutes.
Mr. PHILLIPS. Thank you, Mr. Chair.
Welcome, Mr. Ware. Let me start with gratitude to you, to the
many thousands of employees at SBA who do this important work.
Many of the same ones did it under the Trump administration that
are doing it right now, and I don’t think we express enough grati-
tude to those who are doing what we want people to do, which is
to look after taxpayer dollars.
I like this Committee when the spirit is to restore faith in gov-
ernment. Casting stones and blame is absurd. Donald Trump didn’t
cause the fraud, nor did Joe Biden.
I want to make sure that we go after the fraudsters. All of my
colleagues on the other side of the aisle want to do the same. What
troubles me is that President Biden requested $47.7 million to ap-
propriate dollars to this effort, and my colleagues on the Financial
Services Committee and in the general government appropriations
bill, trimmed that by $16 million. So it is just a little incongruent,
I might say, to say we need to go after this and yet not appropriate
the resources to do it.
I would like to make the case to all of my colleagues that we
should appropriate the dollars necessary to go after the fraud.

25
So if I could just ask you, Mr. Ware, does that $16 million short-
fall impact your ability to do so?
Mr. WARE. It impacts my ability tremendously. It is important
to understand——
Mr. PHILLIPS. Can you say it one more time?
Mr. WARE. It impacts my ability to go after the fraud tremen-
dously.
Mr. PHILLIPS. Thank you.
Mr. WARE. It is important to understand that the supplemental
funding that we had for our office runs out in 2024. We had a lot
of term criminal investigators. A lot of them would have to go
home. It would be depleting us at the time when the fight is the
hardest.
Mr. PHILLIPS. Mr. Chair, I have great respect for you. I would
ask that we try to appropriate the resources necessary to do what
we all want to do, which is to eliminate the fraud and repatriate
the dollars, reclaim, and claw them back, please. That $30 billion
has been done so already.
Mr. Ware, one thing I suspect, anecdotally and otherwise, is that
a number of companies overrepresented their employee counts to
obtain PPP and EIDL loans. Your written testimony provides an
example of a bad actor who was caught doing exactly that.
Can you shed some more light on that practice of companies ex-
aggerating their employee counts and whether the SBA has been
effective in your recommendations to crack down on the practice?
Mr. WARE. Sure.
Well, at the beginning, we were dealing with self-certification as
a general rule. And to be fair, that is what the law called for, to
be fair. It was self-certification. You couldn’t review tax records.
You couldn’t review much of the employee information as well, and,
you know, for speed.
But since then, those things have been tightened up quite a bit,
but the way it worked, it was pretty simple. I am self-certifying.
So there is nobody checking. So, you know, I could easily say 50.
The fraud triangle is a well-known concept. There was pressure,
financial pressure. Everybody, you know where we were as a na-
tion, and then, there was the opportunity with the lack of controls,
and then you rationalize it in terms of, well, why not? Everybody
is doing it.
Mr. PHILLIPS. You spoke about data-sharing between agencies
to support your work. I presume that would include the IRS?
Mr. WARE. Yes, it would.
Mr. PHILLIPS. Are their systems and structures and tech-
nologies up to par right in a way that is necessary to give you the
information you need on a timely basis?
Mr. WARE. I don’t know that it is, but I know that when we
worked through certain agreements, we were able to get it.
But I would argue that not just oversight entities with some of
these agencies could communicate when it comes to issuing govern-
ment funds.
Mr. PHILLIPS. I would just argue that it might not be wise to
reduce funding to the IRS when we need to go after both fraudsters
and tax cheats.

26
But let me just wrap up by one more time just saying we can
distill this entire hearing down into a simple question. We all agree
that there is fraud. We all agree we should go after it. We should
also all agree to resource it to the level that the administration has
asked. We should not be cutting it by $16 million. It makes this
entire hearing, unfortunately, nonsensical.
With that, Mr. Ware, I want to thank you. I know hundreds of
PPP and EIDL recipients in my own district say thank you. Thou-
sands of businesses and millions of employees around the country
say thank you. When we did this, we were under duress. We knew
it would be complicated. We knew there would be fraud. I was here
when we did this. I am so glad we did because if you look at our
economy right now, the highest GDP ever, the best—the lowest in-
flation now in the entire G7 universe, the lowest unemployment in
my lifetime. My goodness, and the highest wage growth in a long
time.
I think we did a darn good job. Businesses around the country
thank you, and I hope you can extend that gratitude to those that
work with you.
Thank you, sir.
Mr. WARE. Thank you.
Chairman WILLIAMS. I now recognize Representative Van
Duyne from the great State of Texas for 5 minutes.
Ms. VAN DUYNE. Thank you very much, Mr. Chairman.
And Inspector General Ware, it is good to see you again. I really
appreciate you taking the time to be with us today. It is clear you
understand the importance of today’s hearing, and I just wish that
we were being joined by Administrator Guzman as well.
We have heard a lot of conversation today about pointing fingers.
I kind of want to figure out when that money was spent, how much
SBA had to spend, and what the resources were.
So in 2019, do you know what the SBA’s budget was?
Mr. WARE. No, I do not know off the top of my head.
Ms. VAN DUYNE. Do you know if it was increased in 2022? I’m
sorry, in 2020.
Mr. WARE. I don’t think so.
Ms. VAN DUYNE. You don’t think it was increased in 2020?
Mr. WARE. I think that was a time when we were all asking to
be flatlined. I don’t know.
Ms. VAN DUYNE. Well, in 2020 is when we had the pandemic.
So did SBA receive any additional funds?
Mr. WARE. For the pandemic? I think supplemental funding was
given at some point. I know I got——
Ms. VAN DUYNE. The answer is yes. The answer is they were.
It is about 100 times as much that they had been given and then
some.
Mr. WARE. Okay. Thanks.
Ms. VAN DUYNE. So, you know, the fact is that when we look
at when the money had been given out, doesn’t it make sense that
it was given out during the pandemic, at the beginning of the pan-
demic?
Mr. WARE. Yes, that is when the——
Ms. VAN DUYNE. That is when the money was supposed to
have been sent out. That is why there was an emergency.

27
Mr. WARE. Fourteen years of revenue in 14 days.
Ms. VAN DUYNE. If we had taken 2 years to do it—Mr. LaLota,
I am going to ask you to move your head just a little. No, the other
way, the other way.
If we had taken 2 years to do it, it really wouldn’t have been an
emergency, would it? I mean, the whole point was to try to get that
money out faster.
We know that a tremendous amount of roles of responsibility
were given to the SBA who really had a skeletal staff at that point,
and they were expected to give out tens of millions, hundreds of
millions of dollars, billions of dollars without having, you know,
adequate—but we wanted to make sure that that money got out be-
cause it wanted to do the best good at a time when everybody was
in an emergency pandemic.
We are now facing, what, 3 years later? And we know that how
much money are we expecting has gotten out fraudulently, was sto-
len from taxpayer dollars?
Mr. WARE. Potentially over $200 billion.
Ms. VAN DUYNE. Okay. So does it make sense that we would
actually, I don’t know, try to avoid this in the future?
Mr. WARE. Absolutely. That is why I am here.
Ms. VAN DUYNE. And does it make sense that we try to go
after the bad actors who have stolen over $200 billion of taxpayer
dollars?
Mr. WARE. Absolutely.
Ms. VAN DUYNE. So does it make sense that we sit here and
we spend a whole lot of time during this hearing on, well, that hap-
pened then and, no, that happened then? Does that make sense to
you?
Mr. WARE. Well, I can’t say whether it makes sense. I can say
that this is what I have been avoiding from the very beginning.
Ms. VAN DUYNE. Yes. And I appreciate your direct answers. In-
stead of, you know, blaming the blame game, playing the blame
game here, I would really hope that everybody on this Committee,
everybody in this Congress would be focused on trying to prevent
$200 billion of fraud from ever happening again and trying to get
that money back.
So when the SBA distributed approximately $1.2 trillion in
COVID EIDL and PPP loans, the IG, who is trained and respon-
sible for the investigatory process of the SBA, estimates over $200
billion was wasted. However, in order to save face to the public, the
SBA, who has admitted they have no role in investigating fraud,
reportedly roughly $36 billion in wasted spending, the $164 billion
difference in wasted dollars alone is troubling. But what concerns
me the most is the SBA who, again, has said that they are not an
investigatory entity has wasted additional time in dollars to put
out a completely false report to cover their previous waste.
The American people deserve more. Taxpayers definitely deserve
more, and small businesses deserve more.
Mr. Chairman, I seek unanimous consent to enter into the record
Administrator Guzman’s response to our letter sent on April 19,
2023, relating to the fraud and the pandemic relief program where
the SBA told us that, quote, ‘‘when it comes to investigating fraud
and recovering taxpayer dollars, it is important to note that SBA

28
is not an enforcement agency. The SBA reports suspected fraud
and identity theft to the Inspector General, and we collaborate with
law enforcement authorities on their investigations,’’ end quote.
Mr. Chairman?
Chairman WILLIAMS. So moved.
Ms. VAN DUYNE. Mr. Ware, just looking at typical fraud inves-
tigation case, on average, how long does a standard OIG fraud in-
vestigation take?
Mr. WARE. About 250 days.
Ms. VAN DUYNE. Just do you agree with the SBA that they
were able to meaningfully process 3,000 human letter reviews of
potentially fraudulent loans per day.
Mr. WARE. Absolutely not.
Ms. VAN DUYNE. So 2 months ago, you testified in front of the
Subcommittee on Oversight Investigations and Regulations where
you shared your concern, the SBA’s decision not to collect on PPP
and EIDL loans under $100,000. Do you maintain that position.
Mr. WARE. I do.
Ms. VAN DUYNE. Has SBA communicated to you whether they
intend to pursue fraudulent loans if they are less than $100,000.
Mr. WARE. Yes, they have. That is their intention to——
Ms. VAN DUYNE. Thank you.
Mr. WARE.—pursue those that have a fraud hold.
Ms. VAN DUYNE. Excellent. I yield back.
Chairman WILLIAMS. All right. Next I now recognize Rep-
resentative Stauber from the great state of Minnesota for 5 min-
utes.
Mr. STAUBER. Thank you, Chair Williams, and thank you to In-
spector Ware for being here.
Inspector, every time I hear you testify, you become more and
more impressive. Thank you for being here.
Mr. WARE. Thank you.
Mr. STAUBER. In March, 10 more people were indicted for the
Feeding Our Future scam, a supposed nonprofit in Minnesota
meant to feed children that used $250 million of COVID-19 federal
funds to buy luxury cars, real estate, and other unlawful futures.
This brings the total up to 60 people indicted. It is considered the
largest COVID-19 fraud scheme in the nation.
Our agencies must make recouping taxpayer dollars a priority.
On July 27, 2023, the Small Business Administration Inspector
General issued his report underscoring how vulnerable the PPP
and idle programs were to fraudsters. Not 3 hours later, the SBA
administrator’s office released a contradicting report. Three hours
later. Unfortunately, the SBA and the Biden administration have
failed to provide a detailed account of how this significant mis-
appropriation of taxpayer funds occurred and how they plan re-
cover these stolen items, or funds, rather. Given the roughly $160
billion discovery sheet the OIG report and the SBA report, it will
be pertinent to hear from both parties as to why the discrepancy.
Unfortunately, as indicated by the empty chair next to the Inspec-
tor General right there, she had declined to come before this com-
mittee. The Small Business Administrator who we talk about small
business being the engine of our economy. She was notified in time
to be here, under the rules, and she has failed the request by the

29
Chair of this committee to answer questions on behalf of the Amer-
ican people. Like where is the discrepancy and why the discrep-
ancy?
On multiple occasions, the Office of the Inspector General has de-
scribed SBA’s data tracking environment as informal and ad hoc.
As the designated investigatory body for the SBA, the OIG holds
the authority to shed light on this matter. Therefore, I would ap-
preciate some insight on the following:
Inspector General, where aside from the Inspector General’s Gen-
eral Office, do you consider the SBA to be the subject matter ex-
perts in fraud investigation?
Mr. WARE. No.
Mr. STAUBER. How much weight should we give to the SBA’s
assessment of your fraud investigation?
Mr. WARE. Well, I would say that SBA is not positioned to de-
fine fraud for the Office of Inspector General.
Mr. STAUBER. If Administrator Guzman were present, it would
have been beneficial for her to provide us with her perspective on
why she believes her report is more accurate despite finding sub-
stantially less fraud. I wanted to be able to have the dialogue and
question both of you. Why the discrepancy? Only in Washington,
D.C., would an administrator not show up when there is $160-bil-
lion discrepancy. I mean, how does that happen? The American
people want to know why the discrepancy? Why the fraud? And the
administrator doesn’t show up, so we can ask questions and get an-
swers for the constituents, the taxpayers of this country. What is
the likelihood of the SBA recovering most of that money?
Mr. WARE. Most of that money is tough to stay what the likeli-
hood is. I could tell you that we have a 10-year statute of limita-
tions, and we will not stop coming. And I believe that is the case
for all our law enforcement partners across the nation.
Mr. STAUBER. The American public deserve answers, and we
deserved answers from the Administrator Guzman today, and her
failure to testify alongside you should not go unnoticed. It is a slap
in the face of the taxpayers who are out $200 billion.
Chair Williams, thank you for holding this hearing. Thank you
for making the notifications on time within the rules. And to the
small businesses across this country who are on the back side of
this COVID that is starting to ramp up, it is beyond me why this
small business administrator would not come here and testify to
the $200 billion in fraud. I yield back.
Chairman WILLIAMS. The gentleman yields back. I now recog-
nize Representative LaLota from New York—from the great State
of New York for 5 minutes.
Mr. LALOTA. The great state of New York.
Chairman WILLIAMS. The great State.
Mr. LALOTA. Yes, sir.
Chairman WILLIAMS. I caught myself.
Mr. LALOTA. Yes, sir. And thank you, sir, for your leadership
on this important issue. And it is important that we get down to
the issue of hundreds of billions of dollars being fraudulently stolen
from American taxpayers.
Mr. Ware, sir, thank you for being here and for your leadership
and being accountable to this committee and to the American peo-

30
ple. Despite the SBA administrator being timely and properly in-
vited numerous times, the head of the very agency with so much
fraud in it sadly is not here today to answer our important ques-
tions.
As a result of the administrator’s absence, my constituents can
be left with no other reasonable conclusion that the SBA losing
$200 billion. It is simply not important enough for the SBA admin-
istrator to be accountable to this Committee and to the American
people.
The effects of the fraud are not limited to just $200 billion of tax-
payer money being lost. There are countless stories of innocent peo-
ple being victimized by SBA’s carelessness.
One such example, Inspector, occurred in my district. A con-
stituent in my district fraudulently had loans take taken out in her
name in excess of $90,000. My constituent did not find out about
this fraud until way after it was initiated too late to reverse when
the bank sent her a note in the mail indicating her of that fraud.
The criminals who stole $90,000 in her name used a fake license
and a Social Security card to open that account. The lender told
her that they had not run a credit check because the SBA is re-
quired to pay them back even if the borrower does not. As a result
my constituent, ultimately, had to freeze her own credit for 7 years
because of these incidents.
This severely limits her freedom to do things like buy a car, buy
a home, and acquire insurance, or even cell phone service. My con-
stituent is far from the only victim of COVID fraud. And SBA must
make it a priority to continue to investigate those who have com-
mitted fraud and recover as much of the money as stolen as pos-
sible.
Mr. Ware, sir, the Office of the Inspector General and SBA have
recovered about $30 billion of the potentially $200 billion of fraud.
That is only about 15 percent. What is the SBA doing to recover
the other $170 billion? How can the SBA be more successful in get-
ting more taxpayer money back? And how much does the OIG ex-
pect it will be able to recover? And what is the timeline for these
investigations, sir?
Mr. WARE. Thank you. So it is important to note that it is the
responsibility of the Office of Inspector General to carry out law en-
forcement activity to make arrests and to attempt to recover along
with SBA. Because there could be other reasons SBA is recovering
money. It could be people trying to give back the money real quick.
And so, it is not just for fraud that money would have been re-
covered. So it is interesting because it seems like that is $30 billion
of the $200 billion, but we don’t necessarily know yet, right?
But we have a prioritization document within our organization.
And we are working with law enforcement entities across this na-
tion to bring fraudsters to justice, and to claw back as much money
as we can. We have an agreement in principal currently with the
United States Postal Inspection Service. They will help us with our
seizures. The Secret Service did them before.
Mr. LALOTA. Sir, would you talk a little about the timeline and
your expectations of when a month from now, 6 months from now,
12 months from now, you will be able to ascertain the full scope
of the issue and be able to provide a remedy to it?

31
Mr. WARE. Right, so the remedy to it is these programs are fin-
ished. Like was said earlier, the evidence is footprints in concrete.
So once we get to the evidence, once we start to investigate each
of these potentially fraudulent instances, that is when you will see
the results. So that is continuing. It is basically—I mean, it is rare
that we open a case, and it is not what it is.
Mr. LALOTA. Would you keep us posted as to your progress,
sir——
Mr. WARE. Absolutely.
Mr. LALOTA.—and it can be helpful to help you make more
progress?
Mr. WARE. Yes.
Mr. LALOTA. With my remaining time, sir, there is a discrep-
ancy we have been told about wherein the SBA claims that $30 bil-
lion in return funds was not retrieved pandemic lending fraud
money despite OIG reporting that it was. Could you explain the
discrepancy, sir?
Mr. WARE. Yeah, the discrepancy is for two reasons, sir. And it
was—an important one is, my office is the independent arbiter of
the facts here. So we bring forward what we find based on our
criminal investigative work. It wasn’t just a data analytics exercise
for us. Criminal investigative work and our audit work came to
bear in this thing. And we have access to datasets that they simply
cannot have access to. And it is a good way to see whether the dis-
crepancy is valid, or even logical is in their response, the agency’s
response to the report and the rebuttal contained inside of it.
Chairman WILLIAMS. The gentleman’s time is up.
Mr. LALOTA. Thank you. I appreciate your time, and I appre-
ciate you being here accountable to us, sir.
Mr. WARE. Thank you.
Mr. LALOTA. Thank you, Chairman.
Chairman WILLIAMS. I now recognize Representative Molinaro
from the great State of New York for 5 minutes.
Chairman MOLINARO. It is convenient, too, from the great
State of New York. Sadly, however, one of the States with some of
the greatest cases of fraud. But that said, Mr. Chairman, grateful
to you for your leadership. Mr. Ware, thank you for being here.
I, too, want to echo the comments of my colleagues that the SBA
administrator would choose simply not to be here. It is insulting,
it is embarrassing, and it is absurd. It is not insulting to this com-
mittee or to Congress, it is insulting to the American taxpayers,
the families, the farmers, the small businesses who for 2-1/2 years
struggled through a pandemic and an economic shutdown that was
well beyond their capacity to manage. It is insulting to the people
who pay every day their taxes to support an institution and a gov-
ernment meant to provide for their best interest. It is insulting
that the administrator of the SBA doesn’t think that the issue of
monumental fraud for an agency its size is worthy of presenting be-
fore Congress.
Now I say this not simply as some Member who just got here.
I say this because for the last 12 years I was a county executive
in the State of New York. It was my job to stand in front of count-
less residents and businesses and explain to them why their gov-
ernment was shutting them down and what resources and support

32
would be available to them. In fact, my county was among the first
in the State to secure SBA loan capacity so that we could move ef-
fectively to support businesses. And we worked with the chambers
of commerce and others to be sure that they had access to the re-
sources they need.
And for me, this is important, because like countless families
across America, I, too, lost a loved one. My father lost his life to
COVID in April of 2020. And in response to that loss, so many fam-
ilies like mine tried to muster up what we could to be of help to
the people who lived on with great struggle. It is embarrassing, it
is insulting, and it is absurd that the SBA wouldn’t be represented
here today, despite adequate notice, and as importantly, that they
wouldn’t be a part of an effort to secure what has been lost.
And so I worked hard to ensure with my colleagues both in Con-
gress and in State government to ensure that assistance and rapid
delivery of that assistance would be made available to small busi-
nesses. Never did we think there would be so little, however, vet-
ting and security procedures in place. Especially since we knew
early on that there were red flags, and we were able to identify
them. But the SBA failed to implement basic safeguards, even as
warnings and reports of fraud were published.
Can I ask you, Mr. Ware, it was suggested that you are uninten-
tionally misleading the public as to the magnitude of fraud. Are
you unintentionally misleading the American taxpayers?
Mr. WARE. Absolutely not.
Mr. MOLINARO. Are you intentionally misleading the American
taxpayers?
Mr. WARE. Absolutely not.
Mr. MOLINARO. Do you believe that the SBA lost track of $200
billion?
Mr. WARE. I believe that there is potentially over $200 billion
in fraud in these programs.
Mr. MOLINARO. In my own State of New York, there was a case
in 2021 where nearly 20 public, State, and municipal employees
conspired together to submit and process false applications and de-
fraud the SBA of over $1.5 million. Now schemes like this were all
too common, and, of course, resulted in this at least $200 billion
in outstanding fraudulent payments.
Now, I certainly know that Congress could make better use of
$200 billion, but more importantly the American taxpayers could
make better use of $200 billion. And so at this point, we are chal-
lenged with how to recover these dollars. It is your agency. It is
you. Your investigatory capacity, the criminal prosecution, and the
partners that you will work with obviously to secure recovery.
Can you speak to though, however, the deficiencies in any col-
laborative effort that has been going on with the SBA, and what
strategy may or may not exist to recover the fraudulent payments?
Mr. WARE. Yes, I can, which is surprising, again, because we
work really closely with the SBA to set up the controls and to go
after seizures and forfeitures. This is something that we partner
really well with. I do believe that Administrator Guzman is serious
about it. She has implemented numerous of our recommendations
to ensure that the controlled environment is stronger. So that dis-

33
crepancy is kind of still puzzling to me in light of all the work that
we have done together.
Mr. MOLINARO. So a collaborative effort has been in place, yet
the failure to acknowledge the problem will lead to the inability to
solve the problem?
Mr. WARE. Well, I think quite honestly, the internal control en-
vironment doesn’t really shift whether it is—whatever the billion
they said and the $200 billion. It is the same.
Mr. MOLINARO. So my time is up, Mr. Chairman. I will follow
up certainly after. But I thank you, Mr. Ware. And on behalf of
those of us who led during the COVID pandemic, we are grateful
for your stewardship.
Mr. WARE. Thank you.
Mr. MOLINARO. I yield back.
Chairman WILLIAMS. I now recognize the Chairman of the Se-
lect Subcommittee on the Coronavirus Pandemic, Dr. Brad
Wenstrup, from the great State of Ohio for 5 minutes.
Mr. WENSTRUP. Well, thank you. And, Mr. Ware, thank you so
much for being here today and for your work. Chairman Williams,
thank you for allowing me to waive onto the committee today to
ask a few questions. I am grateful for the work of this committee.
And we are trying to have the U.S. be prepared for the next time,
that there is a next time and to do better, and in this case, help
small businesses if there is another pandemic in the future.
As Chairman of that committee, as was mentioned, we are
charged with investigating and finding solutions for any waste,
fraud, or abuse with, you know, pandemic-era relief programs. And
essentially, throughout the broad task of this subcommittee, it is
an after-action review and lessons learned, and so we can create
a path forward that does better and look at the things that maybe
worked and those that didn’t work, and be honest with ourselves
about that. Because, you know, we are going to have to, for our
committee, look at what we hear from our victims, look at what we
hear from the committees, from the agencies, hopefully administra-
tors, and definitely from you. So thank you very much for that.
You know, when the pandemic hit, no one knew. No one knew
what to do. I mean, this was—it is called novel for a reason, right?
I mean, you know, and the science and everything else and what
it was going to do to the economy and what we were going to do
next. People were often flying blind, there is no doubt about it. We
had to move quickly to help businesses survive. And that was bi-
partisan agreement, too, that we needed to, including getting
money out the door quickly. But, unfortunately, as these things
often do, there is an opportunity for people that have nefarious
measures in mind. We have got fraud and abuse. We don’t want
that to happen again.
So your report acknowledges that the SBA relaxed its internal
controls to get money out the door quickly, and that allowed for a
lot of this fraud to occur. I don’t know that anyone disagrees that
the money had to get out the door quickly. I can remember Sec-
retary Mnuchin being pretty much in a panic that we had to do
something fast.
In your estimation, which of the SBA’s relaxed controls contrib-
uted most to—most directly, I would say, to these high fraud rates?

34
Mr. WARE. Self-certification.
Mr. WENSTRUP. Thank you. I am on the Ways and Means
Committee, and that was a debate we had there that that was a
problem. And we continued that going forward, unfortunately, for
some other programs.
Moving forward, which of these of internal controls are easy and
effective enough to implement that would enable SBA to get money
out the door quickly while still preventing fraud?
Mr. WARE. So that is the challenge, right?
Mr. WENSTRUP. Yeah.
Mr. WARE. So it is about setting up—first of all, getting rid of
self-certification.
Mr. WENSTRUP. Okay.
Mr. WARE. Having quick verification measures and learning
from the hold flags that we established, not having a procedure in
place to clear them. Just ask a follow-up question. My biggest thing
from in the beginning was ask a follow-up question. You are get-
ting people who normally don’t commit fraud. You ask one ques-
tion, they are gone. They are not coming back to answer a question
when they figure you are on to them.
Mr. WENSTRUP. Yeah.
Mr. WARE. So I thought that that would be very, very impor-
tant.
Mr. WENSTRUP. I appreciate that input. Are there additional
controls SBA should implement? And, I guess, maybe you just an-
swered that. Any others that you can think of?
Mr. WARE. I am pretty sure I can get back to you with a list.
Mr. WENSTRUP. Well, I appreciate that.
Mr. WARE. Yeah, I would.
Mr. WENSTRUP. Yeah. Thank you. For the record, if you would
do that.
Mr. WARE. Yes.
Mr. WENSTRUP. And while most controls deal with risk man-
agement, are there any that we can implement to make detecting
and more prosecuting fraud easier after the fact? You kind of gave
me an example where you might sniff somebody out, but in the ac-
tual prosecution of the fraud, any suggestions there?
Mr. WARE. Right, again, the doing away of self-certification. Be-
cause once people certify, right, with their documents that this is
what it is, it is much easier in terms of prosecution in that regard.
It is much more difficult when it is just they could say anything.
Mr. WENSTRUP. Got it. Real quick. There are some things—
what safeguards did PPP lenders have against fraud that EIDL did
not.
Mr. WARE. The Bank Secrecy Act is one of them. The know your
customer under that was a big, big deal. The banks, like I said ear-
lier, that we got over 5,000 referrals from the banks, basically, gift
wrapped. Like these are fraud. Like we know it. We know these
people don’t have a business. That came quickly.
Mr. WENSTRUP. Real quick, should the SBA partner with pri-
vate sector, do you think.
Mr. WARE. I think that is—what do I call that? That is for
the——
Mr. WENSTRUP. The fraud control I am talking about.

35
Mr. WARE. Right. Well, it is difficult for me to answer that ques-
tion. Because, you know me, I provide oversight. I don’t want to
build a program for them I can’t oversee it then.
Mr. WENSTRUP. Well, I appreciate it. You know, you are being
honest and fair. And thank you very much for your time. You are
very helpful.
Mr. WARE. Thank you.
Mr. WENSTRUP. Thank you.
Chairman WILLIAMS. Thank you, Dr. Wenstrup. All right. I
would like to thank our witnesses today, and I would like to also
say again to Ms. Guzman, we wish she would have been here to
account for questions we all had for her. Maybe we can try again.
But thank you, Mr. Ware, for being here.
Without objection, Members have 5 legislative days to submit ad-
ditional materials and written questions for the witness to the
Chair, which will be forwarded to the witness. I ask the witness
to please respond promptly. And if there is no other further busi-
ness, without objection, the committee is adjourned.
Mr. WARE. Thank you very much.
[Whereupon, at 4:13 p.m., the committee was adjourned.]

36
A P P E N D I X
HANNIBAL "MIKE" WARE
INSPECTOR GENERAL
U.S. SMALL BUSINESS ADMINISTRATION
BEFORE THE
CO:M:MITTEE ON SMALL BUSINESS
U.S. HOUSE OF REPRESENTATIVES
JULY 13, 2023

37
Chairman Williams, Ranking Member Velazquez, and distinguished members of
the Committee, thank you for inviting me to testify before you today and for your
continued support of the Office of Inspector General (OIG). The U.S. Small Business
Administration's (SBA's) role in the nation's pandemic response has presented an
unprecedented oversight challenge. I am proud of the dedication and hard work of
the men and women of OIG to not only oversee SBA programs and services, but also
to detect, deter, and combat fraud.
Over the course of the Coronavirus Disease 2019 (COVID·19) pandemic, SBA
disbursed approximately $1.2 trillion of COVID·19 Economic Injury Disaster Loans
(EIDL) and Paycheck Protection Program (PPP) funds. Using OIG's investigative
casework, prior OIG reporting, advanced data analytics, and additional review
procedures, we estimate SBA disbursed more than $200 billion in potentially
fraudulent COVID·19 EIDLs and PPP loans. This estimate represents
approximately 17 percent of disbursed funds in these programs
specifically, more
than $136 billion COVID·19 EIDLs and $64 billion in PPP funds. OIG published
these findings on ,June 27, 2023.
Office of lnspectoi- Oeneral
OIG provides auditing, investigative, and other services to support and assist SBA
in achieving its mission. OIG's oversight efforts provide recommendations to SBA
leadership to improve the performance of SBA's programs and services for the
benefit of the American people. The office's investigations pursue evidence of
wrongdoing in SBA programs, bringing fraudsters to justice. For the past 2 years,
our office has been ranked as the top OIG in the federal government as a Best Place
to Work by the Partnership for Public Service with a 2022 engagement and
satisfaction employee score of 86.2, which far exceeds the overall government score
of 63.4.
OIG provides taxpayers with an exponential return on investment, rooting out
fraud, waste, and abuse in SBA programs and making recommendations to improve
SBA's programs and operations. In the past 2 years alone, OIG's work has resulted
in more than $9 billion in dollar accomplishments, which includes investigative
recoveries, fines, and forfeitures, as well as review findings of disallowed costs. OIG
oversight of the PPP and the COVID·19 EIDL program has resulted in 1,050
indictments, 827arrests, and 553 convictions as of June 2023. Also, over $8 billion in
EIDL funds have been returned to SBA by financial institutions and another $20
billion by borrowers. OIG has played a key role in the return of these funds through
working with law enforcement partners and financial institutions. We have issued
33 reports on pandemic oversight with 78 recommended corrective actions to
1

38
strengthen internal controls and to promote integrity, efficiency, and effectiveness
within SBA programs.
Notwithstanding these accomplishments, OIG's oversight capacity is dependent
upon the availability of sufficient budgetary resources to continue addressing the
fraud within SBA pandemic response programs. The President has put forward a
Fiscal Year (FY) 2024 budget request for OIG to ensure continued oversight of
SBA's pandemic response and its vital flagship programs supporting the nation's
small businesses. The President also has sought $100 million in supplemental
appropriations, in addition to other measures, for a whole·of·government response
to the massive fraud in the nation's pandemic response programs. Absent the total
budgetary resources requested for OIG in the 2024 Budget, we will not have a
sufficient operating budget to combat the fraud within SBA programs and provide
effective oversight over its flagship programs. Critically, OIG would not have a
sufficient operating budget to capitalize on the new laws (P.L. 117·165 and P.L. 117·
166) that extended the statute of limitations for fraud in the PPP and EIDL
programs to 10 years.
Congress authorized SBA to administer approximately $1.2 trillion through the
PPP, COVID-19 EIDL, Shuttered Venue Operators Grant (SVOG), and the
Restaurant Revitalization Fund (RRF), mitigating the economic damage from the
pandemic.
To support businesses adversely affected by the pandemic, Congress tasked SBA
with the lending authority of approximately $470 billion in COVID-19 EIDLs and
$20 billion in COVID-19 emergency grants. In FY 2021, Congress appropriated
additional funds for new disaster assistance programs: $35 billion for Targeted
EIDL Advances and Supplemental Targeted Advances, $16.25 billion for the SVOG
program, and $28.6 billion for the RRF. The Coronavirus Aid, Relief, and Economic
Security (CARES) Act provided $349 billion for the creation of the PPP under
Section 7(a) of the Small Business Act. Congress added an additional $310 billion to
the PPP on April 24, 2020, through the Paycheck Protection Program and Health
Care Enhancement Act. On December 27, 2020, through the Consolidated
Appropriations Act, 2021, the Economic Aid to Hard·Hit Small Businesses,
Nonprofits, and Venues Act extended the program through March 31, 2021. The
Economic Aid Act provided an additional $147.5 billion in program funding. The
American Rescue Plan Act of 2021 provided an additional $7.2 billion, which
increased the total program funding to $813.7 billion. On March 30, 2021, the PPP
Extension Act of 2021 extended the program through June 30, 2021, with May 31,
2021 as the last day for acceptance of applications. As pandemic assistance
programs swelled to more than $1 trillion, the risk to the taxpayer increased
2

39
because SBA's internal control environment was calibrated to expedite loans and
grants.
Executive and legislative actions at the onset of the pandemic were designed to
quickly address the economic fallout, which allowed SBA to reduce or eliminate key
internal controls and rely on self-certification of eligibility to expedite aid. In turn,
OIG quickly pivoted to provide oversight of SBA's pandemic response programs.
Early Warnings
We knew at the start of the pandemic that SBA would face a delicate balancing act
of preventing widespread fraud while ensuring timely disbursement of relief funds
to Americans in immediate need of assistance. Our first concern was how SBA was
going to quickly delivery capital to qualifying small businesses without having
established the internal controls necessary to decrease fraud risk. This was why we
issued two reports prior to the first PPP loan being disbursed. Our reports stressed
the importance of up-front program controls to mitigate the risk of fraud, such as
verifying that the business did indeed exist before the onset of the pandemic and
that it had been adversely affected by the economic downturn. Because of the
lessons learned from other disasters, OIG knew the weaknesses we found in the
past would be greatly magnified with programs as large as the COVID-19 EIDL
program and PPP.
Even with these early warnings, SBA's internal control environment contributed to
bringing about the biggest fraud in a generation. SBA's need to quickly provide
relief to small businesses led to reduced controls on pandemic-related loans and
grants, substantially increasing the fraud risk. It was immediately clear that
pandemic relief efforts had drawn the attention of unscrupulous and greedy
criminals. In fact, the first criminal charges of PPP fraud were announced on May 5,
2020
approximately 1 month after the program was initially authorized by
Congress. Complaints from lenders and allegations of misuse of funds overwhelmed
OIG's Hotline -
over 100,000 complaints in the first year alone, which exceed more
than 250,000 to the present day.
OIG used agile work products to deliver review findings and suggested
recommendations for corrective action as the programs were first rolled out. Our
reviews revealed alarming findings. We published a flash report on the PPP in May
2020, which was just over a month after the program started. Thanks to this report,
Congress made changes to the program. We sounded the alarm internally of
rampant fraud in the COVID-19 EIDL program in June 2020.
We actively engaged SBA leadership throughout the duration of the pandemic to
notify them of preliminary findings so they could respond in real time to prevent
loss to the taxpayer. At the same time, we launched investigations and published a
list of fraud schemes and scams to alert the public and SBA stakeholders about the
fraud and abuse endangering these critical resources.
3

40
Oversight Work
OIG focuses its oversight capacity on the most significant risks to SBA and
taxpayers. Many of these risks are addressed in OIG's Top Management and
Performance Challenges Facing the SBA, which OIG issues annually in accordance
with the Reports Consolidation Act of 2000. The management challenges represent
areas that OIG considers particularly vulnerable to fraud, waste, abuse, or
mismanagement, or which otherwise pose significant risk to the agency, its
operations, or its credibility.
Each management challenge has originated from one or more reports issued by OIG
or the Government Accountability Office (GAO). We do not usually rank the top
challenges in order of importance or magnitude, except for the pandemic economic
assistance challenge. We view all challenge areas as critically important to SBA
operations. However, we placed COVID·l9 economic relief programs at the top of
the list for the 2021 report in recognition that it is the agency's most acute
challenge, and it remains so at present.
OIG annually publishes an oversight plan for reviews it has ongoing or planned for
that calendar year. In 2020, we published a supplemental oversight plan to address
the imminent oversight needs of the pandemic response. Most recently, we released
our comprehensive oversight plan that outlines OIG's audit and review priorities for
calendar year 2023.
The implementation of this robust oversight plan uses all available OIG resources
to provide timely, objective, and independent oversight of SBA programs and
services. Since the start of the pandemic OIG has testified before Congress 11 times
and held over 80 briefings for Congressional staff to ensure that Congress remains
informed of our oversight of SBA's pandemic programs. The effects of OIG's
oversight efforts for SBA's pandemic response are noteworthy. We have innovative
approaches to issuing agile work products and for leveraging data analytics.
To date, we have issued 33 reports that have focused on SBA's pandemic response
with more significant work to be released soon. As stated in our oversight plan,
upcoming reports will focus on SBA's pandemic response programs, including
evaluating eligibility and forgiveness of PPP loans exceeding maximum size
standards; eligibility and forgiveness of PPP loans made to borrowers in the U.S.
Department of the Treasury's Do Not Pay system; SBA's internal controls to
prevent SVOGs to ineligible entities; SBA's decision to end collections on COVID·l9
EIDLs under $100,000; and COVID-19 EIDL applicants in Treasury's Do Not Pay
system. Additionally, OIG is working on more than 10 mandatory reviews, which
are required by law, and an additional 24 reviews on other areas of risk identified in
the pandemic response programs. OIG also is providing oversight of SBA's response
to Hurricanes Ian and Fiona.
4

41
Over the course of SBA's pandemic response, OIG offered key recommendations to
strengthen the internal controls to prevent fraud in the COVID-19 EIDL program
and the PPP, such as:
• implementing a process to ensure PPP lenders validate that 1) the loan
amount does not exceed the maximum amount per employee, 2) the business
was established before the mandated date, and 3) the loan amount does not
exceed the maximum number of employees or other applicable standards;
• working with the U.S. Department of the Treasury to develop a technical
solution to enable the use of Treasury's Do Not Pay system to determine PPP
loan applicant eligibility and prevent improper payments before the release
of any federal funds;
• updating the PPP borrower application to include a field for the North
American Industry Classification code for the business category and the
business description to prevent potentially ineligible loan approvals:
• revising the PPP application to include the demographic information of
borrowers:
•
establishing or strengthening controls to ensure loan deposits are made to
legitimate bank accounts for eligible borrowers only, preventing the change of
loan application information post-approval without having that information
reviewed again by a person:
•
strengthening or establishing controls to ensure multiple loans are provided
only to eligible COVID-19 EIDL applicants and prevent the erroneous
duplication of loans: and
• strengthening controls for verifying an entity's start date to ensure
applicants meet eligibility requirements.
SBA has been responsive to OIG recommendations for corrective action. The agency
has continually made progress to reduce fraud risks and prevent further losses in
its pandemic loan programs, and our office's ongoing work continues to make
further recommendations for corrective action. Although we are confident that
SBA's implementation of our recommendations stemmed the tide of fraud, many of
the improvements were made after much of the damage had already been done,
namely because of the lax internal control environment at the onset of these
programs.
We will continue to monitor and assess the effectiveness of agency controls through
our ongoing and planned reviews for suspected fraud and suspicious activities.
5

42
Pandemic EIDL and PPP Loan Fraud Landscape
On June 27, 2023, OIG published the COVID·l9 Pandemic EIDL and PPP Loan
Fraud Landscape. We conducted this review to provide a comprehensive estimate of
the potential fraud in the SBA pandemic assistance loan programs. Over the course
of the COV1D·l9 pandemic, SBA disbursed approximately $1.2 trillion of COVID·19
EIDL and PPP funds.
In the rush to swiftly disburse COVID·19 EIDL and PPP funds, the agency
weakened or removed the controls necessary to prevent fraudsters from easily
gaining access to these programs. The fraudsters targeted the weaknesses in these
programs over and over again until they were able to break through and steal from
the American taxpayer.
Using OIG's investigative casework, prior OJG reporting, advanced data analytics,
and additional review procedures, we estimate SBA disbursed more than $200
billion in potentially fraudulent COVID·19 EIDLs and PPP loans. This estimate
represents approximately 17 percent of disbursed COVID·l9 EIDLs and PPP funds
specifically, more than $136 billion COV1D·19 EIDLs and $64 billion in PPP
funds. Since SBA did not have an established strong internal control environment
for approving and disbursing program funds, there was an insufficient barrier
against fraudsters accessing funds that should have been available for eligible
business owners adversely affected by the pandemic.
Based on the various fraud schemes identified in our ongoing and adjudicated
criminal investigations, we expanded rule·based analytics through link analysis
an investigative technique that identifies fraud clusters through shared data
attributes. Link analysis is distinct from simply identifying loans with duplicative
values, such as sharing the same Internet Protocol (IP) address. In contrast, link
analysis refines basic duplicate analysis by only capturing additional loans that are
associated with a source loan suspected of fraud. This reduced the potential false
positives and allowed us to focus on loan clusters highly suspected of being
fraudulent.
We automated a process in which we linked one·third of all OIG Hotline complaints
to associated loan data by extracting the unique identifiers of tax ID, loan number,
and Dun and Bradstreet business identifier (DUNS) number from complaint
narratives. We incorporated previously unavailable PPP borrower intake data using
administrative subpoenas, which are utilized to further our investigative work. This
data was from a small number of PPP lenders and third·party processors and may
be expanded upon as we obtain additional data.
We conducted an additional review using nonstatistical sampling methods and
professional judgment, as necessary. We took prior experience into consideration,
along with investigative casework and previous OIG reports to increase confidence
in the results of our data analysis.
6

43
As a result, we identified 11 fraud indicators, or fraud groups, which are almost like
a fingerprint left behind at a crime scene. We anticipate these estimates could
fluctuate with additional review, investigative, and data analytics work, in addition
to potentially expanding our link analysis investigative technique to include
additional data fields after receiving more lender and government agency data.
OIG identified multiple schemes, depicted in the fraud indicators, that perpetrators
used to steal from the American taxpayer. The groups listed below all possess the
indicators we considered in our fraud landscape estimates. Together, they illustrate
the types of schemes SBA OIG and other oversight agencies continue to unravel and
then prosecute.
Fraud Indicator 1: Hold Codes
• COVID·19 EIDLs and PPP borrowers whose loans were flagged by SBA or
third·party lenders because they identified one or more potential indicators of
fraud
Fraud Indicator 2: IP Addresses
• COVID·19 EIDLs and PPP borrowers who appear to have submitted loan
applications for 1) a foreign country, 2) the same IP address as the other
applications found to have a higher likelihood offraud
Fraud Indicator a: Employer Identification Number
• COVID-19 EIDLs and PPP borrowers whose EIN I) matched another EIDL
or PPP borrowers whose EIN matched another PPP loan or 2) was improperly
formatted or began with a prefix that was not considered valid by the IRS in
its loan application
• COVID-19 EIDLs and PPP borrowers who appear to have established their
business after the cutoff date to qualify for assistance
Fraud Indicator 4: Bank Accounts
• COVID·19 EIDLs borrowers who 1) received multiple COVID-19 EIDLs using
the same bank account and routing number or 2) changed their deposit
account from the one included on their application to a different bank account
or debit card
• COVID-19 EIDL and PPP borrowers whose bank accounts matched other
applications found to have a higher likelihood of fraud
Fraud Indicator 5: Defaulted/No Loan Forgiveness
• PPP borrowers who have not made any payments, are in default, and have
not applied for forgiveness
7

44
Fraud Indicator 6: Hotline Complaints
• Borrowers whose COVID-19 EIDL or PPP loan was the subject of a complaint
submitted to the OIG Hotline reporting various forms of fraud, waste, or
abuse
Fraud Indicator 7: Sole Proprietors and Independent Contractors without Employer
Identification Number
•
COVID-19 EIDL advance sole proprietor or independent contractor borrowers
who claimed to employ more than one person but did not apply using EIN,
which are required of businesses with more than one employee
Fraud Indicator s: Suspicious Phone Numbers
•
COVID-19 EIDL borrowers whose phone numbers match other applications
found to have a higher likelihood of fraud
Fraud Indicator 9: Suspicious Physical Addresses
•
COVID-19 EIDL borrowers whose addressed match other applications found
to have a higher likelihood of fraud
Fraud Indicator 10: COVID-19 EIDL Advances
•
COVID-19 EIDL applicants who received advances that were identified by
SBA as potentially fraudulent
Fraud Indicator 11: Suspicious Email Addresses
•
COVID-19 EIDL and PPP borrowers whose email addresses came from
potentially temporary domains that can disappear in the future or contain
modifications such as dot, dashes, or plus signs that make them appear
unique, but are essentially masked duplicates, as they do not alter where the
email is sent from if appropriate
•
COVID-19 EIDL borrowers whose email addressed match other applications
found to have a higher likelihood of fraud
We refer to "potential fraud" throughout the report due to the increased confidence
we have that fraud may exist within certain indicator groups based on our prior
audits, investigative casework, and advanced data analytics. This review
demonstrated that the potential fraud estimates directly correlate to our
investigative casework, adjudicated and ongoing criminal cases, and to schemes
SBA OIG and other oversight agencies are continuing to unravel and prosecute.
8

45
Since March 2020, we have initiated over a thousand investigations involving
complaints of fraud, resulting in arrests, indictments, and convictions that are
reported daily by the U.S. Department of Justice (DOJ) and its Offices of U.S.
Attorneys. We have received more than 250,000 SBA OIG Hotline complaints and
allegations of wrongdoing since the start of the pandemic. From that number, our
data analytics team identified more than 95,000 actionable leads
representing
more than 100 years of investigative case work. Through our "whole of agency"
approach we were able to identify s a comprehensive picture of the potential fraud
within the COVID·l9 EIDL program and the PPP, expanding our view of the fraud
landscape. With time and resources, OIG and our investigative partners will
investigate these loans identified as potentially fraudulent within the statute of
limitations.
To bring fraudsters to justice and return taxpayer funds, OIG fosters a whole·of·
government approach. OIG has partnered with many other law enforcement
organizations, conducted outreach to the DOJ Offices of the U.S. Attorneys, and
evaluated allegations of wrongdoing received through our Hotline using a
partnership with the Pandemic Response Accountability Committee (PRAC). We
are a key member of several DOJ strike forces, which the President has requested
to increase from 3 to at least 10. We also partnered with the SBA Office of the Chief
Information Officer to investigate and remove websites suspected of being
fraudulent. The U.S. Secret Service has assisted our office in the seizure of more
than $1 billion stolen by fraudsters from the EIDL program.
OIG often communicates with financial institutions to educate them on SBA
COVID-19 related programs and fraud indicators. OIG and the U.S. Secret Service
have jointly issued Financial Crimes Enforcement Network Alerts. We issued a
scam and fraud alert and provided information on how to return the funds or hold
for seizure.
In addition to COVID-19 Strike Force Teams, OIG has fostered and partnered with
numerous task forces across the nation to amplify its law enforcement reach. OIG is
accustomed to such a model through years of investment in training and in outreach
across the law enforcement community to combat fraud in SBA's flagship programs.
The task force model bolsters efforts to investigate and prosecute the most culpable
domestic and international criminal actors. This strategy works by augmenting and
incorporating existing coordination mechanisms, identifying resources and
techniques to uncover fraudulent actors and their schemes, and sharing and
harnessing information and insights gained from prior enforcement efforts.
Our Oregon Task Force is an outstanding example of how the strategy acted as a
force multiplier in taking the fight to fraudsters' doorsteps. This task force was our
Western Region Office's initial task force, bringing charges forward as early as
December 2020. Our partners on this task force include the Federal Bureau of
Investigation, the U.S. Treasury Inspector General for Tax Administration, the
9

46
Internal Revenue Service's Criminal Investigation, Homeland Security
Investigations, the Secret Service, the U.S. Postal Inspection Service, and the Naval
Criminal Investigative Service. Recently, this task force uncovered one of the
largest schemes we have prosecuted so far, exceeding $170 million, with over $11.5
million in secured funding.
Additionally, OIG has employed an international approach by expanding our
collaboration, rooting out bad actors, including Nigerian fraudsters who have taken
advantage of U.S. government programs. In April 2023, OIG joined a U.S.
delegation to Nigeria where we worked with government and law enforcement
representatives to identify ways our countries can work together to ensure
fraudsters are brought to justice. Nigerian fraudsters also often seek to steal from
their own government. This partnership will continue to produce results here and
abroad.
In the fall of 2022, OIG took a significant step by establishing its Technology
Solutions Division, which aligns with our objective of "leveraging technology and
employee experience to improve OIG methods in carrying out our mission." Through
intentional investments in data analytics, OIG's data analytics team has been able
to use machine learning and artificial intelligence to identify outliers in the
portfolios for investigation, as well as employing traditional data analytics to
develop investigative leads for our special agents working in tandem with task force
partners.
Many of the instances of fraud have been egregious, such as:
• In June 2023, a Utah woman was found guilty of $10 million worth of PPP
loan fraud. The federal jury convicted her of two counts of making false
statements designed to influence a bank, one count of money laundering, and
one count of contempt. The woman's false statements influenced the bank to
fund her requested $10 million PPP loan. After receiving the loan proceeds,
she transferred $150,000 to invest in a movie.
• In May 2023 in Puerto Rico, 44 individuals were indicted for their
participation in a multi-million-dollar fraud scheme to illegally obtain federal
recovery funds under the CARES Act. The Grand Jury charged the
defendants with multiple counts of wire fraud and money laundering. The
charging documents allege that from April 2020 through May 2023, the
defendants and their co-conspirators caused the submission of at least 52
EIDL and PPP loan applications seeking the illegal disbursement of at least
$1.2 million in federal recovery funds from the SBA and Bank 1.
• In March 2023, a former South Florida regional manager for a leading
national bank was sentenced to 120 months in prison for participating in a
conspiracy to defraud the PPP. The man and his co·conspirators attempted to

47
submit over 90 fraudulent loan applications to defraud the PPP and EIDL
programs out of approximately $25 million. The conspiracy caused
approximately $15 million in losses. The investigation has recovered over
$800,000 so far.
• In March 2023, a federal jury convicted a Virginia woman on charges of
conspiracy, bank fraud, and money laundering. The woman and her husband
fraudulently obtained two PPP loans. She carried out the scheme in
connection with two of her husband's businesses by creating fraudulent
payroll documentation for each business and then submitting that
documentation in support of the PPP loan applications. The fraudulent
documentation claimed that her husband's businesses had dozens of
employees with over $17 million of annual payroll in 2019, when in fact they
had few, if any, employees. In total, she and her husband fraudulently
obtained approximately $2.5 million in loan proceeds. They then spent those
funds on a 7,000·square·foot home.
• In February 2023, a Texas man was convicted for his role in a scheme to
fraudulently obtain and launder millions in PPP funds. The man conspired
with others to submit fraudulent PPP loan applications by falsifying the
number of employees and the average monthly payroll expenses. In total, the
co-conspirators sought over $35 million through more than 80 fraudulent
PPP loans. The Texas man distributed over $500,000 in fraudulent loan
proceeds to his co-conspirators and himself using bogus payroll checks. He
laundered a portion of the proceeds by transferring the funds from one of his
bank accounts to another bank account he controlled.
• In February 2023, a California man was sentenced to 54 months in federal
prison for fraudulently obtaining $5 million in COVID-19 reliefloans for his
sham businesses. In May and June of 2020, the man submitted false and
fraudulent PPP loan applications to three banks. The false information
submitted included the number of employees, altered bank account records
with inflated balances, and fictitious quarterly federal tax return forms.
Relying on this false information, the banks funded the PPP loan applications
and transferred approximately $5 million to accounts he controlled. He used
the fraudulently obtained PPP loan proceeds for his own personal benefit,
including for expenses prohibited under the requirements of the PPP
program, such as for the purchase of luxury vehicles and lavish vacations.
• In February 202;3, a California woman who fled to Montenegro to avoid
prison sentence was returned to the United States after spending
approximately 1 year as a fugitive. The woman was a member of a Los
Angeles-based fraud ring that engaged in a scheme to fraudulently obtain
more than $20 million in PPP and EIDL COVID-19 relief funds. She and her
11

48
co-conspirators used dozens of fake, stolen, or synthetic identities - including
names belonging to elderly or deceased people and foreign exchange students
to submit fraudulent applications for about 150 PPP and EIDL loans. They
used the fraudulently obtained funds as down payments on three luxury
homes in California. They also used the funds to buy gold coins, diamonds,
jewelry, luxury watches, designer handbags, cryptocurrency, securities, and a
Harley-Davidson motorcycle.
• In November 2022, a Texas man and woman were sentenced to 121 months
and 66 months, respectively, in federal prison for wire fraud violations
related to COVID-19 relief funds. The two operated a sophisticated
telemarketing scheme under the name My Buddy Loans from a house in
Texas: In exchange for a fee, My Buddy Loans took personal identifying
information from victims and promised to file an application for an
agricultural grant, which they said was available to those who owned as little
as one acre ofland. Instead, they filed fraudulent EIDL applications with
SBA that contained the victims' personal identification information. Based on
these fraudulent applications, SBA issued more than $1.56 million in EIDL
Advances to people who were not eligible.
It should be noted that whistleblowers are instrumental to our oversight efforts.
These brave individuals have come forward to help us focus our oversight on
vulnerabilities within SBA's internal control environment and other areas of
significant concern. Many of our Hotline complaints concern identity theft. We have
made referrals to SBA to address victims' concerns pertaining to fraudulent loans.
These reports have also informed our ongoing review of SBA's response to
allegations of identity theft. OIG is deeply appreciative of the whistleblowers who
have come forward. We will investigate any ensuing complaints of retaliation that
may be related to these protected disclosures.
Through the CARES Act, Congress established the PRAC within the Council of the
Inspectors General on Integrity and Efficiency (CIGIE). OIG was designated as a
statutory member of the PRAC, which provides increased oversight capacity to the
pandemic response efforts. I also chair the PRAC's Audit Subcommittee to provide
strategic audit-related direction to all government review efforts.
The PRAC plays a key role in supporting OIG's pandemic oversight efforts. During
the pandemic, our Hotline received thousands of complaints outside of its electronic
complaint submission system. The PRAC identified 10 volunteers to perform a
short-term detail to our Hotline. These volunteers performed data entry to
consolidate these complaints into the case tracking system, where they can be
12

49
efficiently assessed and addressed. We are also engaged with the PRAC to bolster
our internal data analytics capabilities, though we have developed over the past
year a robust internal capability to guide and enrich our oversight efforts.
Working with the PRAC, we created an Agile Products Toolkit to help oversight
agencies quickly produce reports addressing the fraud and misuse of taxpayer
money resulting from the expedited disbursal of pandemic economic aid funds.
Federal, state, and local oversight agencies use this toolkit as a guide for conducting
quick·response reviews.
OIG continues to collaboratively work alongside the PRAC to produce
comprehensive work products that further safeguard taxpayer dollars, identify
cases of fraud in SBA pandemic relief related programs and proactively alert
external stakeholders to areas of potential waste, fraud, and abuse. Through this
partnership, the PRAC has issued the following final reports that relied heavily on
OIG personnels' subject matter expertise regarding SBA programs:
1. SBA PPP Phase III Fraud Controls, January 21, 2022
2. Risk Advism:v- Potential Identity or Other Fraud in SBA Pandemic Relief
Programs, September 19, 2022
3. FRAUD ALERT: PRAG Identifies $5A Billion in Potentially Fraudulent
Pandemic Loans Obtained Using Over 69,000 Questionable Social Security
Numbers, January 30, 2023
On ,July 5, 2023, the PRAC published, the PRAG Impact Project report that was
produced in collaboration with the following nine OIGs: Department of Agriculture,
Education, Health and Human Services, Homeland Security, Housing and Urban
Development, Labor, the Interior, Transportation, and the Treasury to review the
sources, intended purpose, and impacts of federal pandemic funds for six geographic
areas. With this team, OIG reviewed the total combined funding for:
1. The Paycheck Protection Program (PPP) loans and associated lender fees:
2. The COVID·l9 EIDL and Emergency Advance Grants;
3. The Shuttered Venue Operators Grants;
4. The Restaurant Revitalization Fund; and,
5. Section 1112 Debt Relief Payments provided to each of the following areas:
a. Springfield, Massachusetts;
b. Coeur d'Alene, Idaho;
c. Sheridan County, Nebraska;
d. Marion County, Georgia;
e. White Earth Nation Indian Reservation, Minnesota;
f. Jicarilla Apache Nation Indian Reservation, New Mexico
13

50
Outside of assisting in issuance of comprehensive reports from the PRAC our
partnership furthers goals of promoting integrity, efficiency, and effectiveness of
SBA programs; and continues to amplify our oversight impact through engagement
with an external stakeholder.
SBA has exercised over a trillion dollars in lending authority and entrepreneurial
assistance in the wake of the pandemic. While PPP lending is anticipated to resolve
within the next several years, our efforts to detect and investigate the substantial
fraud will continue. We also will be working diligently to offer recommendations
that improve SBA programs and operations, which were strained by the
unprecedented demand during the pandemic crisis. This oversight will require
vigilance so that SBA can efficiently and effectively meet the needs of small
businesses.
The scale and scope of the pandemic response programs, and the potential fraud
under investigation, far outmatches oversight resources. To prioritize our work and
root out fraud in these vast portfolios, we have moved data analytics into the heart
of our oversight efforts. Our data analytics staff is assisted by contractor support
secured through our partnership with the PRAC. Our FY 2024 budget request seeks
three additional data scientists so that we can maintain and improve our fraud
fight. Data analysis produces a higher quality of audit and investigative
information so that we can improve our audit and investigative work. In addition,
SBA's loan portfolios are comprised of millions of records, which are far too
expansive for manual review. Data analytics bolsters our investigative capacity
with findings that have led to the arrest of fraudsters nationwide.
In August 2022, the President signed into law two bipartisan bills that were aimed
at holding accountable those who commit pandemic assistance fraud. The two laws
extend the time available to prosecute individuals who committed fraud through the
PPP or COVID-19 EIDL program, extending the statute oflimitations for criminal
and civil enforcement against a borrower from 5 to 10 years. These bills
demonstrate that pandemic relief fraud enforcement will continue to be a priority
for many years to come.
The President's requested increase in OIG's base operating budget for :F'Y 2024
coincides with the exhaustion of supplemental funds appropriated to OIG during
the pandemic. OIG's proposed FY 2024 budget maintains our staffing level at 185
positions. The budget proposal also provides for three additional investigative
groups (27 positions) to expand our investigative efforts to match the unprecedented
resources expended on pandemic economic assistance. Vital to the oversight
successes of OIG, the budget also provides for three additional data scientists,
14

51
which are essential to detecting the fraud, prioritizing investigations, and
enhancing the impact of the investigations.
With sufficient resources, coupled with the 10·year statute oflimitations on PPP
and EIDL fraud, our office will be poised to combat fraud for years to come. We are
grateful for the swift action from the 117th Congress to extend the statute of
limitations on PPP and EIDL fraud and look forward to working with Congress on
resource determinations for FY 2024 and beyond.
Support of OIG's budget request sends a strong message of deterrence to fraudsters
taking aim at all U.S. government programs. OIG has proven with adequate
resources, we are poised to promote public trust and instill integrity in SBA
programs. Budget scenarios, such as a return to FY 2022 funding levels, would be
detrimental to instilling integrity in SBA programs. We will not be able to
accomplish the goal of accountability for wrongdoing. Reducing OIG's funding to FY
2022, as enacted, would decrease OIG's investigative and fraud enforcement
capabilities to nearly equivalent to staffing levels of the office following
sequestration in 2013, which is less than 100 total positions. At the same time, OIG
will exhaust supplemental funds being directed to combat fraud in SBA's pandemic
response programs in FY 2024. Such a funding scenario simply does not allow OIG
to provide effective oversight.
OIG's COVID·19 Pandemic EIDL and PPP L0tm Fraud Landscape provides a
credible estimate of potential fraud within these programs. This independent and
objective work is intended to keep both the Administrator and Congress informed
about the challenges of employing a pay·and·chase model during an economic crisis.
Fraudsters continuously probed the loan application systems and found
vulnerabilities. They coordinated schemes to bypass limited controls and gain
access to funds meant for eligible small businesses and entrepreneurs adversely
affected by the pandemic.
The nation can depend on OIG to provide independent, objective, and timely
oversight of SBA We will focus our resources on systems and processes that present
serious management and performance challenges within SBA programs with a goal
of improving the integrity, accountability, and performance of those programs for
the benefit of the American people. Our investigations will root out fraud, waste,
and abuse and will marshal the resources available across the federal law
enforcement community to bring wrongdoers to justice.
15

52
House Committee on Small Business
Questions for the Record
"Stolen Taxpayer Funds: Reviewing the SBA and O!G Reports of Fraud in Pandemic Lending
Programs Act"
Hearing held on July 13, 2023
Witness: Mr. Hannibal "Mike" Ware
Questions from Chairman Williams:
I. You stated in your report that there may be cases of fraud that were not detected
and therefore not included in your estimate. The SBA has expressed its intent not to
pursue loans under $100,000. If those loans are no longer being serviced, how will
fraudulent loans that have escaped initial detection be discovered?
OIG will continue to investigate fraudulent loans regardless of dollar amount. If time and
resources were available, OIG would open an investigation into every loan identified as
potentially fraudulent in our reports. We will continue to discover fraud, misuse, and
abuse of these programs in ongoing investigations, often resulting from public
complaints, lender/financial institution referrals, SBA referrals, and our evolving data
analytics capabilities. Our findings in the fraud landscape repo1t will evolve over time
with the incorporation of new data sets and link analysis.
O!G does not agree with SBA's decision to not collect on PPP loans valued at $100,000
or less because SBA did not conduct a sufficient and comprehensive cost-benefit analysis
on PPP purchase guarantees. As of March 2023, SBA ended collections on approximately
306,000 charged-off PPP loans, valued at $100,000 or less, totaling approximately $5
billion. Our fraud landscape report lists specific fraud indicators that we use to detect
fraud. One of these indicators focuses on PPP borrowers who have not made any
payments, are in default, and have not applied for forgiveness. SBA's decision to not
collect on loans under $100,000 means this important indicator will not be applied by
SBA to this large group of loans.
In the coming weeks, our office will publish a management advisory, Ending Collections
on Delinquent COVID-19 Economic Injury Disaster Loans. This management advisory
will examine SBA's decision to end collections on COV!D-19 EIDLs with outstanding
halances of $100,000 or less.
a. Have you received an updated cost-benefit analysis from the SBA justifying
this decision after you relayed that their initial analysis was insufficient? If
so, can you please provide the Committee with a copy?
We have not received a copy of an updated cost-benefit analysis. SBA
management has a milestone date of September 29, 2023 to close the
recommendation by providing such an update.
Pagel of 15

53
b. In the hearing before us ou April 19, 2023, you agreed to provide the
Committee the initial analysis that the SBA claims to have used in making
this decision. We have not yet received that document. Can you provide an
npdate on the delay and what we ean do to get that docnment?
When the request was made at the April 19, 2023 hearing, I believed it was for a
discussion concerning the analysis of the document, not the document itself. SBA
has the document marked "Internal SBA use only-· Coofidential - Not for Public
Distribution." OIG requires authorization from SBA since it is an agency record.
We have made this request to SBA's Office of Congressional and Legislative
Affairs.
2. Page six of your report mentions "certain lenders" added to the fraud risk by
prioritizing quickness and potential profit over a thorough review of applicant
eligibility for government aid. During the hearing these "certain lenders" were
identified as financial technology (FinTech) companies. Your office has
communicated to this Committee that it intends to release a focused report on the
involvement ofFinTechs in pandemic lending fraud. When can we expect that
report'?
The report, Risk Associated with the SBA 's Oversight of PPP Loans Processed by Fintech
Companies is anticipated to be published in the first quarter of FY 2024.
3. What differences in method, analysis, and procedure (other than not considering
partial repayment as an indicator of legitimacy) created this large discrepancy
between the OIG and SBA reports?
While SBA has the responsibility to ensure integrity in its programs, 010 independently
defines fraud. Additionally, 010 performs its mission in an independent and objective
manner to promote public trust in SBA's programs.
There are number of factors for the large difference between dollar amount of fraud
reported by our office versus what was found by SBA. Our office had access to data that
SBA did not, including OIG Hotline complaint data as well as Internet Protocol (IP)
addresses and bank accounts from three PPP lenders/service providers. Our office also
used a variety of analytical methods, including rule-based analytics and machine
learning. Our scope included all COVJD-19 EJDLs and PPP loans disbursed throughout
the COVID-19 pandemic.
Our analyses expanded on findings from our previous reports to identify fraud in the
COVJD-19 EIDL program and PPP. We used new computer search techniques,
optimized our search techniques, and incorporated newly gathered data into the search.
We tested a limited sample of COVJD-19 EJDL and PPP loans identified as potentially
Page 2 of 15

54
fraudulent and, in some instances, tested against source documentation to provide greater
confidence in our results.
We used link analysis to assess and evaluate connections between data points. We
matched the bank accounts, phone numbers, physical addresses, email addresses, and IP
addresses that had a higher likelihood of fraud. We also identified suspicious loans based
on their connection to loans that had a higher likelihood of fraud. For the COVID-19
EIDLs, we considered all loans matched via bank accounts, phone numbers, physical
addresses, email and [P addresses as part of the bank accounts, suspicious phone
numbers, suspicious physical addresses, suspicious emails, and IP address fraud groups.
For PPP, we considered only the loans matched via IP addresses and bank accounts as
part of the IP address and bank account fraud group.
SBA stated that 010 mischaracterized the size of actual fraud in the COVID-19 EIDL
program and PPP because OIO did not explicitly define ·'potential fraud. SBA also
slated that it is important to differentiate between "potential fraud," "likely fraud," and
"confirmed fraud." We refer to "potential fraud" throughout the fraud landscape report
because of our increased confidence that fraud may exist within certain indicator groups
based on our prior audits, investigative casework, and advanced data analytics. We
believe loans identified as potentially fraudulent as part of our review warrant
investigation by 010 and its investigative partners.
We will continue to work on obtaining additional datasets through partnerships with other
government agencies as well as through subpoenas of certain lenders and their third-party
processors. As we receive and analyze additional datasets, the fraud groups may be
refined to identity additional fraudulent loans.
Questions From Rep. Nydia Velazquez, Ranking Member:
1. I understand that the use of advanced data analytics has enabled you to identify and
prioritize potential fraud schemes. What steps will your office take next to determine
how much of the potential fraud is actual fraud, and how long will that process take'?
Every loan that OIG identified as potentially fraudulent as part of our $200 billion
estimate warrants investigation by OIO and its investigative partners. If time and
resources were available, 010 would open an investigation into every loan identified as
potentially fraudulent in our reports. Actual fraud is determined by adjudication, which
is under the purview of the Department of Justice and the comts. We expect thousands
of investigations will ensue for years to come because of swift congressional action to
increase the statute oflimitations to IO years for COVID-19 EIDL and PPP fraud.
Page 3 of 15

55
2. The OIG identified l l fraud indicators, and there may be loans witb multiple flags.
Does your estimate take into account the overlap and weed out any duplicate
reporting of potentially fraudulent loans'?
Yes. 010 can state with confidence that the over $200 billion in potentially fraudulent
funds does not include any double counting. Only unique application IDs for COY!D-19
ElDL and loan numbers for PPP were counted toward the fraud estimate. Through the
decontliction process, OlG ensured loans that were associated with multiple fraud
indicators were only counted once toward the overall estimate.
shows the total amount of potential fraud associated with
each fraud indicator. Our report shows the unique contributions of each fraud indicator
and includes a group of loans that were associated with multiple fraud indicators.
Because loans may be associated with multiple fraud indicators, the aggregates of each
separate group total may exceed the total potential fraud estimate.
3. Could you please share with the Committee how the use of link analysis can detect
potential fraud, and further discuss the parameters your office put into place to
ensure the data yon are collecting is accurate?
Link analysis is an investigative methodological approach to identifying fraud clusters
through shared data attributes. Through link analysis, we reduced the potential false
positives which allowed us to focus on loan clusters highly suspected of being fraudulent.
It's impo1tant to note that link analysis is distinct from simply identifying loans with
duplicative values, such as sharing the same Internet Protocol (JP) address. In contrast,
link analysis refines basic duplicate analysis by only capturing additional loans that are
associated with a source loan suspected of fraud.
Link analysis contributed to identifying approximately 25 percent of all suspected
fraudulent loans within the PPP, which represents $15.8 billion. Link analysis also
contributed to identifying approximately 38 percent of all suspected fraudulent loans
within the COVID-19 E!DL program, which represents $51.7 billion. These loans
otherwise would not have been detected without link analysis.
Follow-up: Did you conduct manual reviews on any of the files flagged as
potentially fraudulent?
Yes, we regularly manually review loan files as a part of our investigations and
audits. Our estimate is based on relevant OIG audits, investigations, advanced
data analytics, other reviews, and prudent professional judgment. Given the nature
of our audits and investigative case work, the number of loans reviewed by 010 is
not a metric that is aggregated. As noted in our report, we have hundreds of
ongoing investigations. and a single case can involve hundreds of loans that were
Page 4 of 15

56
manually reviewed. We have conducted evaluations of PPP loans and COVID-19
ElDLs, and during those evaluations have conducted reviews of source
documents related to the objectives of the various project topics (i.e., do not pay,
size standards, sole proprietors with no EIN, etc.).
4. Turning to COVID-EIDLs, SBA referred 520,000 COVID EIDL loa11s a11d
advances, acco1111ting for $28 billion in disburseme11ts, to your office. What is the
status of your i11vestigatio11 i11to these potentially fraudulent loans?
Because we have received over 90,000 actionable leads on our O!G Hotline, we must
prioritize our casework and leverage data analytics to gather evidence necessary for
referrals to the Department of Justice for prosecution. SBA 's referrals to OIG are made
via email, Box.com, or OIG Hotline portal. However, these referrals are not always new
complaints of fraud, waste, or abuse and there is not a reliable way to discern unique
referrals across these reporting mechanisms.
SBA refers to us information from their own reviews, identity theft'""'"""'"'~
information obtained from financial institutions, as well as information obtained from
OIG and/or other law enforcement agencies. For example, this information might
include applications SBA flagged for fraud based on the over 90,000 EIDL file requests
from us and other law enforcement agencies. These should not be considered as referrals
by SBA as they are already ongoing investigations.
OIG's ElDL and PPP oversight and investigative work has resulted in 1,057
indictments, 882 arrests, and 562 convictions as of July 31, 2023, with associated
amounts
more than $460 million. Additionally, OIG collaboration with SBA
and the U.S. Secret Service has resulted in the seizure of more than $1 billion stolen
from the EIDL program. We also played a key role in
financial institutions in
the return of another $8 billion to SBA's EIDL program and over $20 billion in EIDL
funds paid back by borrowers prior to the end of the deferment period.
5. More than $50 billion in pote11tial fraud is related to the "hold code" fraud indicator.
Upon taking office, Administrator Guzman rei11stated a number of internal controls
to stem the fraud. Were the vast majority of these funds in this bucket disbursed in
the first nine months of the pandemic whe11 the internal eoutrols were weakened?
Of the $34.2 billion in potential fraud SBA OIG identified in the COVlD-19 ElDL program
associated with the active hold code analysis, 77 percent was disbursed within the first nine
months of the program. Of the $17.2 billion in potential fraud SBA OIG identified in the
PPP program associated with the active hold code analysis, 69 percent was disbursed
within the first nine months of the program. However, this pattern of disbursements relative
to COVID-19 EIDL and PPP program timelines is specific to loans with active hold codes
and does not generalize to all loan disbursements identified in the fraud landscape report.
Page 5 of 15

57
As a percentage of total disbursements identified in the fraud landscape, active hold codes
contributed to 21 percent of PPP disbursements and 19 percent of COVfD-19
disbursements respectively.
SBA O!G's white paper COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape
identified $51.4 billion in potentially fraudulent loans from the PPP and COVID-19 EfDL
programs from disbursed loans that had active unresolved hold codes at the time of analysis
May 2023. Hold codes are placed and cleared from loans by SBA. This analysis only
considered a subset of active hold codes that O!G found to be most reflective of potential
fraud, rather than all active hold codes. Any hold codes that had been cleared by SBA were
excluded entirely from the analysis.
6. More than $70 billion in potential fraud is related to the "Internet Protocol (IP)
Addresses" fraud indicator. Could you please breakdown the amounts that are
connected to loan applications from a foreign country vs. applications from multiple
IP addresses?
The table below provides a summary of total disbursed amounts by program and IP
indicator:
Fraud Landscape IP Address Group - Disbursed Summary by Program and
Analysis
fforeig1r m
Targefo<I rn l.iuli:
A'ddresses
,\inalysis
'l'otal IP Indicators
EIDL
$1,873,733,525
$53,805,373,482
$55,679,107,007
PPP
$553,569,337
$] 5,901,031,246
$16,454,600,584
Total
$2,427,302,862
$69,706,404,728
$72,133,707,591
OIG's fraud landscape report identified $72.1 billion in potentially fraudulent loans and
advances from the PPP and COV!D-19 EIDL programs through geo-locational IP address
analysis and link analysis of shared IP addresses. However, the fraud landscape report did
not include an analysis of simple duplicates of IP addresses. This would have meant that
any loan application sharing the same IP address would have been flagged as potentially
fraudulent, which is not necessarily true. To reduce such false positives, our white paper
included link analysis, which refines basic duplicates analysis by only capturing
additional loans that are associated with a source loan already suspected of fraud.
Link analysis better focuses on potentially fraudulent loan clusters and may not include
all loans associated with straight duplicate analyses that carry a lower likelihood of being
fraudulent. All loans identified as potentially fraudulent via link analysis of IP address
f'age 6 of 15

58
shared the same IP address as loans or applications independently identified as potentially
fraudulent.
Follow-up: Of the $70 billion ofpotentialfraud in this bucket, how much was
issued in the first nine months of the pandemic when the internal controls were
weakened?
Of the $55.7 billion in potential fraud O!G identified in the COVID-19 EIDL
program associated with IP address analyses, 48.5 percent was disbursed within
the first nine months of the program -April 2020 through December 2020.
For the COVID-19 EIDL program, O!G has direct access to all applicant [P
addresses captured at intake, as SBA functioned as the sole lender and processed
all COVID-19 applications.
As a result of data limitations, we are unable to calculate the potential fraud in
the first nine months of the PPP associated with IP address analyses, as we have
limited access to PPP lender data through subpoena.
Due to the nature of the PPP, where third-party lenders received and nrr,,,,,~s.•,r1
applications, OIG has limited access to applicant intake IP addresses.
the time
of analysis for the fraud landscape white paper, O!G only had acquired access to
IP addresses from three PPP lenders. These lenders provided IP address data
almost entirely limited to PPP applications from 202 l. These lenders either did
not participate in early rounds of PPP or had not maintained server logs from
2020.
7. The vast majority of the potential fraud identified by the OIG is related to the first
two fraud indicators- "IP addresses and hold codes." Could you please expound on
your work in these two areas and share with the Committee how much actual fraud
you have uncovered and then recovered in these two areas?
Our case management system does not break down investigations by fraud indicators.
Therefore, we are unable to determine how much ofOIG's recoveries are associated to
each fraud indicator. We refer to "potential fraud" throughout the fraud landscape white
paper hecause of the increased confidence we have that fraud may exist within certain
indicator groups based on our prior audits, nv,:stigative casework, and advanced data
analytics. We believe loans identified as potentially fraudulent as part of our review
warrant investigation
OIG and its investigative partners. Actual fraud is determined
by adjudication, which is under the purview of the Department of Justice and the courts.
Many of SBA's COVID-19 related programs were administered electronically, which
have made IP addresses key elements in investigations to identify targets, as well as
detect, related applications/loans. We have been able to take initially low-dollar cases
and expand them to million-dollar cases by using link analysis to include linking loans
Page 7 of 15

59
via IP addresses. Hold codes are important for assisting 010 in prioritizing the potential
fraud schemes as well as assisting in deconf1iction with ongoing investigations.
8. The SBA Administrator testified that they flag all potentially fraudulent loans -even
those under $100,000 - and send those to the OIG for pursuit. What is your process
for investigating these loans??
The majority of the referrals from SBA related to PPP are submitted directly into OIG's
Hotline portal and triaged along with the other Hotline complaints using machine learning.
They are then reviewed by our Hotline personnel to determine if further action is necessary.
010 is employing advanced analytics to identify outliers in the portfolios for investigation,
as well as employing data analytics to develop investigative leads for our agents working
with task force partners. Data analytics has been integral to assessing complaints received
from our 010 Hotline and identifying efficient processes to appropriately resolve and
prioritize the work needed to follow up on these valuable leads. OIG data analytics will be
a vital tool in our oversight ofSBA's flagship programs, including SBA disaster assistance
programs.
OIG has capitalized on our partnerships with other law enforcement entities to stem the
tide of pandemic assistance fraud. We have always placed great value on our partnerships
across the federal government and other law enforcement agencies. The time and effort
invested into these relationships has substantially increased our office's successes, We
have issued fraud alerts in conjunetion with other law enforcement agencies to assist
financial institutions to detect fraud in the SBA COVID-19 programs. We also provide
guidance on returning the potentially fraudulent funds.
SBA OIG has been able to use data to identify fraud leads that arc disseminated to our
various investigative partners. Integral to this success: the COVrD-19 Financial Fraud
Virtual Working Group and other partners like the Pandemic Response Accountability
Committee, Federal Deposit Insurance Corp. OIG, Internal Revenue Service Criminal
Investigation, Treasury Inspector General for Tax Administration, U.S. Postal Service
010, U.S. Secret Service, among many others. We are also partnered with various other
CARES Act fraud task forces across the nation.
9. How much funding would your office need to open an investigation into every case
identified as potential fraud?
The President's requested increase in OIG's base operating budget for FY 2024 coincides
with the exhaustion of supplemental funds appropriated to OIG during the pandemic.
OIG's proposed FY 2024 budget of $63.3 million maintains our staffing level at 185
positions and modestly increases investigative resources to allow for an expanded
Page 8 of 15

60
presence across the nation in areas where SBA pandemic response program dollars were
more often disbursed. The budget proposal also provides for three additional investigative
groups (a total of 27 positions) to expand our investigative efforts to match the demand.
The budget also provides for three additional data scientists, which are essential to
detecting fraud, prioritizing investigations, and enhancing our investigations.
The extension of the statute of limitations allows for the fight to continue for l O years,
but without our requested appropriations for the 2024 Budget, we will not have a
sufficient operating budget to combat the fraud within SBA programs. Our full budget
request allows us to provide effective oversight over SBA's flagship programs. Without
this, OIG would not have a sufficient operating budget to capitalize on the new laws.
It also should be noted that the FY 2024 budget request preceded OIG's recent effort to
identify the fraud landscape for PPP and EIDL. We estimate that SBA disbursed over
$200 billion in potentially fraudulent COVID-19 EIDLs, E!DL Targeted Advances,
Supplemental Targeted Advances, and PPP loans, which magnifies OIG's resource
needs. Fully funding OIG's FY 2024 budget request would facilitate approximately 600
investigations annually, though these investigations can encompass many loans when
data analytics is employed to uncover fraud scheme linkages. It is not possible to
precisely estimate the number of cases that will be opened give such variables and
unknown outcomes of investigations to bring forward the evidence necessary to pursue
charges for prosecution. However, we can anticipate FY 2024 funding will facilitate
approximately 600 cases annually involving complex fraud schemes; whereas there are
4.5 million ofloans associated with the $200 billion PPP and EIDL fraud landscape.
10. Given the number of allegations your office is receiving related to pandemic relief
fraud, can you share with us how your office decides which allegations to pursue and
how you prioritize investigations?
OlG has established priorities and thresholds to focus our investigations on those cases
that likely have a major impact or loss associated with SBA programs or operations,
major cost to the U.S. taxpayer, pose a threat of serious bodily harm, insider threats, or
public trust.
OlG wil! continue to invest in our data analytics team so we can develop strategies, such
as link analysis, to identify priority cases. Data links are identified within the program
data and with our other datasets, such as our Hotline. This also brings otherwise low
priority cases to the forefront.
A case example in our fraud landscape report is associated with a kickback scheme and
demonstrates how we prioritize our casework and fully leverage tbe investigative
capacity afforded to our office:
Page 9 of 15

61
ln this case, we initially noted fraud totaling $500,000 of COVID-19 EIDL and
PPP involving three suspects, which led us to trace the movement offunds
among several co-conspirators. This ultimately revealed a sprawling conspiracy
involving over 1,300 non-existent businesses and up to $140 million in potential
fraud. Our data analytics team indicates this one case could further reveal about
$625 million in potential fraud.
11. The increased use of data analytics has bolstered your ability to identify billions iu
potential fraud. Can you expound on the ways this new tool has enhanced your
oversight capabilities?
Data Analytics has allowed OIG to use more sophisticated analytic tools to enhance our
oversight capabilities. The use of advanced technologies has increased audit review
capacity, expanding the scope of an audit review from a sample to the full population and
demonstrating the possibility of evaluating certain eligibility criteria over an entire loan
program. For example, the use of webCrawlers has enabled us to filter through the full
population of websites to quickly identify suspicious websites or entities that may be
deemed ineligible for loans that otherwise may have gone undetected. With the use of
data analytics, OIG is able to focus audits reviews on the highest risk entities for potential
fraud or ineligibility. Data analytics has also allowed our office to take statistical
samples that can be extrapolated to specific populations to forecast the amount of fraud or
ineligibility in a particular SBA program. Additionally, data analytics has allowed us to
link a fraud suspect to not just one loan application but to all loan applications that used
the same identifying information. Typically, this method of identification allows OIG to
identify an entire network of fraudsters working together to defraud the federal
government.
Furthermore, OIG has relied on link analysis as an investigative technique to identify
fraud clusters through shared data attributes. Link analysis directly contributed to the
identification of roughly 25 percent of all loans suspected of fraud within PPP,
representing$! 5.8 billion and roughly 38 percent of all loans suspected of fraud within
COVID-19 EIDL, representing $51. 7 billion. These loans would not have been detected
without link analysis.
OIG is also using big data and cloud computing that closely mirror our investigative
techniques of case development to triage Hotline complaints in the context of all SBA
loan programs. Specifically, to triage Hotline complaints in a risk-based fashion at scale,
we implemented an Artificial Intelligence (Al) natural
topic model to group
Hotline complaints into types based on the complaint narrative. Our AI-augmented
approach to Hotline complaint review process assists our investigators in prioritizing the
most egregious complaints that need immediate attention. Our approach, for example, has
enabled us to associate over 800 Hotline complaints with one investigation, markedly
increasing our investigative efficiency.
Page 10 of 15

62
To force multiply our efficiency in investigating the massive pandemic-related fraud in
SBA programs, we are applying network detection analytics to our cases to shift our
investigative focus from individual cases to organized fraud rings. This approach
visualizes complex connections between seemingly unrelated loans and has markedly
increased our efficiency and ability to bring wrongdoers to justice.
12. What datasets does the OIG have that the SBA does not? And how do those datasets
better enable yon to detect fraud?
Our fraud landscape estimate is based on OIG investigative casework, prior reports,
advanced data analytics, and prudent professional judgment. Our analysis focused on
detecting fraud signals reflective of fraudulent intent such as manipulated emails; victim,
lender, and whistleblower complaints (hotline submissions); foreign IP addresses; SBA
identified issues of potential fraud (active hold codes); and defaulting PPP loans with no
forgiveness application.
Our office has acquired access to data that SBA does not have access to, including OlG
Hotline submissions, FBI criminal history data and subpoenaed IP addresses and bank
accounts from certain PPP !enders/service providers. We used big data and cloud
computing that closely mirrored investigative techniques of case development through a
variety of rule-based and machine learning analytical methods. In addition, we
implemented link analysis across programs to identify potential fraud clusters through
commonly shared attributes in the data. Link analysis refines basic duplicate analysis by
only capturing additional loans that are associated with a source loan suspected of fraud
thereby reducing potential false positives and focusing on loan clusters highly suspected
of fraud. These techniques allowed us to identify and prioritize potential fraud schemes
perpetrated against SBA ·s COVID-19 ETDL program and PPP.
Our prior audit work includes 22 reports that identified significant internal control
weaknesses and provided SBA with recommendations intended to mitigate fraud risk.
Regarding our investigative casework, fraudsters have been convicted for committing
fraud that aligns with the fraud indicators supporting our fraud landscape estimate.
Based on access to datasets that SBA does not have access to, robust analytical methods
that closely mirror investigative techniques, prior reports and prudent professional
judgment, we are confident in our potential fraud estimate for the COVJD-19 EIDL
program and PPP.
13. What percentage of the potentially fraudulent EIDLs are being paid back, and do
you have an account of the number of loans that are being paid back due to please
agreements?
Currently, OIG cannot confirm the percentage of potentially fraudulent EIDLs in
repayment because we do not have granular payment data. We cannot confirm what types
Page 11 oflS

63
of payments are related to seizure. payments from the borrower, or other types of
reductions to the pr inc ipaL
Questions from Representative Phillips:
l. Mr. Ware, we discussed the importance of fully funding the Office of the Inspector
General's (OIG) at $47.7 million so OIG has the resources it needs to investigate and
recoup fraud in SBA's pandemic aid programs. However, the FY 2024 House
Financial Services and General Government appropriations bill would level fund
OIG at $32 million, nearly $16 million short of its budget request.
Fully funding OIG's FY 2024 budget requested by the President equals $63.3 million.
To meet this funding requirement, the President proposed $47.704 million of
discretionary funding, plus a $1.6 million transfer from SBA 's Disaster Assistance Loan
Program, and an additional $14 million transfer to OIG from a mandatory funding
source.
Unfortunately, the proposed mandatory funding source for the $14 million transfer is no
longer viable ,vuvw11u, enactment of the Fiscal Responsibility Act of 2023 (P.L. l l 8-5)
rescission to SBA Disaster Loan Program account unobligatcd balances, These funds
are needed to provide critical OIG resources to combat the unprecedented fraud in
SBA's pandemic response programs. Specifically, the request would enable OIG to
build on its existing oversight capacity as COVID-l 9 EIDL loans enter into repayment
with additional cdminal investigators, data scientists, auditors, and professional staff.
OIG has provided an exponential return on investment to the taxpayers by rooting out
fraud, waste and abuse in SBA 's programs and promoting public trust and integrity
within SBA's programs and operations. In the past 2 years alone, OIG's work has
resulted in more than $9 billion in dollar accomplishments, which includes investigative
recoveries, fines, and forfeitures, as well as review findings of disallowed costs.
Additional investments in data analytics capabilities, auditors, and investigative
coverage will enable OIG to analyze more data, conduct more audits and reviews, and
instigate more cases.
The President's FY 2024 Budget provides the necessary funding to enable the OIG to
sustain existing oversight capacity and invest in additional necessary staffing. Absent
the total budgetary resources requested in the 2024 Budget
$63.304 million, OIG will
not have sufficient funding to combat fraud within SBA programs or to provide
effective oversight over the agency's programs. Critically, OIG will not have a
sufficient onc!ratm2 budget to capitalize on the new laws (P.L. l 17-165 and P.L. 117-
166) that extended the statute of limitations for fraud in the PPP and ElDL programs to
l O years.
2. In your estimation, would providing OIG with its entire requested budget provide a
positive return 011 investment through enhanced investigative and enforcement
Page 12 of 15

64
capabilities? If so, approximately how much in additional fraud recovery would the
additional $16 million in direct budget authority yield?
Yes. 010 provides taxpayers with an exponential return on investment, rooting out
fraud, waste, and abuse in SBA programs and making recommendations to improve
SBA's programs and operations. In the past 2 years alone, OIG's work has resulted in
more than $9 billion in dollar accomplishments, which includes investigative recoveries,
fines, and forfeitures, as well as review findings of disallowed costs.
With a $47 million mark, 010 would be able to retain current staffing levels of
approximately 185 positions. We request support of the budget that the President has put
forward for FY 2024, which would support approximately 240 positions, to include 27
criminal investigators. At any point in time, each criminal investigator is working a
caseload of about IO investigations, suggesting at least 270 additional cases, at a
minimum, can be conducted annually. We are executing a hiring plan that is data.driven
and evidence•based to allocate resources that align with SBA dollars that flow across the
nation and insights from complaints and criminal cases within our indices. We will be
opening field offices in San Francisco, California; Sacramento, California; Kansas City,
Missouri; Columbus, Ohio; Boston, Massachusetts; New York, New York; and Tampa,
Florida as part of our hiring surge. This significantly expands our nationwide footprint
and takes the fraud fight to the doorsteps of the wrongdoers.
Questions for the record from Representative Scholten:
3. Inspector General Ware, I appreciate the work that your division has done in
investigating fraud. I'm interested in learning more about what happens to the
money you recover from fraudsters. Are recovered funds returned to the Treasury
Department'? How does the government track these funds? Are there any
transparency measures for the public to know where these recovered fnnds go?
A collaborative, interagency approach is necessary to return recovered funds to SBA or
other appropriate government accounts. Following seizure, it is necessary for the federal
agency to petition for the return of fraudulent or misused funds in a timely manner. Due
to the petition process, there is a delay between when the asset is seized and when the
assets are remitted back to the agency. Given the scale and scope of the seizures that have
occurred, this is a resource•intensive process.
There are several factors that detern1ine where funds that are returned to SBA programs
will go. The factors include the type of program, why the funds were returned, and how
the funds are returned.
•
COVID-19 EIDL program -
SBA serves as the lender for the COVJD.19
EIDL program; these are direct loans by SBA to the borrower. These funds
are returned to SBA's Treasury account. 010 will publish a report,
Accounting of COVID-19 EIDL Returned Fundv, before the end of FY23. This
Page 13 of15

65
report addresses the amount of returned funds received by SBA for COVID-
19 EID Ls and the processing of those returns.
•
Paycheck Protection Program -
There are several ways that PPP funds can
be returned. The funds can be returned to PPP lenders, SBA, or the Treasury.
On May 31, 2023, we published Report 23-08, Serious Concerns Regarding
the Return of Paycheck Protection Funds. In this report, our office found that
SBA's guidance to borrowers and lenders on returning PPP funds was
insufficient. The agency did not communicate to lenders how funds can be
returned at the time of forgiveness. In addition, SBA did not have specific
guidance for financial institutions that needed to return deposits related to PPP
funds.
Further, SBA is tracking loans on an ad hoc basis using a spreadsheet based on referrals
of potential fraud from lenders, SBA personnel, and OIG. These loans do not include
seized PPP funds. As of February 1, 2023, OIG was aware of almost $32 million in
seizures related to the PPP that SBA is pursuing in addition to $95 million in frozen PPP
funds. SBA has identified a limited number of seizure activities by government agencies
and frozen PPP funds from financial institutions. However, due to the informal, ad hoc
nature ofSBA's tracking, the full scope of these funds is unknown.
SBA management indicated in email correspondence that managers are continuing to
formalize a PPP funds recovery process, which will include guidance to borrowers,
lenders, and financial institutions on how to return PPP funds. SBA management
anticipates issuing the guidance in the fourth quarter of FY 2023.
4, Inspector General Ware, I noticed that there is a large discrepancy between the
amount of fraud your office has found versus the amount SBA found in their report.
How many manual reviews of loans did your office conduct? Were they done
differently from the manual reviews completed by SBA?
While SBA has the responsibility to ensure integrity in its programs, OIG independently
defines fraud. Additionally, OIG performs its mission in an independent and objective
manner to promote public trust in SBA's programs.
There are number of factors for the large difference between dollar amount of fraud
reported by our office versus what was found by SBA. Our office had access to data that
SBA did not, including OIG Hotline complaint data as well as Internet Protocol (IP)
addresses and bank accounts from three PPP lenders/service providers. Our office also
used a variety of analytical methods, including rule-based analytics and machine
learning. Our scope included all COVID-19 EIDLs and PPP loans disbursed throughout
the COVID-19 pandemic.
Our analyses expanded on findings from our previous reporting to identify fraud in the
COVID-19 EIDL program and PPP. We used new computer search techniques,
Page 14 of 15

66
optimized our search techniques, and incorporated newly gathered data into the search.
We tested a limited sample of COVID-19 EIDLs and PPP loans identified as potentially
fraudulent and, in some instances, tested against source documentation to provide greater
confidence in our results.
We used link analysis to assess and evaluate connections between data points. We
matched the bank accounts, phone numbers, physical addresses, email addresses, and IP
addresses that had a higher likelihood of fraud. We also identified suspicious loans based
on their connection to loans that had a higher likelihood of fraud. For the COVID-19
EIDLs, we considered all loans matched via bank accounts, phone numbers, physical
addresses, email and IP addresses as part of the bank accounts, suspicious phone
numbers, suspicious physical addresses, suspicious emails, and IP address fraud groups.
For PPP, we considered only the loans matched via IP addresses and bank accounts as
part of the IP address and bank account fraud group.
Given the nature of our audits and investigative case work, the number of loans reviewed
by OIG is not a metric that is aggregated. As noted in our fraud landscape white paper,
we have hundreds of ongoing investigations, and a single case can involve hundreds of
other loans. We have conducted evaluations of PPP loans and COVID-19 EIDLs, and
during those evaluations have reviewed source documents related to the objectives of the
various project topics (i.e., do not pay, size standards, sole proprietors with no EIN, etc.).
While SBA states it conducted 3 million human-led reviews, at this time we do not know
the scope of those human-led reviews. Additionally, we have noted that many loans with
flags that have been cleared by SBA were cleared by policy decisions/memos and not
manual reviews.
The depth of work performed by OIG significantly exceeds that of SBA and its
contractors. SBA's provided figures equate to approximately 3,000 reviews per day.
Additionally, OIG performs its mission in an independent and objective manner to
promote public trust in SBA's programs. For context, the average OIG investigation takes
more than 250 days because we obtain and analyze years' worth of financial and business
records, conduct interviews, execute search warrants, obtain tax records via ex parte
orders, and adjudication of the case. SBA's human-led reviews do not reach the same
level or degree of depth as OJG investigations. Moreover, we only considered SBA's
active hold codes for our fraud estimates and not those that may have been cleared
through SBA's human-led reviews.
Page 15 of 15

67
SBA INSPECTOR GENERAL INSPECTION REPORT
SBA's ADMINISTRATIVE PROCESS TO ADDRESS
POTENTIALLY FRAUDULENT RESTAURANT
REVITALIZATION FUND AWARDS
Report 23-10 I July 5, 2023

68
What OIG Reviewed
We
inspected
the
U,S,
Small
Business
Administration's (SBA} administrative process
used to review potentially fraudulent Restaurant
Revitalization Fund (RRF) applications and recover
funds,
The American Rescue Plan Act of 2021 authorized
SBA to administer the RRF and provided $28.6
billion to assist qualifying small businesses
adversely affected by the Coronavirus Disease
2019 pandemic,
Eligible food and drink businesses had several
options to apply for an RRF award, including using
SBA's
point-of-sale
partners to accept the
applications on behalf of SBA. Because point-of-
sale partners were to use their historical sales data
to validate the customers' gross sales claimed on
the applications, SBA did not perform an additional
verification.
The objective of our inspection was to determine
whether SBA took appropriate administrative
actions to review potentially fraudulent RRF
awards reported by one point-of-sale partner and
recover improper payments.
To meet our objective, we reviewed the authorizing
legislation, the Government Accountability Office
(GAO) A Framework for Managing Fraud Risks in
Federal
Programs,
SBA's
April
2021
RRF
Implementation Plan, federal regulations, and
applicable policies and procedures, We met with
program officials, SBA contractors, and a point-of·
sale partner,
We selected all 3,790 applications that the point-of-
sale partner reported to SBA in which gross sales
were not supported by historical sales records, The
partner also identified that 1,056 of these
applications had indicators of potential fraud
which were then reported to the OlG Hotline, For a
sample of these potentially fraudulent applicants,
we reviewed the actions SBA took to review and
recover any improper payments after the point-of-
sale partner notified SBA of the discrepancies,
What OIG Found
Program officials designed the RRF application
validation and approval processes using GAO's
framework for managing fraud risks, However,
Report 23-10
July 5, 2023
3,790 applicatious submitted through a point-of-
sale partner were processed without verifying
gross sales, a key control designed to prevent
ineligible entities from receiving awards,
As a result, SBA's RRF application processing
system approved almost all 3,790 applications for
awards, totaling $55 7 million, despite not having
gross sales verified,
Once notified, SBA took quick action and prevented
$278.4 million from heingdisbursed to 1,618 of the
3,790 applicants, including 946 of the 1,056
potentially fraudulent awards which had been
reported to the OIG Hotline,
However, SBA has not reviewed the remaining
2,172 awards, totaling $278,6 million, which
included the remaining 110 potentially fraudulent
awards reported to OlG, totaling $20,7 million,
Until all 2,172 awards are completely reviewed,
SBA has no assurance that $278,6 million in RRF
program funds were awarded based on accurate
gross sales and cannot attempt to recover
improper payments,
OIG Recommendation
We made one recommendation to prioritize and
complete the review of 2,172 RRF awards, which
includes 110 RRF awards that were suspected of
fraud and referred to the OIG Hotline, These
awards were flagged for having unsupported gross
sales, SBA should take appropriate administrative
actions to recover improper payments.
Agency Response
SBA agreed with the recommendation, SBA
managers planned to review all 2,172 RRF awards
during the post-award process resolve the
recommendation.

69
DATE:
TO:
FROM:
Office of Inspector General
U.S. Small Business Administration
July 5, 2023
Isabella Casillas Guzman
Administrator
Hannibal "Mike" Ware
Inspector General
SUBJECT:
Inspection of SBA's Administrative Process to Address Potentially Fraudulent
Restaurant Revitalization Fund Awards (Report 23-10)
This report represents the results of our inspection SBA's Administrative Process to Address
Potentially Fraudulent Restaurant Revitalization Fund Awards. We considered management
comments on the draft of this report when preparing the final report. SBA management
agreed with our recommendation.
We appreciate the cooperation and courtesies provided by your staff. If you have any
questions, please contact me or Andrea Deadwyler, Assistant Inspector General for Audits,
at (202) 205 6586.
cc:
Arthur Plews, Chief of Staff
Therese Meers, General Counsel
Peggy Delinois Hamilton, Special Counsel for Enterprise Risk
Bailey De Vries, Acting Associate Administrator, Office of Capital Access
John Miller, Deputy Associate Administrator, Office of Capital Access
Katherine Aaby, Chief Financial Officer, Office of Performance, Planning, and the
Chief Financial Officer
Cindy Pitts, Acting Director, Office of Continuous Operations and Risk
Management
Melissa Atwood, Director, Office of Financial Operations and Acquisition
Management
Michael Simmons, Attorney Advisor, Office of General Counsel
Tonia Butler, Director, Office of Internal Controls

70
Table of Contents
Introduction ..................................................................................................................................................................... 1
SBA's Planned Application Review Procedures .......................................................................................... 2
Table 1: Four Methods Used to Calculate an Applicant RRF Award Amount .......................... 3
Application Discrepancies Reported to SBA by a Point-of-Sale Vendor Partner .......................... .4
Objective ..................................................................................................................................................................... 4
Finding: SBA Needs to Review Potentially Ineligible RRF Awards and Recover Improper
Payments ........................................................................................................................................................................... 5
Point-of-Sale Applications Processed Without Gross Sales Verification .......................................... 6
Applications Identified for Potential Fraud .................................................................................................. 7
SBA Relied on Point-of-Sale Partner for Application Validations ........................................................ 8
Recommendation .................................................................................................................................................... 8
Analysis of Agency Response .................................................................................................................................... 9
Summary of Actions Necessary to Close the Report.. ............................................................................... 9
Recommendation 1 ......................................................................................................................................... 9
Appendix I: Objective, Scope, and Methodology ............................................................................................. 10
Objective .................................................................................................................................................................. 10
Scope and Methodology .................................................................................................................................... 10
Table 2: Point-of-Sale Partner Report to SBA about RRF Applications Transmitted ........ 10
Use of Computer-Processed Data .................................................................................................................. 11
Appendix II: Monetary Impact ............................................................................................................................... 12
Table 3: OIG Schedule of Questioned Costs ............................................................................................... 12
Appendix Ill: Management Comments ............................................................................................................... 13

71
Introduction
On March 11, 2021, the President signed the American Rescue Plan Act of 2021, which
provided economic relief to restaurants. The legislation made $28.6 billion available for the
Restaurant Revitalization Fund (RRF) to assist small businesses in the food and drink
service industry by awarding grants to offset pandemic-related revenue loss. 1 The U.S.
Small Business Administration (SBA} Office of Capital Access was charged with
implementing the RRF program.
To help agencies implement the American Rescue Plan Act relief programs in a way that
promotes public trust in the government, the Office of Management Budget (0MB) urged
agencies to use 2 CFR 200 to provide the highest integrity in financial assistance
management. 2 Also, 0MB required agencies to work with the Pandemic Response
Accountability Committee and the Inspectors General to strengthen payment integrity to
minimize misuse and improve the overall award and administration of financial assistance
programs. Agencies needed to submit proposed implementation plans of 2 CFR 200 for any
new program authorized by the American Rescue Plan Act to 0MB for approval.
In accordance with 0MB guidance, SBA program officials established an implementation
plan for the RRF program that incorporated 2 CFR 200 controls for awarding federal
assistance. Program officials also considered lessons learned from administering a prior
Coronavirus Disease 2019 (COVID-19) pandemic relief program, the Paycheck Protection
Program, and incorporated fraud detection controls that the Office of Inspector General
(OIG) recommended in a memorandum sent to agency management. 3 Additionally,
program officials considered the U.S. Government Accountability Office's (GAO) A
Framework for Managing Fraud Risks in Federal Programs4 when they designed the system
of controls to prevent, respond, and detect fraud in the RRF program.
In April 2021, SBA provided the OIG, the Pandemic Response Accountability Committee,
and 0MB the RRF implementation plan as required by 0MB guidance. At that time, 0MB
accepted SBA's plan without having any outstanding questions.
1 Pub.
No. 117-2 American Rescue Plan Act of 2021, § 5003 Support for Restaurants (March 11, 2021).
2 0MB Circular M-21-20, "Promoting Public Trust in the Federal Government through Effective Implementation of the
American Rescue Plan Act and Stewardship of the Taxpayer Resources" (March 19, 2021).
3 SBA OIG Memorandum "Key Recommendations Based on Lessons Learned from Prior COVID~ 19 Economic Injury
Disaster and Paycheck Protection Program Loan Programs" (December 23, 2020).
4 GAO, GA0• 15-593SP, A Framework for Managing Fraud Risks in Federal Programs, (July 2015).

72
SBA's Planned Application Review Procedures
Eligible businesses included those not permanently closed and businesses where patrons
are primarily served food or drinks, including but not limited to restaurants, food stands,
food trucks, food carts, caterers, and bars.
Eligible businesses had three options to apply for an RRF award:
•
call a customer service help line to complete an application questionnaire with a
support agent;
•
use SBA's online RRF award portal, restaurants.sba.gov;
•
submit the application to SBA through their current point-of-sale vendor.
Point-of-sale vendors are technology companies that provide transaction systems to a
business to calculate a customer's purchase amount, add applicable taxes, process the
payment, and track sales. Every time a customer makes a purchase, they are completing a
point-of-sale transaction. According to SBA's RRF Implementation Plan, partnering with
these vendors leveraged their "Know Your Customers" capabilities. Having already
established relationships with their customers, the intention was to provide an easier
process for applicants in which historical sales data could be an added layer of validation.
SBA partnered with four point-of-sale companies. Two point-of-sale partners integrated
with SBA to provide the RRF application on their websites for their customers, while two
other point-of-sale companies only provided a statement to confirm their customer's gross
sales.
SBA established four methods to calculate the RRF award amount based on the applicant's
gross receipts and operational status, see Table 1.
2

73
Table 1: Four Methods Used to Calculate an Applicant RRF Award
Amount
A}U/lieant Operational Status
• Award Amount Calculation
In operation on or prior to
January 1, 2019
Began operations partially
through 2019
Began operations on or between
January 1, 2020 and March 10,
2021 or had not yet opened but
incurred eligible expenses
Operated multiple locations
The award amount equaled the 2019 gross receipts, minus
2020 gross receipts, minus any Paycheck Protection
Program (PPP) loan amounts.
The award amount equaled the average 2019 monthly
gross receipts, times 12, minus 2020 gross receipts, minus
any PPP loan amounts.
The award amount equaled the amount spent on eligible
expenses between February 15, 2020 and March 11, 2021,
minus gross receipts earned from January 1, 2020 through
March 11, 2021, minus any PPP loan amounts.
The aggregate of the award amounts calculated for each
location using separate calculation methods.
Source: OIG generated based on Public Law 117-2, American Rescue Plan Act of 2021, Section 5003(a)(7) and
RRF Program Guide as of April 28, 2021
SBA required applicants to complete and sign Internal Revenue Service (IRS) Form 4506-T,
Request for Transcript of Tax Return, for verification of tax information and then to also
submit gross receipts documentation. SBA designed a risk-based tiered validation process
that determined the level of review prior to award. At a minimum, these tiers were planned
for basic verifications against private and public data sources using the U.S. Department of
the Treasury's Do Not Pay List and other widely used database records. Depending on the
risk level assessed, SBA also planned to verify the applicant's gross receipts using IRS
transcripts.
Based on the risk model, SBA assigned applications submitted through its point-of-sale
vendor partners at the lowest risk tiers. SBA intended for the partners to use historical
sales data already available within their point-of-sale systems to verify the applicants'
reported 2019 and 2020 gross receipts used to calculate the award amount. As such, SBA
did not require IRS tax transcripts for applicants who submitted through the point-of-sales
partners.
Once the point-of-sales partner received the customer's application, the partner sent the
information to a third-party, who in turn, sent the information to SBA's RRF online
application portal that was developed to validate the applicants' information. The
application was then sent to RRF program officials for review and approval.
3

74
Application Discrepancies Reported to SBA by a Point-of-Sale
Vendor Partner
From May 3, 2021 to May 19, 2021, one point-of-sale partner submitted 9,726 RRF
applications to SBA on behalf of its customers. The partner identified 3,790 applications
that included gross sales that were generated outside the partner's point-of-sales systems.
The partner also identified trends and similarities among 1,056 of the 3,790 applications
that had indications of potential fraud. Both the partner and program officials confirmed
the partner reported these discrepancies to SBA on May 17, 2021. Program officials later
reported this to SBA OIG. The point-of-sales partner stopped accepting new applications
and directed applicants to SBA's direct portal on May 19, 2021.
Objective
Our objective was to determine whether SBA took appropriate administrative actions to
review potentially fraudulent RRF awards reported by a point-of-sale vendor partner and
recover any improper payments.
4

75
Finding: SBA Needs to Review Potentially Ineligible RRF
Awards and Recover lmp:rope:r Payments
Program officials designed the RRF application validation and approval processes using
GAO'sA Framework for Managing Fraud Risks in Federal Programs. The framework
provides
practices for designing and implementing an antifraud strategy with
control activities to mitigate fraud risk. The framework recommends federal managers
develop, document, and communicate an antifraud strategy to employees and stakeholders
that describes the program's activities for preventing, detecting, and responding to fraud,
as well as monitoring and evaluating fraud risk management activities.s
The RRF's April 2021 lmplementation Plan incorporated parts ofGAO's framework by
establishing a risk-based approval process. Program officials also had the benefit of lessons
learned and recommendations that addressed internal control gaps identified in our SBA
OIG reports on the Paycheck Protection Program.6 The plan required that all applications
undergo system validation procedures that checked various private and public data
sources. SBA assigned applications submitted through its point-of-sale vendor partners at
the lowest risk tiers because SBA relied on the partners to validate the applicant's
information and the gross sales amounts using the customers historical sales records.
Because SBA assigned applications submitted by a point-of-sale vendor partner the lowest-
risk tier, gross sales were not validated against tax returns. During RRF program
implementation, a point-of-sale vendor partner notified program officials that 3,790 RRF
applications it accepted included unsupported gross sales, and that 1,056 of these
applications showed strong indications of fraud.
Although SBA's application processing system approved the 3,790 applications for awards
totaling $557 million, SBA program officials took quick action and prevented $278.4 million
from being disbursed to 1,618 applicants. This includes 946 of the 1,056 potentially
fraudulent awards.
However, 2 years have passed since the point-of-sale partner notification and program
officials have not fully reviewed or recovered the 2,172 awards that were already
disbursed, totaling $278.6 million, which includes 110 awards that were identified to SBA
5 GAO, GA0-15-593SP, The Fraud Risk Management Framework and Selected Leading Practices (July 2015), advises
agencies to plan regular fraud risk assessments and assess risks to determine a fraud risk profile.
"SBA OIG, 21-06, Paycheck Protection Program Loan Recipients on the Department of Treasury's Do Not Pay List, (January
2021); 21-07, Inspection ofSBA's Implementation of the Paycheck Protection Program, (January 2021); 21-09, Duplicate
Loans Made Under the Paycheck Protection Program, (March 2021); also 22-09, 22-13, and 22-25 collectively identify
internal control gaps in the PPP and require that SBA officials implement corrective actions relative to the PPP and future
pandemic related programs.
5

76
OIG by the vendor as potentially fraudulent (see Appendix II). Though program officials
plan to conduct post-award audits of these awards, 665 were not included in their audit
sample.
SBA relied on the partner to validate the applicants' gross sales amount. However, the
point-of-sales partner documented that they were not responsible for verifying gross sales
outside of their database. Until all 2,172 awards are reviewed, SBA has no assurance that
the $278.6 million in RRF program funds were awarded based on accurate gross sales and
cannot attempt to recover improper payments.
Point-of-Sale Applications Processed Without Gross Sales
Verification
To prevent improper payments from occurring, SBA established controls to verify that an
application was eligible for an RRF award. According to the RRF's April 2021
Implementation Plan, the point-of-sale partners were expected to use the historical sales
data for their customers to validate the applicants' gross receipts. As a result, SBA classified
applications accepted by point-of-sale partners as a lower risk with a tier 1 or 2
designation and did not compare gross sales against IRS tax transcripts. The RRF
implementation plan also required that program officials review applications flagged
during the validation process prior to issuing award payments. Although SBA established a
number of controls to mitigate the risk of fraud, they were not adequately used.
Without the point-of-sale partner reporting that 3,790 of the applications submitted to SBA
included gross sales amounts that were unsupported by historical sales records, SBA more
than likely would not have detected this discrepancy for some of these applications.
Of the 3,790 awards that the partner flagged for having included unsupported gross sales
in the application, 2,172 awards were disbursed for a total of $278.6 million without
adequate verification of the gross sales amounts. SBA officials told us that these
applications were incorrectly classified as being verified due to a technical error in the
partner's system.
SBA program officials noted that these awards will be part of their post-award audit
reviews. However, when we matched their post-award audit sample listing against these
2,172 awards, we found 665 awards, totaling $99.5 million, were missing from the post-
award audit sample population.
SBA should also include the 665 awards with unsupported gross sales to determine
whether the payment was proper. Federal regulations and SBA's federal assistance
6

77
directive require program officials to demand awardees return any payments made in
excess of the entitled amount to the government.7
Applications Identified for Potential Fraud
Of the 3,790 awards the partner reported to SBA, the partner reported that 1,056 showed
strong indications of fraud. The partner submitted the suspected fraudulent applications to
the OIG Hotline. The partner detected that nearly all the suspicious applications were
submitted by accounts that were created on or after May 3, 2021, which was the first day
the point-of-sale partner and SBA began to accept RRF applications.
The point-of-sale partner detected that many accounts listed a business name identical to
the owner's first and last names and signed up with unusual email domains. The partner
told us that some of these email domains registered high fraud scores on independent
third-party databases that analyzes email addresses. Further, the partner found several
merchant accounts shared assets with unrelated individuals. For instance, the same
computer or email domain was used to file applications in various locations. The point-of-
sale partner concluded that these unique patterns and shared assets between unrelated
individuals in different locations were consistent with identity theft.
Although program officials were able to prevent most of the awards that had been reported
as potentially fraudulent from receiving funds, 110 awards were paid $20.7 million.
Despite knowing that these awards were likely made to ineligible recipients, program
officials have not reviewed these awards or attempted to recover the funds. They told us
that these awards will be reviewed as part of a post-award audit of 10,058 awards without
any priority placed on these applications flagged for potential fraud.
We also determined that none of the 110 award recipients completed the required annual
reporting submissions or certifications that the recipient used the funds on eligible
expenses. SBA's Federal Assistance Policy Directive requires that the agency take
appropriate action when recipients do not comply with federal statues, regulations, terms
and conditions of the award. Federal regulations require agencies to issue a written
demand for payment to recover debts to the government. 8 Despite these requirements, SBA
did not take any further action beyond referring the 110 awards to the OIG Hotline
although SBA had administrative authority to review these potentially fraudulently
obtained RRF awards and seek recovery of improper payments.
7 2 C.F.R § 200.346.
8 31 C.F.R. § 901.2.
7

78
SBA Relied on Point-of-Sale Partner for Application Validations
SBA developed a Security and Application Programming Interface Agreement, and the
point-of-sale partner prepared the Product Definition document which collectively
expressed the terms of the partnership. SBA program officials stated the point-of-sale
partner had a responsibility to screen and check the validity of the financial information
submitted by the applicant. However, it was the point-of-sales partner's understanding that
they were only an intake portal that would forward all information provided by the
applicant to a third-party for SBA to review. Additionally, the Product Definition document
made it clear that the partner was not responsible for verifying any information provided
by the RRF applicant that did not originate from the point-of-sales partner's database.
The partner told us that they detected the potentially fraudulent applications as part of
their normal monitoring of their system activity. They noticed an increased volume of RRF
applications and determined that the spike corresponded with newly created accounts
being used to apply for the awards. The partner voluntarily reported the suspicious activity
to SBA.
There is a reasonable expectation that SBA should take responsibility for verifying data in
the absence of historical data. In fact, the Implementation Plan required SBA to validate
gross sales against tax returns in the absence of historical gross data.9 Once the point-of-
sale partner notified SBA that it submitted applications without validating gross sales, SBA
should have immediately reviewed the 2,172 applications (57 percent of the 3,790
applications reported by the point-of-sale partner), disbursed for a total of $278.6 million,
and attempted to recover any improperly disbursed funds.
Recommendation
We recommended that the Administrator direct the Associate Administrator for the Office
of Capital Access to:
1. Prioritize and complete the review of the 2,172 awards that were flagged by the
point-of-sale partner as having unsupported gross sales and take appropriate
administrative actions to recover improper payments, which includes 110
awards that were suspected of fraud.
, 2 CFR Implementation Plan Template for New Programs Authorized by the American Rescue Plan (April 2021].
8

79
Analysis of Agency Response
SBA management provided formal comments that are included in their entirety in
Appendix Jll. Management fully agreed with recommendation 1. Subsequent to receiving
management's written response, we followed up with program officials to clarify
implementation timelines. We found that the agency's planned actions are sufficient to
resolve the recommendation.
Summary of Actions Necessary to Close the Report
The following section details the status of the recommendation and the actions necessary
to close it.
Recommendation 1
Prioritize and complete the review of2,172 RRF awards, which includes 110 RRF awards
that were suspected of fraud and referred to the OIG Hotline. These awards for having
unsupported gross sales. SBA should take appropriate administrative actions to recover
improper payments.
Status: Resolved.
SBA managers agreed with the recommendation and are reviewing all 2,172 RRF awards
during the post•award process. Management plans to complete final action by June 30,
2024.
This recommendation can be closed when management provides results of the reviews for
all 2,172 RRF awards and, if applicable, evidence that management took administrative
action to recover improper payments.
9

80
Appendix I: Objective, Scope, and Methodology
Objective
To determine whether SBA took appropriate administrative actions to review potentially
fraudulently obtained RRF program funds reported by point-of-sale partner and recover
improper payments.
Scope and Methodology
To meet our inspection objective, we reviewed applicable Restaurant Revitalization Fund
legislation, GAO's A Framework for Managing Fraud Risks in Federal Programs, RRF's April
2021 lmplementation Plan, federal regulations in 2 CFR 200.345, and applicable SBA
policies and procedures. We also reviewed SBA's RRF program webpage and all publicly
available documents. We met with SBA program officials, contractors, and the point-of-sale
partner for additional clarity and documentation.
We relied on the data SBA and the point-of-sale partner provided, showing the RRF
applications that originated at the point-sale partner's website in May 2021.
The point-of-sale partner reported issues with applications it had submitted to SBA for
processing. These applications were submitted between May 3, 2021 and May 17, 2021
(See Table 2 for the types of issues identified and number of awards).
Table 2: Point-of-Sale Partner Report to SBA about RRF Applications
Transmitted
l:!oint•of•Sale IR!al'tner Inventory of RR£ Applications
Numberof
1\:warl:I
Transmitted for l!tocessing
Applications
Amou11t
Applications Identified with Unverified Gross Sales
3,790
$556,970,119
Paid Applications ldentified with Unverified Gross Sales
2,172
$278,570,834
Unpaid Applications Described in Payment System as Fully
1,618
$278,399,285
Canceled, Active Un-Disbursed or Blank (No Description)
Source: OIG generated based on Office of Capital Access' listings containing RRF applications and point~of~sale
partner's records
SBA used the RRF online application platform to help process and maintain program
applications and awards. We selected all 3,790 applicatio11s identified by the point-of-sale
partner with unverified gross sales totaling $557 million. This included 1,056 applications
that the point-of-sale partner also identified with potential fraud.
The scope of the inspection was limited to documented comments made by SBA and one
point-of-sale partner, as well as official award documents held on the RRF online
10

81
application platform. We believe that the evidence we obtained provides a reasonable basis
for our findings and conclusions based on our inspection objective.
We conducted this inspection in accordance with the Council of the Inspectors General on
Integrity and Efficiency's Quality Standards for Inspection and Evaluation. Those standards
require that we adequately plan and perform the inspection to obtain sufficient and
appropriate evidence to provide a reasonable basis for our findings and conclusions based
on our objective.
Use of Computer-Processed Data
We relied on computer-processed data in the RRF online application platform and E-Tran
(payment data) files. We retrieved listings of applications, award information, and SBA's
record for 3,790 RRF applicants. We tested the reliability of the data by comparing data
received from the point-of-sale partner to data received from SBA. We believe the
computer-processed information is reliable for the purposes of this inspection.
11

82
Appendix II: Monetary Impact
Questioned costs are expenditures that do not comply with legal, regulatory, or contractual
requirements; are not supported by adequate documentation at the time of the inspection;
or are unnecessary or unreasonable. 10 Questioned costs may be remedied by offset, waiver,
recovery of funds, the provision of supporting documentation, or contract ratification,
where appropriate.
Table 3: OIG Schedule of Questioned Costs
Source: OlG analysis of data received from SBA and point-of-sale partner
10 Inspector General Act of 1978, as amended, section 5(!)(1).
12

83
Appendix HI: Management Comments
SBA Management Response to Inspection Report
13

84
TO:
FROM:
U .S, SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 204 l 6
Hannibal "Mike" Ware, Inspector General
The Office oflnspector General (OlG)
Jihoon Kim JI KIM
Director, Office of Financial Program Operations
SUBJECT:
Response to O!G Draft Report entitled "Inspection of SBA's Procedures to
Recover Potentially Fraudulently Obtained Restaurant Revitalization Funds"
DA TE:
June 21, 2023
Thank you for providing the Office of Capital Access (OCA) the opportunity to respond to
OIG's Draft Report entitled, "Inspection of SBA's Procedures to Recover Potentially
Fraudulently Obtained Restaurant Revitalization Funds," dated May 5, 2023. The OIG's audit
objective for this draft rcp01t was to determine whether SBA took appropriate administrative
actions to review potentially fraudulent RRF awards by a point-of-sale vendor and recover any
improper payments.
OIG Recommendation 1- We recommend to prioritize and complete the review of2,172 RRF
awards, which includes 110 RRF awards that were suspected of fraud and referred to the OIG
Hotline. These awards were flagged for having unsupported gross sales. SBA should take
appropriate administrative actions to recover improper payments.
SBA Response: SBA concurs with this recommendation and is currently reviewing all 2,172
RRF awards during the post-award process,

85
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
Date:
June 21, 2023
To:
Hannibal "Mike" Ware, Inspector General
From:
Bailey De Vries, Acting Associate Administrator, Office of Capital Access ~~~:,1s
Subject:
Response to COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Project 23010)
Thank you for the opportunity to review and respond to the Office of the Inspector General's (OIG) Fraud
Land,cape white paper. The U.S. Small Business Administration's (SBA) appreciates our partnership to
strengthen all of SBA's programs, and especially the significant work we have done together to address
fraud in the Paycheck Protection Program (PPP) and COVJD Economic Injury Disaster Loan (COVID-
EIDL) programs, as well as establish a strong fraud risk framework to strengthen SBA against future
potential risks. However, we are concerned that the white paper's approach contains serious t1aws that
significantly overestimate fraud and unintentionally mislead the public to believe that the work we did
together had no significant impact in protecting against fraud. The concerns are as follows:
I) The paper only minimally acknowledges a critical aspect of SBA's fraud controls-the
material fact that SBA's fraud controls improved dramatically over time. While the white
paper highlights 16 measures the SBA put iu place in 202 l to stem the tide of the frnud attacks that
were prominent at the outset ofCOVJD-EIDL and PPP, the white paper does not provide a clear
accounting of when tl1e largest amoU11ts of fraud took place and when the efforts in early 2021 to
address it were taken. 111e statement: "there was an insiifficient barrier againstfi"audsters" does
not clarify the applicable time period for this conclusion. SBA believes a full accounting of our
work together would provide critical context for fraud in the programs and when that fraud
occurred. The vast majority of the fraud, 86% by SBA's estimate, occurred in the first nine months
ofCOVID-EIDL and PPP. It is critical to clarify when SBA added controls and to emphasize
which of those controls effectively protected against fraud. Such changes can provide valuable
information to policymakers, as they consider effective controls for inclusion in legislation and at
program launch for any future emergency program.
You have previously highlighted this distinction. In January 2022 you stated:
SBA is more prepared now than they've ever been in terms of the control environment...
certainly much stronger than ... at the onset of the pandemic ... The agency has moved
rather expeditious(v to close out the majority of the [JG} recommendations.

86
SBA acknowledges the prior administration made decisions to prioritize speed and unnecessarily
deflated the control environment for PPP and COVID-EIDL for the first several months of the
programs. However, SBA introduced additional fraud controls over time and implemented a
strengthened anti-fraud control framework in 2021. For example, SBA introduced pre-award
application screenings beginning in January 2021, including automated screenings for PPP,
adding tax transcript verification for COVID-EIDL, and running applications through the
Treasury Department's Do Not Pay system. These controls saved billions. Additionally, SBA
conducted a full review of all loans originated in 2020 to find likely fraud and refer it to your
office. As a result of this work, SBA has found 86% of likely fraud originated in the first nine
months of the programs. Aud while this white paper did not cover the Restaurant Revitalization
Fund or Shuttered Venues Operator Grant programs, two new programs that were launched in
2021 had a combined fraud rate SBA estimates near half of one percent
2) The white paper's estimate of a 34% potential fraud rate for COVID-EIDL does not stand
up against SBA's current repayment data: Only 12% of lending went to borrowers who are
past due and yet to make payments, most of which is likely accounted for by real businesses
that closed or are unable to repay. Common-sense dictates that a bad actor would not
fraudulently obtain a loan, only to repay it with interest. You have previously pointed out that
fraudsters have no intention of repaying their loan (OIG Report 22-09), and that the true extent
of fraud would become known once loans enter repayment (Deputy IG Testimony, March 2023).
Now, in June 2023, an overwhelming majority of the portfolio by volume has passed deferral
and is now obligated to repay. We recommend your office match the list of"potential
fraudulent" COVID-EIDL borrowers with their actual repayment history, which OIG staff told
SBA it considered but decided not to do as part of its white paper analysis. SBA would be happy
to partner with your office in this analysis.
As of June 2023, only 12% ofloan dollars went to borrowers who have not yet begun, but still
may begin, repayment after their loan came due. Every other business has either fully repaid
their loan or begun to do so {74%), or is still in the allowed deferment period (14%).
Importantly, most borrowers who do not repay their loans are not fraudulent; they are real
businesses who did not make it through the turbulence of the pandemic and have no ability to
repay. Indeed, early in the program, budget officials projected a default rate over one-third due to
the likelihood of distress and closure under the unique, historic circumstances of the pandemic.
Although SBA continues to estimate a higher-than-average non-repayment rate for the program
overall, SBA's modeling relied on structural elements of the programs, such as Congress's
decision to remove the requirement for personal guarantees for most loans, and the high
likelihood of small business closures during the pandemic and years-long impact it had on the
economy.

87
3) Third, the white paper presents a summary of loans that are potential fraud as if they were
loans that are likelv fraud. The white paper provides an estimate of "potential fraud," but does
not explicitly define the term except mentioning that OIG believes all loans identified "warrant
investigation." It is important to provide clear definitions of terms like "potential fraud" to
differentiate from "likely fraud" or "confirmed fraud." This is important both for policymakers and
for the small business owners who may consider participating in future federal emergency loan
programs. SBA invites the opportunity to work together with OIG on this issue so we have a
common framework which will benefit all program stakeholders. Without such, the white paper
leads the reader to mischaracterize the size of actual fraud in these programs.
SBA also reviewed all pandemic loans-and already conducted rigorous reviews of those with
fraud indicators. SBA used automated screening similar to the tools used in the white paper to
identify an initial set of files with anomalies, or "fraud indicators." SBA's first sweep found over
$400 billion worthy of further investigation more than twice the amount OIG identified of
worthy of further scrutiny. However, SBA's fraud identification and investigation did not stop
there. SBA then interrogated those files with over 3 million human-led reviews by trained
professionals, many with long prior careers in law enforcement, complemented by data analytics.
This extensive analysis revealed that the body of loans likely to be fraudulent is approximately
$36 billion across PPP and COVID-EIDL. The white paper highlights that OIG has condncted
over 1,000 investigations of pandemic loans so far. As the OIG team further scrutinizes its batch
of anomalous files, it will find the false positive rate is high and the set of potentially fraudulent
files will narrow as it did when SBA conducted our reviews.
To be clear, SBA believes tl1at all the fraud indicators in OIG's white paper can be helpful in
detem1ining which loans require further review and analysis to determine when there is actual
fraud, and we have used many of the same indicators as OIG in our initial analysis. Nonetheless,
SBA's more than 3 million manual reviews to date have shown that many of these OIG
indicators include a high percentage of false positives. While SBA has identified loans that were
not fraudulent within all I I of the OIG's Fraud Indicators (e.g., typos, misunderstandings,
circumstances for very small businesses, etc.), we focused the below examples on those
indicators in the white paper for which a failure to acknowledge and account for a high
propensity of false positives has the most material impact on OIG's inflated fraud estimate.

88
Examples of False Positives
# I lndic,1tor Nam!l
, Exam le
Hold Codes
Employer
3
identification
numbers
4
Bank accounts
Defaulted/ No loan
forgiveness
Hold code 8 (mismatch of entity name) identifies a business or entity where the
company name provided does not match any of the listed identification credentials
or provided application materials. Although this merits further review, SBA' s
historical manual reviews of loans with hold code 8 show that around over 75% of
those with hold code 8 would likely be resolved due to the clear existence of
borrower or lender data entry errors, or other valid factors.
SBA believes factoring in the historical results of the manual reviews of each hold
code would help identify the "likely fraud" rather than just those loans with "fraud
indicators."
For EIDL loans, thousands of borrowers requested a loan increase that required
approval from a different funding appropriation than the original loan. To manage
this, the SBA opened a second loan with the same EIN to grant the increase using
the correct appropriations. Many such loans, the total of which SBA estimates is
valued at over $6 billion, would likely be counted as 'potentially fraudulent' under
the white paper's methodology.
The SBA encountered various data entry errors when reviewing loans associated
with this hold code. For example, applicants would provide the standard routing
information and the wire routing information, essentially providing the routing
number twice without providing an account number. Additionally, the SBA found
in its review of loans multiple instances of loans using the same bank account for
legitimate reasons.
Through coordinated outreach from the SBA and Lenders, it was determined that
many of these borrowers are intimidated by the complexity of the PPP forms,
processes, and the formality of the forgiveness process.
To add complication, once PPP loan data was made public, many borrowers
received a multitude of sales calls from both legitimate lenders and scammers.
When the Lenders approached certain borrowers with routine communication
alerting them to the need to file for forgiveness (email, US Mail, voicemail
reminders, etc.) they were suspicious and untrusting.
Below are a few examples of feedback the SBA has received from the Lenders in
this process as to why certain borrowers have not yet applied for forgiveness:
a) A change of email address, physical address, or phone numbers due to
changes in personnel or life conditions (e.g., moving, marriage, etc.).

89
#
1 Indicator Name
I Exam le
ll Suspicious email
addresses
b) Many borrowers incorrectly believed they did not need to apply for
forgiveness because their loans were relatively small ($ l 50,000 of less) or
heard the headlines that "blanket forgiveness" had or would occur.
c)
A group of borrowers have passed away.
d)
Some businesses have failed, and the borrowers did not understand the
necessity to request forgiveness.
h) Borrowers who are suspicious they are being scammed.
Some borrowers X' cd out a portion of their email ( e.g., Jose~mith(<.i.lg_mail.com as
Joxxx3.1[th(ii!gmail.com) in their initial application, perhaps in an attempt to avoid
unwanted email outreach or as a glitch in a copy-paste. Upon review, the full email
appeared valid with no indicia of fraud identified.

90
June 5, 2023
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
The Honorable Beth Van Duyne
Chairman
House Small Business Committee
Washington, DC 20515
Dear Representative Van Duyne:
Thank you for your April 19, 2023, letter related to potential fraud in the pandemic relief
programs administered by the Small Business Administration (SBA) including the
Paycheck Protection Program (PPP) and the COVID Economic Injury Disaster Loan
(COVID EIDL) program. Administrator Guzman has asked me to respond on her
behalf.
The SBA responded to the unprecedented challenges brought by the COVID-19
pandemic, effectively delivering economic assistance to tens of millions of small
business owners who collectively serve as the bedrock of our community's economy.
PPP loans and their subsequent forgiveness have been important to borrowers and
businesses. In addition, COVID EIDL loans provided a critical lifeline of support for
small businesses that were impacted by the pandemic.
Prior to the pandemic relief programs, fraud in SBA's programs was minimal, and since
the beginning in 2021, the Agency has received positive marks on our performance by
both the Inspector General as well as the General Accountability Office (GAO). When
setting up new, temporary relief programs such as PPP and EIDL, the previous
Congress and Administration made decisions that relaxed commonly used safeguards
such as income tax verification and checking the Treasury's Do Not Pay List. These
decisions helped expedite relief to struggling American business owners, but it opened
the door for fraudsters to take advantage of relaxed controls on loans. Administrator
Guzman has made addressing these concerns a top priority.
The pandemic programs ended more than a year ago, and SBA continues to be vigilant
in responding to reports of fraud and taking lessons learned to safeguard our programs.
Under Administrator Guzman's leadership, the SBA moved aggressively to institute up-
front controls to validate and verify applicants with government databases including the
IRS. We utilize technology to scrutinize loan applications and flag suspicious
applications prior to disbursement. We also used automated tools to review pandemic
loans that were approved in the prior Administration without tax verification to ensure
that potentially fraudulent applications were turned over to authorities.
Both the GAO and Inspector General have recognized Administrator Guzman's reforms
to implement strong management structures that control for fraud risk. As you noted in

91
The Honorable Beth Van Duyne
Page 2
your letter, the Administrator established a Fraud Risk Management Board to provide
anti-fraud oversight and intra-agency coordination among program offices using the
lessons learned from the pandemic to strengthen fraud prevention and detection
measures across the agency. Responsive materials related to the Fraud Risk
Management Board are attached to this letter. Additionally, the Administrator
established a new Special Counsel for Enterprise Risk charged with leading fraud and
risk mitigation efforts across the agency.
When it comes to investigating fraud and recovering taxpayer dollars, it is important to
note that SBA is not an enforcement agency. The SBA reports suspected fraud and
identity theft to the Inspector General and we collaborate with law enforcement
authorities on their investigations. As the Administrator mentioned in her testimony, law
enforcement has recovered $29 billion which is based upon the most recent estimates
from the Inspector General's office. Deputy Inspector General Sheldon Shoemaker
testified on March 9, 2023 before the House Oversight Subcommittee that SBA has
recovered $20 billion in returned EIDL funds, $8 billion in returned EIDL funds from
financial institutions and $1.1 billion seized in partnership with the United States Secret
Service. 1
Should you have further questions about investigations related to fraudulent pandemic
loans, I would encourage you to reach out to law enforcement and the Inspector
General rather than SBA. Loans flagged for fraud
along with potential fraud indicators
are part of active law enforcement investigations and SBA is unable to share
information that could potentially interfere with active investigations.
Sincerely,
J,illa a. .M.ille4
John A. Miller
Deputy Associate Administrator
Office of Capital Access
1 https://oversight.house.gov/wp-content/uploads/2023/03/Statement-for-the-Record-03-
09-2023_Final-Shoemaker.pdf

92
I
I
s A
U.S. Small Business
Administration
PROTECTING THE
INTEGRI
OF THE PANDEMIC
RELIEF PROGRAMS:
SBA's Actions to Prevent, Detect and Tackle Fraud
JUNE 2023

93
Contents
Abstract ....... .
. ........................................................................................................... 3
Executive Summary ....................................................................................................................................... 4
Background ................................................................................................................................................. 10
Part 1: SBA in Action. How the Biden-Harris Administration Addressed Fraud ......................................... 12
Advancements in Fraud Detection through Technology ........................................................................ 12
Enhanced Risk Management Structures ................................................................................................. 16
Collaboration with law Enforcement ..................................................................................................... 20
Part 2: SBA's Continuing Role in Fraud Prevention ..................................................................................... 23
Recommendations .................................................................................................................................. 24
Support the President's Pandemic Anti-Fraud Proposal, Providing SBA OIG with $100 Million to
Investigate ........................................................................................................................................... 24
Future Program Design ....................................................................................................................... 25
Conclusion ................................................................................................................................................... 28
2

94
Abstract
In response to the historic threat posed to small businesses by the COVID-19 pandemic, the U.S. Small
Business Administration delivered an unprecedented $1.2 trillion in emergency grants and loans over
two years. That funding contributed to a historic economic recovery of 21 million lost private sector jobs
plus the attainment of 4 million more private sector jobs than ever existed before the pandemic.
The surge of funding also invited unprecedented fraud attacks against the agency, which was left
vulnerable by missteps that weakened agency defenses in the early months of the pandemic. This
report:
1. Estimates fraud levels in each of the four major SBA relief programs, 86% of which originated in
the first nine months of the pandemic.
2.
Describes SBA's actions under the Biden-Harris Administration to rebuild and strengthen anti-
fraud controls within the Paycheck Protection Program (PPP) and the COVID-19 Economic Injury
Disaster Loan (EIDL), both of which started in 2020 and continued into 2021. Those actions
include the initiation of SBA pre-approval screening for PPP, tax transcript verification for
COVID-EIDL, and Treasury Do Not Pay list validation for both.
3.
Details how SBA learned from the mistakes of the 2020 implementation of PPP and COVID-EIDL
to design the two major relief programs that launched in 2021 -
SVOG and RRF -
which both
achieved estimated fraud rates of well below 1%.
4.
Supports President Biden's proposal for $1.6 billion in mandatory funding for law enforcement
in pursuit of government-wide pandemic fraud -
and provides additional policy
recommendations to minimize fraud in future small business emergency relief programs.
3

95
Executive Summary
Three years after the onset of the historic COVID-19 pandemic, the U.S. unemployment rate is 3.7%, 1 a
near-record low for the modern era, and new businesses are forming at record rates. By any measure,
the nation's small businesses have made a strong recovery. That recovery was made possible by an
unprecedented $5 trillion in federal emergency spending, one-fourth of which was delivered through
the U.S. Small Business Administration (SBA} in its four largest pandemic relief programs: the Paycheck
Protection Program (PPP) ($792 billion}, COVID-19 Economic Injury Disaster Loan program (COVID-EIDL)
($405.2 billion), the Restaurant Revitalization fund (RRF} ($28.6 billion), and the Shuttered Venue
Operators Grant Program {SVOG) ($14.6 billion). 2
As the SBA rapidly scaled to administer the pandemic relief programs in 2020, there were also
unprecedented fraud 3 attacks. Prior to 2020, the agency demonstrated a strong track record of
managing fraud risk in its core programs. For over a decade, independent auditors issued annual
financial statement audit opinions without any material weaknesses or findings. But in 2020, Congress
mandated quick implementation of the pandemic relief emergency programs -
which, combined with a
lack of proper controls in some cases, enabled the attacks. Many of the existing controls and design
features in SSA's longstanding disaster lending and loan guarantee programs that largely worked to
reduce fraud risks were removed in 2020. A failure to verify applicant data against existing federal
government databases, such as the U.S. Treasury Department's Do Not Pay system, and a statutory bar
against obtaining and validating applications against tax records were two of the key missteps that took
place in 2020.
What is Fraud?
Fraud involves obtaining something of value through Willful misrepresentation. Examples of fraud
Include, but are not limited to:
•
Forgery or al~tmltlon of documents,
•
false financial repQrting,
•
Receipt of payment for services not performed, and
•
Receipt of unearned benefits.
Analyses. of fraud in pandemic pr<1grams use a variety of different terms to d!!scribe possible fraud.
The term pQtentially fraudulent is the broadest, including any grants or loans that. have indica.tors of
suspicio11s Qr Inconsistent behavior and require further review. This is an rnitlal sc:reenlng, slmll<)r to. a
metal detector at anairpqrt that may indicate something s~rlous but often flags something benign. As
pQtentia//y fraudulent loans are analyzed and reviewed, often by staff with long prior careers
analyzing fl:iancial cr,me, they are determined to be eith.er a false positive or. likely fra~dulent: Every
grant or loan SBA determines as likely.fraudulent is referred to, law enforcemenf: A grant Qr loan may
only be confirmed fraudulent: through a crimlna! investigation. SSA's program~wide estimates
reflected in thi.s paper reft)l.ct the likely fraud standard:
To address these concerns, the Biden-Harris Administration, SBA Administrator Isabella Casillas Guzman,
and the dedicated employees of the SBA prioritized actions that restored longstanding anti-fraud
controls, put in place innovative new protections, and successfully reduced the potential for fraud,
4

96
waste, and abuse across SBA's current and future programs. With a strong commitment from
Administrator Guzman and senior agency leadership to combat fraud, SBA has been actively engaged in
reducing the risk of fraud throughout the agency by improving operations and bolstering its risk
management systems. This report provides an overview of the tools, controls, and strategies deployed
by the SBA since January 2021 to prevent, detect, and respond to fraud risks identified in the COVID-19
pandemic relief programs it administered. Of note, the agency under the Biden-Harris Administration:
Drove Tangible Results in Fighting Fraud in Small Business Programs. SBA developed a dynamic anti-
fraud framework that limited fraud substantially, to a level far less than what could have occurred
otherwise. Across all four pandemic relief emergency programs, SBA:
•
Screened 49.3 million applications using a combination of manual and automated controls, 4
triggering alerts on 6.7 million applications indicating the potential for fraud or ineligibility.
•
Identified over $400 billion in applications, loans, grants, and awards that had indicators of potential
fraud requiring further investigation or review. This led to a deeper review to determine which of
these loans were in fact "likely fraudulent"
•
Conducted over 3.4 million human-led reviews of applications with fraud indicators or as part of a
random audit, and projects the agency will reach 3. 75 million human-led reviews once complete.
•
Projects that a total of 744,000 disbursed loans, grants, and awards and 2.46 million blocked
applications have been or will be referred by SBA to SBA's Office of Inspector General (OIG) for likely
fraud. SBA identifies these referrals after a comprehensive automated screening, data analytics, and
human-led reviews of applications.
5

97
SBA's Fraud Estimate Represents 3% of the $1.2 Trillion in Disbursed Emergency Relief Funds,
stemming largely from the first several months of the pandemic. While SBA identified over $400
billion with indicators that required additional review, analysis, or investigation, further investigation
of the flagged loans -
including over 3.4 million human-led reviews -
cleared many of the flags and
is expected to identify $36 billion of pandemic relief emergency program funds that were likely
obtained fraudulently. This amount reflects two groups of disbursed loans, grants, and awards: those
that SBA, after a complete internal review including a human-led review, suspects as likely fraudulent
and has already referred to OIG; and a portion of those that are still under review that SBA estimates,
based on prior review results, will be referred to OIG after human-led reviews are complete. Only after
lawful adjudication (through the court system or otherwise) can actual fraud be confirmed. All these
cases have been or will be brought to the attention of the Office of Inspector General for further
investigation and law enforcement action.
6

98
Moreover, SBA:
•
Achieved dramatically lower fraud rates in the two large relief programs designed and launched
in 2021, SVOG and RRF. SBA estimates a fraud rate of one-third of one percent (0.33%} for
SVOG, and three-fourths of one percent (0.75%) for RRF.
•
Blocked a total of 21.3 million applications from accessing pandemic relief programs,
representing $511 billion of funds retained. These included duplicate applications, ineligible
applications, and attempted fraud.
•
Supported the investigations by several law enforcement agencies, including the U.S.
Department of Justice, the Federal Bureau of Investigation, and the U.S. Secret Service. As of
May 2023, there have been 1,011 indictments, 803 arrests and 526 convictions related to
COVID-EIDL and PPP.5
•
Aided the recovery of $30 billion from pandemic relief emergency programs as a result of law
enforcement actions, seizures, and voluntary repayments by borrowers and financial institution
returns. 6
Implemented an Innovative, Four-Part Anti-Fraud Control Framework to Prevent and Detect Fraud
across programs. Beginning in 2021, SBA implemented a four-part anti-fraud control framework across
all pandemic programs. It was applied retroactively to examine all 2020 PPP and COVID-EIDL loans and
used for all new applicants in 2021. For PPP, for example, this included screening all loans disbursed in
2021 prior to disbursement using automated checks for nineteen fraud indicators. For all programs, this
framework included both random and risk-based human-led reviews, leading to over 3.4 million human-
led reviews being performed across all programs.
Reinstated Checks using Treasury's Oo Not Pay System, to Make Sure That Businesses Applying for
COVIO-EIOL or PPP Loans Existed. Policies implemented in 2020 allowed over 57,000 loans, worth $3.6
billion, to. be disbursed to recipients in the Department of Treasury's Do Not Pay system. Beginning in
2021, applications were subjected to pre-funding checks using information from the Do Not Pay system.
Loans that failed this compliance check did not receive approval unless the lender was able to resolve
the concern by obtaining sufficient documentation.
Used Tax Transcripts to Validate COVIO-EIOL applicants. This change reversed course from 2020 and
ensured that SBA could use this basic anti-fraud control to verify applicants. This tool not only verifies a
business's authenticity but also ensures the business is not overstating its pre-pandemic revenue to
obtain a loan larger than the one for which it is eligible.
7

99
*Every PPP borrower applied thn:mgha delll!g(irodlender(not SBA); RRFcwardef!Stoulduwo point of sale vendC!lfattheiroptit:morapp(ydi~through SM
Established a New Fraud Risk Management Board and Designated the first Special Counsel for
Enterprise Risk. To ensure the removal of basic anti-fraud controls that occurred in 2020 was not
replicated in the future, SBA established a new Fraud Risk Management Board (FRMB) -
a designated
anti-fraud entity responsible for oversight and coordination of SBA's fraud risk prevention, detection,
and response activities. The FRMB is composed of experienced agency executives across the SBA
enterprise. Furthermore, SBA's General Counsel was designated to a new role as Special Counsel to
advise the Administrator on fraud and risk management activities across the Agency.
Received Positive Recognition by Oversight Bodies. These results have been recognized by both the
SBA Inspector General and the Pandemic Relief Accountability Committee (PRAC). SBA Inspector General
8

100
Mike Ware told Congress in a January 2022 hearing that "SBA is more prepared now than they've ever
been in terms of the control environment. [That] environment is stronger now than it's ever been and
certainly much stronger than what there was at the onset of the pandemic." In March 2022, PRAC Chair
Michael Horowitz praised the collaborative efforts that brought together SBA, PRAC, 0MB, and the SBA
IG to increase COVID-EIDL anti-fraud controls, testifying that this collaboration exhibited a model for
how to manage large-scale spending initiatives and balance the need for robust independent oversight
with timely implementation." 7 And the GAO commended SSA's 2021 RRF fraud framework, saying it
"reflects some leading practices described in GAO's fraud risk framework" and identified numerous
improvements across SBA pandemic programs.
Anti-Fraud Recommendations
Under the Biden-Harris Administration and Administrator Guzman, the SBA has strengthened its
framework for identifying and reporting fraud and is committed to ensuring that lessons learned in
fraud management have an immediate as well as long-term impact on policy and program design. To
continue this critical prevention and enforcement work, this report concludes with recommendations to
further protect our nation's small business assistance programs.
In the short term, funding investigations and law enforcement actions are a priority. President Biden
asked Congress to provide at least $100 million in mandatory funding to SSA's OIG to fulfill the mission
laid out by recent legislation extending the statute of limitations for PPP and COVID-EIDL fraud. 8 That
requested funding is part of a broader, $1.6 billion government-wide proposal to combat fraud and
identity theft.
For the long term, SBA would encourage lawmakers to design emergency business relief programs with
a particular focus on program parameters that could further minimize fraud risk:
1.
Expand government data-sharing. As outlined in President Biden's Pandemic Anti-Fraud Proposal,
increasing access to government datasets, and expanding "yes"/ "no" attribute validation services
would further SSA's ability to prevent fraud on the front end. Grant SBA digital, real-time access to
government payroll data, as well as tax identification data, so that SBA can more quickly verify
applicant information.
2.
Build now to save later. Establish the statutory framework in advance of an emergency, so that
agency personnel and procedures can move quickly and with a full range of controls in the event of a
crisis.
3.
Consider the costs of fraud prevention measures. PPP origination fees to lenders were sizeable
(approximately $46 billion in fees as compared to the $1.5 billion appropriated to SBA to cover the
administrative costs of PPP and other pandemic relief program implementation). Future
programming could consider shifting administrative funding to the implementing agency, to enable
more agency loan reviews and additional fraud prevention measures, including human-led reviews.
4.
Make the private sector part of the solution. With any approved administrative funding to lenders,
include stronger incentives or mandates for lenders to combat fraud, including by removing or
redesigning hold harmless provisions to ensure lenders have skin in the game when it comes to fraud
prevention and requiring measures to prevent, detect, and respond to fraud risks.
5. Prevent fraud rather than chase it. Center expectations on up-front fraud control measures
rather than on recovery efforts after funds are distributed, so that the post-disbursement stage
can better focus on applicant performance and ongoing monitoring.
9

101
Background
At the onset of the COVID-19 pandemic in the winter and early spring of 2020, our nation's small
businesses faced massive disruption, forced to close their doors in response to public health orders and
left with uncertainty about the future. At the beginning of April, economic forecasts predicted a 38%
GDP drop in the second quarter, and the economy was shedding 700,000 jobs a month, the worst pace
since March 2009. 9 The Treasury Secretary predicted unemployment could reach 20%. 10 Between March
15 and April 4, one in 10 American workers filed for unemployment -
eight times the previous high for
a period of that length. 11
This economic pain was concentrated among small businesses. Industries dominated by large
corporations -
technology, pharmaceuticals, shipping, and energy -
continued operating or, in some
cases, thrived. But industries led by small businesses -
accommodation, food services, retail, arts, and
other services -
were virtually shut down. And what was initially anticipated by many to be a two-
month economic hiatus followed by a return to normal was threatening to turn Into a protracted
depression. By May 2020, the U.S. had lost 21 million private sector jobs, and public reports indicated
that as many as 40% of U.S. businesses had closed their doors, worrying policymakers that many might
not ever reopen. 12
A burst of federal relief and the on-and-off relaxation of public health measures brought a partial
recovery. But with a resurgence of the virus and federal relief slowing to a trickle, the recovery stalled,
with no meaningful job growth for three months, through January 2021.
President Biden was sworn in, and he appointed Administrator Guzman to lead the SBA. The Biden-
Harris Administration reinvigorated the SBA's pandemic relief emergency programs, bringing a new anti-
fraud focus and a strong emphasis on the smallest businesses hardest hit by the pandemic.
The two-year economic boom that followed was historic. New business formation accelerated, with 10.5
million new business applications in 2021 and 2022, a record high. 13 By April 2022, the U.S. surpassed its
pre-pandemic private sector jobs level, and the growth has continued. As of May 2023, the U.S. private
sector employed four million more workers than it ever did before the pandemic. Restaurant, travel,
and tourism businesses have come back, and service workers have seen their best real-wage growth in
decades. The American pandemic recovery has outpaced that of other advanced economies, and
experts attribute that success to the largest per-capita fiscal intervention in the world, one-fourth of
which was delivered through small business and nonprofit emergency programs at the U.S. Small
Business Administration.
The $1.2 trillion in SBA aid came in two waves: the first $742 billion, delivered mostly in mid-2020, was
broadly available to all small employers, regardless of sector or pandemic impact. In its delivery, speed
was the priority. The second wave, about $455 billion administered by the Biden-Harris Administration
from 2021 through mid-2022, was more targeted, favoring smaller entities, those with demonstrated
losses, operating in industries hit hard by the pandemic, or too small or disconnected from the banking
sector to have accessed relief in 2020. This second wave was effective for two reasons. First, the
Administration made critical choices in implementation, to push access to relief to the most struggling
and underserved small businesses. And second, it improved protections for the relief programs -
which
had grown more numerous and complex -
in detecting ineligible or fraudulent applicants in critical
ways that the 2020 implementation did not. This latter effort is the focus of this report: how SBA
10

102
strengthened pandemic relief emergency program fraud controls, the ongoing work at SBA to identify
and address pandemic-relief-related fraud, and lessons learned from both waves of pandemic relief.
Pandemic Relief Emergency Programs
In March 2020, Congress passed the CARES Act, creating the SSA's Paycheck Protection Program (PPP}
and allocating additional funding to the COVID-19 Economic Injury Disaster Loan Program (COVID-
EIDL"). Congress tasked the SBA to help avoid an economic catastrophe: Provide businesses and
nonprofit organizations throughout the nation economic support by creating two new loan programs.
After successive rounds of funding, PPP delivered $792 billion in forgivable loans, up to $10 million per
entity. COVID-EIDL distributed $378 billion in low-interest loans up to $2 million and $27.2 billion in loan
advances to eligible businesses and nonprofit organizations.
As 2020 progressed, it became increasingly clear that these programs were attacked by fraudulent
actors. Public media reports as well as official government audits began to describe what appeared to be
a tremendous problem. They placed the blame on a lack of internal controls and oversight. Both the
Government Accountability Office (GAO) and OIG warned SBA of potential fraud in PPP and the need to
manage fraud risks. 14 The concerns appeared to relate to an insufficient control environment given the
scale of the pandemic relief programs, the speed at which funds were distributed, and the removal, by
statute and administrative actions, of key tools to verify applicant information and ensure the likelihood
of repayment. 15
Starting in December 2020, Congress passed additional measures to provide for pandemic-related
economic relief. The Economic Aid to Hard-Hit Small Businesses, Nonprofits and Venues Act of 2020
established the Shuttered Venue Operators Grant ("SVOG"} program, designed to assist the live
performing arts and entertainment industry. The American Rescue Plan Act of 2021 established both the
Restaurant Revitalization Fund ("RRF"), an award program designed to assist restaurants, bars, and
other similar places, and provided additional funding for the PPP and COVID-EIDL programs. Ultimately,
SBA administered four major pandemic relief programs: PPP, COVID-EIDL, RRF, and SVOG. Through
these programs, SBA administered $1.2 trillion to support small businesses and nonprofit organizations.
Since the beginning of the Biden-Harris Administration, SBA has been actively engaged and committed
to addressing these concerns, by improving operations and bolstering risk management systems. Part 1
of this report describes what the agency has accomplished and learned through improving upon and
implementing several pandemic relief programs since January 2021.
11

103
Part 1: SBA in Action. How the Biden-Harris Administration Addressed Fraud
The implementation of PPP and COVID-EIDL was expedited to quickly provide timely relief to mitigate
the economic impact of the COV!D-19 pandemic. During 2020, the desire for the rapid deployment of
relief funds resulted in fewer fraud and eligibility controls up-front and at disbursement than what
normally occurred in SBA program operations. This approach increased the risk for funds to be
fraudulently obtained at origination, relying on the sufficiency of post-origination and post-
disbursement controls to identify and report instances of fraud and abuse.
Over the past two years, under Administrator Guzman's leadership, the SBA has been proactive -
both
enterprise-wide and program-specific -
to address the concerns. Here are the highlights:
Advancements In Fraud Detection through Technology
SBA's four-step approach to prevent and detect fraud begins with automated screening technology to
trigger an alert when an application met certain criteria potentially indicative of fraud, ineligibility, or
both. This technology raises an alert prompting the placement of a "flag" on an applicant or application
that would prevent funding of the loan, award, or grant. Higher-risk applications were prioritized and
inspected by human reviewers, by the lending organization (in the case of PPP), and at SBA, to confirm
or resolve initial flags. SBA deployed these up-front controls during the third round of PPP funding
(January 2021) and then deployed a similar approach in each of the pandemic relief programs. In
addition to using this approach as an up-front control, SBA also retroactively reviewed all loans
disbursed in 2020 using this process. Across all applications, loans, grants, and awards, SBA found over
$400 billion in potential fraud -
84% of which originated in 2020 -
and placed flags on all files.
Subsequent reviews, including over 3.4 million human-led reviews, have cleared the majority of flags
while identifying an expected $36 billion in likely fraud -
of which 86% originated in 2020. This graphic
gives an overview of the process:
Accomplishments To Date
The use of up-front controls produced an overall tangible impact in administering the pandemic relief
programs. SBA designed and created over 100 unique fraud and eligibility detection scenarios (referred
to as "Rules") which triggered alerts (also referred to as "Hold Codes"). These rules were used to screen
49.3 million applications and alerted 6.7 million applications across SBA's pandemic relief emergency
programs.
12

104
These results were also reflected in the automated fraud detection used in each of SBA's pandemic
relief programs:
PPP (comprised of approximately 11.S million disbursed loans totaling $792 billion)
Beginning in 2021, SBA implemented a new innovative anti-fraud control system: a combination of
alerts, enhanced front-end controls, and a machine-learning model that uses data from internal SBA
sources and private-sector databases to automatically determine which loans are the riskiest. All PPP
loans made under the Biden-Harris Administration had this level of screening before funds were
disbursed. The loans made under the previous Administration did not. Loans already disbursed in 2020
were subsequently assessed during the Biden-Harris Administration to identify those potentially
fraudulent loans. SBA performed an additional check to identify networks of potentially fraudulent PPP
loans, that when looked at individually, would not necessarily show indicia of fraud. In some instances,
SBA identified additional loans that were part of networks already known or partially known to law
enforcement but not previously identified.
SBA's four-part anti-fraud framework used in PPP is described in more detail in Part 2 of this paper.
This work has produced results. After flagging 3.7 million loans with alerts and scrutinizing those loans
with the machine-learning model and subsequent human-led reviews, 188,000 loans totaling $6.7 billion
have been identified as likely fraudulent by SBA and referred to OIG for further law enforcement action.
SBA projects that when its PPP review is complete, a total of 223,000 loans totaling $7.4 billion will have
been referred to OIG.
Other key performance indicators include:
•
In 2021, SBA prevented 174,000 potentially ineligible or fraudulent PPP applications from being
funded (after initially approved by lenders), representing $3.7 billion. This does not include
applications blocked by lenders, who were the first reviewers of all PPP loans.
•
Identified 2,800 potential fraud networks, totaling almost $2 billion of taxpayer money. Using a
series of network analyses, the agency identified and analyzed relationships across loans,
borrowers, and lenders to identify potentially suspicious loan networks, relationships, and
activities. This process leverages learnings, data, patterns, and trends observed during reviews.
COVID·EIOL (comprised of approximately 10.5 million disbursed loans and loan advances totaling $405
billion)
Throughout 2021, SBA continually enhanced the COVID-EIDL control framework to prevent and detect
known weaknesses in the program. Control improvements included tools such as multi-factor
authentication; the use of tax transcripts; the use of the U.S. Treasury Department's Do Not Pay system
(DNP); increased human contact for applicant verification; screens for known fraud indicators (such as
duplicate IP addresses); the use of automated tools for validation; and human-led reviews of
applications with fraud alerts.
This work has produced results: SBA screened 36.7 million entities and blocked 21.1 million from
receiving funding due to ineligibility, duplicate applications, or potential fraud. Out of the 3 million flags
generated from the automated screening tools and manual reviews deployed by the agency, SBA
13

105
referred, due to likely fraud, 2.46 million blocked COVID-EIDL applications and 520,000 funded loans and
loan advances to OIG for further investigation and law enforcement action. The 520,000 referred COVID-
EIDL loans and advances account for $28 billion in disbursements.
SBA checked this estimate using a second, independent method, analyzing COVID-EIDL repayment data,
and found both approaches Indicate a similar scope of likely fraud in the program. One way that COVID-
EIDL participants demonstrate their authenticity is by beginning to repay their loans once they come
due. This is an observation that the SBA IG has made going back to 2022. 16 Now, after a long, 30-month
deferral period, a large majority of the loans by volume have entered the required repayment period.
SBA found that 74% of the COVID-EIDL portfolio has already made a payment, and SBA projects, based
on repayment data to date, that once fill borrowers have entered repayment, 85.6% will make at least
one payment. Another 8.1%, SBA conservatively estimates based on past disasters, can be expected to
not make payments for non-fraud economic reasons, such as business closure. That leaves 6.3% of the
loan program, or about $24 billion in lending, which could be associated with a likelihood of fraud based
on this estimation method.
The fact that the COVID·EIDL program produced more screened applicants and made more referrals to
OIG than PPP comes as no surprise to the agency. First, although COVID-EIDL program disbursements
were approximately half of PPP dollars, the agency received three times as many applications within
COVID-EIDL than it did within PPP. This was because COVID-EIDL consisted of four distinct products: the
COVID-EIDL loan, the original Advance authorized by the CARES Act, the Targeted Advance, and the
Supplemental Advance; the three Advance products offered relatively small award amounts to a broad
universe of potential applicants, generating a large volume of applications, Another reason is that SBA,
as the lender, had to screen and approve applications for loans and loan advances, whereas PPP
required borrowers to apply with lenders, who screened applicants and only sent approved applications
to SBA. As a delegated loan program, lenders could deny PPP loan applications for potential fraud or
ineligibility. Conversely, SBA had to refer cases of likely fraud, regardless of whether an application is
funded, to OIG for further investigation and law enforcement. Lenders that suspected fraud in PPP
applications were directed to refer those cases to SBA's OIG. Given the limited number of fraud controls
in the COVID-EIDL program during the previous Administration, the Biden-Harris Administration is proud
of the work that commenced in 2021 to prevent and reduce fraud risks in the program -
as well as
identify wrongdoers -
and refer them to OIG.
RRF (comprised of 101,000 awards totaling $28,6 billion)
Building on the lessons learned in PPP and COVID-EIDL, the RRF program had a control framework in
place upon its launch in 2021 and operationalized fraud risk management -
resulting in just 0.75% of
loans being referred to OIG as likely fraud. GAO praised the extensive implementation plan that was
created through an interagency process to obtain feedback from internal and external stakeholders,
such as staff from other SBA offices, congressional committees, the Office of Management and Budget,
as well as recommendations from industry associations. GAO reported, in July 2022, "SBA's emphasis on
automated, pre-award controls to prevent fraud reflects some leading practices described in GAO's
fraud risk framework."17 RRF utili2-ed robust third-party data validation tools from industry leaders
including IRS tax verification and DNP. SBA validated applicants' information with third-party data
sources and limited applicants' ability to modify their information after submission.
14

106
This work has produced results: These pre-award controls helped to detect and prevent 31,000
potentially ineligible or fraudulent award applications from being funded for $3 billion. SBA screened
294,000 entities and 118,000 award applications resulting in 9,000 flagged applications with fraud alerts
Of those, SBA determined, after human-led reviews, that 720 awards representing $215 million in
funding merited referral as likely fraudulent to OIG. This likely fraud referral rate, representing just
0. 75% of the total loan value, shows the effectiveness of up-front controls when implemented at the
onset of a program.
SVOG (comprised of 13,000 grants totaling $14.6 billion)
Like RRF, SVOG implemented similar up-front controls to include IRS tax verification, DNP, as well as
cross checks with other government and private-sector databases" before executing disbursements.
SBA screened over 17,600 entities, resulting in less than 600 flagged applications with fraud alerts. Of
the 13,000 grantees, 17 were referred to OIG, representing $48.5 million. Out of the over 4,600
applications that were blocked, 248 were referred to OIG -
meaning just 0.33% of all disbursed funds
were referred to OIG as likely fraudulent. These results withstood scrutiny: No significant weaknesses
were found in the testing of internal controls by external auditors. Pre-award control activities reflected
some GAO Fraud Risk Framework best practices related to developing an antifraud strategy.
The agency is proud that RRF and SVOG, programs fully implemented under the Biden-Harris
Administration, had instances of likely fraud totaling less than 1% of disbursed awards and grants in
those programs. This small amount proves the success of anti-fraud controls in SBA programs. The
following chart depicts the anti-fraud controls deployed by the agency in each of the small business
emergency relief programs:
15

107
*Ewl}'PPPborrawerapplkdthfOll(Jh a delegated lender (net SBA); RRF awardef!scould useapolntofsclevendarot ~lroptfonorapplydlroctlythrough-SBA
Enhanced Risk Management Structures
A Dedicated Anti-Fraud Entity
At the beginning of the Biden-Harris Administration, SBA managed fraud risk primarily at the program
office level. SBA offices responsible for managing particular programs, such as disaster lending or loan
guarantees, were primarily responsible for maintaining an appropriate level of controls. Throughout the
history of the SBA, this strategy for preventing fraud risks worked. SBA's longstanding disaster lending
and loan guarantee programs, which had the largest financial exposure, had controls (such as borrower
tax return information) and design features (such as lenders that determine eligibility) that largely
worked to reduce fraud risks to lower levels. Moreover, prior to FY2020, SBA had a solid record of
unmodified financial statement audits, with no material weakness in internal controls and no findings
16

108
related to fraud risk management. However, the COVID-19 pandemic relief programs introduced a step-
change in the agency's fraud risk exposure.
Under Administrator Guzman's leadership, SBA quickly recognized that its existing infrastructure was
not sufficient to manage the risks presented by the COVID-19 pandemic relief programs and responded
by organizing new oversight mechanisms. To better manage the growing concerns related to potential
fraud in SSA's portfolio and to better align with best practices identified in GAO's Fraud Risk
Management Framework, 19 SBA established the Fraud Risk Management Board (FRMB) at the beginning
of 2022. Under this structure, the FRMB provides high-level, agency-wide oversight of fraud risk
management, deploying senior career officials at the level of Deputy Associate Administrator (DAAl or
equivalent seniority. The FRMB serves as SSA's designated Anti-Fraud Entity and as such, is responsible
for agency-wide fraud risk management, guidance, the issuance of SBA agency-wide fraud risk
governance policies, and supporting agency-wide oversight of fraud prevention, detection, and response
strategies. Offices within SBA rely on this guidance and materials to supplement the program controls
they design.
Notable enhancements to risk management
In addition to creating a dedicated anti-fraud entity, the agency has:
•
Established an inaugural Special Counsel for Enterprise Risk. The Administrator designated the
agency's then-General Counsel to advise her on risk management activities enterprise-wide,
focusing on fraud in pandemic relief programs as well as potential fraud exposure as a top
priority.
•
Conducted formal Fraud Risk Assessments for all pandemic relief programs. These assessments
and related fraud risk mitigation plans respond to and reduce fraud risks that lay beyond the
agency's accepted risk tolerance levels.
•
Adopted four major principles concerning fraud risk management:
•
Tone at the Top. To ensure that senior leadership is appropriately focused and accountable
for fraud risk mitigation.
•
Ongoing Monitoring. To ensure that fraud risk management is executed consistently and
effectively across the agency.
•
Training. To ensure that SBA personnel are aware of fraud risk vulnerabilities and responses.
•
Innovative Technology Solutions. To ensure that current technology is used to identify,
assess, and mitigate potential fraud risks,
•
Applied Data Analytics. SBA partnered with a global management technology and risk consulting
firm to leverage several data analytics methods to review the PPP loan portfolio with the intent
of managing fraud risks by reducing false positives, prioritizing identified fraud typologies and
behaviors, as well as uncovering areas of fraud risk not previously known. SBA began the use of
data analytics to enable the monitoring of transactional outliers, trends, and emerging
vulnerabilities in both PPP and COVID·EIDL Developed and implemented portfolio-level data
analytics across the COVID-EIDL program loans and advances to detect potentially ineligible and
fraudulent applications.
•
Standardized Data Analytics Reporting Across Programs. SBA launched a standardized data
analytics program to help identify potentially ineligible and fraudulent loans, grants, or
recipients across multiple SBA programs.
17

109
•
Enhanced Safeguards for COVID-EIDL in Consultation with PRAC and GAO. Prior to the increase
of the COVID-EIDL cap to $2 million in September 2021, SBA worked closely in consultation with
the PRAC and GAO to carefully review new fraud controls that should be put in place. This
consultation and review led to SBA taking the following additional steps:
•
Strengthened "economic needs" and "cashflow sufficiency" tests.
•
Required additional documentation of borrower performance.
•
Increased protections for the government against borrower default, including by requiring
personal guarantees and increased collateral requirements for larger loans.
•
Flagged suspicious foreign IP addresses.
Improvements to Operations
Implementation of GAO and O/G Recommendations
Under the Biden-Harris Administration, SBA's program offices responded fully to fraud risks by
expeditiously implementing controls and measures recommended by GAO and SBA's OIG. Both have
positively recognized SSA's work under Administrator Guzman's leadership to enhance fraud controls in
pandemic relief programs. The agency continues to work aggressively to implement the
recommendations in the audits related to all the pandemic relief programs.
In response to specific GAO recommendations, the agency has:
•
Fully implemented most of the high-priority fraud risk recommendations. In several reports
from GAO concerning fraud risks in PPP and COVID-EIDL, the agency implemented six out of
eight recommendations and has substantially completed the remainder to help ensure program
integrity, achieve program effectiveness, and address potential fraud. 20 SBA executed the fraud-
related recommendations within 18 months of issuance. Agencies are commonly given four
years to implement GAO recommendations.
•
Maintained an appropriate improper payments rate. SBA estimated the rate of improper
payments consistent with the requirements of the Payment Integrity Information Act of 2019
(PIIA) with a rate well below the statutory threshold of 10%. A payment is deemed "improper" if
it was made in an incorrect amount, either more or less than the approved amount, or to an
incorrect or ineligible recipient. 21
•
Created a multi-year Fraud Risk Management Strategic Plan. The agency's Fraud Risk
Management Board implemented a strategic plan designed to implement and sustain a mature
fraud risk management program that encompasses GAO's fraud risk management framework,
federal government best practices, and professional standards in fraud and enterprise risk
management as well as internal controls. With a mission to optimize financial resources by
minimizing fraud in agency programs and operations, the strategic plan leverages seven core
elements: Governance and Tone at the Top, Fraud Risk Assessments, Effective Internal Controls,
Fraud Identification, Investigation and Corrective Actions, Fraud Risk Monitoring, Enterprise-
Wide Fraud Risk Knowledge and Capabilities, and Fraud Reporting and Management.
Similarly, SBA has already made great strides in improving its operations by implementing several OIG
recommendations related to COVID-EIDL fraud concerns:
18

110
•
Canceled all ineligible loans that were not disbursed, recovered funds from loans disbursed to
ineligible applicants, and flagged those loans for the improper payments estimation process.
•
Formalized a process to restore identity theft victims to their condition prior to the fraud. The
process includes steps to stop the loan billing statements, prevent delinquency collections, and
release victims from loan liability and UCC liens.
•
Performed a thorough review of the COVID-EIDL portfolio and determined which transactions
were made to ineligible recipients and were not in conformance with the CARES Act or related
legislation.
•
Implemented pre-payment and pre-award procedures -
including the use of batch match and
continuous monitoring functions available in the Treasury's DNP system -to identify
potentially ineligible applicants before disbursing COVID-EIDL program funds.
SBA continues to work with OIG to address the remaining open recommendations. As reported by the
OIG, Congress mandated SBA to swiftly disburse funds to millions of struggling small businesses. While
basic anti-fraud controls were removed in 2020, in favor of speed, reflecting on the current state of
SBA's fraud risk management, OIG stated that "SBA has since implemented fraud and eligibility controls
and taken corrective actions to combat PPP fraud." 22
Additional Fraud Detection, Prevention, and Response Measures
SBA has put in place additional fraud-detection measures, establishing a multi-layered strategy for
preventing, detecting, and responding to fraud in the pandemic relief programs:
Enhanced Anti-Fraud Detection Teams
Dramatically Scaled Its Anti-Fraud Teams From 2 to 280 Full-Time Employees. In response to the
unprecedented influx of potential and confirmed identity theft cases in 2020, associated with
loan applications for pandemic relief programs, SBA scaled its anti-fraud review teams from 2
full-time employees to 280.
Developed a Human-Led Review Process. SBA conducted more than 3.4 million human-led
reviews of applications and loans that had been determined through a combination of
automated screening, data analytics, and in the case of PPP, machine learning, to present a
heightened risk of fraud or ineligibility. If after investigation fraud or ineligibility seem likely,
these applications and loans are referred to the SBA Office of Inspector General for further
action. Loans that have been approved and funded are also subject to human-led review if
indicia of fraud or ineligibility are later detected.
Improved Lender and Loan Agent Oversight. In December 2022, the House Select Subcommittee
on the Coronavirus Crisis reported on fraud in PPP. The report focused on the lenders, their
third-party vendors, and other participants in SBA's lending program who appeared to have
actively engaged in fraud, facilitating a disproportionately high rate of fraudulent and otherwise
ineligible loans. The report found that certain companies and individuals observed significant
fraud, but evaded responsibility. SBA took swift action in response to the report, suspending
certain actors from working with SBA in any capacity in the future and launching a full
investigation of the lenders and other related entities named in the report. Moreover, in FY
2021, SBA improved its operations and realigned its governance structure to strengthen lender
oversight and added resources for more effective oversight.
19

111
Improved Public Engagement
•
Enhanced SSA's Fraud Prevention and Reporting Protocols. SBA's "Preventing Fraud and Identity
Theft" webpage emphasized the agency's focus on fraud and provided resources for the public
on the agency's actions against fraud. Importantly, this page was designed to provide
information to small business owners and lenders on how they can work with the SBA to
prevent and report potential fraud. Those resources can be found at sba.gov/fraud.
Improved Victim Resources
•
Enhanced SSA's Identity Theft Protocols. In response to the unprecedented demand for
addressing victims of identity theft inherited from 2020, SBA has put in place a system that
allows victims of identity theft to seek to have their names cleared and ensure they are not held
financially liable. SBA created dedicated teams to quickly support PPP and COVID-EIDL recipients
with the filing and processing of identity-theft complaints. These teams work diligently to ensure
victims' fraudulently obtained loan debts are released. Where identity theft is confirmed, SBA
acts to protect victims, including coordinating with third parties to prevent billing or collections.
•
Improved Identity Theft Victim Services. Recognizing the increased risk for identity theft in the
pandemic relief programs", SBA improved services for victims of identity theft to complete the
necessary steps to fully resolve the fraudulent use of their information. Victims can go to
sba.gQy/lD!heft for assistance.
Collaboration with Law Enforcement
SBA continues to work with the OIG and the U.S. Department of Justice (DOJ) on actions related to
potentially fraudulent recipients of federal funds. In PPP, SBA receives numerous, but not all, reports of
fraud from lenders. When SBA receives such reports, SBA flags the individual loans for further analysis
and/or law enforcement investigation. SBA similarly flags individual loans the Agency is made aware of
that were identified through fraud referrals received from OIG and DOJ.
In connection with the enactment of the CARES Act, Congress also established the Pandemic Response
Accountability Committee (PRAC). This group of 21 Inspectors General uses data to detect and combat
fraud, waste, and abuse as well as mismanagement of any pandemic-related programs and funding.
Working collaboratively with the PRAC, SBA has been able to reinforce its own fraud risk management
efforts. In one example of this collaboration, the PRAC assisted in identifying fraud patterns and
networks that extend beyond SBA's ability to prevent and detect. 24
SBA successfully leveraged hundreds of investigators and lawyers from multiple agencies to assist in the
investigation and pursuit of COVID-EIDL loan fraud cases. When SBA identifies cases of potential fraud or
identity theft, the COVID-EIDL fraud review team refers the case to the OIG for possible criminal
investigation. The fraud review team also provides support to the OIG, Department of Justice, U.S.
Secret Service, and other law enforcement agencies investigating and prosecuting cases of fraud. As a
result of SBA' s close collaboration with the OIG and our nationwide reviews of fraud patterns and cases,
SBA and OIG have been able to identify and track systemic patterns of fraud in the COVID-related loan
programs.
20

112
To date, SBA has leveraged its close working relationship with the United States Secret Service (USSS)
Special Agent in Charge (SAC) responsible for COVID-related issues, to enable USSS to seize $1.1 billion
in fraudulently obtained funds. Many of these funds were collected through voluntary turnovers as
opposed to judicial action. In addition, as of March 2023, $460 million had been recovered through
Department of Justice-led indictments and convictions, $8 billion has been returned by financial
institutions and $20 billion has been returned by borrower voluntary repayment. In May 2023, total
recoveries from the pandemic relief emergency programs had reached $30 billion.
Estimating Fraud
Many of SBA's external stakeholders have asked how much fraud there is in the $1.2 trillion of SBA
pandemic aid. SBA recognizes the importance of understanding the degree to which participants in
critical emergency funding misled the federal government and stole taxpayer dollars. To date, the
federal government has not developed an accepted methodology for estimating fraud in federal
programs. 25 In a recent report, GAO underscored the difficulty of producing a fraud estimate in federal
programs given varying definitions, imperfect detection and reporting, and insufficient data. 26
Notwithstanding the difficulties, SBA conducted a comprehensive analysis and calculated an estimated
$36 billion in fraud to date, reflecting the value of 744,000 million in loans, grants, and awards
distributed to pandemic relief program recipients. Of this amount, SBA estimates $31 billion -
or 86%
-
is associated with applications that originated in 2020, and the remaining 14% with applications from
2021 and 2022. As reflected in the graphic below, the agency estimates that the likely fraud in small
business emergency relief programs is the value of loans, grants, and awards referred to, or expected to
be referred to, OIG for law enforcement action. The process by which the agency identified likely fraud
began with the automated screening process, which flagged over $400 billion in applications, loans,
grants, and awards with data anomalies. Then, SBA deployed a combination of advanced data analytics,
machine learning (in the case of PPP), and over 3.4 million manual, human-led investigations to arrive at
a population of loans, grants, and awards that could be referred to OIG with a strong belief of likely
fraud, supported by detailed and documented investigation.
21

113
22

114
Part 2: SBA's Continuing Role in Fraud Prevention
SBA's critical role in the nation's economy, supporting a strong ecosystem for small business and
entrepreneurship, as well as its role in helping businesses and communities recover from disasters,
demands that SBA consistently remain a good steward of taxpayer dollars.
SBA will work diligently to continuously combat fraud and reduce fraud risks in SBA programs. Efforts
include:
•
Continuously monitoring and improving SBA's fraud controls to respond to the ever-changing
fraud risk environment. One of the lessons learned from 2020 is that the removal of certain
controls (even at the direction of specific legislation) to prioritize the speed of program
implementation and execution must be managed and monitored continuously for fraud risks.
The implementation of up-front, automated fraud controls is key to that strategy.
•
Improving data analytics capabilities. The use of data analytics across an entire portfolio helps
identify potential signs of fraud for teams to further research. Sharing data across programs can
better facilitate fraud detection. SBA is also investing in technology that will enable additional,
automated fraud screenings for all loan programs using third-party data sources.
•
Ongoing oversight of program fraud risks. With the creation of a dedicated entity to lead fraud
risk management activities, SBA has established the structure necessary to oversee fraud risk
management activities enterprise-wide. In carrying out its role, the FRMB can serve as a
repository of knowledge on fraud risks and controls, cat:1 manage the fraud risk assessment
process, can assist with trainings and other fraud awareness activities, and can coordinate anti·
fraud initiatives across all of SBA' s programs. Much of this work has already commenced.
•
Engaging in data sharing with other federal agencies. lnteragency collaboration is important for
sharing best practices related to fraud prevention and data analytics. Examples include:
o
As previously advised by the PRAC, SBA has engaged with the Social Security
Administration in order to verify Social Security Numbers (SSNs) directly with the
agency, as an improvement or complement to the use of third-party sources for SSN
verification. SSA has not granted SBA access to date, but the agencies are in dialogue
about the possibility; ultimately, legislation may be necessary.
o
The SBA worked closely with the IRS to verify tax data for pandemic programs beginning
in 2021. However, modernized approaches to data sharing, such as the use of APls,
would significantly increase the speed of data exchange and decrease manual errors in
the process.
o
Another data source that the agency would like to evaluate is the National Directory of
New Hires (NDNH) maintained by the Department of Health and Human Services, which
reflects unemployment taxes paid by employers to State Workforce Agencies. New
legislation is required to grant SBA access.
•
Researching additional methods and determining best practices and funding sources for
recovery of fraudulently obtained federal funds, as well as seeking additional administrative
funding resources to assist with ongoing servicing and post-award monitoring.
These efforts work to ensure that SBA's current programs do not face the fraud risks that beset
PPP and COVID·EIDL as they were launched in 2020.
23

115
Recommendotions
The federal economic response to the COVID-19 pandemic was extraordinary and unprecedented in size
and speed. While public health officials prepared for pandemics, few policymakers contemplated or
prepared for a policy response to a total shutdown of the economy and the ongoing struggle for families
and businesses brought about by the pandemic and the necessary public health measures that came
with it. It would be a mistake not to take the opportunity to learn from the experience and prepare for a
similar national economic crisis. In the spirit of that effort, SBA is providing recommendations to
policymakers below -
both on how to continue fighting fraud in economic relief programs and on how
to design similar aid in the future that is less susceptible to fraud.
Support the President's Pandemic Anti-Fraud Proposal, Providing SBA O/G with $100 Million to
Investigate
Anti-fraud enforcement has generated successful results and financial returns for the public. SBA's OIG
investigations of its pandemic loan programs had resulted in 1,011 indictments, 803 arrests, and S29
convictions as of May 2023, and their collaboration with federal law enforcement agencies combined
with returns from financial institutions has resulted in $30 billion in COVID-EIDL and PPP funds being
seized or returned to SBA.
SBA has identified more cases of potential or likely fraud than law enforcement can handle. About
744,000 cases of likely fraud from approved awards, grants, and loans have been referred, or likely will
be referred, to OIG across pandemic programs. All of these are reported to the SSA's Office of Inspector
General, who then must decide how to allocate their own scarce resources. The OIG has repeatedly and
publicly indicated that the office is overstretched. Deputy Inspector General Shoemaker told Congress
in March 2023 that the office had over 80,000 actionable leads, but only 550 open cases across both
PPP and COVID-EIDL. 27
In early 2022, Congress and President Biden demonstrated their commitment to pandemic fraud
accountability by passing into law the "PPP and Bank Fraud Enforcement Harmonization Act of 2022,"
which extends from 5 to 10 years the statute of limitations for PPP fraud. Now that law enforcement has
the time and leads available to hold fraudsters accountable, Congress has begun to fund the mission. In
the Fiscal Year 2023 Omnibus passed at the end of December 2022, Congress provided $32 million to
OIG, a 41% increase above its prior-year level. That is notable progress.
However, more resources for law enforcement are still needed. SSA's COVID-19 programs were three
times the size of the 2009 Troubled Asset Relief Program (TARP) and significantly more complex, but the
SBA OIG funding has been significantly less than the OIG funding Congress provided for TARP. 28
Continued increases in annual appropriations for OIG will enable the office to enhance its data analytics
unit and hire more permanent investigative personnel.
OIG is also operating on supplemental funding associated with pandemic programs, that allowed a
temporary staffing increase of 51 positions. However, this funding is winding down. OIG now expects to
use up the remainder of its $50 million in pandemic supplemental funding near the conclusion of FY
2024, well before the end of the statute of limitations for PPP fraud. 29
On March 1, 2023, President Biden released his $1.6 billion Pandemic Anti-Fraud proposal, which
proposes at least $100 million in new mandatory funding for SBA OIG to expand its capacity and extend
24

116
the pandemic-focused personnel surge. This would complement the additional $15. 7 million funding
increase called for in the President's FY 2024 budget request. OIG's investigative work to date has
returned billions of dollars on a limited budget; it's reasonable that additional resources would bring
additional returns to recoup what the federal government has lost to fraudsters.
Along with increased funding for SBA OIG, the President's proposal also highlights critical policy
enhancements that would allow SBA to prevent fraud before it happens. These enhancements include
expanding access to government datasets, such as Treasury's Do Not Pay and IRS Tax Transcripts, and
increasing privacy-preserving "yes"/ "no" attribute validation services.
Future Program Design
Lessons learned from the COVID-19 SBA programs provide an opportunity to consider design choices for
future small business emergency programs. The purpose of the recommendations that follow is not to
argue in favor of one framework or another, or to comment on distributional tradeoffs in the program.
Rather, it is to identify program features for consideration, if large-scale small business grants, loans, or
hybrid programs are to be considered again in the event of another pandemic or other national
economic emergency. The recommendations are:
1. Expand government data-sharing. 30 IRS holds the gold-standard data for business verification.
However, today, IRS tax data is only available to SBA for limited program use and by request (a
process that often takes a week or longer), relying on an old form of technology and requiring
human-conducted reviews by both the SBA and IRS. In the CARES Act, Congress initially barred
SBA from using IRS tax data in administering COVID-EIDL, a long-standing agency practice for
mitigating fraud and determining eligibility, to facilitate quick delivery of pandemic relief funds
to needy businesses. SBA was subsequently granted the authority and used IRS data starting in
2021 to verify identity for its pandemic programs, notably doing so for COVID-EIDL, RRF, and
SVOG. 31 Once established, the use of IRS tax data was highly successful in denying loans to
ineligible and fraudulent applicants.
Using IRS payroll and tax identification data in future programs comes with an expectation of
faster processing so that relief can be provided timely. A faster, more modern payroll
verification would be necessary to achieve the goals of speedy distribution and reduced fraud.
Fortunately, a model already exists for other federal agencies having direct access to IRS tax
data. Notably, Congress granted the authority to the Department of Education for its Federal
Student Loan program. Extending the same authority to SBA could enable a real-time
application programming interface (API), such that SBA could instantly verify an applicant's
stated payroll level from the prior year. This feature would allow SBA to verify all the applicant-
provided payroll information necessary to compute the eligible loan amount. Facilitating the
sharing of government-collected information between federal agencies would reduce the fraud
risks inherent in government programs. 32 Several pandemic programs used objective business
financial data (for example, payroll expenses and business income) to calculate an appropriate
loan or grant amount. Because SBA does not have access to this information, applicants were
required to provide it as part of their application or retain it to support self-certification of
eligibility. Instead of requiring a substantial amount of financial data and burdening agencies
with verifying complex transactions such as payroll expenses, Congress could base eligibility
25

117
and loan amount on objective, pre-existing tax data, such as a desired percentage of Social
Security- or Medicare-covered wages reported to IRS in the previous tax year or quarter.
2. Build now to save later. Permanent emergency relief programs are standard throughout the
government. FEMA, the SBA, and numerous other agencies are permanently authorized to assist
in the event of hurricanes, floods, earthquakes, and other natural disasters. Congress often must
provide emergency appropriations to fund those relief efforts, but permanent authorization
enables program rules, agency personnel, and procedures to be in place and move quickly to
deliver relief once appropriations are available. If lawmakers believe that an emergency
forgivable loan program would be prudent in the event of a future nationwide economic
emergency, Congress should consider creating permanent authorization for this program as
well. With a relatively minimal administrative investment, such a statute would enable the SBA
to establish rules, regulations, and systems inclusive of robust fraud control measures -
which
would resemble the 2021 third round of PPP, as opposed to the version stood up in one week by
the CARES Act in April 2020. Congress could take this action with minimal budgetary cost and
postpone the decision on how substantially to finance the program until a future economic
emergency arises. A permanent framework could also be established for any of SBA's pandemic
relief programs should Congress so desire to execute them in the event of a national emergency.
3. Consider the costs of fraud prevention. Congress delegated most of the administration of PPP
to program lenders, as demonstrated by the authority vested in lenders to directly approve
loans, and to the extent they were resourced, relative to SBA. Over the course of PPP, Congress
paid lenders more than $46 billion in origination fees, more than 30 times the $1.5 billion in
administrative dollars appropriated to SBA over three years to cover PPP and other pandemic
relief programs. For a nearly $800 billion program, SBA's administrative funding was historically
small, representing less than two-tenths of 1% (0.2%).
In contrast, SBA core programs typically receive about 10-15% of program costs in the form of
administrative oversight funding. From the standpoint of fraud mitigation, the lenders played an
important frontline role -
their performance of Know Your Customer and Bank Secrecy Act
procedures was vital -
but critical tools such as third-party data checks by their nature must be
centralized at SBA. The same is true for standardized human-led reviews for the purpose of
improper payments analysis, for example. Future programming could consider shifting
administrative funding to the implementing agency to enable more agency loan reviews and
additional fraud prevention measures, including human-led reviews.
4. Make the private sector part of the solution. Two statutory features of PPP combined to
substantially minimize the incentive for lenders to deter and weed out fraudulent applications:
(1) the 100% loan guarantee provided, and (2) the requirement that SBA hold lenders harmless
for false certifications made by borrowers. As reported by the House Select Committee on the
Coronavirus Crisis, the combination of these two features led to some lenders bypassing fraud
controls as they rushed to approve as many loans as possible. 33 Removing, or at least
redesigning, the hold harmless provision to ensure that lenders have skin in the game would
strengthen their resolve to fully participate in fraud prevention.
26

118
5. Prevent fraud rather than chase it. In the case of PPP, Congress authorized a forgivable loan
program for the reason advertised in the program's name: to incentivize businesses to retain
workers and keep them on the payroll. As this report has detailed, millions of loans were quickly
funded without critical, pre-disbursement screening. As the program developed and after
millions of loans had been disbursed, Administration officials in 2020 indicated publicly that the
forgiveness process would be used to identify ineligible participants and claw back funds. Fraud
controls must be pushed to the front end, at the time of application and before disbursement,
to the greatest extent possible. Ongoing fraud controls can and should continue post-
origination, but these should be to complement -
not substitute for
upfront screening.
27

119
Conclusion
The door closed to SBA pandemic emergency relief one year ago, but the work to administer the
programs continues. Under Administrator Guzman, the agency continues to prioritize serving small
businesses in loan repayment, forgiveness, or grant reporting and compliance. The agency also
continues to prioritize identifying fraud and ineligibility across the pandemic programs and remains in
close partnership with law enforcement to hold accountable those individuals who stole from the
taxpayer, small businesses and nonprofit organizations rightfully eligible for assistance. This work will
continue for years. But this continued work should not stop policymakers across the Federal
Government from assessing the strengths and weaknesses of the COVID-19 response for small
businesses -
and using those learnings to improve both permanent federal programming and any
emergency assistance that may be deployed in response to a future emergency. SBA is eager to partner
with other agencies and Congress in pursuit of those goals.
###
28

120
1 U.S. Bureau of Labor Statistics. The Employment Situation news release for May 2023.
hi!11.~Ll~~~~hartfil!!lll:!Q~~
2 Numbers in parentheses reflect net distributed funding as of March 2023. Unless otherwise noted, all other
figures are rounded to the nearest 100,000, current as of April 2023 and are subject to change as SBA continues its
fraud fighting work.
'Fraud involves obtaining something of value through willful misrepresentation, which is determined through a
court or other adjudicative systems. See: U.S. Government Accountability Office. Fraud in the Federal Government,
p. 1. January 2023. https://www.g9o.gov/assets/gao-23-106110.pdf. References to potential fraud reflect when
fraud is suspected, but not yet confirmed, determined, or proven. See: U.S. Government Accountability Office, A
Framework/or Managing Fraud Risks in Federal Programs, July 2015. https:/lwww.gao.gov/assets/gao-15·
~
(GAO Fraud Framework 2015).
• SBA screened affiliated entities/individuals through government and commercial databases for SVOG manually,
while PPP, COVID-EIDL, and RRF screening was automated.
5 Provided to SBA by Office of Inspector General.
6 U.S. Small Business Administration, Office of Inspector General. Testimony of Deputy Inspector General Sheldon
Shoemaker before the U.S. House of Representatives Subcommittee on Government Operations and the Federal
Workforce. March 9, 2023, l:l!wi~
I
/
/ .Mi.Bf
U'l:QM!/1!i:lilli.11.!'.C.!.OL
gfil!_~ral-sheldon-shoem_fil[:US-h.Ql!e.!'_:.~
sub_committee#:~:text=Testimony%20of%20Deputy%201nspector%20General%20Sheldon%20~j1.QJL!llillsfil.%2Q~.'12!:
~Jl~F.,deral%20Workforc.,. At time of
testimony, $29.1 billion reflected $1.1 billion seized by U.S. Secret Service, $8 billion returned by borrowers and
$20 billion returned by financial institutions in the COVID-EIDL program. OIG updated the total to $30 billion in
June 2023.
7 In Congressional testimony, PRAC Chair Michael Horowitz wrote about the importance of this collaborative
process between the Biden-Harris Administration and PRAC to increasing COVID-EIDL fraud controls: "The PRAC
worked with 0MB to conduct a review of SBA's COVID-EIDL program before the loan threshold was increased to $2
million. That review resulted in the addition of new controls, including additional safeguards to detect against and
handle suspicious IP addresses, additional program eligibility checks, and other preventative measures. See:
Pandemic Response Accountability Committee. Statement of Michael E. Horowitz, Chair, before the U.S. House of
Representatives Select Committee on the Coronovirus Crisis. February 1, 2023.
https:/loig.iustice.gov/news/testimony/statement·michael-e-horowitz-chair-pandemic-response-accountability•
r;.2mmL\l&st.~.11.;:;r~1,t':lhe%20PR1:,C%20worked%20with%200MB,wae%20increased%20to%20%242%20[nJ!jjon.
Also see: Statement of Michael E. Horowitz, before the U.S. Senate Committee on Homeland Security and
Government Affairs. March 17, 2022. !Jllfilil.oig.iustice.gQ)!,(sites/default/files/2022·03/03-17-2022.pdf.
8 The White House. FACT SHEET: President Biden's Sweeping Pandemic Anti-Fraud Proposal: Going After Systemic
Fraud, Taking on Identity Theft, Helping Victims. March 2, 2023, b!l:P.s://www.whitehouse.gov/briefing:
rn2mL~tatelT\~!lts-re~!~il1.Q1.lli~Qli~tt:lilll:~Jm~W11:tUlll:ru~W:Jl!l!lK:12aJlli!lfilll£c:!!D.li::fril.!td::w:QllQiill::
~ident~QK:Yictim~.
• U.S. Congressional Budget Office. Interim Economic Projections for 2020 and 2021. May 19, 2020.
D '//
.g
/p
I
/
. Also see U.S. Bureau of Labor Statistics. Employment Situation News
Release. April 3, 2020. hi!JL~;/~v,,.
.g
/
/
/
g ~htm.
10 "Mnuchin warns senators of 20% US unemployment without coronavirus rescue, source says." CNBC.com. March
18, 2020. https://www.cnbc.coml2020/03/llllmnuchin-warns-senators-of-20percent-us-unemployment-without-
coronavirus-rescu~-soun;:~.
11 Rainey, Rebecca and Forgey, Quint. "Unemployment claims near 17 million in three weeks as coronavirus
ravages economy." POLITICO. April 9, 2020. https:/lwww.2olitico.com/news/2020/04/09/coronavirus,
unemployment-claims-numb~.L'!:176794.
29

121
12 Tankersley, Jim. "As Job Losses Mount, Lawmakers Face a Make-or-break Moment." The New York Times. May 9,
2020. https://www.nvtimes.com/2020/05/09/business/as-iob-losses-mount-lawmakers-face-a-make-or-break-·
mom~nt.html.
"U.S. Census Bureau. Business Formation Statistics. hlli1s://www.census.gov/econ/bfs/index.htmj.
14 U.S. Government Accountability Office. COVID-19: Opportunities to Improve Federal Response and Recovery
Efforts. June 25, 2020. https://www.gao.gov/products/gao-20-625. Also see U.S. Small Business Administration
Office of Inspector General. Serious Concerns of Potential Fraud in Economic Injury Disaster Loan Program
Pertaining to the Response to COVID-19. July 28, 2020. https://www.sba.gov/sites/default/files/2020-
/
p
p .
15 GAO, June 2020. Also see U.S. Small Business Administration Office of Inspector General. "Management Alert
Paycheck Protection Program Loan Recipients on the Department ofTreasury's Do Not Pay List." January 11, 2021.
bl\PEJl.W::fVw.sti_~,.gg.Yld.q_cument/report-21-06-management-alert-payche_ck-protection-program-loan-re..f.!.lw.m.e::
department-treasurys-do-not-pay-list. Also see: U.S. Small Business Administration Office of Inspector General.
"Duplicate Loans Made Under the Paycheck Protection Program." March 15, 2021.
h.lli1m~w.sb .g v/
Ir p
pr
I
p y
p
p i
m.
"See, for example: U.S. Small Business Administration Office of Inspector General. "SSA's Paycheck Protection
Program Loan Review Process." Page 5. https://www.sba.gov/sites/default/files/2022-
/
I
R
17 U.S. Government Accountability Office. Restaurant Revitalization Fund: Opportunities Exist to Improve Oversight.
Page 33. July 14, 2022. https:/!www.gao.gov/products/gao-22-105442.
18 SAM (System for Award Management) registration, FAPIIS (Federal Awardee Performance and Integrity
Information System), and LexisNexis are some examples.
19 See GAO Fraud Framework 2015.
20 US Government Accountability Office. COVID-19 Opportunities to Improve Federal Response and Recovery
Efforts, June 2020 (Report 20-265). https://www.gao.gov/assets/gao-20-625.pdf; COVID-19 Urgent Actions
Needed to Better Ensure an Effective Federal Response, November 2020 (Report 21-191).
https://www.gao.gov/products/gao-21-191; COVID-19 Critical Vaccine Distribution, Supply Chain, Program
Integrity, and other Challenges Require Focused Federal Attention January 2021 (Report 21-265)
p ·//
g /
/g
- ~;
Sustained Federal Action is Crucial as Pandemic Enters its Second
Year. March 2021 (Report 21-387)
p ·//
g .g
/
/g
p . GAO report 21-387 has 5
recommendations and reports 20-625, 21-191, 21-265 each have one recommendation related to fraud. The
recommendation in GAO report 20-625 closed April 2022 and recommendations in GAO reports 21-191 and 21-265
closed December 2022. As of April 2023, 3 recommendations from GAO Report 21-387 have closed.
21 Although improper payment classifications are not indicative of fraud in the portfolio, SBA put controls in place
to prevent improper payments as well. As of March 31, 2022, the PPP improper payments rate was estimated as
1.83%, and the COVID-EIDL improper payments rate was estimated as 4.50%.
22 U.S. Small Business Administration Office of Inspector General. Top Management and Performance Challenges
Facing the Small Business Administration in Fiscal Year 2023. Page 6. October 14, 2022. Noted improvements
included: Establishing a Fraud Risk Management Board in 2022; Developing a webpage dedicating to preventing
fraud and identity theft, which includes a section entitled "Lenders and Fraud Response"; Developing aggregate
review processes to identify different fraud scenarios; Developing and implementing a Master Review Plan that
established guidelines for loan and forgiveness reviews; Increasing antifraud controls for loans originating in 2021,
including checking application data against Treasury's Do Not Pay system; Developing and implementing SBA and
contractor fraud risk management policy and framework; Increasing post-disbursement antifraud controls for
loans that originated in 2020; Commencing manual loan and forgiveness reviews; Engaging a contractor with
expertise in detection and identification of potential fraud; Using a contractor's automated review tool and the
SBA Paycheck Protection Platform to analyze loans for fraud and eligibility; Implementing machine learning
functionality to focus on areas of higher risk; Providing outreach and training; and Implementing processes to refer
potential fraud to SBA OIG.
30

122
23 Pandemic Response Accountability Committee (PRAC). Risk Advisory- Potential Identity or Other Fraud in SBA
Pandemic Relief Programs. September 20, 2022. https://www.oversight.gov/report/PRAC/Risk-Advisory-
%E2%80%93-Potential-ldentity-or-Other-fraud-SBA-Pandemic-Relief-
Progr;,msll:~:text= The%20PRAC%20identified%20possible%20identity%20or%20other%20fraud,Development%E2
%80~99s%20Low%20Rent%20and%2For%2Qliwang%2CKhoice%20\loUclJeL%2QQ(Qgrun.
14 PRAC, September 2022. Also see: Pandemic Response Accountability Committee (PRAC). FRAUD ALERT: $5.4
Billion in Potentially Fraudulent Pandemic Loans Obtained Using over 69,000 Questionable Social Security
Numbers. January 30, 2023. https://www.oversight.gov/reporu'.PRAC/FRAUD-ALERT-PRAC-ld§lJ!ifl.!'s-54-Sillio.!l:
Potentially-Fraudulent-Pandemic-Loans-
PbtaJ!!.!1f!!/.:~:text= The%20PRAC's%20Pandemic%20Analytics%20Center,19%20EconomicJ'gQ!nl\!ry%20Disaster%20
Loan.
25 U.S. Government Accountability Office. Fraud in the Federal Government-Challenges Determining the Extent of
Federal Fraud. January 23, 2023. lJ.!!p.§;LJ.Y'1lM.W.filM2W2r9J:tucts/gao-23-106110.
26 GAO, January 2023.
27 Deputy IG Shoemaker Testimony
28 SBA COVID Programs (PPP, COVID-EIDL, RRF, & SVOG): $1.2 trillion disbursed, 22.1 million recipients received
funds (all programs), and nearly 5,400 lenders supported PPP. TARP: $431 billion disbursed; 763 financial
institutions received funds. Although both organizations received $50 million in initial administrative funding, SBA
OIG has only received modest amounts of supplemental funds and SIGTARP has received at least $15 million in
additional annual appropriations annually.
29 U.S. Small Business Administration Office of Inspector General. FY 2024 Budget Justification. Page 1.
30 Although this recommendation references IRS data, there is also support for sharing Social Security
Administration data. See PRAC January 2023.
32 PRAC January 2023. Also see GAO January 2023.
33 House Select Subcommittee on the Coronavirus Crisis Staff Report "We are Not the Fraud Police: How Fin Techs
Facilitated Fraud in the Paycheck Protection Program" (December 2022).
31

123
July 12, 2023
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
The Honorable Roger Williams
Chairman
House Small Business Committee
Washington, DC 20515
Dear Chaim1an Williams:
Thank you for the invitation to appear before the House Small Business Committee on hearing
entitled "Stolen Taxpayer Funds: Reviewing the SBA and OIG Reports of Fraud in Pandemic
Lending Programs." Administrator Guzman is unable to testify due to previously scheduled
commitments that require her to be outside of Washington, DC on the date you proposed.
The SBA has worked collaboratively with the [nspector General and other law enforcement
partners to identify and refer suspected fraud for investigation leading to substantial recoveries of
taxpayer funds. Our collaboration with the Inspector General included reviewing his fraud
estimate.
Our formal response, which is attached to this letter, states our concerns that his approach
contains serious flaws that significantly overestimate fraud and unintentionally mislead the
public to believe that the work we did together had no significant impact in protecting against
fraud.
On June 28, 2023, the SBA released our analysis "Pro
e i
E~~etecl.l!p..Q_Agdress Fraug_" to highlight the
actions the agency deployed to restore fraud measures in pre-existing relief programs, enhance
fraud controls in new programs, as well as support cross-agency efforts to bring fraudsters to
justice. We conducted a bipartisan staff briefing about the report on June 28, 2023 to engage with
your staff and answer questions.
Every analysis of the pandemic programs - including SBA's own - shows that fraud was not
inevitable, bnt instead resulted from policy choices made under the previous Administration to
lower existing safeguards in order to expedite relief. Nearly 86% of all pandemic funding
originated under the previous Administration without important controls in place. That is why
the Biden-Harris Administration took action to rebuild and strengthen anti-fraud controls such as
checking the Treasury Do Not Pay database and verifying tax income. SBA learned from
the mistakes of the 2020 implementation of PPP and COVID-EIDL to design the two major
relief programs that launched in 2021
the Shuttered Venues Operator Grant Program and the
Restaurant Revitalization Fund
which both achieved estimated fraud rates of well below 1 %.

124
We look forward to working with you and members of the Committee as we continue to
implement strong controls to protect taxpayer dollars.
Sincerely,
George Holman
Associate Administrator
Congressional and Legislative Affairs

125
Sentilink
July 13, 2023
The Honorable Roger Williams
Chairman
Committee on Small Business
U.S. House of Representatives
The Honorable Nydia Velazquez
Ranking Member
Committee on Small Business
U.S. House of Representatives
Dear Chairman Williams and Ranking Member Velazquez:
On behalf of Sentilink, I am pleased to submit this statement for the record for your hearing titled
"Stolen Taxpayer Funds: Reviewing the SBA and 0/G Reports of Fraud in Pandemic Lending Programs."
Senti link works with over 300 financial institutions to prevent synthetic fraud, identity theft, and other
emerging forms of first party fraud at the point of account origination. We were also the first company
in history to use the Social Security Administration's Electronic Consent Based SSN Verification
service (eCBSV) to validate account application data.
The federal government's response to the pandemic saw unprecedent volumes of money moving at a
very rapid pace to consumers and businesses. As a rule, when any amount of money moves
electronically, there is always the possibility that a fraudster is either behind it or hoping to divert it for
themselves. When trillions of dollars are moving, that threat grows exponentially.
With the benefit of hindsight, we have been able to analyze our own proprietary data as well as
publicly available information to draw conclusions that we hope can help shape future policymaking
decisions. Overall:
•
Tens of billions of taxpayer dollars were misappropriated or outright stolen by scammers and
identity thieves.
•
Policy decisions prioritized speed -i.e., getting stimulus funds to consumers and businesses
- over identity due diligence.
•
Achieving the policy objective of speeding funds to legitimate recipients, while simultaneously
preventing widescale fraud, was entirely achievable. Had the U.S. government placed a priority
on the need to use readily available technology to ensure funds were being delivered to the
correct recipients and not identity thieves or synthetic identities, the fraud losses incurred
would have been significantly less.
•
The use of synthetic and stolen identities to open checking accounts to launder ill-gotten
pandemic relief funds remains a problem for the financial industry broadly, as those accounts
continue to show clear signals of poor performance and additional fraudulent behavior.
Identity Theft at the Heart
We believe the widescale, organized theft of pandemic relief payments relied on applications to the
various stimulus programs using stolen identity information, with fraudsters using the name, date of
birth, Social Security number, and address of their victim to first establish a bank account. With a
deposit account opened, fraudsters then used the same stolen identity information to apply for
government relief funds, to be remitted to the fraudulently opened checking account. When the funds

126
Sentilink
were received, they could be laundered through a myriad of other financial accounts such as other
deposit accounts, peer-to-peer payment services or cryptocurrency platforms.
Based on our analysis to date, we believe a
significant portion of this fraud found its way into the
banking system by way of checking accounts (DDAs)
created with stolen identities. An analysis of data
from a sample of Sentilink partners illustrates the
growing incidence of DOA account applications using
stolen identity credentials during this period.
From September, 2020, to June, 2021, the percentage
of applications for DDAs identified by Sentilink as
using stolen identities increased 187%.
Many of the identity theft victims in these instances may not be aware that their credentials have
been compromised in this way. Others may have received a welcome package from their "new"
checking account provider in the mail sometime later, by which time the fraudster would have already
used on line banking to exfiltrate and launder the stolen funds.
More recently, SBA data on all PPP loans originated during the pandemic has been made available to
the public through a Freedom of Information Act (FOIA) request. While our analysis of this data is
ongoing, many loans were made to businesses that do not exist. Further, individuals that received
many of these PPP loans show a clear propensity to commit fraud generally. Our initial analysis
suggests the recipients of loans made by the five lenders affiliated with Blueacorn and Womply - two
fintechs noted in the Select Subcommittee on the Coronavirus Crisis Staff Report as having lax fraud
controls·- are 5X-20X more likely to subsequently commit additional fraud against other financial
institutions, such as ACH and check fraud.
Specific to synthetic identity fraud, Sentilink examined a sample of 25 known synthetic identities who
applied to the Small Business Administration for COVID Economic Injury Disaster loan (E!DL) loans
between April and August 2020.1 Twenty-one of these identities were first party synthetics, which
means they were real people using Social Security numbers (SSN) that didn't belong to them. Four of
the identities were third party synthetics, which means they were totally fabricated identities. Third
party synthetic identities are often created by organized crime groups with malicious intent.
For the most part, the synthetic identities who applied for credit with the SBA were quite established.
Most had inquiries and tradelines dating back to 2018. Only three were created in early 2020.
While this analysis of synthetic identities used to apply for EIDL loans was only based on a relatively
small sample, it is clear evidence of abuse of federal COVID relief programs by synthetic identity
1 We assume identities with an inquity to the SBA between April and August 2020 were applying for an EIDL loan. The
E!DL does have two other programs, military reservist and physical damage loans, but there are limitations on who can
apply, and less likely that inquiries during this short time period were related to them.

127
Æ
Sentilink
criminals. 2 We believe this pattern manifested itself across the range of federal small and medium-
sized business relief programs. Entirely fictitious businesses, or real businesses with fictitious
employees used to apply for loans, is a known practice among fraudsters, which was unquestionably
accelerated in the context of COVID relief programs.
Thank you for holding this hearing. The use of stolen and synthetic identities to open financial
accounts is not new. U.S. financial institutions that onboard new customers digitally are required to
have rigorous controls in place, many of which enable identity verification in real-time. The policy
mistakes inherent in the government's pandemic relief response provide a valuable learning
opportunity as it relates to the importance of identity verification: Had the U.S. government
incorporated solutions to detect stolen and synthetic identities when distributing COVID relief funds,
the fraud losses incurred would have been significantly less.
We appreciate the opportunity to provide these comments and look forward to engaging with you and
your colleagues to advance policy solutions that protect American consumers and businesses from
identity crimes.
Sincerely,
Jason Kratovil
Head of Public Policy and External Affairs
2 For example, see "Defendant Pleads Guilty to Stealing $24 million in COVID-19 Relief Money Through Fraud Scheme
that Used Synthetic Identities," US Department of Justice, June 29, 2021. Accessed at: https:llwww.justice.govlusao-
sdfllprldefendant-pleads-guilty-stealing-24-million-covid-19-reliel~money-through-fraud-scheme.

File and source

File

CHRG-118hhrg52559.pdf

Size

9,414,981 bytes

SHA-256

39fd356ee4ddef5945fec4f8f447d5121e5cef966ae20d6e2b3ae97613476515

Our copy

CHRG-118hhrg52559.pdf

Original

www.govinfo.gov