COVID-19 Economic Injury Disaster Loan Applications Submitted From Foreign IP Addresses — Report Number 22-17
Summary
SBA Inspector General Evaluation Report 22-17, dated September 12, 2022, on COVID-19 Economic Injury Disaster Loan (EIDL) applications submitted from foreign IP addresses, addressed to Administrator Isabella Casillas Guzman. The executive summary says SBA and a contractor designed four layers of internal controls and that, in a judgmental sample of 50 applications, 16 were not flagged by the system and another 15 were flagged but not properly reviewed by loan officers. It reports that SBA approved and disbursed 41,638 COVID-19 EIDLs, advances, and grants for $1.3 billion. Management partially agreed with recommendation 1 and agreed with recommendation 2.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“COVID-19 Economic Injury Disaster Loan Applications Submitted From Foreign IP Addresses — Report Number 22-17.”
Original at www.sba.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/covid-19-eidl-applications-from-foreign-ip-addresses-22-17-cbedf95ab4/
, SHA-256 55e835b1ef32e2ea6ef379879c91140088859a87e60aacda6b08255b2762f6c3.Full text
SBA INSPECTOR GENERAL EVALUATION REPORT
COVID-19 ECONOMIC INJURY DISASTER LOAN
APPLICATIONS SUBMITTED FROM
FOREIGN IP ADDRESSES
REPORT NUMBER 22-17 | SEPTEMBER 12, 2022
EXECUTIVE SUMMARY Report 22-17
September
12, 2022
COVID-19 ECONOMIC INJURY DISASTER LOAN
APPLICATIONS SUBMITTED FROM FOREIGN IP ADDRESSES
What OIG Reviewed If a loan application from a foreign IP address made it
Our objective was to assess the U.S. Small Business past the first two controls, control layer 3 was for the
Administration’s (SBA) controls to flag or prevent system to flag the application. Control layer 4 was to
potentially fraudulent Coronavirus Disease 2019 have a loan officer thoroughly review the flagged
(COVID-19) Economic Injury Disaster Loan (EIDL) application to determine if the applicant was eligible.
applications submitted from foreign Internet Protocol We used a judgmental sample of 50 COVID-19 EIDL
(IP) addresses. applications submitted from foreign IP addresses to
We reviewed SBA policies and procedures, interviewed test control layers 3 and 4. We found 16 applications
agency and contractor officials, and analyzed SBA’s were not flagged by the system and another 15
COVID-19 EIDL data. applications were flagged by the system but were not
properly reviewed by loan officers before loans were
What OIG Found approved and disbursed.
Although the agency implemented several layers of SBA acknowledged that the controls did not perform as
controls to prevent or reduce fraud from foreign intended and will not be used in future or current
countries, individuals at foreign IP addresses were able application systems.
to access the COVID-19 EIDL application system.
OIG Recommendations
SBA received millions of attempts to submit COVID-19
EIDL applications from foreign IP addresses and We recommended the agency thoroughly review the
stopped most of them; however, the agency processed loans in our test sample and the $1.3 billion disbursed
more than 233,000 of these applications from March to applicants from foreign IP addresses. The agency
20, 2020 to November 12, 2021, our review period. Of should stop any further or future disbursements to any
this amount, SBA approved and disbursed 41,638 applicants deemed to be ineligible or fraudulent. We
COVID-19 EIDLs, advances, and grants for $1.3 billion. also recommended SBA recover any disbursed loans
and advances determined to be ineligible or fraudulent.
Although applicants that reside overseas may qualify Additionally, we recommended that the agency
for this assistance, transnational crime entities in examine controls related to foreign IP addresses and
foreign countries have fraudulently obtained funding ensure these controls are more effective in future
from this and other U.S. programs in the past. disaster processing systems.
The numerous applications submitted from foreign IP Agency Response
addresses are an indication of potential fraud that may
involve international criminal organizations. OIG has Management partially agreed with recommendation 1,
ongoing investigations into international organized stating they would conduct a proactive review of
crime operations that applied for and stole pandemic COVID-19 EIDL applications that received funds for
relief funds. potentially ineligible or fraudulent businesses. They
will attempt recovery and continue to refer suspected
SBA officials were aware of and concerned about the fraud to the OIG. Management also emphasized that the
potential fraud from overseas. SBA hired a contractor applications approved from foreign IP addresses were
to process 27.8 million COVID-19 EIDL applications as a small proportion of all applications. SBA agreed with
of December 31, 2021. SBA and contractor officials recommendation 2, stating the agency will examine
designed a system of four layers of internal controls to controls related to foreign IP addresses and ensure
prevent loan applications from foreign IP addresses. these controls are more effective in future disaster
Control layers 1 and 2 were supposed to block (1) the processing systems.
submission of applications from foreign IP addresses in
six countries deemed high risk and (2) the completion
of applications from foreign IP addresses in all foreign
countries. We found both controls did not always block
these applications.
U.S. Small Business Administration
Office of Inspector General
DATE: September 12, 2022
TO: Isabella Casillas Guzman
Administrator
FROM: Hannibal “Mike” Ware
Inspector General
SUBJECT: COVID-19 Economic Injury Disaster Loan Applications Submitted from
Foreign IP Addresses
This report presents the results of our evaluation COVID-19 Economic Injury Disaster Loan
Applications Submitted from Foreign IP Addresses. We considered management’s comments
on the draft of this report when preparing the final report. Management partially agreed to
one recommendation and agreed with the other recommendation.
We appreciate the cooperation and courtesies provided by your staff. If you have any
questions, contact me or Andrea Deadwyler, Assistant Inspector General for Audits, at
(202) 205-6586.
cc: Arthur Plews, Chief of Staff
Patrick Kelley, Associate Administrator, Office of Capital Access
Peggy Delinois Hamilton, Special Counsel for Enterprise Risk
Therese Meers, Acting General Counsel
Michael Simmons, Attorney Advisor, Office of General Counsel
Katherine Aaby, Associate Administrator, Office of Performance, Planning, and the
Chief Financial Officer
Erica Gaddy, Deputy Chief Financial Officer
John Miller, Deputy Associate Administrator, Office of Capital Access
Tonia Butler, Director, Office of Internal Controls
Table of Contents
Introduction ................................................................................................................................................................ 1
Background............................................................................................................................................................. 1
Record-setting Funding Amounts ............................................................................................................ 1
Historic Application Volumes for COVID-19 EIDLs .......................................................................... 1
Overview of the COVID-19 Application Process ................................................................................ 2
Figure 1. SBA’s COVID-19 EIDL Application Process ....................................................................... 3
SBA Can No Longer Accept New Applications .................................................................................... 3
Objective .................................................................................................................................................................. 4
Results....................................................................................................................................................................... 4
Finding: SBA’s Controls Did Not Prevent All COVID-19 EIDL Applications from Foreign IP
Addresses ..................................................................................................................................................................... 5
Structure and Function of SBA Foreign IP Controls.............................................................................. 5
Figure 2. Four Layers of Control in SBA’s System ............................................................................. 5
Control Layer 1 = Firewall 1 – The Intake Point Control ............................................................... 6
Table 1. Attempts to Access COVID-19 EIDL Application System from IP Addresses
Located in Six Countries Deemed High Risk ........................................................................................ 7
Table 2. COVID-19 EIDL Funds to Applicants with IP Addresses Located in Six
Countries Deemed High Risk ...................................................................................................................... 8
Control Layer 2 = Firewall 2 - The Client Portal Control................................................................ 8
Table 3. Applications Processed by Country ....................................................................................... 9
Control Layer 3 = Contractor System Flags....................................................................................... 10
Table 4. Results of OIG Audit Test of System Flagging for Foreign IP Addresses............. 11
Control Layer 4 = Loan Officer Review ............................................................................................... 11
Table 5. OIG Test Results of Loan Officer Review of Flagged Loan Applications from
Foreign IP Addresses .................................................................................................................................. 13
Conclusion ............................................................................................................................................................ 13
Recommendations ............................................................................................................................................ 14
Analysis of Agency Response ........................................................................................................................... 15
Summary of Actions Necessary to Close the Recommendations ................................................. 15
Appendix I: Objective, Scope, and Methodology ...................................................................................... 17
Appendix II: Prior Work ..................................................................................................................................... 19
Table 6. OIG Prior Oversight Work on SBA’s COVID-19 EIDL Program .................................... 19
Appendix III: Foreign IP Loan Data by Country ....................................................................................... 20
Appendix IV: Management Comments ......................................................................................................... 30
Introduction
The U.S. Small Business Administration’s (SBA) disaster assistance is the federal
government’s primary program for assisting small businesses, small agricultural
cooperatives, and most private, nonprofit organizations after declared disasters. The
program provides up to $2 million in disaster assistance loans to help eligible entities meet
financial obligations and operating expenses after a disaster.
Background
A series of national relief packages aimed at easing the economic effects of the Coronavirus
Disease 2019 (COVID-19) pandemic directed SBA, in accordance with the Small Business
Act, to provide COVID-19 Economic Injury Disaster Loans (EIDL) and additional funds in
three grant and advance programs, emergency EIDL grants, Targeted EIDL Advances, and
Supplemental Targeted Advances to affected eligible entities. 1 We refer to the three
programs as EIDL grants and advances in this report.
The laws also expanded the types of organizations that qualified for the funding to small
businesses to include small agricultural cooperatives, most private, nonprofit
organizations, cooperatives, Employee Stock Ownership Plans, and tribal concerns, all with
no more than 500 employees, then to sole proprietorships, independent contractors, and
agricultural enterprises. Agricultural enterprises are small businesses in food and fiber
production, ranching and raising livestock, aquaculture, or other farming or agricultural-
related industries. 2
To be eligible, an entity must have been in business on or before January 31, 2020,
adversely affected by the COVID-19 pandemic, and located in the United States or U.S.
territories.
Record-setting Funding Amounts
The national relief packages tasked SBA with quickly lending an enormous amount of
taxpayer funds: $500 billion in COVID-19 EIDLs; $20 billion in COVID-19 emergency EIDL
grants, up to $10,000 each; $30 billion in Targeted EIDL Advances, up to $10,000 each; and
$5 billion in Supplemental Targeted Advances, up to $5,000 each. Since the agency’s
inception in 1953, SBA has provided more disaster assistance funding through these
programs than in its entire history.
Historic Application Volumes for COVID-19 EIDLs
SBA suddenly had to process an unprecedented number of applications. On March 31,
2020, more than 680,000 applications were submitted to SBA, the highest number of loan
1 Public Law 116-123 - Coronavirus Preparedness and Response Supplemental Appropriations Act (March 6, 2020);
Public Law 116-136 - Coronavirus Aid, Relief, and Economic Security Act (March 27, 2020); Public Law 116-139 -
Paycheck Protection Program and Health Care Enhancement Act (April 24, 2020); and Economic Aid to Hard-Hit Small
Businesses, Nonprofits, and Venues Act (December 27, 2020); American Rescue Plan Act of 2021 (March 11, 2021).
2 Small Business Act 15 U.S.C. 647(b), section 18(b).
1
applications the agency had ever received in a day. By April 10, 2020, SBA had received
more than 4.5 million loan applications, well above the average of 65,000 per year before
the pandemic. By December 31, 2021, SBA had received 27.8 million COVID-19 EIDL
applications.
SBA hired a contractor to process COVID-19 EIDL applications and make recommendations
to approve or deny loan applications. SBA loan officers or team leads would give final
approval of each application.
Overview of the COVID-19 Application Process
EIDL relief eligibility, in accordance with U.S.C. Title 8, Chapter 14, Section 1611, is limited
to U.S. citizens, noncitizen nationals, and qualified aliens. 3 Therefore, those applicants
located at foreign Internet Protocol (IP) addresses could be legitimate if they controlled at
least a 20 percent share of an eligible entity, were adversely affected by the COVID-19
pandemic, located in the United States or U.S. territories, and in business on or before
January 31, 2020.
Although individuals who reside overseas may qualify for the assistance if they meet the
eligibility requirements, the fraud risk was high because of the history of fraud originating
from transnational crime organizations that have stolen funds from U.S programs in the
past. SBA was concerned with potential fraud from overseas and elected to block or flag all
applications from foreign IP addresses. To reduce fraud and cyber threats, SBA and the
contractor designed four layers of technical computing controls, known as firewalls (two
digital entry blocks), electronic flags (alerts), and human intervention (loan officer review)
to prevent fraud (See Figure 1). SBA did not have a plan to address how qualifying
individuals overseas could apply for this relief.
3 Part of the Immigration and Nationality Act.
2
Figure 1. SBA’s COVID-19 EIDL Application Process
Source: SBA and its contractor
SBA Can No Longer Accept New Applications
As of January 1, 2022, SBA stopped accepting new COVID-19 EIDL applications. Because of
lack of funds as of May 6, 2022, SBA was no longer accepting requests for increases to
COVID-19 EIDLs or reconsiderations of previously declined loan applications. Finally, on
May 16, 2022, the COVID-19 EIDL portal closed.
3
Objective
Our objective was to assess SBA’s internal controls in place to flag or prevent potentially
fraudulent COVID-19 EIDL applications submitted from foreign IP addresses.
Results
Despite the four layers of controls SBA
and its contractor established, we found
that SBA disbursed 15,873 COVID-19
EIDLs totaling $1.2 billion and 25,765
EIDL grants and advances totaling $111.5
million, as of November 12, 2021, the end
of our review period, to individuals who
submitted applications from foreign IP
addresses. These were applications
missed by the first two layers of controls.
The third and fourth layers of controls
were designed to flag any applications
missed by the first two layers and ensure
SBA loan officers reviewed them. From a
judgmental sample of 50 COVID EIDL applications, we found the system did not flag 16
applications. The controls did flag the remaining 34 applications in our sample. However,
we found loan officers did not properly review 15 of the flagged applications in accordance
with written procedures to address and mitigate potential fraud indicators.
4
Finding: SBA’s Controls Did Not Prevent All COVID-19
EIDL Applications from Foreign IP Addresses
We found that as of November 12, 2021, SBA had disbursed approximately $1.2 billion in
COVID-19 EIDLs and $111.5 million in EIDL grants and advances to applicants whose initial
application came from a foreign IP address.
Although SBA’s contractor provided evidence that the controls prevented individuals
located at a foreign IP address from accessing the system millions of times, we determined
the controls did not prevent such access more than 233,000 times. In addition, we found
problems with the flagging of applications from foreign IP addresses and the vetting of
those applications. From a judgmental sample of 50 COVID-19 EIDL applications, we found
the system did not flag 16 applications. The controls did flag 34 applications in our sample.
However, we found loan officers did not properly review 15 of the 34 flagged applications
in accordance with policies and procedures in place to prevent potentially fraudulent
applications.
Structure and Function of SBA Foreign IP Controls
The contractor’s system to process COVID-19 EIDL applications comprised at least two
access portals (intake point and client portal). When a potential applicant went to SBA’s
website to apply for a COVID-19 EIDL, the system would redirect to one of the contractor’s
access portals, referred to here as the “intake point” for initial applications and the “client
portal” for the completion of applications (see Figure 2). In general, the intake point should
have blocked all applicants from six foreign countries deemed high risk (Layer 1 = Firewall
1) from accessing the contractor’s system and the client portal (Layer 2 = Firewall 2)
should have blocked all foreign applicants not deemed high risk from completing
applications submitted to the intake point from all foreign countries.
Figure 2. Four Layers of Control in SBA’s System
Source: OIG analysis of SBA’s COVID-19 EIDL control structure
SBA speculated that applicants could have used technology to subvert the controls. During
our review, SBA acknowledged that the controls did not perform as intended and will not
be in use in future or current application systems.
5
As we describe in detail below, applicants were able to submit COVID-19 applications from
foreign IP addresses although there were layers of controls intended to prevent this and to
address the potential fraud risk. In addition, we asked SBA why Layer 1 and 2 controls had
separate application blocking criteria designed to prevent applications from foreign
countries. SBA officials stated there were points in time in 2020 where the decision by SBA
was to not block all foreign IP addresses. SBA did not maintain any information as to why
they made the different blocking criteria decisions in 2020. Thus, it is unknown why Layer
1 control was designed to prevent applications from six high-risk countries and Layer 2
control was designed to prevent the completion of applications from all foreign countries.
Control Layer 1 = Firewall 1 – The Intake Point Control
The first control between the applicant and contractor’s access portal, called the “intake
point,” of the system was designed to prevent submission of COVID-19 EIDL applications
from IP addresses in six countries categorized as high risk by a third-party software vendor
used by SBA’s contractor.
If Firewall 1 did not find the IP address was geolocated in one of the specified countries
deemed high risk, the applicant was allowed to fill out a COVID-19 EIDL application and
submit it. Once an application was submitted, the system executed various controls, such as
checking the applicant’s credit score and other identifying information. If the application
passed these controls and checks, the applicant would then be invited back to finish
additional application requirements in a second access portal, called the “client portal,” on
return to the system.
Firewall 1 should have prevented anyone at IP addresses in countries deemed high risk
from accessing the intake point. The contractor stated the firewall blocked 110,549
attempts from the six countries in May 2021 alone (see Table 1). We were unable to get
information on the number of attempts for other time periods because SBA’s contractor did
not maintain more than 1 month of information on blocked attempts.
6
Table 1. Attempts to Access COVID-19 EIDL Application System from IP
Addresses Located in Six Countries Deemed High Risk
Number of
Country Attempts
High-Risk Country 1 71,174
High-Risk Country 2 9,681
High-Risk Country 3 3,901
High-Risk Country 4 389
High-Risk Country 5 0
High-Risk Country 6 25,404
Total 110,549
Source: SBA contractor data for May 2021
Our analysis of SBA’s COVID-19 loan, grant, and advance data revealed that between March
20, 2020 and November 12, 2021, 3,097 applications from the six countries deemed high
risk were not blocked.
Those applications were processed, approved, and disbursed a total of $14.3 million in
COVID-19 EIDLs and emergency EIDL grants (see Table 2).
7
Table 2. COVID-19 EIDL Funds to Applicants with IP Addresses Located
in Six Countries Deemed High Risk
Total
Total
Approved Total Total
Approved Total
Applications Amount, Amount, Disbursed
Country Grants Approved
Submitted Grants and EIDLs Amount
and EIDLs
Advances (dollars) (dollars)
Advances
(dollars)
High-Risk Country 488 64 $316,000 26 $1,268,100 $1,584,100
1
High-Risk Country 1,338 187 1,040,000 108 7,475,600 8,515,600
2
High-Risk Country 112 8 26,000 4 139,900 165,900
3
High-Risk Country 104 6 36,000 0 0 36,000
4
High-Risk Country 0 0 0 0 0 0
5
High-Risk Country 1,055 100 448,000 47 3,568,800 4,016,800
6
Total 3,097 365 $1,866,000 185 $12,452,400 $14,318,400
Source: SBA COVID-19 EIDL, grant, and advance data as of November 12, 2021
We asked the contractor why the control did not block access from all six countries
completely and how applicants were able to subvert Firewall 1. Their response was that
they could not guarantee 100 percent effectiveness. The contractor speculated that the IP
addresses could be masked. Neither SBA nor its contractor knew why so many applications
were able to subvert Firewall 1.
During our evaluation, SBA transitioned the responsibility of the COVID-19 EIDL program
from the Office of Disaster Assistance to the Office of Capital Access on June 29, 2021. After
the transition, we asked the Office of Capital Access why the control was designed to block
applications from only six countries deemed high risk when the Layer 2 control was
designed to block the completion of all applications from all foreign countries. Again, SBA
officials did not know why this decision was made at the onset of the program. After our
questions, SBA and the contractor confirmed that SBA had directed the contractor on July
19, 2021 to block IP addresses of all foreign countries from accessing the intake point.
Control Layer 2 = Firewall 2 - The Client Portal Control
The control at the client portal was supposed to prevent applicants from all foreign IP
addresses from accessing the system and completing COVID-19 EIDL applications. The
contractor’s data showed Firewall 2 blocked more than 1.6 million attempts by applicants
located at foreign IP addresses from accessing the client portal in May 2021. Again, we
8
were unable to get information on the number of attempts for other time periods because
SBA’s contractor does not maintain more than 1 month of information on blocked attempts.
In addition to blocking foreign IP addresses, the contractor banned some IP addresses for
repeated attempts to access the system and various other reasons. In total, the contractor
banned more than 32,000 IP addresses located in foreign countries.
The blocking and banning of foreign IP addresses showed the system had some effect on
preventing applications from foreign countries. However, we found Firewalls 1 and 2 did
not prevent the completion of 233,872 applications submitted from foreign IP addresses at
the intake point and the disbursement of $1.3 billion in COVID-19 EIDLs and grants (see
Table 3).
Table 3. Applications Processed by Country
Total Total
Total
Approved Approved Total Total Amount,
Applications Disbursed
Country Grants Amount, Approved EIDLs
Submitted Amount
and Advances EIDLs (dollars)
(dollars)
Advances (dollars)
Nigeria 33,477 241 $1,109,000 496 $18,452,300 $19,561,300
Pakistan 29,290 632 3,353,000 483 43,862,300 47,215,300
Canada 20,500 3,755 19,236,000 2,062 164,071,090 183,307,090
Mexico 14,656 3,100 12,740,000 2,081 145,128,775 157,868,775
United 12,007 1,358 6,418,000 834 59,884,398 66,302,398
Kingdom
Philippines 9,762 658 3,399,000 335 25,902,800 29,301,800
Dominican 9,524 781 3,750,000 564 30,397,700 34,147,700
Republic
India 9,273 1,561 6,763,000 1,061 137,027,317 143,790,317
Germany 6,061 719 3,056,000 355 18,106,768 21,162,768
All other 89,322 12,960 51,666,000 7,602 560,044,698 611,710,698
countries
Total 233,872 25,765 $111,490,000 15,873 $1,202,878,146 $1,314,368,146
Source: OIG analysis of SBA’s COVID-19 EIDL, grant, and advance data from March 20, 2020 to November 12,
2021
We believe there is a significant risk of potential fraud in applications submitted from
foreign IP addresses. SBA was also concerned with this risk because agency officials
recommended blocking all applications from foreign IP addresses at program outset.
However, the control did not prevent all applications from foreign countries. Neither SBA
nor its contractor knew how so many applications were able to subvert Firewall 2.
9
Control Layer 3 = Contractor System Flags
If the software did not detect a foreign IP address, the applicant would be admitted to the
client portal to finish their application. To complete COVID-19 EIDL applications, the
applicant would verify their identity, submit any needed additional documents and
information, and eventually sign the loan agreement to receive the funds.
SBA and the contractor officials told us they had been concerned about the risk that
Firewall 1 and 2 controls might be bypassed. Technologically savvy ineligible applicants
might use computer technology, such as virtual private networks (VPNs), proxy servers, or
The Onion Router, commonly known as TOR, to mask their actual locations, enter the
system, and apply for American relief funds.
In case some applicants were able to bypass system controls, the contractor installed a
third-party software program to identify and flag attempts to mask the actual location of
applicants.
If the software identified a foreign IP address, it electronically flagged the COVID-19 EIDL
application with an alert warning of “Client location is international” or “high-risk IP
address.”
Client Location Is International. This flag alerted loan officers that the applicant
accessed the loan system from a location outside the United States and its
territories, indicating a high risk of fraud.
High-risk IP. This flag alerted the loan officer that a device used to electronically
submit the loan application may have been used in fraudulent activity. For example,
if the application came from a domestic IP address as a proxy or if a connection to
the “dark web” was detected. The dark web is the area of the internet that allows
users to be anonymous.
If the software did not detect an IP address, or the IP address was in some way suspect, the
software flagged the application with an alert of “suspicious online behavior.”
Suspicious Online Behavior. This flag alerted loan officers if different devices had
accessed the system, the data had been associated with possible online fraud, or if
there was an attempt to bypass fraud checks.
To test the third control layer, we judgmentally selected a sample of 50 approved and
disbursed COVID-19 EIDLs from the loan data from locations in 12 foreign countries
geographically dispersed across the world. We reviewed the selected loan files to
determine if the software had flagged them.
We found 34 applications, totaling $5.3 million, were properly flagged by the software.
However, 16 applications out of the 50 in our sample were not identified or flagged by the
contractor’s third-party software intended to alert loan officers to properly mitigate these
flags. These 16 applications were processed, approved, and disbursed for a total amount of
more than $3.1 million. Without the software alert flags, loan officers were unaware that
additional vetting was needed for approval (see Table 4).
10
Table 4. Results of OIG Audit Test of System Flagging for Foreign IP
Addresses
Grant
EIDL and Total
System
Flagged Amount Advance Disbursed
Loans Did
Country by Not Amount Amount Not
Tested Not
System* Flagged Not Flagged
Flag
(dollars) Flagged (dollars)
(dollars)
Afghanistan 4 2 2 $162,300 $6,000 $168,300
China 4 1 3 406,000 13,000 419,000
Dominican 5 4 1 174,400 5,000 179,400
Republic
India 5 2 3 897,400 5,000 902,400
Iraq 4 4 0 0 0 0
Israel 5 5 0 0 0 0
Nigeria 5 4 1 150,000 0 150,000
Russia 4 2 2 300,000 4,000 304,000
Syria 1 1 0 0 0 0
United 5 3 2 719,000 11,000 730,000
Kingdom
Venezuela 4 3 1 150,000 2,000 152,000
Yemen 4 3 1 150,000 1,000 151,000
Total 50 34 16 $3,109,100 $47,000 $3,156,100
Source: OIG analysis
*COVID-19 EIDL applications flagged by the system for any of these three fraud alerts: “Client location is
international,” “High-risk IP address,” and “Suspicious online behavior.”
Control Layer 4 = Loan Officer Review
The fourth layer of control established by SBA and the contractor required a review by the
loan officers to address or clear alert flags on the applications. SBA and the contractor
released written procedures on April 13, 2020 and revised them five times over the next
year, outlining specific loan officer actions on how to properly mitigate these alert flags. In
this layer, COVID-19 EIDL applications flagged by the system for any of these three fraud
alerts: “Client location is international,” “High-risk IP address,” and “Suspicious online
behavior” required review and approval by a loan officer.
SBA policy required the following:
11
Client Location Is International. The procedures required loan officers to confirm
the business was physically located within the United States or a U.S. territory
before approving the application. If not, the officer was supposed to deny the
application.
High-risk IP. This alert flag was not added until the written procedures were
revised on April 20, 2021. The written procedures required the loan officer to call
the applicant to verify the applicant’s identity, but there was no requirement for a
loan officer to obtain a copy of valid identification.
Suspicious Online Behavior. Prior to April 20, 2021, the written procedures
required the loan officer to automatically deny the loan.
SBA revised the written procedures on April 20, 2021, reversing the automatic denial. The
revision required loan officers to call the applicant to verify identity and request a copy of
valid identification within 7 days. If the applicant’s identity could not be verified, then the
loan would be denied.
To test these alert flags, we reviewed the 34 loan files in our testing sample flagged by the
system. These files were tagged in the system with the fraud alert flags, “Client location is
international,” “Suspicious online behavior,” or “High-risk IP address.”
We found 19 of the files, totaling about $2.9 million, had been properly reviewed before
loan approval. However, 15 loan files, totaling about $2.4 million, were not vetted by the
loan officers before loan approval and disbursement (see Table 5).
We asked SBA officials why applications with fraud flags were approved without a loan
officer addressing these alerts. SBA officials informed us that there were several factors:
• For five of the loan applications, “the file was sent to the approved queue by the
system” bypassing loan officer review;
• For seven of the applications, the reference guide did not provide direction for fraud
alerts. However, we found the reference guide did provide loan officer actions to
mitigate or deny the loan based on fraud alerts; and
• For six of the applications, the fraud alert did not exist at time of approval. However,
there is no data field for the date the alert flags were created, and it is uncertain
when the alert flags were created by the system. Therefore, the fraud flag may or
may not have existed at the time of loan office review.
The total number of exceptions exceeds the number of files because the response provided
for each file consisted of more than one of the factors or reasons listed above.
12
Table 5. OIG Test Results of Loan Officer Review of Flagged Loan
Applications from Foreign IP Addresses
Loan Grant and Total
Loan EIDL
Officer Did Advance Disbursed
Country Flags Officer Amount
Not Amount Amount
Mitigated (dollars)*
Mitigate (dollars)* (dollars)*
Afghanistan 2 2 0 0 0 0
China 1 1 0 0 0 0
Dominican 4 3 1 150,000 1,000 151,000
Republic
India 2 2 0 0 0 0
Iraq 4 2 2 103,500 2,000 105,500
Israel 5 3 2 300,000 17,000 317,000
Nigeria 4 1 3 450,000 14,000 464,000
Russia 2 1 1 150,000 10,000 160,000
Syria 1 0 1 21,500 1,000 22,500
United 3 2 1 300,700 0 300,700
Kingdom
Venezuela 3 1 2 650,000 8,000 658,000
Yemen 3 1 2 213,800 3,000 216,800
Total 34 19 15 $2,339,500 $56,000 $2,395,500
Source: OIG analysis of SBA COVID-19 data
*For applications not mitigated by the loan officer.
Conclusion
The agency implemented several layers of controls to prevent or reduce fraud with
firewalls or alerts designed to prevent applications originating from foreign countries. We
believe the system blocked a majority of the applications from foreign IP addresses.
However, we found that applicants with foreign IP addresses were able to access the
system more than 233,000 times, resulting in $1.3 billion in COVID-19 EIDL funding to
applicants in foreign countries who may not have been eligible.
13
Recommendations
We recommend the Administrator direct the Associate Administrator for the Office of
Capital Access in conjunction with the Associate Administrator for Disaster Assistance and
Chief Information Officer to:
1. Thoroughly review each COVID-19 EIDL, grant, and advance application submitted
from foreign IP addresses that were approved and funded and verify eligibility. If
ineligibility or evidence of potential fraud is found, SBA should stop any further or
future disbursements, recover any disbursed funds, and refer fraudulent loans to
OIG for investigation.
2. Examine controls related to foreign IP addresses and ensure these controls are more
effective in future disaster processing systems.
14
Analysis of Agency Response
SBA management provided formal comments to the draft report, which are included in
Appendix IV. Management partially agreed with recommendation 1 and agreed with
recommendation 2. The proposed actions will resolve both recommendations and
management will provide implementation dates by separate correspondence. We
considered management’s comments when preparing this final report.
Regarding recommendation 1, management partially agreed and proposed actions that
were responsive to the recommendation. Specifically, management agreed that controls
initially in place to flag and prevent the applications from high-risk countries did not do so
consistently. However, they stated that “The $1.3 billion identified by the OIG that
originated from applications submitted from a foreign IP address represents less than .04
percent of the more than $342 billion approved by SBA for COVID EIDL advances and
loans.” OIG acknowledges that the percentage of disbursements identified may seem small,
however, we believe that $1.3 billion in taxpayer funds to individuals or businesses that
should not have received it is significant. We reported that the numerous applications
submitted from foreign IP addresses are an indication of potential fraud that may involve
international criminal organizations. Also, OIG has ongoing investigations into
international organized crime operations that applied for and stole pandemic relief funds.
Consequently, it is concerning that $1.3 billion intended to assist small businesses during
the pandemic potentially funded illegal activities worldwide, making it critical that proper
controls are in place and working as intended.
Summary of Actions Necessary to Close the Recommendations
Recommendation 1
Thoroughly review each COVID-19 EIDL, grant, and advance application submitted from
foreign IP addresses that were approved and funded and verify eligibility. If ineligibility or
evidence of potential fraud is found, SBA should stop any further or future disbursements,
recover any disbursed funds, and refer fraudulent loans to OIG for investigation.
Status: Resolved
Management partially agreed with our recommendation and stated SBA will conduct a
proactive review using additional data analytics of COVID EIDL applications that received
funds for potentially ineligible or fraudulent businesses. Management further stated SBA
will attempt recovery and continue to refer all suspected cases of fraud to OIG to be
investigated. Management’s proposed actions were responsive to the recommendation, and
we consider this recommendation to be resolved.
This recommendation can be closed when management provides evidence that the agency
has completed the review of the over 233,000 applications from foreign IP addresses and
then recovered, or at a minimum, attempted to recover funds and referred potentially
fraudulent loans to OIG.
15
Recommendation 2
Examine controls related to foreign IP addresses and ensure these controls are more
effective in future disaster processing systems.
Status: Resolved
Management agreed with this recommendation to examine controls related to foreign IP
addresses and ensure these controls are more effective in future disaster processing
systems. Management’s proposed actions were responsive to the recommendation, and we
consider this recommendation to be resolved.
This recommendation can be closed when management provides evidence that they have
examined controls related to foreign IP addresses and they have implemented a system
with adequate controls to prevent access from foreign IP addresses or to adequately vet
access from foreign IP addresses.
16
Appendix I: Objective, Scope, and Methodology
Our objective was to assess SBA’s controls in place to flag or prevent potentially fraudulent
applications for the COVID-19 EIDL program submitted from foreign IP addresses not in a
U.S. territory.
To meet our objective, we reviewed the following:
• Coronavirus Aid, Relief, and Economic Security Act
• Coronavirus Preparedness and Response Supplemental Appropriations Act
• SOP 50 30 9, Disaster Assistance Program
• SBA Rapid Decision Reference Guides (dated April 13, 2020 through April 20, 2021)
• SBA contractor data for COVID-19 EIDLs, grants, and advances
• U.S.C. Title 8, Chapter 14, Section 1611
We interviewed SBA officials at the Office of Disaster Assistance, Office of Capital Access,
and the Office of the Chief Information Officer. We also interviewed officials of the
contractor used by SBA to process COVID-19 EIDLs.
We obtained data for COVID-19 EIDLs from March 20, 2020 through November 12, 2021
from the contractor’s system and loan approval and disbursement data from SBA’s system,
known as ETRAN. Within this data, we used a private vendor geolocation tool to identify IP
addresses located outside the United States and its territories.
We attempted to assess the reliability of the data by performing limited testing. However,
neither SBA nor the contractor provided source information to us to perform data
reliability testing. As a result, the reliability of the ETRAN and subcontractor’s system data
is undetermined. But it produces the best available data, which SBA uses to manage the
program and derive program statistics.
Additionally, SBA and contractor officials told us the login records of the client portal were
not reliable to use in this review. SBA’s contractor told us the computer software at the
client portal was not updated to capture the increased number of characters of the newer
Internet Protocol version 6 addresses, but that it did not affect the login records of the
application intake point. Consequently, we were unable to reliably analyze the foreign IP
addresses that accessed the client portal. Based on the contractor’s statement, our analyses
about devices with foreign IP addresses accessing the initial application submitted at the
intake point remain reliable.
We ran the IP addresses in the loan data through a geolocation software tool from a private
vendor to identify the internet provider used by the applicant and the location of the device
used to submit the application. The geolocator tool that we used to identify the applications
received from outside the U. S. and its territories is used by OIG Investigations Division and
other government agencies. This geolocator tool asserts a 99.8 percent accuracy rate for
identifying the internet service providers and specific locations of the submitted IP
addresses.
We judgmentally selected 50 COVID-19 EIDL applications submitted from 12 randomly
selected countries. These specific loans were selected in order to provide a wide or
reasonable representation of countries. To confirm that the IP addresses used to submit
17
these 50 EIDLs were from outside the United States and its territories, we used a second
and distinct geolocator tool to retest them. This tool confirmed that all 50 EIDL applications
in our test sample had come from the foreign location identified by the first geolocator tool.
We selected a sample of 50 loans approved between April 20, 2020 and April 23, 2021,
totaling more than $8.4 million. These were judgmentally selected because they originated
from the 12 randomly selected countries. We tested the 50 EIDL files to determine whether
SBA had identified the foreign source of the loan application, and if so, whether a loan
officer reviewed the system flag to determine whether the application was legitimately
from an eligible applicant.
We conducted this evaluation in accordance with the Council of the Inspectors General on
Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. These standards
require that we plan and perform the inspection to obtain sufficient, appropriate evidence
to provide a reasonable basis for our conclusions and observations based on our objectives.
18
Appendix II: Prior Work
Table 6. OIG Prior Oversight Work on SBA’s COVID-19 EIDL
Program
Report Title Report Number Final Report Date
COVID-19 EIDL Program SBA OIG 22-06 November 30,
Recipients on the Department of 2021
Treasury’s Do Not Pay List
SBA’s Emergency EIDL Grants SBA OIG 22-01 October 7, 2021
to Sole Proprietors and
Independent Contractors
SBA’s Handling of Identity Theft SBA OIG 21-15 May 6, 2021
in the COVID-19 EIDL Program
Serious Concerns About SBA’s SBA OIG 21-13 April 7, 2021
Control Environment and the
Tracking of Performance
Results in the Shuttered Venue
Operators Grant Program
Inspection of Small Business SBA OIG 21-02 October 28, 2020
Administration’s Initial Disaster
Assistance Response to the
Coronavirus Pandemic
Serious Concerns of Potential SBA-OIG 20-16 July 28, 2020
Fraud in EIDL Program
Pertaining to the Response to
COVID-19
White Paper: Risk Awareness SBA OIG 20-12 April 3, 2020
and Lessons Learned from
Audits and Inspections of EIDLs
and Other Disaster Lending
Source: SBA OIG
19
Appendix III: Foreign IP Loan Data by Country
The following table is a comprehensive list of COVID-19 EIDLs disbursed for approved loan applications submitted to SBA
from foreign IP addresses in descending order of total number of applications. The countries are listed from higher to lower
based on the number of applications submitted.
Country Applications Total Total Total Total Amount, Total
Submitted Approved Approved Approved EIDLs (dollars) Disbursed
Grants and Amount, EIDLs Amount
Advances Grants and (dollars)
Advances
(dollars)
Nigeria 33,477 241 $1,109,000 496 $18,452,300 $19,561,300
Pakistan 29,290 632 3,353,000 483 43,862,300 47,215,300
Canada 20,500 3,755 19,236,000 2,062 164,071,090 183,307,090
Mexico 14,656 3,100 12,740,000 2,081 145,128,775 157,868,775
United 12,007 1,358 6,418,000 834 59,884,398 66,302,398
Kingdom
Philippines 9,762 658 3,399,000 335 25,902,800 29,301,800
Dominican 9,524 781 3,750,000 564 30,397,700 34,147,700
Republic
India 9,273 1561 6,763,000 1061 137,027,317 143,790,317
Germany 6,061 719 3,056,000 355 18,106,768 21,162,768
Netherlands 4,583 337 1,812,000 218 15,422,400 17,234,400
Ghana 4,313 68 351,000 59 3,273,100 3,624,100
Colombia 3,956 811 2,776,000 588 38,187,300 40,963,300
France 3,632 438 1,885,000 248 16,639,600 18,524,600
Israel 3,198 917 3,460,000 656 72,275,200 75,735,200
Turkey 3,030 298 883,000 158 12,808,900 13,691,900
Spain 2,967 540 1,363,000 284 20,934,800 22,297,800
20
South Africa 2,723 127 591,000 126 9,275,300 9,866,300
Jamaica 2,525 191 812,000 168 8,596,500 9,408,500
United Arab 2,459 183 748,000 92 9,900,800 10,648,800
Emirates
Australia 2,315 330 1,284,000 184 12,920,800 14,204,800
Brazil 2,285 373 1,557,000 225 15,016,000 16,573,000
Japan 2,052 396 1,695,000 172 7,183,700 8,878,700
South Korea 1,830 397 1,295,000 159 11,609,000 12,904,000
Kenya 1,508 90 453,000 54 5,176,300 5,629,300
Italy 1,483 295 945,000 142 10,899,100 11,844,100
Switzerland 1,471 202 787,000 98 7,557,700 8,344,700
Costa Rica 1,458 389 1,356,000 280 23,914,000 25,270,000
Egypt 1,338 187 1,040,000 108 7,475,600 8,515,600
Thailand 1,231 311 1,174,000 167 9,080,900 10,254,900
Argentina 1,146 317 1,403,000 135 7,625,900 9,028,900
Hong Kong 1,124 224 1,021,000 97 6,698,300 7,719,300
Vietnam 1,099 312 1,050,000 127 9,011,300 10,061,300
Romania 1076 90 331,000 45 4,018,500 4,349,500
Russia 1055 100 448,000 47 3,568,800 4,016,800
Singapore 933 156 707,000 70 4,767,200 5,474,200
Ecuador 923 159 501,000 96 6,217,800 6,718,800
Venezuela 874 187 526,000 70 5,014,400 5,540,400
Taiwan 827 230 656,000 89 6,328,400 6,984,400
Morocco 822 83 511,000 39 1,898,400 2,409,400
Burkina 816 7 64,000 10 610,300 674,300
Faso
Ukraine 812 106 419,000 74 6,834,500 7,253,500
Portugal 781 116 360,000 78 3,736,800 4,096,800
21
Bulgaria 768 89 338,000 64 4,837,400 5,175,400
Ethiopia 740 50 422,000 47 3,149,100 3,571,100
Peru 692 204 652,000 140 7,186,400 7,838,400
Jordan 680 96 410,000 57 4,578,500 4,988,500
Greece 607 101 355,000 76 4,954,900 5,309,900
Austria 603 71 299,000 43 2,958,700 3,257,700
Haiti 597 41 201,000 33 1,281,100 1,482,100
Malaysia 589 43 179,000 30 1,840,900 2,019,900
Nicaragua 557 122 497,000 108 12,241,800 12,738,800
Belgium 550 87 389,000 38 2,114,900 2,503,900
Bangladesh 538 81 688,000 58 5,621,200 6,309,200
Indonesia 532 98 329,000 62 4,207,399 4,536,399
Ireland 520 109 557,000 62 6,241,100 6,798,100
Senegal 507 45 300,000 30 1,243,200 1,543,200
Sweden 497 83 285,000 51 3,094,800 3,379,800
China 488 64 316,000 26 1,268,100 1,584,100
Bahamas 479 75 332,000 49 2,768,100 3,100,100
Poland 472 90 273,000 55 2,549,000 2,822,000
Panama 444 105 426,000 82 7,678,400 8,104,400
Cyprus 437 14 51,000 12 378,100 429,100
New 428 139 489,000 78 6,085,200 6,574,200
Zealand
Chile 384 82 323,000 38 3,475,200 3,798,200
Serbia 378 78 273,000 62 7,088,500 7,361,500
Georgia 369 43 142,000 23 1,023,700 1,165,700
Guatemala 366 87 302,000 47 2,238,400 2,540,400
Afghanistan 358 70 299,000 31 1,289,700 1,588,700
Honduras 350 67 317,000 44 3,491,100 3,808,100
22
Saudi Arabia 342 86 340,000 32 1,742,500 2,082,500
Armenia 313 45 197,000 27 2,084,900 2,281,900
Belize 301 35 173,000 29 966,900 1,139,900
Denmark 294 64 397,000 35 1,438,500 1,835,500
Albania 290 19 96,000 11 1,073,600 1,169,600
Benin 289 2 16,000 2 67,300 83,300
Kuwait 285 72 371,000 25 1,160,100 1,531,100
Lebanon 268 57 235,000 46 4,608,600 4,843,600
Czechia 263 49 148,000 23 1,100,600 1,248,600
El Salvador 256 32 149,000 22 2,603,100 2,752,100
Iraq 256 26 148,000 16 538,800 686,800
Norway 252 38 83,000 28 845,500 928,500
Antigua and 240 17 75,000 12 2,177,000 2,252,000
Barbuda
Palestine 225 27 78,000 16 1,401,500 1,479,500
Finland 223 18 63,000 15 1,542,300 1,605,300
Cambodia 216 29 105,000 18 944,900 1,049,900
Bahrain 211 30 195,000 18 648,400 843,400
Somalia 210 15 144,000 4 208,000 352,000
Luxembourg 207 25 147,000 6 287,300 434,300
Hungary 201 39 116,000 29 2,814,000 2,930,000
Uganda 199 21 130,000 11 720,100 850,100
Barbados 198 26 131,000 21 1,514,499 1,645,499
Tanzania 195 9 30,000 8 276,800 306,800
Trinidad 194 47 185,000 31 2,043,500 2,228,500
and Tobago
Uzbekistan 192 26 108,000 12 1,470,500 1,578,500
Algeria 181 20 117,000 4 57,100 174,100
23
Cameroon 179 13 88,000 10 553,700 641,700
Sudan 178 10 69,000 5 530,300 599,300
Croatia 177 41 255,000 21 1,161,000 1,416,000
Cuba 175 28 82,000 8 194,200 276,200
Ivory Coast 172 8 38,000 8 403,900 441,900
Liberia 169 11 69,000 11 517,000 586,000
Nepal 167 26 91,000 13 588,100 679,100
Moldova 154 27 84,000 12 802,600 886,600
Tunisia 154 12 60,000 8 648,100 708,100
Yemen 154 10 77,000 5 629,600 706,600
Togo 153 2 2,000 6 215,800 217,800
Guinea 151 9 107,000 3 208,500 315,500
Qatar 142 34 126,000 17 679,600 805,600
Mali 139 8 79,000 5 858,700 937,700
Iceland 137 18 76,000 15 1,168,900 1,244,900
Sri Lanka 136 26 119,000 16 1,148,300 1,267,300
Guyana 132 13 63,000 6 328,100 391,100
Bolivia 131 39 151,000 18 648,500 799,500
Gambia 131 7 54,000 5 578,000 632,000
Sierra Leone 121 9 20,000 3 171,000 191,000
Azerbaijan 118 9 12,000 4 177,000 189,000
Belarus 118 28 129,000 10 742,000 871,000
Iran 112 8 26,000 4 139,900 165,900
Cayman 111 32 103,000 15 2,361,000 2,464,000
Islands
Aruba 110 10 31,000 8 251,200 282,200
North 110 27 108,000 13 1,477,400 1,585,400
Macedonia
24
Lithuania 108 20 53,000 9 910,600 963,600
Slovakia 106 17 98,000 8 834,200 932,200
Uruguay 106 21 72,000 11 801,800 873,800
Eritrea 104 8 26,000 4 181000 207,000
Mauritania 104 6 36,000 0 0 36,000
Mongolia 101 11 72,000 4 731,600 803,600
Estonia 96 12 39,000 6 246,500 285,500
Latvia 89 21 122,000 11 629,800 751,800
Bosnia and 88 14 75,000 14 1,116,300 1,191,300
Herzegovina
Myanmar 83 40 226,000 10 835,300 1,061,300
Kyrgyzstan 74 13 49,000 7 729,200 778,200
DR Congo 70 2 5,000 1 150,000 155,000
Saint Lucia 68 15 66,000 7 277,700 343,700
Sint Maarten 68 16 55,000 16 1,154,500 1,209,500
British 64 12 30,000 13 975,500 1,005,500
Virgin
Islands
Rwanda 62 5 26,000 6 870,200 896,200
Seychelles 61 4 23,000 4 110,900 133,900
Bermuda 57 11 52,000 9 367,100 419,100
Curacao 57 20 64,000 14 791,500 855,500
Anguilla 53 8 12,000 5 271,600 283,600
Turks and 52 12 54,000 6 839,700 893,700
Caicos
Islands
Kazakhstan 50 6 12,000 3 164,000 176,000
Grenada 47 7 37,000 5 103,300 140,300
25
Oman 46 6 20,000 4 60,500 80,500
Tajikistan 46 7 65,000 3 62800 127,800
Botswana 43 1 1,000 0 0 1,000
Saint 43 7 26,000 4 348,000 374,000
Vincent and
the
Grenadines
Djibouti 42 6 18,000 5 98,000 116,000
Saint Martin 38 7 49,000 3 217,500 266,500
St Kitts and 38 6 32,000 5 727,000 759,000
Nevis
Montenegro 36 4 21,000 3 186,500 207,500
Mauritius 35 4 13,000 0 0 13,000
Zimbabwe 34 1 1,000 0 0 1,000
Cabo Verde 31 1 15,000 1 69,900 84,900
Malta 30 4 4,000 4 1,261,900 1,265,900
Dominica 29 4 14,000 5 243,600 257,600
Slovenia 28 6 39,000 1 20,000 59,000
Laos 27 4 33,000 1 24,000 57,000
Zambia 24 0 0 1 13,000 13,000
Paraguay 23 4 21,000 3 107,700 128,700
Macao 21 4 13000 2 58,900 71,900
Libya 19 2 2,000 0 0 2,000
Niger 19 0 0 0 0 0
Guadeloupe 18 4 17000 2 98500 115,500
Reunion 18 0 0 0 0 0
French 15 2 2,000 1 11600 13,600
Polynesia
26
Gabon 15 1 10000 0 0 10,000
Angola 13 0 0 1 24,400 24,400
Maldives 13 1 15000 1 4,800 19,800
Syria 13 2 2,000 1 21,500 23,500
Namibia 12 1 4,000 1 76,500 80,500
Samoa 12 1 15000 2 106,000 121,000
Malawi 11 0 0 3 147,300 147,300
Lesotho 10 2 12,000 0 0 12,000
Mozambique 10 3 15,000 2 183,900 198,900
Principality 9 3 3,000 2 88,000 91,000
of Monaco
Greenland 8 0 0 0 0 0
Saint 8 1 1,000 1 301300 302,300
Barthelemy
Andorra 7 2 3,000 2 154700 157,700
Fiji 7 2 11,000 0 0 11,000
Burundi 6 0 0 0 0 0
Eswatini 6 1 1000 0 0 1,000
Isle of Man 6 1 5000 0 0 5,000
Sao Tome 6 2 2000 0 0 2,000
and Principe
Bhutan 5 1 1,000 1 107,000 108,000
Bonaire, Sint 5 1 1,000 1 150,000 151,000
Eustatius,
and Saba
Brunei 5 0 0 0 0 0
Chad 5 0 0 0 0 0
Congo 5 1 1000 0 0 1,000
Republic
27
French 5 0 0 0 0 0
Guiana
Palau 5 3 9000 1 36,400 45,400
Tonga 5 0 0 0 0 0
Martinique 4 0 0 1 549900 549,900
Central 3 0 0 0 0 0
African
Republic
Guernsey 3 1 10000 1 500000 510,000
Jersey 3 0 0 0 0 0
New 3 0 0 0 0 0
Caledonia
British 2 0 0 0 0 0
Indian
Ocean
Territory
Gibraltar 2 0 0 0 0 0
Kosovo 2 0 0 0 0 0
Papua New 2 2 21,000 0 0 21,000
Guinea
Suriname 2 0 0 0 0 0
Cook Islands 1 0 0 0 0 0
Equatorial 1 1 8000 0 0 8,000
Guinea
Madagascar 1 1 1000 0 0 1,000
Marshall 1 0 0 0 0 0
Islands
Montserrat 1 1 1000 1 10100 11,100
28
Pitcairn 1 0 0 0 0 0
Islands
Total 233,872 25,765 $111,490,000 15,873 $1,202,878,146 $1,314,368,146
Source: OIG analysis, SBA COVID-19 loan data as of November 12, 2021
29
Appendix IV: Management Comments
SBA RESPONSE TO EVALUATION REPORT
30
U.S. SMALL BUSINESS ADMINISTRATION
WASHINGTON, DC 20416
To: Hannibal “Mike” Ware
Inspector General
Office of Inspector General (OIG)
From: Patrick Kelley /Patrick Kelly
Associate Administrator
Office of Capital Access
Subject: Response to OIG Draft Report entitled “COVID-19 Economic Injury Disaster Loan
Applications Submitted from Foreign IP Addresses” (Project 21803)
Date: August 24, 2022
Thank you for providing the Office of Capital Access (OCA) the opportunity to respond to OIG’s Draft
Report entitled, “COVID-19 Economic Injury Disaster Loan Applications Submitted from Foreign IP
Addresses,” dated July 21, 2022. The objective of this audit was to assess the U.S. Small Business
Administration’s (SBA) controls internal controls in place to flag or prevent potentially fraudulent
COVID-19 EIDL applications submitted from foreign internet protocol (IP) addresses.
It is important to remember that the COVID-19 Pandemic posed a national health and economic crisis
of historic proportions equivalent to very few events in our country’s history. As a result, the initial
focus of SBA’s COVID relief programs had to be on providing financial assistance as quickly as possible
to respond to the crisis.
While it is true that great speed was needed when developing the COVID EIDL program and to deliver
this economic assistance to millions of small businesses impacted by the pandemic; we do not believe
there is a tradeoff between speed and fraud controls. SBA Administrator Isabella Guzman has directed
the agency to operate with both speed and certainty.
The scope of the audit evaluates COVID EIDL applications received from March 20, 2020, through
November 12, 2021. During this time, SBA received and processed over 21 million COVID EIDL
applications and approved over 3.8 million loan requests totaling more than $296 billion. SBA also
approved 5.8 million EIDL Advances totaling $20 billion, 486,000 Targeted EIDL Advances for $4.2
billion, and 390,000 Supplemental Targeted EIDL Advances for $2 billion. All together SBA provided
over $342 billion across 10.5 million COVID EIDL advances and loans.
Only one percent of all COVID EIDL applications successfully submitted to SBA originated from a
foreign IP address, and just .01 percent were associated with a foreign country deemed high risk.
As mentioned in the OIG report, the initial system control established by the contractor and the
previous administration was intended to block incoming applications from foreign IP addresses
[1]
originating from six foreign countries deemed high risk. The system control successfully blocked
millions of attempts from foreign IP addresses to access the application intake portal. However, the
control was not 100 percent successful; out of millions of failed attempts, 3,097 applications
originating from an IP address associated with one of six foreign countries deemed high risk were able
to access the application intake portal and submit a COVID EIDL application. The represents just .01
percent of the 21 million COVID EIDL applications submitted through the intake portal through
November 12, 2021.
Less than .04 percent of all COVID EIDL advances and loans approved were associated with an
application submitted from a foreign IP address, and less than .005 percent were associated with a
foreign country deemed high risk.
As stated earlier, the COVID EIDL program provided millions of small businesses with hundreds of
billions of dollars in direct assistance to help them with emergency working capital needs through the
pandemic. As of November 12, 2021, SBA had approved over 3.8 million loan applications totaling
more than $296 billion. During this same period, the SBA also approved 6.7 million advances totaling
more than $26.2 billion across three separate advance programs, including the EIDL Advance,
Targeted EIDL Advance and Supplemental Targeted Advance. Less than .04 percent of all COVID EIDL
advances and loans approved through the scope of the audit were associated with an application
submitted from a foreign IP address. Furthermore, just 185 loans equating to less than .005 percent of
loans and advances approved during this period originated from a foreign IP address from one of the
six countries deemed a high risk by the previous administration when setting up the control. Our
teams are reviewing the 185 loans to ensure the proper holds were put in place and stop any further
disbursements from being made to the applicant. Already we have found that funds were returned by
the bank to SBA on four of the loans, which means loan funds did not reach those accounts.
The $1.3 billion identified by the OIG that originated from applications submitted from a foreign IP
address represents less than .04 percent of the more than $342 billion approved by SBA for COVID
EIDL advances and loans.
Out of the $342 billion approved by the SBA through November 12, 2021, the OIG report found that
$1.3 billion was associated with an application that originated from a foreign IP address, which
accounts for less than .04 percent of all funds approved for the COVID EIDL program during this
period. Furthermore, the total dollar amount of COVID EIDL funds approved to the six foreign
countries deemed high risk – $14.3 million – represents .004 percent of the total advance and loan
funds approved by the SBA during the scope of the audit.
OIG Recommendation 1 – Thoroughly review each COVID-19 EIDL, grant, and advance application
submitted from foreign IP addresses that were approved and funded and verify eligibility. If
ineligibility or evidence of potential fraud is found, SBA should stop any further or future
disbursements, recover any disbursed funds, and refer fraudulent loans to OIG for investigation.
SBA Response: SBA partially agrees with the recommendation. We have already initiated a thorough
review of the COVID EIDL applications that originated from a foreign IP address from one of the six
countries deemed high risk, which should have been blocked by the established system controls
during the scope of the audit. SBA will flag and conduct a proactive review using additional data
[2]
analytics on the approximately 35,000 unique files and stop any possible future disbursements on
COVID EIDL applications that originated from a foreign IP address. Based upon the results of the data
analytics, SBA will attempt recovery of improperly disbursed funds and will continue to refer all
suspected cases of fraud to the OIG to be investigated and will support those criminal investigations
and prosecutions conducted by the OIG, DOJ, and other law enforcement agencies.
The Office of Capital Access (OCA) has the following comments with respect to the OIG
recommendation 1:
SBA partially concurs with this recommendation. Based on our initial review, we found there were
approximately 35,000 unique COVID EIDL applications that originated from a foreign IP addresses and
funds were disbursed. SBA will conduct a proactive review of COVID EIDL applications that received
funds for potentially ineligible or fraudulent businesses using additional data analytics.
The system control established during this period was designed to block access to the application
intake portal for six foreign countries deemed to be high risk. The total number of advances and loans
approved that originated from applications submitted from foreign IP addresses from these six
countries account for less than .005 percent of all COVID EIDL advances and loans approved during the
scope of the audit. Furthermore, as the OIG acknowledged in the draft report, a business is not
outrightly ineligible for COVID EIDL assistance simply because the individual who accessed the
application intake portal did so from a foreign IP address. There are many scenarios where business
owners, officers, accountants, or other representatives of an eligible business entity needed to apply
for the COVID EIDL program from overseas, either out of necessity or convenience. It is important to
remember that in the early months of the COVID-19 Pandemic, strict quarantine rules and travel
restrictions delayed some people from returning to the United States. Because of the limited funds
available for the COVID EIDL Advance program, there was a real sense of urgency to apply as soon as
possible for business owners out of fear the funds would be exhausted quickly. Those concerns were
validated when the SBA approved 5.8 million COVID EIDL advances and exhausted the full $20 billion
appropriated by Congress in just over 90 days.
SBA will attempt recovery and will continue to refer all suspected cases of fraud to the OIG to be
investigated and will support those criminal investigations and prosecutions conducted by the OIG,
DOJ, and other law enforcement agencies. We were pleased to see President Biden sign bipartisan
legislation – the COVID–19 EIDL Fraud Statute of Limitations Act of 2022 – which doubles the statute of
limitations for criminal investigations and prosecutions of fraudsters that stole taxpayer-funded
assistance intended to help legitimate small businesses.
OIG Recommendation 2 – Examine controls related to foreign IP addresses and ensure these controls
are more effective in future disaster processing systems.
SBA Response: SBA concurs with this recommendation and agrees to examine controls related to
foreign IP addresses and ensure these controls are more effective in future disaster processing
systems.
[3]
File and source
- File
- covid-19-eidl-applications-from-foreign-ip-addresses-22-17.pdf
- Size
- 1,168,402 bytes
- SHA-256
- 55e835b1ef32e2ea6ef379879c91140088859a87e60aacda6b08255b2762f6c3
- Original
- www.sba.gov