Fraud Alert Follow-Up: Improved Sharing of Death Records and Use of the Do Not Pay System — PRAC
Summary
A Pandemic Response Accountability Committee fraud alert follow-up says it identified $38 million in potentially improper or fraudulent pandemic loans associated with Social Security Numbers of deceased individuals. It expands on a January 2023 Fraud Alert that identified 69,000 questionable SSNs used to obtain $5.4 billion in potentially fraudulent EIDL and PPP loans. Treasury's Do Not Pay system provided dates of death for 15,307 of 20,404 SSNs, and 3,222 of those were used on COVID-19 EIDL/PPP applications; funds were disbursed on applications using 305 of them. The PRAC says DNP lacks access to SSA's full Death Master File, which may explain why DNP could only match 75 percent of the SSNs. A footnote says a data mismatch does not prove that an improper or fraudulent payment has occurred.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Fraud Alert Follow-Up: Improved Sharing of Death Records and Use of the Do Not Pay System — PRAC.”
Original at www.oversight.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/do-not-pay-fraud-alert-follow-upprac-ff47bccb17/
, SHA-256 e5ae4849e37173e27533a546c5cd02bc0c879f8741e19f86ba0a253d7a5f6c99.Full text
FRAUD ALERT FOLLOW-UP: Improved
Sharing of Death Records and Use
of the Do Not Pay System Would
Strengthen Program Integrity and
Better Protect the Public
PRAC Identifies $38 Million in Potentially Improper or Fraudulent
Pandemic Loans Associated with Social Security Numbers of
Deceased Individuals
This update expands on our January 2023 Fraud Alert that identified 69,000 questionable Social Security Numbers
(SSNs) used to obtain $5.4 billion in potentially fraudulent loans made in the COVID-19 Economic Injury Disaster Loan
(EIDL) program and Paycheck Protection Program (PPP). As detailed in that Fraud Alert, PRAC data scientists, using our
Pandemic Analytics Center of Excellence, identified the questionable SSNs after determining that the names, SSNs,
and/or dates of birth used in connection with a targeted selection of COVID-19 EIDL/PPP applications did not match
information in Social Security Administration (SSA) records.1
We further noted in the Fraud Alert that a significant number of the targeted selection of applications used SSNs
that were associated with individuals who, according to SSA records, were deceased as of the date of our verification
results received from SSA. We did not include those deceased individuals’ SSNs in our January 2023 Fraud Alert
because we first needed to determine if those individuals were alive at the time the COVID-19 EIDL/PPP applications
were submitted. Therefore, following receipt of this information from SSA, we worked with the Department of the
Treasury’s (Treasury) Do Not Pay (DNP) system to obtain the dates of death for this separate population of 20,404
SSNs that SSA records indicated were associated with deceased individuals.2 The Treasury’s DNP system was able
to provide the dates of death for 15,307 of the requested 20,404 SSNs. Using data available from DNP’s matching
process and date of death information, the PRAC’s data scientists found that 3,222 of the 15,307 deceased
individuals’ SSNs were used on COVID-19 EIDL/PPP applications across three analytic scenarios.
20,404 SSNs of deceased 15,307 SSNs matched 3,222 SSNs $38 million in
individuals, verified by SSA, by Treasury DNP identified across potential improper
used on applications all three scenarios or fraudulent
payments
305 SSNs were paid $38
EIDL/PPP money million
xxx-xx-xxx
xxx-xx-xxx xxx-xx-xxx
1 We recognize that a data mismatch does not prove that an improper or fraudulent payment has occurred. Further review is necessary by the Small Business
Administration (SBA).
2 The Department of Treasury’s DNP working system is the executive branch’s designated source of centralized data and analytics services to help executive
branch agencies verify eligibility for government payments and to help deter improper or fraudulent payments.
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
These COVID-19 EIDL/PPP applications were submitted: (a) after the SSN owner’s date of death; (b) both before
and after the SSN owner’s date of death; or (c) before the SSN owner’s date of death but were paid after the date
of death. These potentially improper or fraudulent loans should be further reviewed to ensure payments did not go
to ineligible recipients. We further determined that funds were disbursed in connection with applications using 305
of the SSNs, resulting in nearly $38 million in potentially improper or fraudulent payments. Although 2,917 of the
3,222 SSNs did not receive a loan disbursement, we are concerned they could be used to improperly obtain benefits
from other government programs and, therefore, warrant further review by the SBA.
As we detail below, Treasury’s DNP system does not have access to SSA’s full Death Master File (DMF). The full DMF
uses data submitted from state level vital statistics agencies and matches them to SSA data to verify their identity.
Because of the source of the information and this verification process, DMF data is considered a superior source
of death information over the National Technical Information Service Limited Access Death Master File that DNP
receives from SSA, as discussed below. This limitation may explain why DNP could only match 75 percent of the
SSNs that we provided. Having access to the full DMF would have helped our PRAC data scientists identify whether
potential improper or fraudulent payments were associated with the other 5,097 SSNs. More importantly, having
such access would allow executive branch agencies to enhance their efforts to identify and prevent improper, and
potentially fraudulent, payments to deceased individuals.
Verifying borrower information, including SSN and the date of death, helps prevent identity
fraud and ensures government benefits are paid only to those who are eligible.
As we previously reported, identity theft and identity fraud increased substantially since the start of the pandemic.
According to a 2021 report from the Identity Theft Resource Center, pandemic-related payments were the most
reported stolen payment, with SBA loans (e.g., COVID-19 EIDL and PPP) comprising some of the highest reports of
misuse.3 Each of these programs permitted applicants to self-certify their eligibility. The reduction of controls in 2020
to verify borrower information—coupled with expedited timeframes to disburse pandemic relief funds—increased
opportunities for individuals to use stolen identities to commit or conspire to commit fraud.
The DNP system helps government program administrators
identify and prevent improper payments by allowing agencies Data Sharing Success Story
to check a variety of data sources to verify an applicant’s The Treasury Inspector General for Tax
eligibility to receive federal funds.4 However, as noted above, Administration (TIGTA) found that the Internal
the DNP system does not currently have access to SSA’s full Revenue Service (IRS) had issued nearly 2.2 million
Death Master File (DMF). DNP currently receives the National payments totaling nearly $3.5 billion to individuals
who per their records were deceased. To prevent
Technical Information Service Limited Access Death Master additional payments to deceased individuals, TIGTA
File from SSA, in addition to other death sources listed in reported that the IRS shared Taxpayer Identification
“Our Approach and Analysis” section below. The full file of Numbers with Treasury’s Bureau of the Fiscal
death information includes all death data that SSA receives, Service to prevent additional Economic Impact
Payments to deceased individuals.
including state-owned data. SSA’s death records are cross
checked with SSA’s system of records that houses identifying
(TIGTA, “Implementation of Economic Impact
information on everyone that holds an SSN.5 Payments,” 2021-46-034, May 24, 2021).
3 Identity Theft Resource Center, “2021 Trends in Identity,” August 2022.
4 Do Not Pay is a service that agencies can use at no cost to check many federated data sources at one time to verify a recipient’s eligibility for payment.
Agencies can check multiple DNP data sources related to debt, exclusions, and deceased individuals to assist in making payment eligibility decisions.
Agencies have the right to access these data sources and are to work with Treasury’s Bureau of the Fiscal Service to identify the proper DNP data sources
they need for their purposes.
5 Social Security Advisory Board, “Social Security and the Death Master File,” June 2019.
Pandemic Response Accountability Committee 2
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
As a result of a provision included in the 2021 Consolidated Appropriations Act, Treasury anticipates receiving the
full DMF for a three-year period beginning December 27, 2023.6 The Government Accountability Office (GAO) has
recommended that Congress accelerate and make permanent the requirement for SSA to share the full DMF with
Treasury for inclusion in the DNP system.7 We concur with the GAO’s recommendation given how access to the DMF
can help prevent deceased individuals’ identities being used to improperly apply for government benefits. A DNP
system that contains the full DMF can give agencies a higher degree of certainty that a payee is legitimate and
eligible before making an award or payment.
Effective use of government information requires timely and effective program controls.
As reported in our January Fraud Alert, both COVID-19 EIDL and PPP loans were susceptible to fraud because
in 2020 SBA initially prioritized getting pandemic relief to those in need quickly with few safeguards to confirm
eligibility. In some cases, agency officials relaxed or removed controls to expedite payments. The SBA’s Office of
Inspector General (OIG) has identified the DNP system as a critical control that could have been implemented at the
onset of these relief programs to prevent billions of dollars from being improperly disbursed. The Payment Integrity
Information Act of 2019 dated March 2, 2020, requires agencies to evaluate fraud risks and use a risk-based
approach to design and implement financial and administrative controls to counter identified fraud risks. The law
reinforces the requirement for agencies to review pre-payment and pre-award procedures. At a minimum, and before
issuing payment, agencies must review certain databases, statutorily mandated to be within the DNP Initiative, to
verify eligibility of the payment.8 As discussed below, SBA began referencing the DNP system for PPP and COVID-19
EIDL loan applications beginning in January 2021 and April 2021, respectively.9
6 Consolidated Appropriations Act, 2021, Pub. L. No. 116-260. § 801, 134 Stat. 1182, 3201 (Dec. 27, 2020), amending 42 U.S.C. § 405(r). This provision
will take effect three years after enactment and will be effective for a three-year period.
7 GAO, “Emergency Relief Funds: Significant Improvements Are Needed to Address Fraud and Improper Payments,” GAO-23-106556, February 1, 2023.
8 SBA OIG, “Paycheck Protection Program Loan Recipients on the Department of Treasury’s Do Not Pay List,” 21-06, January 11, 2021.
9 SBA gained direct access to Treasury’s DNP system in March 2021 for PPP when Treasury issued its revised Computer Matching Agreement. According to
SBA officials, from January to March 2021, SBA provided loans daily to Treasury to verify PPP borrowers on the DNP system.
Pandemic Response Accountability Committee 3
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
What We Found
In connection with our January Fraud Alert, SSA informed us that 20,404 of the questionable SSNs we identified
in our targeted selection were associated with deceased individuals. We excluded those SSNs and the associated
loans from the Fraud Alert because we were in the process of using Treasury’s DNP system to determine if those
individuals were alive when they submitted their COVID-19 EIDL/PPP application. Applications submitted after the
recorded date of death raise the potential that an individual’s identity was being used improperly.10
The PRAC obtained from DNP the dates of death for 15,307 (75 percent) of the 20,404 SSNs that SSA verified
were deceased. Next, PRAC data scientists analyzed the 15,307 SSNs and their associated COVID-19 EIDL/PPP
applications to identify instances of potential improper or fraudulent payments. Our data scientists looked at three
categories of applications associated with these 15,307 SSNs to assess potential fraud or improper payments: (a)
applications filed after the SSN owner’s date of death; (b) applications filed both before and after the SSN owner’s
date of death; and (c) applications submitted before the SSN owner’s date of death but paid after the date of
death.11 See Table 1 for more details on the scenarios we considered.
Table 1. Potential Improper or Fraudulent Payments Identified Across 15,307 SSNs Matched Against
the Treasury’s DNP System.
Count of SSNs Count of SSNs
Associated with Associated with Number of Disbursed
Scenario Applications Disbursements Disbursements Amount
1. SSNs used on applications 3,109 131 153 $10,425,461
submitted after date of death
2. SSNs in Scenario 1 also 169 92 184 $13,369,416
associated with applications
submitted before date of death*
3. SSN owner was alive at time of 113 113 118 $14,098,357
application but deceased before
disbursement**
Total*** 3,222 305 455 $37,893,234
(Based on distinct counts)
Source: PRAC analysis of 15,307 SSNs matched against Treasury’s DNP System.
* This scenario does not include applications/disbursements that are already included in analytic scenario 1.
** This scenario only focuses on disbursements and SSNs associated with undisbursed applications would not be included.
***The number of SSNs and applications are not a one-for-one match given that a distinct SSN could have been used across multiple
COVID-19 EIDL and/or PPP applications that were disbursed and undisbursed. Therefore, a SSN can be associated with multiple applications
and disbursements.
10 According to DNP, the DNP is NOT a list of entities or people who should not be paid. It requires agencies to perform additional due diligence before
awarding payments.
11 The COVID-19 pandemic resulted in excess deaths in the United States. These results do not account for any time that may have lapsed between when the
death occurred and when it was reported and recorded in SSA’s full Death Master File or DNP’s Limited Access Data File.
Pandemic Response Accountability Committee 4
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
Scenario 1 | SSNs used on applications submitted after date of death:
131 SSNs connected to $10.4 million in potential fraudulent payments.
In total, we identified 3,109 SSNs used in this manner on loan applications and believe these are likely instances of
identity fraud. Of these applications, 131 SSNs received loan disbursements totaling $10.4 million.
Although SBA in January 2021 (for PPP) and April 2021 (for COVID-19 EIDL) began to check applicants against
DNP, our analysis found 41 deceased individuals’ SSNs were used on 45 loan disbursements after this control was
implemented. This underscores the importance of GAO’s recommendation for Congress to accelerate and make
permanent the requirement for SSA to share the full DMF with Treasury for inclusion in the DNP system. Additionally,
implementing DNP still requires agencies to do their own due diligence when they receive a positive match.
Table 2. Timing of Disbursements for the 3,109 SSNs used on PPP/COVID-19 EIDL applications
submitted after the SSN owner’s Date of Death
SSNs used on SSNs used on
applications submitted disbursements after Disbursements
Timeframe* after death date death date** using these SSNs Total dollar value
Before Use of DNP 2,783 91 108 $ 7.47 million
After Use of DNP 375 41 45 $ 2.96 million
Total** 3,109 131 153 $10.43 million
Source: PRAC data analysis of SSNs used on PPP/COVID-19 EIDL applications after date of death.
*Pre-control update includes PPP loans between April 2020 and January 2021 and COVID-19 EIDL loans between March 2020 and April
2021. Post-control update includes PPP loans between January 2021 and October 2022 and COVID-19 EIDL loans between April 2021 and
October 2022.
**The number of SSNs and applications are not a one-for-one match given that a distinct SSN could have been used across multiple COVID-19
EIDL and/or PPP applications that were disbursed and undisbursed. Therefore, an SSN can be associated with multiple applications.
We also identified particularly egregious examples in Scenario 1 where SSNs had an associated date of death one
year prior or earlier to the declaration of the pandemic – March 11, 2020. Specifically, 30 SSNs were used in this
manner on applications that received $1.3 million in total. These examples suggest these identities may have been
exploited for years by wrongdoers in attempts to fraudulently obtain other government benefits.
Pandemic Response Accountability Committee 5
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
Scenario 2 | SSNs identified in Scenario 1 also used on applications submitted
before individual’s date of death:
92 SSNs connected to $13.4 million in potential fraudulent payments.
We further examined the SSNs identified in the scenario above and found that 169 of these 3,109 SSNs had been
used on loan applications that were submitted both before and after the associated individuals’ date of death, and
that 92 SSNs received loan disbursements totaling an additional $13.4 million.12 We believe these are instances of
potential identity fraud.
Scenario 3 | SSNs used on applications belonging to individuals alive at time of
application but deceased before disbursement:
113 SSNs associated with $14.1 million in improper payments.
We found an additional 113 SSNs used in this manner on 118 loan applications that received a loan disbursement.
We believe these are potentially improper payments, but not necessarily fraudulent.13
While PPP loans were disbursed by lenders to applicants in a lump sum, COVID-19 EIDL loans could be distributed
in incremental or partial payments.14 In programs like this, continuous monitoring and recertification of eligibility
through additional DNP checks can help prevent and deter improper payments. For example, in 2021, SBA added a
control in its COVID-19 EIDL program to detect late-stage bank account changes prior to disbursement. Beginning in
2021, SBA also conducted one last fraud check in its loan system of record to identify any duplicate and/or potential
suspicious loans prior to disbursement and issuance of a loan number. This approach is consistent with GAO’s fraud
risk management framework, which requires agencies to automate data-analytic tests to monitor fraud indicators on
a continuous, real-time basis.15
12 While applications submitted while the SSN owner was still alive are not inherently fraudulent, because they were also used on applications following their
associated date of death, this could indicate that these SSNs may have already been exploited while the individuals were still alive, indicating potentially
fraudulent activity.
13 While these individuals were alive at the time the applications were submitted, DNP sources show that they were deceased at the time federal funds were
released to them. The Payment Integrity Information Act of 2019, which authorizes and governs DNP, requires agencies to use DNP sources as a control
before the release of federal funds.
14 The PPP data the PRAC received from SBA does not include a disbursement date. According to SBA guidance, the lender must disburse the loan no later
than 10 days from the date of loan approval. Therefore, we derived the disbursement date as 10 days after the application date.
15 GAO, “A Framework For Managing Risk in Federal Programs,” GAO-15-593SP, July 2015: The objective of fraud risk management is to ensure program
integrity by continuously and strategically mitigating the likelihood and impact of fraud and facilitate achievement of the program’s broader mission and
strategic goals by helping to ensure that funds are spent effectively, services fulfill their intended purpose, and assets are safeguarded. Additionally, in the
context of fraud risk management, the objective is to mitigate fraud risks—in general, to have a very low level of fraud.
Pandemic Response Accountability Committee 6
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
Our Approach and Analysis
As discussed in our January 2023 Fraud Alert, the PRAC’s data scientists identified a targeted selection of 2.7
million SSNs associated with COVID-19 EIDL loan applications that fell under two rule sets:
1. potentially invalid SSNs; and
2. SSNs potentially “not issued” prior to June 2011
Due to limited access to the necessary government information for proper verification, we used our CARES Act
authorities to request SSA’s assistance to provide several verification results on this cohort of 2.7 million SSNs. One
such request was for SSA to verify if any of the SSNs used on associated loan applications were associated with
deceased individuals. SSA could only provide the death indicator information for fully verified SSNs. The SSA was
able to determine that 20,404 out of the 2.7 million SSNs belong to deceased individuals.
What Did We Ask DNP to Do?
As the date of death was not provided in SSA’s verification output, we requested Treasury DNP to provide the date
of death for the 20,404 deceased individuals’ SSNs to perform additional analysis. DNP provided the information
using several data sources available to them including:
1. Electronic Verification of Vital Events Fact of Death (EVVE);16
2. Department of State;
3. American InfoSource Obituary;
4. American InfoSource Probate;
5. Limited Access Death Master File; and
6. Department of Defense Death Data
What Analyses Did We Perform?
Using the date of death results returned from DNP, the PRAC data scientists identified 15,307 SSNs where at least
one of DNP’s data sources returned a date of death. From this data set, the PRAC identified 5,640 distinct SSNs tied
to deceased individuals who received payments from 8,536 PPP loans and/or COVID-19 EIDL applications, totaling
$374 million.17 Of these, we identified 3,222 SSNs used on applications across the three scenarios. The 3,222 is a
subset of the 15,307 containing both disbursed and undisbursed SSNs.18
16 This data set from NAPHSIS | Electronic Verification comes from 44 states and jurisdictions and, therefore, helps cover the state protected records that are
missing from the Limited Access DMF.
17 The PRAC identified COVID-19 EIDL applications and PPP loans using only the deceased SSNs, including applications where the associated first name, last
name, and date of birth may not have matched with the respective data attributes in the deceased SSN data set. We determined that this was appropriate
as all identified SSNs in this population had been confirmed as deceased by SSA. Therefore, any instance with one of these SSNs is questionable and
warrants inclusion in our analysis.
18 The remaining 9,667 SSNs (15,307-5,640) are undisbursed SSNs.
Pandemic Response Accountability Committee 7
FRAUD ALERT FOLLOW-UP: Improved Use of the DNP System Would Strengthen Program Integrity
The data scientists conducted time-based analysis to better understand the timing of the applications and
disbursements in relation to the dates of death, including:
1. SSNs used in COVID-19 EIDL/PPP applications where the date of death preceded the submission date;
2. SSNs used in multiple COVID-19 EIDL/PPP applications both before and after the date of death; and
3. SSNs used in COVID-19 EIDL/PPP applications where the date of death was after the submission date but
preceded the payment date
Of the 15,307 SSNs returned by DNP, there are 191 SSNs where DNP’s data sources returned different dates of
death. According to DNP Analytics, the EVVE death source has a higher degree of certainty; in cases where there
are multiple dates of death with the same SSN, DNP Analytics recommends using the EVVE death date. In the 191
SSNs with multiple dates of death, there are 62 SSNs where the earliest date of death available does not match the
EVVE death date. For 53 of these 62 SSNs, the earliest death date is within 30 days of the EVVE death date. For the
remaining 9 SSNs, the earliest death date differs by 31 days or more from the EVVE death date. We determined that
this is not a significant margin of error. Therefore, for trends and patterns analysis that require date comparison, the
PRAC used the earliest date of death returned by DNP data sources for applicable SSNs.
PRAC’s Commitment to Quality and Integrity
We conducted this review using agile oversight principles that require we adhere to the professional standards
of independence, due professional care, and quality assurance and follow procedures to ensure accuracy of the
information presented. These principles are embedded in the Council of the Inspectors General on Integrity and
Efficiency’s Quality Standards for Federal Offices of Inspectors General.
Pandemic Response Accountability Committee 8
For more information:
Lisa Reijula
Associate Director, Outreach and Engagement
Lisa.Reijula@cigie.gov
Visit us at:
PandemicOversight.gov
Follow us at:
@COVID_Oversight
Report Fraud, Waste, Abuse, or Misconduct:
To report allegations of fraud, waste, abuse, or
misconduct regarding pandemic relief funds or programs
please go to the PRAC website at
PandemicOversight.gov.
A Committee of the
Council of the Inspectors General
on Integrity and Efficiency
File and source
- File
- do-not-pay-fraud-alert-follow-upPRAC.pdf
- Size
- 353,747 bytes
- SHA-256
- e5ae4849e37173e27533a546c5cd02bc0c879f8741e19f86ba0a253d7a5f6c99
- Original
- www.oversight.gov