Report Wa State Auditor Esd Ui Fraud Investigation Ar1028164 2021 04
Summary
A Fraud Investigation Report, Report No. 1028164, published April 13, 2021 by the Office of the Washington State Auditor on the Employment Security Department, covering January 1, 2020 through December 31, 2020. The report describes illegitimate unemployment claims and payments, attributing the largest share to imposters using stolen personal information and identifying reduced verification requirements for Pandemic Unemployment Assistance as a contributing factor. Its tables classify $646,818,372 as misappropriation and $460,503,024 as questionable, for a total of $1,107,321,396 across 245,930 claims. The report states that the Department could not provide enough information in time to fully quantify the loss, and it describes control weaknesses, including that the Department was primarily reactive.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Fraud Investigation Report
Employment Security
Department
For the investigation period January 1, 2020 through December 31, 2020
Published April 13, 2021 Find out what’s new at SAO
by scanning this code with
Report No. 1028164 your smartphone’s camera
A note about data involved in this audit
In January 2021, the State Auditor’s Office was alerted to a potential cybersecurity incident
involving its third-party file transfer service. Among the files that may have been compromised
was a set of data files provided by ESD containing personal information of people who received
unemployment benefits in the 2017 to 2020 time period. The data files were provided as part of
our series of audits of the Unemployment Insurance program. We worked collaboratively with
ESD to assess the information included in the files so we could notify those people whose personal
information may have been compromised. The effort to address the cybersecurity incident
involving the data files was handled separately from the audits themselves, and it did not affect
the findings, conclusions or recommendations of any of the audits.
Office of the Washington State Auditor
Pat McCarthy
April 13, 2021
Commissioner
Employment Security Department
Olympia, Washington
Report on Fraud Investigation
Attached is the official report on a misappropriation at the Employment Security Department. In
May 2020, our Office became aware of false unemployment claims being made in the names of
some of our employees. We contacted the Department about a potential loss of public funds.
Through additional discussions, the ESD shared information about the potential losses they were
experiencing.
This report contains the results of our investigation of the illegitimate unemployment claims and
payments at the Department from January 1, 2020 through December 31, 2020. The purpose of
our investigation was to determine if a misappropriation had occurred and to provide the
Department with recommendations to improve internal controls.
We performed our investigation under the authority of state law (RCW 43.09.290) and included
procedures we considered necessary under the circumstances.
If you have questions about this report, please contact Director of Communications Kathleen
Cooper at (564) 999-0800.
Pat McCarthy
State Auditor
Olympia, WA
cc: Kari Summerour, External Audit Manager
Americans with Disabilities
In accordance with the Americans with Disabilities Act, we will make this document available in
alternative formats. For more information, please contact our Office at (564) 999-0950, TDD
Relay at (800) 833-6388, or email our webmaster at webmaster@sao.wa.gov.
Insurance Building, P.O. Box 40021 Olympia, Washington 98504-0021 (564) 999-0950 Pat.McCarthy@sao.wa.gov
FRAUD INVESTIGATION REPORT
Investigation Summary
In April 2020, the Employment Security Department (Department) became aware that an
increasing number of the unemployment insurance benefit claims it received, and in many cases
had paid, were initiated by someone other than a legitimate claimant. Imposters, posing as
unemployed Washingtonians, used personal information widely available on the “dark web” to
file false claims in record numbers. The Department initiated an investigation, which is still
ongoing. The Department is working with the U.S. Department of Justice and the Federal Bureau
of Investigation, which are also investigating.
In May 2020, our Office became aware of false unemployment claims being made in the names of
some of our employees. We contacted the Department about a potential loss of public funds.
During our investigation, we worked with the Department to obtain information to conduct our
investigation into the loss.
Limitation on investigation scope
One of our investigation objectives was to quantify the extent and scope of illegitimate activity.
This includes quantifying the number and associated dollar amount of illegitimate claims filed
with the Department in 2020, including those the Department stopped before payment, as well as
those actually paid. Throughout our investigation, we consistently adjusted our timelines, as we
acknowledged the Department was having difficulty getting us information. However, even though
the Department made multiple attempts to get us information throughout our investigation, they
could not provide us with enough information timely to fully achieve this objective.
The Department originally provided a report showing claimant-level detail for a large portion of
the loss; however, during the course of our investigation, we determined the report did not
encompass the entirety of the loss. For example, the report showed the “net” amount of loss, not
“gross.” As such, we requested a revision to the report; however, we determined the revised report
unexpectedly omitted data that was included on the original report.
The Department provided us with a final, revised report; however, the Department did not include
a date field. Without the date field, we could not tell if the Department captured the entire
population of claims during the investigation period.
Lastly, the Department’s data can change at any point as new claimant data is entered in the
Department’s system. This means each revised report included different data. Since this
information is not closely monitored by the Department, revision requests added to the complexity
of confirming that all information provided for this investigation was accurate and complete.
Finally, Washingtonians continue to notify the both Department and our Office that unemployment
claims were filed with their stolen personal information. This indicates the actual extent of
misappropriation is greater than the Department has been able to capture so far.
Office of the Washington State Auditor sao.wa.gov Page 4
Background
The Department’s usual operating budget before the pandemic was about $400 million. The
Department administers programs authorized under the Workforce Innovation and Opportunity
Act, paid family medical leave program and Unemployment Insurance program. The Department’s
Office of Special Investigations and Financial Services Division are tasked with reviewing any
potentially illegitimate claims. In 2020, the Department paid out more than $13.6 billion in
unemployment benefits.
Soon after the coronavirus pandemic was declared a national emergency on March 13, 2020, the
federal government took action. On March 18, 2020, the Families First Coronavirus Response Act
(FFCRA) was signed into law, which provided additional flexibility for state unemployment
insurance agencies. On March 27, the Coronavirus Aid, Relief, and Economic Security (CARES)
Act was signed into law. The CARES Act in turn created the Pandemic Unemployment Assistance
(PUA) program. This program offers unemployment assistance to classes of workers, such as those
who are self-employed or working part time, not normally eligible for regular unemployment
compensation. PUA allows eligibility for these people if they are not considered able and available
for work for reasons related to the coronavirus pandemic, without the typical verifications required
for regular unemployment benefits.
The CARES Act also created the Federal Pandemic Unemployment Compensation (FPUC)
program, which allowed people receiving regular unemployment or PUA benefits to have their
weekly benefit amount increased by $600. The Pandemic Emergency Unemployment
Compensation (PEUC) program allowed people who had exhausted their unemployment benefits
to claim benefits for an additional 13 weeks.
In spring 2020, the Department received record numbers of unemployment claims as a result of
the pandemic and the state’s efforts to manage its spread, such as the Governor’s “Stay Home,
Stay Healthy” order. In late April, an investigator in the Department’s fraud detection unit learned
from staff at a federal agency that unemployment claims had been made in the names of people
currently employed. Over the next few days, the same federal contact reached out to the
Department with further instances. The Department received an increasing number of reports over
the following weeks from citizens, federal and Washington state agency sources. On May 14, the
U.S. Secret Service released an informational alert about “imposter fraud” targeting
unemployment programs in Washington and other states. That same day, the Department
announced that it was suspending payments for two days to help “validate claims as authentic,”
and provided information on how people should report illegitimate claims made in their name.
Office of the Washington State Auditor sao.wa.gov Page 5
Investigation results
The widespread unemployment misappropriation was carried out through multiple schemes. The
reduced verification requirements for Pandemic Unemployment Assistance (PUA) benefits may
have been the largest contributing factor in allowing each type of misappropriation to occur.
Reduced verification requirements for PUA
The new PUA program expanded unemployment benefits to new classes of workers not previously
eligible, such as self-employed workers and gig workers. PUA allowed eligibility for these people
if they were not considered able and available for work for reasons related to the coronavirus
pandemic. The program did not apply the typical verifications required for regular unemployment
benefits. For example, when applying for other unemployment funding, claimants are typically
required to provide verification of prior employment, such as a pay stub or W-2. The Department
also verified the claimant’s employment with the prior employer. These verification steps are not
required to receive PUA funding.
The U.S. Department of Labor’s Employment and Training Administration instructed states not to
require people applying for PUA to provide documentation to support their employment, but rather
to accept an applicant’s self-certification. On May 26, 2020, the Office of the Inspector General
(OIG) issued an alert memorandum highlighting the increased risk for fraud due to the sole reliance
on self-certification for claimant eligibility. On June 5, the Department of Labor responded,
maintaining its position that the PUA program does not require proof of employment, but requires
only that applicants self-certify their employment status.
The PUA eligibility form asks claimants a list of questions. They only need to check a box to be
eligible for benefits. This simple certification made it easier for ineligible people and imposters
with stolen information to submit illegitimate claims.
Within a week of PUA funding availability, the number in potentially illegitimate claims began to
increase sharply, reaching a peak in the week starting May 10. This chart illustrates the number of
claims and associated benefit payments that the Department either confirmed as misappropriation
or flagged as potential misappropriation; the latter is still under investigation by the Department.
Office of the Washington State Auditor sao.wa.gov Page 6
Misappropriation schemes
We’ve classified the schemes used to conduct the widespread unemployment misappropriation at
the Department into three categories. While the largest portion is attributed to external bad actors
who used stolen personal information to file claims, other schemes were also successful.
Imposter scheme: Bad actors using stolen personal information
The largest scheme in terms of both dollar amount and number of claims was conducted by bad
actors using stolen personal information to file illegitimate claims.
Our investigation did not attempt to determine the exact source of personal information used in
this scheme. However, personal information for potentially millions of Americans is available for
sale on the dark web. Cybercriminals have obtained this information through various means,
including a series of large-scale data breaches. The Equifax breach alone exposed more than 145
million consumers’ personal information in 2017.
With stolen identities in hand, the bad actors created user accounts for each identity and filed
claims. They primarily applied for PUA benefits, given the program’s lax eligibility and
verification requirements. For a more in depth discussion of this scheme, please refer our Office’s
related performance audit, Washington’s Unemployment Benefit Programs in 2020.
Claimant scheme: People claiming benefits when they are ineligible
Another category of loss was carried out by people who filed claims under their own valid
identities but were not actually eligible for benefits.
Office of the Washington State Auditor sao.wa.gov Page 7
This scheme involves the intentional misreporting or withholding of information in order to receive
benefits, such as:
• Knowingly submitting false information
• Knowingly continuing to collect benefits when ineligible
• Certifying for benefits under state law despite not being able and available to work
The scheme is not new to the Department. The agency’s fraud detection strategy prior to 2020 was
designed mostly to detect claims made under this scheme. For example, the Department verified
wages and employment status with employers to verify eligibility. However, the introduction of
PUA funding made it easier for people to claim benefits they were not eligible for. For example,
the Department may not be able to verify employment for claimants certifying they are
self-employed.
Potential misappropriation by department employees
We are conducting an ongoing investigation into this matter, and will issue a separate report upon
its completion.
Quantifying the misappropriation
The Department categorizes known and potentially illegitimate claims into various categories as
the Department initially flags the claim for review and subsequently investigates it. As one
example, in a nightly process referred to as “Discovery,” the Department’s software system
evaluates unemployment claims against a series of metrics in a variety of categories that have been
shown to correlate with fraud. Claims that contain a combination of certain risk elements are
flagged for review by the Department’s Office of Special Investigations.
We have categorized claims flagged for review by Special Investigations, but not yet investigated,
as questionable, because the Department cannot yet know whether these claims represent
misappropriation.
Dollar amount Imposter claims People claiming Total
benefits when they
are not eligible
Misappropriation $642,954,417 $3,863,955 $646,818,372
Questionable $458,112,292 $2,390,732 $460,503,024
Total $1,101,066,709 $6,254,687 $1,107,321,396
Office of the Washington State Auditor sao.wa.gov Page 8
Number of Imposter claims People claiming Total
claims benefits when they
are not eligible
Misappropriation 191,634* 2,157 193,791
Questionable 51,340 799 52,139
Total 242,974 2,956 245,930
*Includes illegitimate claims filed, but stopped by the Department before making
payment.
Not every misappropriated dollar makes it into the hands of bad actors
Even though the Department suffered a loss of over $646 million, those dollars did not necessary
make it to the bad actors. Portions of the benefit payment can be withheld and redirected. For
example, the Department may deduct child support garnishments or federal taxes and redirect that
money to the Department of Social and Health Services or Internal Revenue Service respectively.
State versus federal dollars
Members of the public and lawmakers have expressed interest in knowing in the dollar value of
the loss that was an actual loss to the state, but determining this would require calculating what
portion of the misappropriated funds was comprised of state tax dollars. The Department did not
provide this data in the format we needed for our analysis before we issued this report.
Management at the Department explained that the Unemployment Tax and Benefit (UTAB)
system was not designed to draw the data we asked for because no federal or state laws require the
agency to report data in that way. Developing the requested data requires the Department to change
how financial information is stored in the UTAB system; the Department is currently working on
doing so.
Control Weaknesses
Internal controls at the Department were inadequate to safeguard public resources. Some control
weaknesses were information technology (IT) related. Because public distribution of information
about tests performed and the related results could increase the risk to the Department, distribution
of recommendations related to IT will be limited to management and the governing body of the
Department. In addition to the IT control weaknesses, we found the following additional
weaknesses allowed the misappropriation to occur:
The Department was primarily reactive
The Department’s pre-pandemic fraud detection and prevention structure was not prepared for the
massive influx of claims during the pandemic, or for the shift in illegitamate claims from those
made by ineligble residents to those made by bad actors using stolen identities.
Office of the Washington State Auditor sao.wa.gov Page 9
Some of the tools in the Department’s fraud prevention portfolio were not working early in 2020.
For example, the Department ran certain Discovery tools a day after claims were processed and,
potentially, paid. This was an intentional choice due to a key component of Discovery that required
additional time to run. Prior to March 2020, this choice may not have had the same consequences.
In accordance with state law, claimants were not paid during the first week of unemployment
eligibility, which gave the Department time to run Discovery tools. However, when the governor
authorized the Department to waive the one-week waiting period in March, many payments went
out before the Discovery process ran.
In March 2016, we released an Accountability Audit showing that some incarcerated people
received unemployment benefits. Incarcarated people are typically not able and available to work,
and are therefore ineligible for benefits. To prevent improper payments, we recommended the
Legislature allow the Department to use jail information to perform a cross-match with
unemployment insurance payments and incarceration records. We also recommended the
Department continue to identify and investigate improper payments to incarcerated people.
In 2018, the Department discontinued its cross-match between people filing for unemployment
benefits and people in jails and prisons. The Department ran this cross-check in prior years, but
discontinued it when the Department of Corrections changed the format of its data, which then
caused problems with Department’s cross-checking software. The Department ran a cross-match
late in 2020, analyzing the first three quarters of the year, and flagged 1,500 potentially ineligible
claims made by incaracarated people.
Separately, although the Department runs the Discovery process to flag potential illegitimate
claims, the Department will continue to pay claims flagged with eligibility issues until Special
Investigations has determined they are either valid or illegitimate – as long as the claimant
continues to file weekly, and the initial payment was made.
The Department’s identity verification process may not be sufficient
When claims are flagged for any number of reasons, Department staff try to verify the claimant’s
identity. We examined a selection of claimant accounts along with the documents that claimants
submitted to verify their identity. While many claimants provided reasonable and appropriate proof
of their identity, we also found instances of some questionable documents. With the massive influx
of flagged claims, at the end of 2020, Special Investigation’s has accumulated a backlog of roughly
56,000 claims, just relating to possible cases of imposters filing with stolen personal information.
The Department requires management oversight of their key activities
Department and Special Investigations staff make important decisions for claims they work with,
and can approve payment on large dollar-amount claims, especially if the claimant has back-dated
claims. However, the Department does not require a secondary review of the decisions staff make
about the claim’s legitimacy, even for large claims. This heightens the Department’s risk of
illegitimate claims being erroneously cleared and paid. Further, this lack of secondary review
Office of the Washington State Auditor sao.wa.gov Page 10
creates an opportunity for Department staff to abuse their positions by possibly approving
ineligible claims for friends or family, or even submitting and approving ineligble claims for
personal benefit. These risks were exacerbated during the pandemic, as the Department hired 417
additional people to help process claims. These new staff were given access to the claims system
with minimal training.
Furthermore, the Department lacks adequate procedures to monitor the overall extent of loss,
including the development of accurate and complete reports to capture loss activity.
Early in our investigation, we asked the Department for detailed records concerning the complete
population of misappropriation by claim, illegitimate claims filed but caught before payment, and
other information on subsets and categories of loss. While the Department was able to give us
information, the agency’s IT staff had to build new reports based on our requests. This indicates
the Department does not have this information readily available for its own analysis and
management of loss. Additionally, the Department indicated it verified the data provide to us;
however, we identified discrepancies, such as claims included on one report but unexpectedly
omitted from another.
Recommendations
Internal controls
The Department said it has taken steps to improve its control structure. We recommend the
following to supplement those actions:
• Develop an agency plan to adequately respond to any future surges in Unemployment
Insurance claims.
• Continue to improve the fraud prevention portfolio, including the Discovery process, to
identify known or potentially illegitimate claims accurately and promptly.
• Ensure the cross-match between claimants and incarcerated people is performed
consistently.
• Dedicate resources as needed to clear the backlog of flagged claims.
• Improve the identity verification processes to ensure claimants provide sufficient, valid
proof of their identities.
• Improve monitoring over employees to include approval levels for certain dollar thresholds
of benefit payments, and frequent spot checks of other activity.
• Improve Department oversight to evaluate the extent and population of the entire loss,
including improved reporting mechanisms.
• We also recommend the Department implement recommendations we will provide in a
separate communication about IT systems.
Office of the Washington State Auditor sao.wa.gov Page 11
Recovering misappropriated funds
The Department has worked with federal agencies and banking institutions to recoup some of the
lost funds. As of March 2021, the Department reports it has recovered $369,798,082 of the loss:
We recommend the Department continue seek recovery of the remaining loss.
Department’s Response
The Department deeply appreciates the role of the State Auditor’s Office (SAO), and welcomes
any new insights that will bolster the progress the Department has already made to reduce the risk
of fraud.
It must be made clear that, although there are aspects of the Accountability Audit the Department
agrees with, there are also deep flaws, numerous pieces of incorrect information and overall, the
characterization of the total amount of possible imposter fraud paid in 2020 is false.
This audit stands in stark contrast to the SAO’s Performance Audit, which is both thorough and
followed processes that allowed the Department the opportunity for technical review of a draft
report to provide corrections and clarification where needed.
Office of the Washington State Auditor sao.wa.gov Page 12
The heart of any state agency’s challenge when providing essential benefits to Washingtonians is
in balancing service delivery and the safeguarding of public funds. As noted in the SAO’s
Performance Audit:
ESD has already taken steps to restructure and expand its fraud program and to
hire additional staff to address concerns about customer service. We make no
additional formal recommendations, but strongly encourage ESD to continue its
efforts to address these issues.
The Department remains wholly committed to our ongoing efforts to strike this balance between
service delivery and fraud prevention, and will continue to be transparent about our successes,
challenges and lessons learned. We also will continue to be a dedicated partner to the SAO, and
share the desire to identify and address the strengths and weaknesses of our agency’s response in
this historic crisis.
Background
When the COVID-19 pandemic hit in the spring of 2020, the Washington State Employment
Security Department (Department) was one of the first state workforce agencies to implement the
new unemployment benefit programs created under the Coronavirus Aid, Relief, and Economic
Security Act (CARES Act), including the Pandemic Unemployment Assistance program (PUA).
The prompt rollout of these essential benefits, along with our state having one of the highest weekly
benefit amounts in the nation, made Washington an early target of an unprecedented nationwide
imposter fraud attack.
The Department’s swift action to halt the attack was highly effective in stopping further fraud, and
even using the SAO’s figures for misappropriation, resulted in less than 5 percent of total benefits
paid to imposters during 2020. For context, the U.S. Department of Labor’s Office of Inspector
General assumed a baseline 10 percent CARES Act benefit improper payment rate, with a
significant portion due to fraud, as nationwide the state UI program improper payment rate is
typically above the 10 percent acceptable threshold set in federal statute and implementing federal
guidance.
It is always a priority of the Department to keep losses as low as possible, and pre-pandemic levels
of loss due to fraud were about 3.4 percent. Moreover, we are currently below the 10 percent
baseline assumption for improper payments even as other states have struggled with much higher
losses due to fraud.
Data provided by the Department to the SAO
In the spirit of partnership, the Department has spent hundreds of staff hours gathering the
required information and developing new reports requested by the SAO when they were not
already available. The development of these reports often takes complex technical programing,
which siphons hours otherwise spent in implementing benefit extensions or customer service
Office of the Washington State Auditor sao.wa.gov Page 13
improvements. The aggressive timelines set by the SAO, and their revisions to data requests,
complicated these efforts. It is worth noting that since this audit work began in December 2020,
the Department has implemented two rounds of significant extensions of the federal CARES Act
benefits and developed an entirely new direct benefit at the state level.
Contrary to the published report, the Department provided the SAO the data requested within their
parameters. While the SAO argues that they couldn’t complete the depth of the work (or had a
“limitation on scope”) to answer their questions about fraud, the data the Department provided
the SAO was timely and in the format investigators requested, as they confirmed during meetings
with Department staff. The only exception was one report, that breaks the losses out by federal
and state dollars, which isn’t relevant to the total amount of loss. The Department discussed this
report in advance and agreed to a later delivery date. The Department continues its willingness to
provide the SAO with the information they requested to meet their objectives. However, the SAO
has imposed their own deadlines and communicated they will not accept additional information
offered by the Department for the purposes of their report.
Also contrary to the SAO report, the Department has sufficient tools in place to analyze and
manage potential fraud and losses, and has a robust monitoring system in place. The data provided
is “living data” that naturally changes daily as new information comes in about individual claims
and claimants. The Department is constantly monitoring this data for fraud trends and adjusting
our controls to improve efficiencies and limit false positive ratios. The Department’s Financial
Unit also constantly monitors data to ensure the Department is not making payments to claims
identified as fraudulent.
No opportunity to provide technical review of the audit
As a ready partner in safeguarding public assets, the Department was disappointed it was not
given a draft report in order to provide technical review of the work in this audit. This opportunity
to provide technical review and corrections has been afforded with every other audit conducted
so far. As such, much of the information in the report has not been validated by the Department
and there is information included that is inaccurate. A notable example is the mischaracterization
of the total potential fraud loss. There are also inaccuracies in the report about various processes
and methods of information verification that we would have appreciated the opportunity to correct.
The lack of transparency and opportunity to provide technical review directly resulted in gross
inaccuracies throughout the SAO’s report.
Key points of clarification
• Inaccuracy in reported fraud amounts: Since the novel imposter fraud attack that
occurred, primarily in May 2020, the Department has been very open about the estimated
loss of between $550-$650 million – although roughly $370 million has already been
recovered by the Department. The total likely imposter fraud reported by the SAO –– which
was validated in three of the SAO’s audits of the unemployment benefit programs and
Office of the Washington State Auditor sao.wa.gov Page 14
conducted under Governmental Auditing Standards –– was about $647 million and falls
within the Department’s initial estimates.
In this audit however, the SAO has reported a possible total of more than $1.1 billion in
imposter fraud. Taken at face value, this is widely variant from the Department’s numbers
reported and those validated in other SAO audits. It must be made clear that this total
represents a gross mischaracterization of possible fraud loss.
There are two primary reasons this total inflates what the Department has reported:
1. The SAO’s inclusion of “Questionable” claims.
2. The SAO included additional types of fraud not part of the novel imposter fraud
attack.
The SAO’s inclusion of “Questionable” claims falsely and dramatically inflates the
possible total imposter fraud. There are three key reasons for this.
First, this category constitutes a population of claims flagged for review that are in no way
connected to the novel imposter fraud attack last May. This population is highly transitory
and will change daily as claims are flagged for review, investigated, and resolved.
Including this category creates a perception that there are hundreds of millions of possible
dollars paid to imposters that the Department has not disclosed. This is simply not true.
Imposter fraud has been almost entirely stopped as a result of the actions the Department
took following the May 2020 attack, as noted in the SAO’s own Performance Audit –
conducted at the same time as this investigation – in which the SAO stated “ESD did not
make significant payments to fraudsters after [the May 2020 attack] despite high demand
for unemployment assistance throughout 2020.” (See the Appendix for further details.)
As such, the “Questionable” category includes claims that are not imposter fraud. For
example, legitimate claimants that had an identity issue flagged and who failed to provide
necessary documentation to the Department in time, resulting in presumptive denial of
benefits, are included in this category. Another example is claimants the Department is
waiting to hear back from after contacting them.
To further illustrate the transitory nature of this population, the data run on March 6, 2021,
produced the $458 million in “Questionable” imposter fraud in the SAO’s report. The
exact same data set run on April 8, 2021, updates that figure to approximately $222
million. In one month, what the SAO deems as “Questionable” imposter fraud decreased
by $236 million. This is because the SAO is reporting claims flagged that need review but
that ultimately are not found to be imposter fraud. What hasn't changed is the roughly $643
million in confirmed and probable imposter fraud, which remains within the range the
Department first reported and is reaffirmed in this and other SAO reports. Again, it is
Office of the Washington State Auditor sao.wa.gov Page 15
worth noting the Department has already recovered roughly $370 million and continues
to pursue further recoveries.
Second, it is inappropriate to label as “imposter fraud” claims that remain under
investigation. In fact, the SAO defines that to be the entirety of the “Questionable”
population, which the SAO says is “claims flagged for review by Special Investigations,
but not yet investigated.” The SAO’s Performance Audit identified a loss of $647 million,
a figure the Department largely agrees with, indicating this “Questionable” category
cannot be verified as imposter fraud and should not be considered in the total for this
report.
Third, the SAO inflates the number of claims that remain under investigation. The SAO’s
definition of “Questionable” as awaiting investigation is not aligned with the data they
use. In the data provided on which the SAO relies for its table on page 7 of the report,
many of the claims were and are not awaiting investigation but had been denied or
presumptively denied. And those claims are not imposter fraud, because the claims that
have been determined and rise to the level of confirmed or probable fraud appear in the
SAO’s data as misappropriation.
For all of these reasons, the “Questionable” fields are unreliable and should have no place
in this report.
The SAO included additional types of fraud not part of the novel imposter fraud attack
(see below for more). The estimates that have been given by the Department in previous
statements and presentations were in reference to the imposter fraud attack only.
• Additional types of fraud: The Department is not clear as to why two additional types of
fraud were included within the scope of this audit:
• Claimant fraud: People claiming benefits when they are ineligible is an ongoing
risk for the Unemployment Insurance system throughout the nation. As the SAO
noted, the Department developed its fraud detection strategy to primarily address
this type of fraud and our controls are highly effective in combatting it.
Additionally, there are claims the SAO categorizes as “claimant fraud” that have
been investigated and cleared and yet are still inaccurately included in the “People
claiming benefits when they are not eligible – Questionable” category. As such, the
SAO’s numbers are inaccurate.
• Potential internal fraud: The Department is committed to protecting public dollars
from all types of fraud. The SAO highlights the potential for fraud committed by
internal employees. This is not currently, nor has it ever been, a systemic issue. In
2020, the Department detected and reported two cases of suspected employee fraud
to the SAO. Only one of these is likely to be a confirmed isolated case of individual
fraud, although it is still under investigation by law enforcement and is immaterial
Office of the Washington State Auditor sao.wa.gov Page 16
to the overall losses due to fraud in 2020. The other case was found to not be
fraudulent.
• Inaccuracies in processes: There are several inaccuracies related to processes or
verifications published in this report. Examples include:
• Confusing eligibility fraud with imposter fraud. Claims flagged as potential
imposter fraud are not paid while the investigation is pending. The SAO identified
a control weakness that the Department is continuing to pay claims with certain
eligibility issues, when in fact the Department must do this per state and federal
requirements, as has been the case for decades. When that eligibility issue is
imposter fraud, however, those claims do not continue to pay out and the SAO’s
inclusion of this issue represents a deep misunderstanding of the Department’s
rules and has the potential to create confusion in a report that is intended to focus
on imposter fraud.
• Misunderstanding of the Discovery process. This report inaccurately describes the
Discovery process as an eligibility control, when it is instead about identity
verification. Tying the Discovery process to claims paid with eligibility issues is
inaccurate. We do not continue to pay claims flagged by the Discovery process
because, since last May, we stop payment on claims flagged with identity issues
until we have received sufficient information to verify the claimant’s identity.
• Inaccurate characterization of PUA. While the SAO correctly identifies aspects of
PUA as ripe for fraud, the Department implemented the program – including
allowing claimants to self-certify eligibility – as prescribed in the CARES Act and
affirmed in U.S. Department of Labor guidance. The Department does not have
discretion in how it implements this federal program. Moreover, there are
inaccuracies that raise fundamental questions as to whether SAO understands how
unemployment programs work. For example, the SAO fails to note that claimants
must first be denied regular unemployment benefits before being afforded the
opportunity to apply for PUA (a claimant cannot just apply directly for PUA). They
also state that regular unemployment claimants are typically required to provide
verification of prior employment such as a paystub or W-2 – this is not true.
Individual wage information is reported by employers, and individuals only provide
it when their employers have failed to report as required by law.
• False reporting of the backlog of 56,000 claims. There was not a backlog of 56,000 claims
relating to possible imposter fraud. Of that 56,000, about 19,000 claims with new issues
were awaiting initial review by an investigator. The rest of these claims had been
investigated and determinations on them had been made.
Office of the Washington State Auditor sao.wa.gov Page 17
• Payments to incarcerated individuals remains a low risk issue: Contrary to the report,
the Department does conduct crossmatching on claims made by incarcerated individuals.
Although one type of crossmatch was temporarily inoperable because of the way the data
was provided to the Department, the agency has continued crossmatching. As such, fraud
by incarcerated individuals is a low risk.
For example: Out of the roughly 1,500 incarcerated individuals that
applied for unemployment benefits, only 67 were newly identified claimants
that were determined to be committing fraud (totaling $83,950). The rest
had already been flagged, were legitimate claimants or otherwise found to
be not fraudulent.
Many recommendations are already implemented or underway
Since the imposter fraud attack last May, the Department has set in place a continuous process to
improve its fraud prevention portfolio and strengthen internal controls within the Department as
a whole. In the course of these ongoing improvements, many of the SAO’s recommendations in
this audit have already been put in place, and it is unfortunate the Department did not get the
opportunity to provide this information for inclusion. Some of the many activities include:
• Creating and fully staffing a unit headed by a Chief Fraud Officer. This unit is dedicated
to combating all types of fraud and is already underway in developing a response strategy
for any surge in fraud that may occur in the future.
• Hiring an Internal Control Officer to review agency internal control systems.
• Conducting a comprehensive review of the Department’s employee-based internal controls
with a focus on monitoring activities and approval levels. This review is critical to the
balance the Department must strike between timely benefit payments and protection of
public funds.
• Building a formal management structure specific to data analytics and fraud detection.
• Establishing a specialized team in August 2020, dedicated to reviewing new claims for
fraud schemes.
• Partnering with other state industries and financial institutions to implement industry
fraud prevention best practices and recovery of funds. We have already successfully
recovered $370 million – a number we expect to continue to rise as the recovery is ongoing.
• Continuing to implement and refine a suite of identity verification tools.
All of these and other controls implemented are proving to be effective, as there has been a
dramatic reduction in fraudulent claim attempts since June 2, 2020.
Office of the Washington State Auditor sao.wa.gov Page 18
Closing
Assessing the lessons learned from this crisis is an ongoing effort by the Department. All aid in
that effort is welcome, including the audits from the SAO. No single narrative can capture the
complexity of what happened over the past year, and yet with the benefit of hindsight the
Department and its partners may continue to learn and adapt to this new reality. As always, this
assessment serves the critical pursuit of balancing rapid service delivery to eligible claimants, and
prevention of fraud from those who seek to do harm.
Appendix
From the SAO’s Performance Audit, April 2021: “Exhibit 3 shows that the wave of fraudulent
payments were made when ESD was already struggling to manage the first wave of pandemic-
related claims. The graph also shows that ESD did not make significant payments to fraudsters
after that time despite high demand for unemployment assistance throughout 2020.”
Auditor’s Remarks
This report, along with the accountability audit report and the performance audit report, seek to
establish the extent and scope of illegitimate claims activity, and to understand the reasons behind
the payments. The audits work together to explain what happened during the pandemic-related
unemployment surge and its effect on the state’s administration of benefits. Each audit and report
serves important objectives. The fraud investigation provided a detailed analysis of all
unemployment-related fraud, and examined known and potential losses from all misappropriation
methods or schemes. This analysis necessarily included more than just the imposter fraud, because
our responsibility is to explore and report on all aspects of any loss of public funds. The
performance audit focused on the significant “imposter fraud” and customer service issues at the
Office of the Washington State Auditor sao.wa.gov Page 19
Department, and put those issues in a national context. The performance audit relied on numbers
from this fraud investigation.
Each audit report references and properly contextualizes the misappropriated amount of
$646,818,372. The fraud report includes the questionable amount of $460,503,024 as is
appropriate for its objective. Each report explains how the figures were determined, and each report
explains why the total loss of public funds is likely higher than what has been previously described
publicly. Finally, each report acknowledges improvements at the Department while describing
weaknesses in internal controls that existed at the time of the misappropriation.
The Office of the Washington State Auditor stands behind its work and re-affirms its findings. We
will continue to audit the Department and verify the amount of known and suspected
misappropriation related to pandemic-era unemployment benefits.
Office of the Washington State Auditor sao.wa.gov Page 20
ABOUT THE STATE AUDITOR’S OFFICE
The State Auditor’s Office is established in the Washington State Constitution and is part of the
executive branch of state government. The State Auditor is elected by the people of Washington
and serves four-year terms.
We work with state agencies, local governments and the public to achieve our vision of increasing
trust in government by helping governments work better and deliver higher value.
In fulfilling our mission to provide citizens with independent and transparent examinations of how
state and local governments use public funds, we hold ourselves to those same standards by
continually improving our audit quality and operational efficiency, and by developing highly
engaged and committed employees.
As an agency, the State Auditor’s Office has the independence necessary to objectively perform
audits, attestation engagements and investigations. Our work is designed to comply with
professional standards as well as to satisfy the requirements of federal, state and local laws. The
Office also has an extensive quality control program and undergoes regular external peer review
to ensure our work meets the highest possible standards of accuracy, objectivity and clarity.
Our audits look at financial information and compliance with federal, state and local laws for all
local governments, including schools, and all state agencies, including institutions of higher
education. In addition, we conduct performance audits and cybersecurity audits of state agencies
and local governments, as well as state whistleblower, fraud and citizen hotline investigations.
The results of our work are available to everyone through the more than 2,000 reports we publish
each year on our website, www.sao.wa.gov. Additionally, we share regular news and other
information via an email subscription service and social media channels.
We take our role as partners in accountability seriously. The Office provides training and technical
assistance to governments both directly and through partnerships with other governmental support
organizations.
Stay connected at sao.wa.gov Other ways to stay in touch
• Find your audit team • Main telephone:
• Request public records (564) 999-0950
• Search BARS manuals (GAAP and
cash), and find reporting templates • Toll-free Citizen Hotline:
• Learn about our training workshops (866) 902-3900
and on-demand videos
• Email:
• Discover which governments serve you
webmaster@sao.wa.gov
— enter an address on our map
• Explore public financial data
with the Financial Intelligence Tool
Office of the Washington State Auditor sao.wa.gov Page 21
File and source
- File
- REPORT_WA-State-Auditor_ESD-UI-fraud-investigation-ar1028164_2021-04.pdf
- Size
- 521,796 bytes
- SHA-256
- a44fbdd2e34b2eca67b7b8a5a7ae2aaa0112367eb485e1663b7ec88024aa51a0
- Original
- portal.sao.wa.gov