SBA, Response to COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Project 23010, June 21, 2023)

Summary

A memorandum dated June 21, 2023 from Bailey DeVries, Acting Associate Administrator, Office of Capital Access, to Hannibal “Mike” Ware, Inspector General, on the subject "Response to COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Project 23010)." It states SBA's concern that the Office of the Inspector General's Fraud Landscape white paper contains serious flaws that significantly overestimate fraud. Its stated objections are that the paper only minimally acknowledges SBA's improved fraud controls, with 86% of the fraud by SBA's estimate occurring in the first nine months; that the white paper's 34% potential fraud rate for COVID-EIDL does not stand up against SBA's repayment data; and that potential fraud is presented as if it were likely fraud. SBA states that its reviews found likely fraud of approximately $36 billion across PPP and COVID-EIDL.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

                                  U.S. SMALL BUSINESS ADMINISTRATION
                                         WASHINGTON, DC 20416




Date:          June 21, 2023

To:            Hannibal “Mike” Ware, Inspector General

                                                                                           BAILEY     Digitally signed by BAILEY

From:          Bailey DeVries, Acting Associate Administrator, Office of Capital Access DEVRIES       DEVRIES
                                                                                                      Date: 2023.06.21 23:59:13
                                                                                                      -04'00'




Subject:       Response to COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape (Project 23010)



Thank you for the opportunity to review and respond to the Office of the Inspector General’s (OIG) Fraud
Landscape white paper. The U.S. Small Business Administration’s (SBA) appreciates our partnership to
strengthen all of SBA’s programs, and especially the significant work we have done together to address
fraud in the Paycheck Protection Program (PPP) and COVID Economic Injury Disaster Loan (COVID-
EIDL) programs, as well as establish a strong fraud risk framework to strengthen SBA against future
potential risks. However, we are concerned that the white paper’s approach contains serious flaws that
significantly overestimate fraud and unintentionally mislead the public to believe that the work we did
together had no significant impact in protecting against fraud. The concerns are as follows:
   1) The paper only minimally acknowledges a critical aspect of SBA’s fraud controls—the
      material fact that SBA’s fraud controls improved dramatically over time. While the white
      paper highlights 16 measures the SBA put in place in 2021 to stem the tide of the fraud attacks that
      were prominent at the outset of COVID-EIDL and PPP, the white paper does not provide a clear
      accounting of when the largest amounts of fraud took place and when the efforts in early 2021 to
      address it were taken. The statement: “there was an insufficient barrier against fraudsters” does
      not clarify the applicable time period for this conclusion. SBA believes a full accounting of our
      work together would provide critical context for fraud in the programs and when that fraud
      occurred. The vast majority of the fraud, 86% by SBA’s estimate, occurred in the first nine months
      of COVID-EIDL and PPP. It is critical to clarify when SBA added controls and to emphasize
      which of those controls effectively protected against fraud. Such changes can provide valuable
      information to policymakers, as they consider effective controls for inclusion in legislation and at
      program launch for any future emergency program.
        You have previously highlighted this distinction. In January 2022 you stated:
               SBA is more prepared now than they've ever been in terms of the control environment…
               certainly much stronger than… at the onset of the pandemic… The agency has moved
               rather expeditiously to close out the majority of the [IG] recommendations.
   SBA acknowledges the prior administration made decisions to prioritize speed and unnecessarily
   deflated the control environment for PPP and COVID-EIDL for the first several months of the
   programs. However, SBA introduced additional fraud controls over time and implemented a
   strengthened anti-fraud control framework in 2021. For example, SBA introduced pre-award
   application screenings beginning in January 2021, including automated screenings for PPP,
   adding tax transcript verification for COVID-EIDL, and running applications through the
   Treasury Department’s Do Not Pay system. These controls saved billions. Additionally, SBA
   conducted a full review of all loans originated in 2020 to find likely fraud and refer it to your
   office. As a result of this work, SBA has found 86% of likely fraud originated in the first nine
   months of the programs. And while this white paper did not cover the Restaurant Revitalization
   Fund or Shuttered Venues Operator Grant programs, two new programs that were launched in
   2021 had a combined fraud rate SBA estimates near half of one percent.
2) The white paper’s estimate of a 34% potential fraud rate for COVID-EIDL does not stand
   up against SBA’s current repayment data: Only 12% of lending went to borrowers who are
   past due and yet to make payments, most of which is likely accounted for by real businesses
   that closed or are unable to repay. Common-sense dictates that a bad actor would not
   fraudulently obtain a loan, only to repay it with interest. You have previously pointed out that
   fraudsters have no intention of repaying their loan (OIG Report 22-09), and that the true extent
   of fraud would become known once loans enter repayment (Deputy IG Testimony, March 2023).
   Now, in June 2023, an overwhelming majority of the portfolio by volume has passed deferral
   and is now obligated to repay. We recommend your office match the list of “potential
   fraudulent” COVID-EIDL borrowers with their actual repayment history, which OIG staff told
   SBA it considered but decided not to do as part of its white paper analysis. SBA would be happy
   to partner with your office in this analysis.
   As of June 2023, only 12% of loan dollars went to borrowers who have not yet begun, but still
   may begin, repayment after their loan came due. Every other business has either fully repaid
   their loan or begun to do so (74%), or is still in the allowed deferment period (14%).
   Importantly, most borrowers who do not repay their loans are not fraudulent; they are real
   businesses who did not make it through the turbulence of the pandemic and have no ability to
   repay. Indeed, early in the program, budget officials projected a default rate over one-third due to
   the likelihood of distress and closure under the unique, historic circumstances of the pandemic.
   Although SBA continues to estimate a higher-than-average non-repayment rate for the program
   overall, SBA’s modeling relied on structural elements of the programs, such as Congress’s
   decision to remove the requirement for personal guarantees for most loans, and the high
   likelihood of small business closures during the pandemic and years-long impact it had on the
   economy.
3) Third, the white paper presents a summary of loans that are potential fraud as if they were
   loans that are likely fraud. The white paper provides an estimate of “potential fraud,” but does
   not explicitly define the term except mentioning that OIG believes all loans identified “warrant
   investigation.” It is important to provide clear definitions of terms like “potential fraud” to
   differentiate from “likely fraud” or “confirmed fraud.” This is important both for policymakers and
   for the small business owners who may consider participating in future federal emergency loan
   programs. SBA invites the opportunity to work together with OIG on this issue so we have a
   common framework which will benefit all program stakeholders. Without such, the white paper
   leads the reader to mischaracterize the size of actual fraud in these programs.
   SBA also reviewed all pandemic loans—and already conducted rigorous reviews of those with
   fraud indicators. SBA used automated screening similar to the tools used in the white paper to
   identify an initial set of files with anomalies, or “fraud indicators.” SBA’s first sweep found over
   $400 billion worthy of further investigation—more than twice the amount OIG identified of
   worthy of further scrutiny. However, SBA’s fraud identification and investigation did not stop
   there. SBA then interrogated those files with over 3 million human-led reviews by trained
   professionals, many with long prior careers in law enforcement, complemented by data analytics.
   This extensive analysis revealed that the body of loans likely to be fraudulent is approximately
   $36 billion across PPP and COVID-EIDL. The white paper highlights that OIG has conducted
   over 1,000 investigations of pandemic loans so far. As the OIG team further scrutinizes its batch
   of anomalous files, it will find the false positive rate is high and the set of potentially fraudulent
   files will narrow as it did when SBA conducted our reviews.
   To be clear, SBA believes that all the fraud indicators in OIG’s white paper can be helpful in
   determining which loans require further review and analysis to determine when there is actual
   fraud, and we have used many of the same indicators as OIG in our initial analysis. Nonetheless,
   SBA’s more than 3 million manual reviews to date have shown that many of these OIG
   indicators include a high percentage of false positives. While SBA has identified loans that were
   not fraudulent within all 11 of the OIG’s Fraud Indicators (e.g., typos, misunderstandings,
   circumstances for very small businesses, etc.), we focused the below examples on those
   indicators in the white paper for which a failure to acknowledge and account for a high
   propensity of false positives has the most material impact on OIG’s inflated fraud estimate.
                                    Examples of False Positives
#   Indicator Name       Example
                         Hold code 8 (mismatch of entity name) identifies a business or entity where the
                         company name provided does not match any of the listed identification credentials
                         or provided application materials. Although this merits further review, SBA’s
                         historical manual reviews of loans with hold code 8 show that around over 75% of
1   Hold Codes           those with hold code 8 would likely be resolved due to the clear existence of
                         borrower or lender data entry errors, or other valid factors.
                         SBA believes factoring in the historical results of the manual reviews of each hold
                         code would help identify the “likely fraud” rather than just those loans with “fraud
                         indicators.”

                         For EIDL loans, thousands of borrowers requested a loan increase that required
                         approval from a different funding appropriation than the original loan. To manage
    Employer
                         this, the SBA opened a second loan with the same EIN to grant the increase using
3   identification
                         the correct appropriations. Many such loans, the total of which SBA estimates is
    numbers
                         valued at over $6 billion, would likely be counted as ‘potentially fraudulent’ under
                         the white paper’s methodology.

                         The SBA encountered various data entry errors when reviewing loans associated
                         with this hold code. For example, applicants would provide the standard routing
                         information and the wire routing information, essentially providing the routing
4   Bank accounts
                         number twice without providing an account number. Additionally, the SBA found
                         in its review of loans multiple instances of loans using the same bank account for
                         legitimate reasons.

                         Through coordinated outreach from the SBA and Lenders, it was determined that
                         many of these borrowers are intimidated by the complexity of the PPP forms,
                         processes, and the formality of the forgiveness process.
                         To add complication, once PPP loan data was made public, many borrowers
                         received a multitude of sales calls from both legitimate lenders and scammers.
    Defaulted/ No loan   When the Lenders approached certain borrowers with routine communication
5
    forgiveness          alerting them to the need to file for forgiveness (email, US Mail, voicemail
                         reminders, etc.) they were suspicious and untrusting.
                         Below are a few examples of feedback the SBA has received from the Lenders in
                         this process as to why certain borrowers have not yet applied for forgiveness:
                         a) A change of email address, physical address, or phone numbers due to
                            changes in personnel or life conditions (e.g., moving, marriage, etc.).
#    Indicator Name     Example
                        b) Many borrowers incorrectly believed they did not need to apply for
                           forgiveness because their loans were relatively small ($150,000 of less) or
                           heard the headlines that “blanket forgiveness” had or would occur.
                        c) A group of borrowers have passed away.
                        d) Some businesses have failed, and the borrowers did not understand the
                           necessity to request forgiveness.
                        h) Borrowers who are suspicious they are being scammed.

                        Some borrowers X’ed out a portion of their email (e.g., JoseSmith@gmail.com as
     Suspicious email   Joxxxxxth@gmail.com) in their initial application, perhaps in an attempt to avoid
11
     addresses          unwanted email outreach or as a glitch in a copy-paste. Upon review, the full email
                        appeared valid with no indicia of fraud identified.


File and source

File

OIG_23010_White_Paper_COVID-EIDL_and_PPP_Fraud_Landscape_-_SBA_Response_SIGNED.pdf

Size

257,877 bytes

SHA-256

38e696d37dc486a4802da881e0afcb7f1d983738a55309b2abd5ed5f23d2e3d8

Our copy

OIG_23010_White_Paper_COVID-EIDL_and_PPP_Fraud_Landscape_-_SBA_Response_SIGNED.pdf

Original

legacy.sba.gov