Most banks and lenders are well aware of how synthetic identities can be used to fraudulently open a bank account and secure a credit card or other type of loan. According to McKinsey, synthetic identity theft is the fastest-growing type of financial crime in the U.S., accounting for 10–15% charge offs in a typical unsecured lending portfolio.

The U.S. government now has synthetic identities on their radar thanks to the Paycheck Protection Program (PPP). Many manipulated and fabricated identities were used to apply for these government loans in 2020.

The amount of fraud executed through the PPP program is still being tallied but there have been notable pending cases that show synthetic identities were used.

There are many factors that enabled fraudsters to take advantage of PPP loans including the speed of issuance, loosened credit criteria, and financial rewards for all involved with little downside risk. Below is a discussion of the evolution of the PPP and the elements that contributed to fraud.

PPP — How Did We Get Here?

When the U.S. economy largely shut down as a result of responses to COVID-19, the government put programs in place to help small businesses weather a major turndown. Nearly half of the U.S. workforce is employed by a small business. Helping these companies continue to pay workers was critical to maintaining a viable economy.

The Coronavirus Aid, Relief, and Economic Security (CARES) Act was passed on March 27th, 2020. This over $2 trillion economic relief package was intended to protect Americans from the public health and economic impacts of COVID-19.

The PPP was established by the CARES Act and was implemented by the Small Business Administration with support from the Department of the Treasury. This program provided small businesses with funds to pay up to 8 weeks of payroll costs. Funds could also be used to pay interest on mortgages, rent, and utilities. The PPP, specifically, was authorized to fund up to $659 billion of these small business expenses.

Faced with having to distribute over half a trillion dollars within a few short months, the SBA enlisted the help of banks and lenders. The private sector was also tasked with the vetting and funding of applications, a process which the Treasury Department encouraged lenders to complete in as little as a day.

Getting money into the hands of small businesses quickly was vitally important. Claims for unemployment benefits catapulted to over 3 million the week of March 21st from a weekly average of 200,000 for months prior.

To facilitate rapid distribution, the stringent requirements to qualify for funding established at the beginning of the program were relaxed over time. For example, the need to verify an applicant’s tax records and payroll documentation was eliminated.

The huge loan sizes (up to $10M per loan) combined with urgency and relaxed standards drew the attention of fraudsters. “Any time you have large amounts of federal aid available, it’s going to bring out all the bad guys,” said Kathryn Petralia, co-founder and the president of Kabbage, an online lender that handled 297,000 loans for the program.

The PPP ended August 8th and by then, $525B had been distributed to over 5M businesses by nearly 5500 banks and lenders.

PPP — Revenue Boost For Banks & Lenders

Those who were approved by the SBA to administer funds were well rewarded, and there was no penalty for issuing loans to fraudulent entities. Banks and lenders were paid fees for each loan issued plus 1% interest on PPP loans they held that weren’t forgiven. Many banks could earn as much from the PPP loans as they reported in net revenue for all of 2019, according to analysis from S&P Global Market Intelligence.

Below is a sampling of the fees estimated to be earned by some of the largest banks involved in issuing PPP loans.

In pursuit of these fees, lenders were incentivized to fund as many loans as possible. Given the competition for funding loans, those that had the least friction got most of the applications — and likely most of the fraud.

PPP and Fraud—Stay Tuned

While millions of small businesses were helped by the PPP program, work is ongoing to figure out how much money may have been disbursed to fraudulent accounts.

Anecdotal evidence suggests a significant amount of money was issued to illegitimate applicants:

-The Small Business Administration’s fraud hotline, which received fewer than 800 calls last year, has already had 42,000 reports about coronavirus-related fraud.

-The Justice Department has made at least 41 criminal complaints in federal court against nearly 60 people, who collectively took $62 million from PPP by using what law enforcement officials said were forged documents, stolen identities, and false certifications.

-The Treasury Secretary, Steven Mnuchin, said the Treasury Department would review every loan over $2MM to determine if funds were disbursed fraudulently.

While the work above addresses funds already disbursed, the real story will likely emerge as small businesses apply for forgiveness. In order to get PPP loans forgiven, small business owners have to show proof that at least 60% of the money was used for payroll and the rest for other permitted expenses. Falsifying these records will result in hefty penalties. However, fraudsters with malicious intent have presumably already taken their PPP money, and are unlikely to apply for forgiveness, leaving the SBA responsible for reimbursing banks.

To be clear, a wide variety of fraud schemes were likely pursued to secure PPP funding. The most grievous method was to create fictitious businesses, proprietors, and employees to effectively steal U.S. taxpayer money. The less black and white forms of fraud include companies that spent the funds on non-compliant expenses and companies that leveraged organizational structures to obtain more funding.

The fact that synthetic identities were created to steal PPP dollars demonstrates the pervasiveness of this type of fraud. Synthetic identities have infiltrated financial services and are clearly being used to take advantage of government programs. This type of fraud is not bound by any vertical or medium. Any product or service that requires identity verification is potentially susceptible to synthetic identity fraud.

______________________________________________________________

Sarah Hoisington is head of Marketing at SentiLink, a fraud protection tech firm helping financial institutions and government agencies.