Beware: Synthetic Identity Fraud in PPP Loans

Most banks and lenders are well aware of how synthetic identities can be used to fraudulently open a bank account and secure a credit card or other type of loan. According to McKinsey, synthetic identity theft is the fastest growing type of financial crime in the U.S., accounting for 10–15 UEclaims

(Click for larger image.)

To facilitate rapid distribution, the stringent requirements to qualify for funding established at the beginning of the program were relaxed over time. For example, the need to verify an applicant’s tax records and payroll documentation was eliminated.

The huge loan sizes (up to $10M per loan) combined with urgency and relaxed standards drew the attention of fraudsters. “Any time you have large amounts of federal aid available, it’s going to bring out all the bad guys,” said Kathryn Petralia, co-founder and the president of Kabbage, an online lender that handled 297,000 loans for the program.

The PPP ended August 8th and by then, $525B had been distributed to over 5M businesses by nearly 5500 banks and lenders.

PPP — Revenue Boost For Banks & Lenders

Those who were approved by the SBA to administer funds were well rewarded, and there was no penalty for issuing loans to fraudulent entities. Banks and lenders were paid fees for each loan issued plus 1 Bank Fees PPP

(Click for larger image.)

In pursuit of these fees, lenders were incentivized to fund as many loans as possible. Given the competition for funding loans, those that had the least friction got most of the applications — and likely most of the fraud.

PPP and Fraud—Stay Tuned

While millions of small businesses were helped by the PPP program, work is ongoing to figure out how much money may have been disbursed to fraudulent accounts.

Anecdotal evidence suggests a significant amount of money was issued to illegitimate applicants:

The Small Business Administration’s fraud hotline, which received fewer than 800 calls last year, has already had 42,000 reports about coronavirus-related fraud.
The Justice Department has made at least 41 criminal complaints in federal court against nearly 60 people, who collectively took $62 million from PPP by using what law enforcement officials said were forged documents, stolen identities, and false certifications.
The Treasury Secretary, Steven Mnuchin, said the Treasury Department would review every loan over $2MM to determine if funds were disbursed fraudulently.

While the work above addresses funds already disbursed, the real story will likely emerge as small businesses apply for forgiveness. In order to get PPP loans forgiven, small business owners have to show proof that at least 60% of the money was used for payroll and the rest for other permitted expenses. Falsifying these records will result in hefty penalties. However, fraudsters with malicious intent have presumably already taken their PPP money, and are unlikely to apply for forgiveness, leaving the SBA responsible for reimbursing banks.

To be clear, a wide variety of fraud schemes were likely pursued to secure PPP funding. The most grievous method was to create fictitious businesses, proprietors, and employees to effectively steal U.S. taxpayer money. The less black and white forms of fraud include companies that spent the funds on non-compliant expenses, and companies that leveraged organizational structures to obtain more funding.

The fact that synthetic identities were created to steal PPP dollars demonstrates the pervasiveness of this type of fraud. Synthetic identities have infiltrated financial services and are clearly being used to take advantage of government programs. This type of fraud is not bound by any vertical or medium. Any product or service that requires identity verification is potentially susceptible to synthetic identity fraud.

=========

Sarah Hoisington is head of Marketing at SentiLink, a fraud protection tech firm helping financial institutions and government agencies.

Small Business