banks and lenders are well aware of how synthetic identities can be used to
fraudulently open a bank account and secure a credit card or other type of
loan. According to
McKinsey, synthetic identity theft is the fastest growing type
of financial crime in the U.S., accounting for 10–15% charge offs in a typical
unsecured lending portfolio.
U.S. government now has synthetic identities on their radar thanks to the
Paycheck Protection Program (PPP). Many manipulated and fabricated identities
were used to apply for these government loans in 2020.
amount of fraud executed through the PPP program is still being tallied but
there have been notable pending cases that show synthetic identities were used.
are many factors that enabled fraudsters to take advantage of PPP loans including
the speed of issuance, loosened credit criteria, and financial rewards for all
involved with little downside risk. Below is a discussion of the evolution of
the PPP and the elements that contributed to fraud.
PPP — How Did We Get Here?
the U.S. economy largely shut down as a result of responses to COVID-19, the
government put programs in place to help small businesses weather a major
turndown. Nearly half of
the U.S. workforce is employed by a small business. Helping these companies
continue to pay workers was critical to maintaining a viable economy.
Coronavirus Aid, Relief, and Economic Security (CARES)
Act was passed on March 27th, 2020. This over $2 trillion economic relief
package was intended to protect Americans from the public health and economic
impacts of COVID-19.
PPP was established by the CARES Act, and was implemented by the Small Business
Administration with support from the
of the Treasury. This program provided small businesses with funds to pay up to
8 weeks of payroll costs. Funds could also be used to pay interest on
mortgages, rent, and utilities. The PPP, specifically, was authorized to fund
up to $659 billion of these small business expenses.
with having to distribute over half a trillion dollars within a few short
months, the SBA enlisted the help of banks and lenders. The private sector was
also tasked with the vetting and funding of applications, a process which the
Treasury Department encouraged lenders to complete in as little as a day.
money into the hands of small businesses quickly was vitally important. Claims for
unemployment benefits catapulted to over 3 million the week of March 21st from
a weekly average of 200,000 for months prior.
Source: U.S. Labor Department
facilitate rapid distribution, the stringent requirements to qualify for
funding established at the beginning of the program were relaxed over time. For
example, the need to verify an applicant’s tax records and payroll
documentation was eliminated.
huge loan sizes (up to $10M per loan) combined with urgency and relaxed
standards drew the attention of fraudsters. “Any time you have large amounts of
federal aid available, it’s going to bring out all the bad guys,” said Kathryn
Petralia, co-founder and the president of Kabbage, an online
lender that handled 297,000 loans for the program.
PPP ended August 8th and by then, $525B had been distributed to over 5M
businesses by nearly 5500 banks and lenders.
PPP — Revenue Boost For Banks & Lenders
who were approved by the SBA to administer funds were well rewarded, and there
was no penalty for issuing loans to fraudulent entities. Banks and lenders were
paid fees for each loan issued plus 1% interest on PPP loans they held that
weren’t forgiven. Many banks could earn as much from the PPP loans as they
reported in net revenue for all of 2019, according to analysis from
S&P Global Market Intelligence.
a sampling of the fees estimated to be earned by some of the largest banks
involved in issuing PPP loans.
pursuit of these fees, lenders were incentivized to fund as many loans as
possible. Given the competition for funding loans, those that had the least
friction got most of the applications — and likely most of the fraud.
PPP and Fraud—Stay Tuned
millions of small businesses were helped by the PPP program, work is ongoing to
figure out how much money may have been disbursed to fraudulent accounts.
evidence suggests a significant amount of money was issued to illegitimate
- The Small Business Administration’s fraud hotline, which
received fewer than 800 calls last year, has already had 42,000 reports about
- The Justice Department has made at least
41 criminal complaints in federal court against nearly 60 people, who
collectively took $62 million from PPP by using what law enforcement officials
said were forged documents, stolen identities, and false certifications.
- The Treasury Secretary, Steven Mnuchin,
said the Treasury Department would review every loan over $2MM to determine if
funds were disbursed fraudulently.
the work above addresses funds already disbursed, the real story will likely
emerge as small businesses apply for forgiveness. In order to get PPP loans
forgiven, small business owners have to show proof that at least 60% of the
money was used for payroll and the rest for other permitted expenses.
Falsifying these records will result in hefty penalties. However, fraudsters
with malicious intent have presumably already taken their PPP money, and are
unlikely to apply for forgiveness, leaving the SBA responsible for reimbursing
be clear, a wide variety of fraud schemes were likely pursued to secure PPP
funding. The most grievous method was to create fictitious businesses,
proprietors, and employees to effectively steal U.S. taxpayer money. The less
black and white forms of fraud include companies that spent the funds on
non-compliant expenses, and companies that leveraged organizational structures
to obtain more funding.
The fact that synthetic identities were created to steal PPP dollars demonstrates the pervasiveness of this type of fraud. Synthetic identities have infiltrated financial services and are clearly being used to take advantage of government programs. This type of fraud is not bound by any vertical or medium. Any product or service that requires identity verification is potentially susceptible to synthetic identity fraud.
Sarah Hoisington is head of Marketing at SentiLink, a fraud protection tech firm helping financial institutions and government agencies.