State struggles to fix pandemic fraud targeting unemployed Pennsylvanians
PITTSBURGH (KDKA) -- Identity thieves stole billions of dollars intended for unemployed Pennsylvanians.
KDKA Investigates broke the story in June, and for weeks has been asking the state for answers.
And now, as we're starting to get them, it turns out there's also been trouble with the state's attempt to fix that unemployment fraud. This is all part of what some call the largest fraud in history.
The theft of billions of dollars of U.S. pandemic relief was primarily done by overseas cybercriminals who have targeted state unemployment compensation systems across the nation.
After asking the state of Pennsylvania to put a number on the theft here and getting no response, KDKA-TV asked Governor Tom Wolf about the estimates from security experts.
Sheehan: They're putting that number at between $5 and $10 billion and faulting the state for not doing enough to stop the fraud.
Wolf: I don't know if that's the number at all.
In a statement to KDKA Investigates, the Pennsylvania Department of Labor & Industry now concedes the state has lost $6 billion to identity and cyber thieves during the last two years of the pandemic. Most of that, $4.6 billion, was lost in the first year when there were few safeguards to verify applicants.
Sheehan: When the system started, there were no checks and balances.
Wolf: That's not true. We've always had checks and balances.
In its statement, the Pennsylvania Department of Labor & Industry was quick to highlight steps it has since taken to stop the fraud. Namely, the hiring last summer of the private screening company ID.me, which uses facial recognition technology to verify claims.
And while the state says the new verification system has slowed the theft to $1.4 billion, there have been issues with people having a hard time navigating ID.me's system.
"A lot of people can't, if you're not technologically savvy, if you don't know how to operate your phone and load things online. It's just very, very confusing to people," says Barney Oursler of the Mon Valley Unemployment Committee.
After losing her job at McDonald's, Cindy Kohr of Mt. Washington couldn't get on the new system at first. And when she finally did, she found someone stole her identity, and her claim was denied.
"It made me very frustrated and depressed. I felt like giving up," says Kohr.
Since August, she's been part of a massive backlog of applicants trying to prove they are the rightful applicants.
"We believe there are at least a few hundred thousand people who are stuck in the loop where someone has stolen their identity," says Oursler.
The state disputes that number, saying it's actually closer to 64,000.
The American Civil Liberties Union and others are now petitioning states using ID.me to drop it for being an invasion of privacy and for outsourcing a government function to a private company. Meanwhile, the unemployed and their advocates just want the system to be fixed.
"I had to go to food pantries, I had people deliver food to me. My daughter had to help me out financially," says Kohr.
"They're losing their benefits, they're losing their cars, they're losing their ability to get another job and it's very scary to people," adds Oursler.
KDKA-TV reached out to ID.me for comment, and received this statement:
"We are committed to working together with the Pennsylvania to implement the best identity verification solutions to prevent fraud, protect Americans' privacy, and ensure equitable, bias-free access to unemployment benefits. It's important to note ID.me provides identity verification services to Pennsylvania, not eligibility verification. The state administers the Keystone ID login system itself and determines claims eligibility. To learn more about the early success of ID.me's partnership with Pennsylvania and fraud we stopped, please click here:
"The FTC reported identity theft tied to government benefits increased by 2,920% during the pandemic. Sophisticated criminal enterprises have been successfully penetrating government benefits systems with fake identities, resulting in hundreds of billions in losses to state and federal treasuries, victimizing millions of Americans and causing a breach in trust between citizens and their government. ID.me is an essential tool to deliver secure access at scale and the trusted partner of 27 states.
"Four states have credited ID.me with preventing $210 billion in fraud."
ID.me On Access:
"While 9 in 10 individuals verify their identity using ID.me's automated self-service process, those who need additional support are directed to verify with a trained video chat agent. ID.me is the only vendor in the U.S. with a video chat option for those unable to go through the automated process - including those who don't have a presence in records or are victims of identity fraud (like those with flagged accounts). For more information on how ID.me is growing its video agent workforce to enhance the customer experience to support seasonal demand," please click here.
On Privacy:
"ID.me is certified against NIST 800-53 with a FedRAMP Authority to Operate from the General Services Administration. This certification speaks to the rigorous technical and policy controls ID.me adheres to in order to ensure data security.
"Data is encrypted and stored by ID.me in a way that cannot be accessed by any other entity besides ID.me. No third party organizations, including government agencies, have access to ID.me's database. The information provided by ID.me users for the purposes of verifying their identity with government agencies is securely retained by ID.me. Biometric data is not shared with government agencies as part of the verification process.
"ID.me does not share biometric data with the IRS, or any government agency, absent the receipt of a subpoena, or as part of an investigation into an identity theft or fraud case only at the specific agency where the ID.me account was involved."