Organized Crime Exploits Security Flaws In California EDD Program Locking Out Thousands Of Legitimate Claims
SAN FRANCISCO (KPIX) - California's Employment Development Department reopens for business this week. The agency is promising major security changes after a government strike team found rampant inefficiencies and fraud. One big reason for much of the problems as KPIX 5 discovered, is organized crime.
"I thought you know, they're just making a mistake," said Susan Smith.
That was Smith's initial reaction when letters arrived from EDD, approving her husband for a $9,700 unemployment claim. Problem is, he didn't apply for unemployment. Not only that, Steve Lewis passed away last December.
"Before I had a chance to look into it, the next day I had two more letters arrive," said Smith.
This time the letter from EDD was addressed to a presumably fake employer, also listed at the couple's address, trying to verify her dead husband's employment.
"Then I started getting really worried," said Smith, because many of the documents had her husband's social security number in plain sight. "These claims, according to EDD, were just submitted last month. And they're that anxious to start paying a dead person when living people with real needs are not getting their claims addressed."
"We have seen a 3500% increase in the number of cases of this type," said Eva Velasquez with the Identity Theft Resource Center, a national support group for victims of identity theft.
"Truly the saddest and most tragic experience that we're hearing about is for the people who have a legitimate need. When it's denied, because they're a victim of a crime, they then have to go through the process of unwinding that and remediating that case," said Velasquez.
Meanwhile federal and state governments are losing billions to fraud. That's because in an effort to make it easier for desperate people to apply, many states including California did not use time tested security measures.
"The law of unintended consequences took shape here. It took hold," said Armen Najarian, Chief Identity Officer at email security firm Agari.
"The actual identity verification process was minimal. Create an account, you can use whatever email address you wanted. They weren't even verifying necessarily whether the same email address or versions of that same email address were being used for multiple accounts," said Najarian.
He says criminals of all shapes and sizes jumped on the money wagon. But most of the fraud he says is orchestrated by organized cybercrime groups.
"We have identified at least one highly organized group that has exploited the pandemic and funds available both through the CARES Act and through state level, EDD programs," said Najarian.
The crime ring's name: Scattered Canary, based out of Nigeria, notorious for romance scams and real estate scams. Najarian told us the criminals easily obtain email addresses and social security numbers on the dark web, and during the pandemic that's all they have really needed.
"We actually had deep visibility into their own messaging flow. We were able to see the patterns and the proliferation," said Najarian.
It's all a slap in the face for Susan Smith, who is now trying to clear her dead husband's name.
"We have people in extremis, no money for food, no rent money, no money to put gas in their car. And here I am trying to get EDD to not send money to my deceased husband. It's like Alice through the Looking Glass, everything is reversed," said Smith.
Beginning this week EDD says it will start verifying identities at the "start" of a claim and will start suspending multiple claims filed using the same address.
EDD currently only has 27 fraud investigators but tell KPIX 5 they plan to hire more.