Unemployment Scammer Spills Secrets: Illinois Easy Target Because 'They Don't Verify Anything'
By Dorothy Tucker and Carol Thompson
CHICAGO (CBS) — You've heard a lot about fraud in the state's unemployment system, but you've never heard this: A scammer spills his secrets — how he steals your taxpayer dollars, leaving those desperately needing benefits stuck in limbo.
CBS 2 Investigator Dorothy Tucker went inside the scheme and uncovers why Illinois is a favorite target.
Cynthia Sawaneh couldn't believe what CBS 2 showed her on her computer. The information she was looking at usually lurks in the shadows, meant for criminals who are aiming to make millions, targeting taxpayers like Sawaneh.
"This is really scary. Oh my God," she said after reading the words on the screen. "They got my money."
The CBS 2 Investigators showed Sawaneh a 19-page guide. It's a how-to on filing fraudulent unemployment claims.
"It's like any other step-by-step tutorial," said Crane Hassold, who is the Senior Director of Threat Research at Agari, a business email security firm. "It walks you through exactly what questions to answer."
Before Agari, Hassold worked in the FBI's Behavioral Analysis Unit, investigating national security threats and serial criminals, like those scamming unemployment systems across the country, including here in Illinois.
"They've adapted their tactics," he said.
His job at Agari is to cultivate a network of sources, willing to sell their scamming secrets.
"We've been able to build those sources over the past year or so," he said.
As a result of the connections made, Hassold knows their tactics and the tutorial well.
"It's a lot of screenshots and very brief descriptions of how you should fill out the information," he said.
The tutorial for Illinois describes which section to leave blank, when to click next and where to answer "no." It also describes how to fill out the phone number — just find the area code and the rest can be "rubbish".
"What's really surprising is how open a lot of these cybercriminals are to share how they do what they do," said Hassold.
The scammers are also telling Hassold and his team how they get their hands on the money.
"Once a claim has actually been filed and everything's processing, it provides the user with an opportunity to change that direct deposit method," said Hassold.
Translation: it makes it easy for the thief to steer stolen funds to an accessible account.
We're not telling you where or how to find the tutorials, but we will say it took us less than 24 hours to get an offer to buy one. All it took was a series of text messages with someone with a tutorial to sell and pictures to prove it. The asking price? $50 in bitcoin or cash.
"It's completely disgusting that this exists," said Ofer Eckstein who is a partner at Personnel Planners, a third-party vendor helping clients process unemployment claims. Describing the amount of fraud right now, he said, "It's terrible."
His clients feel the pain. Personnel Planners has 1,200 across the state representing school districts, healthcare facilities and restaurants. His clients employ about 200,000 people.
"Over 50% of the claims that we receive in our office are fraudulent claims," Eckstein said. Before the pandemic he said it was "Less than 1%."
The bogus claims Eckstein sees are just a fraction of the fraud. The Illinois Department of Employment Security reported, between March 2020 and January 2021, it had stopped close to one million fraudulent claims.
Cynthia Sawaneh's case is one of them.
After her work hours cut back from 40 hours a week to just 16 hours, she applied for unemployment benefits in late October. She received one deposit, $397, before getting a letter from IDES saying, "…that my identity had been compromised. Therefore, my unemployment was ceased," said Sawaneh.
Like so many identity theft victims, she knows scammers have her personal information, "My employer, my address, my name, my date of birth," she said.
But Sawaneh has one big outstanding question.
"I would really like to know how they got my information," she asked.
Here's how. Scammers bought it, probably off the dark web. It's the same place criminals shop for drugs, guns, fake passports and social security numbers.
Paul Petefish, with Chicago's Evolve Security, showed CBS 2 how easy it is to find those things. "Right here we have list of markets," he said.
A five-minute search turned up nearly 500 vendors.
"This is somebody's driver's license," said Petefish.
Precious personal information for sale collected from massive data breaches in the past. Among those:
- The 2013 hack of three billion Yahoo accounts that exposed names, email addresses, phone numbers, birthdates, passwords as well as security questions and answers.
- The 2018 hack of 500 million Marriott accounts revealing customers' names, addresses, phone numbers, email addresses, birthdates and gender. Hackers also got some payment card numbers and expiration dates according to the Federal Trade Commission.
- The 2017 hack of Equifax where the personal identifiable information of 147 million people got stolen, including their names, social security numbers, birthdates, addresses and in some cases, their driver's license numbers.
What's the cost to buy that information now, all these years later?
"This one's $40. This one's $8," said Petefish.
Who is buying this information and then using it to steal identities, file fake claims and slow down benefits for the jobless or underemployed who are struggling, like Sawaneh?
Her unemployment benefits suddenly stopped and her identity appeared to have been compromised. She now visits food banks frequently to feed her family. "It's things I find myself doing that I've never had to do before," she said.
Another first: "All my bills are behind," said Sawaneh.
Even her mortgage. "There are times that bills come in and you don't bother to look at them because it just depresses you," she said.
She had just bought her very first home and now worries about losing it. "I never would have dreamed that I would have to go through this," said Sawaneh.
Scammers could not care less about her struggle to keep food on the table, make a dent in the growing pile of bills or keep her dream home. Many of them reside far away from the South Side of Chicago where Sawaneh lives. They live in the dark recesses of Russia, Europe, and West Africa.
"A lot of the scammers are young, They're quite highly educated," said Crane Hassold whose sources are in Nigeria.
"It's a job. This is how they make their living," he said. So, he pays them $150 in cryptocurrency, untraceable money, to talk. "They want to brag about the crimes that they're committing," said Hassold.
What one scammer told him about our unemployment system will make you cringe.
The scammer said: "They don't verify anything. What they just check is, is the name and the social security number the same? Is the date of birth on the Social Security number correct? That's the only thing we have to get right on our part. Once they have gotten those kinds of information, it is over?"
And get this, scammers consider IDES an easier target than most. Why?
"Primarily because of some of the restrictions that are not in place in Illinois may be in place in other states," Hassold explained.
He means better security measures like in Oklahoma, where a new identity verification tool was put in place in November.
It's a Digital ID program from IDEMIA. Oklahomans who file unemployment claims are now required to upload their driver's license and take a selfie. The new tool uses facial recognition technology to make sure the faces match.
"And this picture was taken recently and wasn't pulled off the website or something like that," said Shelley Zumwalt, the Executive Director at the Oklahoma Employment Security Commission (OESC).
In just the first month using the new identity tool called VerifyOK, OESC saw fraud cases drop by 40%, verified and paid 100,000 legit claimants and saved taxpayers $20 million.
"It helped quite a bit," said Zumwalt.
How long will it help?
"This is a very difficult group of people to stay one step ahead of," said Michele Evermore with the National Employment Law Project.
She works with states to improve their unemployment systems and make them more secure.
"After they figured out how to shut them out one way, the fraudsters figured out another way to get in," she said.
"Wherever there is an opportunity to make money, a lot of these scammers really jump on and try to make as much money as they can," said Hassold.
Making money at the expense of faceless victims like Sawaneh.
"We don't know them. We don't know who they are. We don't familiarize with them. It's just an hustle to us over here," said the scammer Hassold paid for his insight.
What's a hustle to the overseas scammer is harmful to people here in Illinois, like Sawaneh, waiting on benefits, trying to make ends meet and worrying about the future.
"It's been stressful to me. Many nights of no sleep. Waking up early, walking back and forth around the house. It's a terrifying situation to live in," she said.
The question is what is IDES doing to stop scammers? We asked. The agency didn't exactly answer that question. However, last week the agency did release a statement announcing new requirements. Now, all pandemic unemployment claimants will have to upload a paycheck stub, W-2 or some other proof of employment. Will this prevent fraud? We'll have to wait to see.
Also From CBS Chicago:
