Scammers steal "hundreds of millions" using fake unemployment claims
The first word Seattle political consultant Dayna Lurie had that someone filed for unemployment benefits in her name was when her boss called. "Did you quit without telling me?" he asked. "We got an unemployment form from the state of Washington saying you don't work here anymore."
It turned out that, as with thousands of Washington state residents, Lurie's identity was used by criminals seeking to capitalize on a flood of legitimate unemployment claims by sneaking in fraudulent ones.
Washington's race to help newly laid-off residents as the coronavirus pandemic ravaged the economy left it vulnerable to such scams, and last week officials hinted at the scope: Hundreds of millions of dollars were paid out in fake claims, they said. Much of it apparently went to a West African fraud ring using identities stolen in prior data breaches, such as the massive 2017 Equifax breach.
Multi-state problem
State and federal authorities have tried to claw back as much money as possible and say they have blocked hundreds of millions more from being paid out, but Washington's experience is nevertheless a cautionary tale.
"Our intel says Washington was the first state they went after, but we are seeing the number of states being attacked expand day by day," said Patrick Peterson, chief executive of the California cyber security firm Agari, which has monitored the Nigerian fraud group, dubbed Scattered Canary. At least nine states have been subject to attacks as of the end of last week, he said.
The state of Ohio last week suffered an attack on its unemployment system servers as well as what officials called a "data leak," according to Spectrum News, in which applicants for jobless aid saw screens that should have been off-limits. Pennsylvania's labor department launched an investigation on Monday into fraudulent claims sent to people who live out of state, PennLive reported.
The Secret Service issued a warning earlier this month about scammers targeting unemployment benefits, and said scams had been detected in Florida, Massachusetts, North Carolina, Oklahoma, Rhode Island, Wyoming and Washington, according to Krebs on Security.
In many cases, the fraudsters have used identities of people who haven't lost their jobs — so they aren't likely to immediately notice someone else filing in their name. They've been able to have the money sent to prepaid debit cards associated with bank accounts, from which they can have it transferred internationally or quickly exchanged for bitcoin or gift cards, Peterson said.
Washington may have been simply unlucky in being the first state targeted, but it's also known internationally as the home of Microsoft and Amazon, it offers the second most generous unemployment benefits in the country, and it was one of the first states to implement the federal coronavirus aid bill that provided additional money for unemployed workers.
"Assault by the premier fraudsters"
Suzi LeVine, the commissioner of Washington's Employment Security Department, said last week there is an inherent tension between rushing out benefits in an emergency and thoroughly vetting claims to block any fraudulent payments. "Our charge is to find that right balance," she said.
But as an immense number of initial claims inundated the system — the number of weekly claims topped 180,000, compared to a typical average of around 6,000 — that balance was hard to come by. Some 2 million initial claims have been filed in Washington since the first week in March, and the state has paid $3.8 billion in benefits since then.
"We have a fundamental obligation to protect public money, to protect the integrity of our information technology system, and we failed," said state Sen. Reuven Carlyle. "Good people worked very hard to identify it as best we could, but this was a 100-year flood, an assault by the premier fraudsters in the world, who have been collecting data on the people of this country for years."
LeVine declined to identify some measures the state has taken to ward off so-called imposter fraud, saying she didn't want to tip off bad actors, but she said the department has been warning other states about how it fell prey. The state's response includes delaying payments to provide more time to verify claims, a step she considers regrettable considering how many people need the money.
Delaying payments comes with a human cost. Nikita Gilbert, a 29-year-old single mother in Spokane, Washington, who has lost work as a billing specialist, told the Associated Press she had started receiving unemployment benefits, but the state halted the payments May 15 and required more verification. Her parents have helped financially, but she doesn't know if she'll make rent.
"I'm struggling to get food for my daughter and myself," Gilbert said. "I can't even go shopping because I don't have gas."
A recent analysis from advocacy group One Fair Wage found that more than 40% of unemployment claims have been denied or have yet to be paid out.
The scope of the fraud in Washington has been a wake-up call around the nation, said Andrew Stettner, who monitors social insurance programs for The Century Foundation, a progressive think tank.
"Fraud prevention efforts have been a singular focus for the Department of Labor and the states," he said. "It's disappointing that those didn't work."
