Every unemployment fraud control had a cost to real claimants

The week

On Thursday, May 14, 2020, Washington State’s Employment Security Department announced that it would hold unemployment payments for up to two days while it checked claims for fraud. Its commissioner, Suzi LeVine, stressed that the agency’s own systems had not been breached. The personal details being used to file the claims had been stolen elsewhere, in earlier incidents such as the 2017 Equifax breach, and were now being turned against the state. The department said fraudulent claims had jumped to many times their pre-pandemic rate.

Two days later, on May 16, KrebsOnSecurity reported on a US Secret Service memo circulated to field offices that week. The Secret Service, which investigates financial crimes as well as protecting the president, warned that a well-organized Nigerian fraud ring was filing large numbers of unemployment claims in several states using stolen identities. Washington was the primary target. The memo also cited evidence of attacks on North Carolina, Massachusetts, Rhode Island, Oklahoma, Wyoming and Florida, and it judged that every state was likely exposed. Potential losses ran to hundreds of millions of dollars.

The criminals were not breaking into the systems in a technical sense. They were applying for benefits in other people’s names, using Social Security numbers, birth dates and addresses traded online after years of breaches. According to the memo, a substantial share of the stolen identities belonged to first responders, government employees and school staff. These were people still at work, with no reason to watch for an unemployment claim. Benefits were paid by direct deposit into accounts held by money mules, people recruited, often through romance or work-from-home scams, to receive the money and pass it on. Bankers in Oklahoma described large transfers tied to Washington claims landing in local accounts.

Within days, researchers at the email security firm Agari tied part of the activity to a Nigerian group it had tracked for years and called Scattered Canary. Agari reported that the group had filed at least 174 fraudulent claims with Washington since late April. It received payments on dozens of prepaid card accounts. It also used hundreds of variations of a single Gmail address. Gmail ignores dots in an address, so one inbox could pose as hundreds of separate applicants to a system that treated each spelling as new.

The scale became clear quickly. Before the month was out, Washington’s commissioner said the state believed it had paid between $550 million and $650 million to impostors. By early June, the Associated Press reported that $333 million had been recovered. On May 26, the Labor Department’s Office of Inspector General issued an alert memo about the new federal program for self-employed workers. It warned that relying on applicants’ own word about eligibility and wages left the program highly vulnerable to improper payments and fraud.

It was a second crisis for offices already overwhelmed by the first. That spring, millions of Americans had lost their jobs in a matter of weeks. By mid-May, more than 36 million initial claims had been filed nationally in roughly two months, according to the Labor Department’s weekly counts. Washington’s State Auditor later noted that the state received more than 180,000 claims in a single late-March week, in a year when weekly claims had topped 10,000 only four times in all of 2019. Many state offices ran computer systems decades old. Phone lines jammed. Websites crashed. People waited weeks for money they needed to pay rent.

The timing could hardly have been worse. Besides the surge in ordinary claims, states had just begun administering new federal programs under the CARES Act, the relief law signed on March 27, 2020. It added a $600 weekly federal supplement to benefits, which made each successful claim, honest or fraudulent, worth far more. It also created Pandemic Unemployment Assistance, which extended benefits to self-employed and gig workers, people such as rideshare drivers and freelancers who normally do not qualify for unemployment insurance. Because states had no wage records for these workers, the program initially allowed applicants to self-certify eligibility, meaning their own statement that they qualified was accepted without independent proof. Federal guidance also required states to backdate these claims, so a newly approved claim could release several weeks of payments at once.

That design was a sensible response to an emergency: it got money to people quickly. It was also an open invitation to anyone holding a stolen identity.

So state agencies faced a cruel trade-off. They were being criticized, rightly, for being too slow to pay people who were desperate. Now they were being criticized, also rightly, for paying criminals. Any check added to stop the second problem risked making the first one worse. Washington’s two-day pause showed the dilemma in miniature: it stopped some fraudulent payments, and it also stopped payments to thousands of legitimate claimants who had already waited weeks. How agencies handled that trade-off is one of the clearest case studies of the period in how digital identity, fraud control and public service collide.

Unemployment insurance agencies in 2020 faced two failures at once. They were too slow for legitimate claimants and too easy for fraudsters. Identity proofing was at the center of both, because every check that stopped a fraudulent claim could also stop or delay a real one. Where to check is the key design choice, and a claim offers three points: at application, before payment, and after payment. Each point prevents fraud in a different way and places its cost on a different group of legitimate claimants.

Banks opening accounts online, insurers paying claims, and health plans enrolling members all make the same choice about where to put identity checks, and all face the same trade-off between keeping criminals out and letting real customers in. The unemployment story of 2020 shows that trade-off at its starkest, because the people being kept waiting had just lost their income.

The sections below begin with what identity proofing is and which kind of fraud it addresses. They then take the three points in order. After that come a composite case of one state’s two attempts and the stakes for the people accountable. The last sections cover the human route for those the digital check cannot serve, and the measures that keep both failures in view.

What identity proofing actually is

Identity proofing is the process of confirming that a person applying for something is who they say they are. It is different from signing in. Signing in confirms that you are the same person who opened an account; proofing confirms, at the start, that the account belongs to a real, specific individual.

Three separate questions

Federal identity guidance from the National Institute of Standards and Technology (NIST) breaks proofing into three steps, and the split is useful outside government too. Resolution asks which single person, among everyone with a similar name, the applicant claims to be. Validation asks whether the evidence offered is genuine and matches authoritative records. Verification asks whether the person in front of the system is the person that evidence describes. A stolen identity passes the first two steps easily, because the identity is real and the records match. Only the third step catches it.

That is why the pre-2020 methods failed. Many state systems proofed identity by knowledge-based checks: asking for a name, birth date, Social Security number and address, and perhaps a question or two about past addresses, then checking that the answers matched records. Those checks resolve and validate an identity well. They verify almost nothing, because the facts are no longer secret. Years of large data breaches had put them in criminal hands at scale. Asking for them is like protecting a door with a password printed in the phone book. NIST had already moved away from relying on such questions before 2020, and its 2025 revision of the guidelines states flatly that knowledge-based verification must not be used to verify identity.

The stronger methods

The stronger alternative that spread from 2020 is document verification with selfie matching. The applicant photographs a government ID such as a driver’s license, software checks that the document looks genuine, and the applicant then takes a selfie that is compared with the photo on the ID using facial recognition. If the checks pass, the agency has much better evidence that a real person holding a real document is applying. The comparison is one-to-one: this face against this document. That is a narrower and less contested use than searching a face against a database of millions.

A third approach works in the background. Cross-matching compares the details on a claim with other records the government already holds, such as employers’ reports of who they pay, or records of deaths and incarceration. If a claim says someone was laid off from a job the wage records do not show, or the claimant is recorded as deceased, something is wrong. The applicant never sees these checks unless one fails.

Which fraud each method addresses

Three kinds of fraud hit benefit programs in 2020, and each needs a different control. Impostor fraud uses a real person’s identity without their knowledge; this was the Secret Service’s concern. Synthetic identity fraud stitches together a real Social Security number with an invented name or birth date. Claimant fraud involves a real person claiming in their own name but misstating their eligibility, for example by continuing to work. Selfie matching is strong against impostors and weak against claimant fraud, since the claimant is who they say they are. Wage cross-matching is strong against claimant fraud and only partly effective against impostors.

Washington’s State Auditor later found that the department’s fraud unit, before the pandemic, had been organized mainly around claimant fraud. Its tools were built for the wrong adversary. Any organization reviewing its own controls should ask the same question first: which kind of fraud is this control designed to stop, and is that the kind we are actually facing?

Each method has strengths and blind spots, and that is why the question of where to put them matters so much.

At application: checking who is applying

Checking identity at application stops fraud earliest. It also protects people whose stolen identities would otherwise be used to file claims in their names. The cost falls on every claimant, at the moment they most need help. Before 2020, many state systems relied on matching personal details that had already been widely exposed in breaches. That offered little protection against organized fraud using stolen identities.

What the stronger check costs

Stronger online proofing, using document verification and selfie matching, spread through state systems from 2020. It reduced fraud but excluded some legitimate claimants. People without smartphones or valid photo identification struggled. So did people whose appearance or documents produced mismatches, and people with limited English or digital skills. Those claimants needed an alternative, such as in-person or video verification. Many states lacked the capacity to provide it at scale. A three-week wait for an in-person appointment is not a meaningful alternative for someone who has just lost their income.

Accuracy also varies. In December 2019, a few months before the crisis, NIST published a study of demographic effects in face recognition algorithms. It found that many algorithms produced different error rates across demographic groups, and that the size of the gap varied widely from one algorithm to the next. For an agency, that means the vendor’s choice of algorithm is a fairness decision, and one the agency cannot see unless the contract lets it.

What the stronger check does not prove

Document and selfie checks prove that a real person with a matching document completed the process. They do not prove that the person is acting for themselves. A fraud ring that can no longer file with stolen data can recruit real people, including mules, to pass the check and then hand over the account. The control raises the cost of fraud and shrinks its volume. It does not end it, and an agency that treats a passed check as proof of a legitimate claim will stop looking too early.

Risk-based proofing and its signals

Proportion matters at this point. A state can apply light checks to most claims and stronger proofing only where risk signals appear. This is called risk-based proofing: treat most people as the honest majority they are, and concentrate effort where the evidence suggests trouble.

The useful signals in 2020 were mostly patterns across claims. Many claims from one device or internet address. Many claims paying into one bank account or routing to one prepaid card program. Email addresses that differ only by dots, or that were created the same day. Mailing addresses shared by dozens of unrelated claimants. Claims from abroad for jobs in the state. The federal investigator quoted by KrebsOnSecurity said some states lacked even basic controls to spot multiple claims from the same internet addresses or bank accounts.

Each signal also catches honest people. A public library computer serves many claimants in a day. A family shares one phone. Residents of a shelter share an address. People without bank accounts often use prepaid cards. A signal that is useful in aggregate can be unfair in a specific case, so signals should raise the level of checking, not deny a claim on their own. Risk-based proofing reduces friction for most claimants, but it depends on the risk signals being accurate and regularly tested.

Testing for fairness

Agencies should check, at least quarterly, whether the claimants sent to stronger proofing differ by age, language or neighborhood in ways the fraud data does not explain. If, say, older claimants or those in particular zip codes are flagged far more often without a matching difference in confirmed fraud, the rules are filtering for the wrong thing. The test needs three numbers per group: the share referred to stronger checks, the share who then pass, and the share of referred claims later confirmed as fraud. A group with a high referral rate, a high pass rate and little confirmed fraud is a group the rules are burdening for nothing.

Vendor contracts should require the data needed to run that check. An agency that buys a proofing service without the right to see how it performs for different groups cannot answer to its legislature when the questions come. The contract should also say how long images and document scans are kept, forbid any use beyond verification, and give the agency the right to change thresholds and to leave with its data. Federally funded programs also carry civil rights obligations, including meaningful access for people with limited English, so translated instructions and interpreter-supported alternatives belong in the design from the start.

Before payment: checking the claim against other data

Cross-matching claims against other records catches fraud without asking anything of the claimant up front. Useful sources include employer wage records, incarceration records, death records and other states’ claims. The checks depend on data-sharing agreements and on systems that can run them quickly. Many state systems were old and could not add new checks easily. The new federal programs also lacked wage records for self-employed applicants, so eligibility rested largely on self-certification at first.

What each data source catches, and when

Each source has a blind spot, often a timing one. Quarterly wage records arrive months after the work they describe. They can confirm that a claimant once worked for an employer, which a fraudster using a real identity will also pass. They cannot confirm that the job ended. New-hire reports, which employers file within weeks of hiring someone, catch people who return to work while still claiming. Death and incarceration records catch a narrower but cleaner set of impossible claims. Matches against other states’ claims catch the same identity being used in several places at once.

The best early signal in 2020 often came from employers. A state that files a claim notifies the claimant’s last employer. KrebsOnSecurity reported an Oklahoma company with seven employees that received notices for several hundred people who had never worked there. An employer response saying “this person still works here” is strong evidence of impostor fraud. Agencies that processed employer responses quickly, and treated them as fraud signals rather than routine eligibility paperwork, turned the people with the least to gain into an early warning system.

Shared tools existed. The National Association of State Workforce Agencies ran an Integrity Data Hub, built from a suspicious-actor repository set up in 2017, which let participating states compare claims across state lines. Its value depended on how many states took part and how quickly they uploaded data. In a fraud wave that moved from state to state within days, a weekly batch upload was close to useless.

The systems problem

The age of the systems matters more than it might seem. Many state unemployment systems were built on mainframe computers, large central machines programmed in older languages such as COBOL, with rules coded in ways that only a shrinking number of specialists understood. In April 2020, New Jersey’s governor publicly appealed for volunteers who knew COBOL. Adding a new data check to such a system can take months of careful work. In the spring of 2020, agencies did not have months.

States that coped better often bolted a separate rules engine or analytics layer in front of the old system. Claims passed through the new layer, which could add or change checks in days, before reaching the mainframe for payment. That architecture is worth having before a crisis. It separates the logic that changes quickly, fraud rules, from the logic that changes slowly, benefit calculation and payment.

Holds and notices

This point gives agencies the most fraud prevention for the least burden on claimants, because checks stay invisible unless they fail. Its cost falls on the minority caught by false matches. A payment hold triggered by a data error can be hard to understand and harder to resolve, especially when the notice does not say what triggered it or what to do. Clear notices are part of the control: which record did not match, what evidence resolves it, and a deadline the agency commits to.

Holds also carry a legal edge. The Social Security Act requires states to have methods of administration reasonably calculated to ensure full payment of unemployment compensation when due. The Supreme Court held in 1971, in California Department of Human Resources Development v. Java, that this means paying at the earliest stage administratively feasible once eligibility has been decided. A hold is defensible when it is a genuine, prompt eligibility review. It becomes harder to defend when it is an open-ended pause. Washington was sued in early June 2020 over benefits delayed during its fraud review. Agencies should check with counsel on hold design, and should document the reason, the review steps and the target resolution time for every category of hold.

Cross-program signals

Fraud signals also cross programs. The same stolen identities were used against unemployment, small business relief and tax refunds. Agari reported that Scattered Canary had also filed claims for the CARES Act’s economic impact payments that spring. A state that shared signals across its own agencies, and with other states through national data hubs, could stop patterns that no single program would see. That needs data-sharing agreements, common identifiers and a team whose remit spans programs. It also needs legal review, because the statutes governing unemployment, tax and health data each limit how the data may be shared, and the limits differ.

After payment: recovery and redress

Once a fraudulent payment is made, recovery depends on banks and payment providers, which can freeze or return funds. Banks saw large volumes of unemployment deposits into accounts whose holders did not match the claimant’s name, and many began flagging and returning them. Agencies that set up a fast channel for banks to report and return suspect deposits recovered more.

Why the deposits landed

The mechanism explains why banks became the last line of defense. Benefit payments travel through the ACH network, which moves batches of payments between banks. Receiving banks typically post an ACH credit using the account number, and the network rules do not require them to match the name on the payment to the name on the account. A state could send a payment in one person’s name to an account owned by someone else, and it would usually arrive.

Banks and credit unions therefore saw the anomaly before the state did. A credit union whose members mostly live in one state notices when a member receives unemployment payments from another state, several payments in one week, or payments in three different names. In October 2020, the Financial Crimes Enforcement Network (FinCEN) issued an advisory, FIN-2020-A007, listing red flags of this kind and asking institutions to cite it in suspicious activity reports. Before that, institutions relied on their own monitoring and on ad hoc contact with state agencies. Many found that no one at the state answered the phone.

Prepaid cards and mass freezes

Some states paid benefits mainly through prepaid debit cards issued by a contracted bank. That concentrated both the fraud and the response. In California, the bank that issued the state’s benefit cards froze large numbers of accounts it judged suspicious. Many were fraudulent, and some belonged to legitimate claimants who then had to pass further verification before their money was released. Lawsuits followed. A mass freeze is the after-payment version of applying the strongest check to everyone: effective against fraud, and costly for every honest person caught in it.

Victims and wrongly flagged claimants

Recovery has a citizen side. People whose identities were used needed a simple way to report it and to correct tax forms and employer records. Many were still employed and confused about why they had received benefit notices. A dedicated identity theft reporting form, linked to automatic correction of the year-end tax form, spared them weeks of calls. The tax piece mattered, because benefits are reported on Form 1099-G. In early 2021 the IRS advised victims who received a 1099-G for benefits they never claimed to ask the issuing state for a corrected form.

Redress for legitimate claimants wrongly flagged belongs to the same stage. A fraud control without a fast, fair appeal shifts the cost of fraud onto those least able to bear it. It also generates call volume that slows service for everyone else. Appeals should be tracked by reason, so that recurring false matches feed back into the rules that caused them.

The label itself has consequences. Federal rules let states waive repayment of some overpayments made without fault, but not of overpayments classified as fraud. A claimant wrongly labeled as fraudulent therefore loses a route to relief that an honest mistake would have kept open. An agency should require a higher standard of evidence before it applies the fraud label than before it places a temporary hold.

One state, two attempts

Suppose a state unemployment office receives in a week what it normally handles in several months. Its system asks for name, birth date and Social Security number, and pays within days if the details match. Within weeks, investigators warn that a large share of new claims may be fraudulent.

The first attempt

The state’s first instinct is to require document and selfie verification for everyone. Fraud attempts drop sharply. But calls to the office surge from people who cannot complete the process: an older man with no smartphone, a woman whose license expired during the shutdown, a recent immigrant whose name is spelled differently on two documents. In-person appointments are booked weeks ahead. Legislators start hearing from constituents who have had no income for a month.

The first attempt also creates a backlog that feeds on itself. Every claimant who fails the check calls, and many file a second claim, which the fraud rules then flag as a duplicate. Staff move from processing claims to answering phones. The share of claims paid within the federal timeliness standards falls. The agency is now failing on speed and still has fraud to chase among the claims that passed.

The second attempt

The state then adjusts. It keeps a light check for most claimants and sends to stronger proofing only claims that show risk signals, such as many applications from one device or details that do not match wage records. It invests in cross-matching against wage, death and incarceration data, which catches many fraudulent claims without asking anything of honest ones. It rewrites its hold notices so each one names the record that did not match, the document that will resolve it, and the date by which the agency will decide. It opens a channel for banks to return suspect deposits, and a web form for people whose identities were misused.

Staffing changes too. The state creates a small fraud analytics team that reviews the risk rules each week, rather than leaving them with the vendor. It assigns a named owner for bank relationships, so a credit union that spots suspect deposits reaches a person. It moves trained staff to the in-person and video route, sized to the number of claimants expected to fail the online check.

Finally, the state starts reporting two numbers side by side to its leadership every week: estimated fraud prevented, and legitimate claimants delayed or denied. For the first time, the people making decisions can see both sides of the trade-off at once.

What the second attempt still gets wrong

Even the better design leaves gaps. Risk rules tuned to this month’s fraud ring will miss the next one, which will learn which signals the state uses. Cross-matching depends on data that lags. A light check for most claimants means some fraud gets through, and the state must be prepared to defend that choice publicly when a loss surfaces. The second attempt is better because its costs are chosen and visible, not because it has no costs.

Notice what changed between the state’s first response and its second. The technology barely moved; the same verification tools were available throughout. What changed was where each check was placed, who it was applied to, how the agency communicated, and what it measured. Those are management decisions, not engineering ones, and they are the decisions that determined whether real people got paid while criminals were kept out.

Two failures with visible faces

For an agency head, a governor’s office or a legislative committee, the 2020 experience turned what looked like a technical question into a test of public trust. Each failure had a visible face. Fraud meant public money flowing to criminal rings, headlines about losses and pressure from auditors. Excessive friction meant constituents with no income calling their representatives, local news stories about people waiting months, and accusations that the system was shutting out older, poorer or non-English-speaking residents. An agency could be blamed for both at once, and many were.

How the costs compound

The costs also compound. A badly targeted check delays one person and then generates calls, appeals and repeat applications that consume staff time and slow service for everyone. A fraudulent payment loses money, and it may also mean the real person whose identity was used receives a tax form for income they never had, and spends weeks proving it. Choosing where to put a check is therefore a decision about where to put the work, and who does it: the agency, the bank, or the citizen.

Federal and state money also sit on different ledgers. Much of the pandemic benefit money came from federal programs. Regular state benefits drew on state trust funds financed by employer taxes. An agency’s incentives can tilt accordingly. Leaders should look at fraud losses and access failures across all programs together, so that the funding source does not decide, by default, which failure gets attention.

The strongest counter-arguments

One counter-argument says speed should have won outright. Unemployment insurance exists to stabilize household income and the wider economy during a downturn. On this view, paying quickly and recovering fraud later was the right call, and every week of delay did real harm. The argument has force. Its weakness is that recovery after payment proved slow and incomplete, and the identity theft victims bore costs that pay-first designs ignored.

The opposite counter-argument says any loss of public money to organized crime is unacceptable, so the strongest check should apply to everyone. Its weakness is that the strongest check also has a failure rate, and that rate falls hardest on the people with the fewest alternatives. A control that stops fraud by denying benefits to eligible people has moved the loss, not removed it.

Both counter-arguments assume a single dial between speed and security. The agencies that did best acted as if there were several dials: which claims get which check, how fast holds resolve, how quickly banks can return money. Turning those separately is what made both numbers move in the right direction.

How it differs by organization

The same trade-off appears elsewhere with different rules attached. A bank or credit union opening deposit accounts online works under customer identification program rules and anti-money-laundering obligations, and it can decline a customer. A state benefit agency usually cannot decline an eligible claimant, and it owes notice and a hearing when it delays or denies. A health system verifying patients for a patient portal faces lower fraud stakes but higher costs from locking out someone who needs care. Federal agencies building online services follow NIST’s digital identity guidelines directly. Each organization should borrow the design discipline and check with counsel on the rules specific to it.

Vendors and accountability

Vendors are part of the picture too. Many agencies bought identity verification as a service. That can be the fastest route, but it moves important decisions about who passes and who fails into a supplier’s software. Leaders need contracts that let them see results by group, change thresholds, and switch suppliers if needed. Otherwise the agency carries the accountability without the control.

Procurement speed added to the risk. Emergency purchasing let states sign contracts in days, which was necessary. It also meant contracts often lacked the performance reporting, data retention limits and exit terms a normal procurement would have included. A sensible practice is to revisit emergency contracts within a few months and add the missing terms while the agency still has a choice of supplier.

Designing the human route

Every digital proofing process needs a route for people it cannot serve, and the design of that route often decides whether a program is fair. In 2020, the human route was the weakest link in many states. It was usually an in-person office visit, available only during working hours, booked weeks ahead and located far from many claimants.

Sizing it in advance

Better human routes share a few features. They are sized in advance, using the expected share of applicants who will fail the online check, rather than discovered when the queue forms. The arithmetic is simple. Multiply the expected weekly applications by the expected failure rate, divide by the number of verifications a trained agent completes in an hour, and the result is the agent-hours needed each week. If the vendor cannot state its failure rate for a population like the state’s, the agency should run a pilot to find it before switching on the check for everyone.

Vendor-run video routes had the same capacity problem. A 2022 congressional staff report examined one large identity verification provider. Using the company’s own data, it found that average waits for video verification ran to hours in most of the states it served in April 2021. Waits spiked when states sent large backlogs through verification at once. Sequencing matters: an agency that routes a backlog to a new check in one batch should expect the human route to collapse that week.

Options and trusted referees

Good human routes also offer more than one option: an in-person appointment for those who prefer it, a video call with a trained agent for those who can manage a screen but not an automated selfie match, and partnerships with trusted local places such as libraries or community organizations. Later federal work added in-person verification at post offices as an option for agencies. NIST’s guidelines describe a trusted referee, a trained agent who makes a risk-based judgment about an applicant who lacks the usual evidence. They also describe an applicant reference, someone who can vouch for the applicant. Both give agencies a recognized way to verify people the automated route rejects.

The best routes tell the applicant exactly what to bring. And they feed results back, so that if many people fail the online check for the same reason, the online check gets fixed. A common example is name mismatches caused by hyphenated or multi-part surnames, which a rule change can often resolve.

Measuring it

A useful measure is time to resolution: how many days pass between an applicant failing the online check and their identity being confirmed through another route. If that number is measured in weeks, the alternative exists on paper only. Track it by channel and by language, because a route that works for English speakers in a city can fail rural or non-English-speaking claimants entirely.

Both numbers, side by side

Across all three points, the agencies that did best kept proofing at application proportionate, put most of the work into invisible pre-payment checks, and built real redress. They measured both sides of the trade-off: fraud prevented, and legitimate claimants delayed or denied. An agency that tracks only one number tunes its controls in one direction, and its leaders are surprised by the other.

Defining the numbers honestly

Both numbers are estimates, and each can be gamed. “Fraud prevented” can be inflated by counting every blocked claim as fraud, when some were honest claimants who gave up. A more defensible figure counts claims blocked and later confirmed as fraud, plus an estimate for the rest with the method stated. “Legitimate claimants harmed” can be understated by counting only formal appeals, when most people who are wrongly blocked never appeal. A better figure counts held claims later paid, plus a sampled review of abandoned claims. Agencies should also keep the federal first-payment timeliness measures in the same report, since those are what the Labor Department watches.

The evidence an auditor or inspector general will ask for follows from these definitions. They will want the rule set in force on each date, the change log and who approved each change. They will also want referral and pass rates by group, hold reasons and resolution times, and bank return volumes. An agency that keeps those records can explain any week of its operation. One that does not will find its decisions reconstructed by others, usually less kindly.

What worked and what did not

In practice, that meant:

• Light checks for most applicants, with stronger proofing reserved for claims that show tested risk signals.
• Non-digital alternatives, such as in-person or video verification, with capacity sized to the people who need them.
• Invisible cross-matching against other records before payment.
• Hold notices that say what did not match, what will fix it and when the agency will decide.
• Fast channels for banks to return suspect deposits and for identity theft victims to report misuse.
• An appeals process tracked by reason, feeding back into the rules.

The agencies that struggled tended to do the opposite:

• Applying the strongest check to everyone, then discovering who cannot pass it.
• Buying a proofing service without the right to see how it performs for different groups.
• Sending vague notices that generate calls rather than resolutions.
• Measuring fraud stopped but not legitimate claimants harmed, or the reverse.
• Treating each benefit program separately when the same stolen identities are hitting all of them.

Where your own checks sit

The same audit applies to any organization that pays money out or opens accounts to the public: a state agency, a county human services department, a bank onboarding customers online or a health plan enrolling members. The answers should come from data, not from the vendor’s brochure, and the people answering should include the fraud team, the service team and whoever handles complaints.

1. Where in our process do we check identity: at application, before payment, after payment, or all three?
2. What share of genuine applicants fail our online checks, and what happens to them next?
3. How long does an applicant wait for an in-person or video alternative?
4. Do the people sent for extra checks differ by age, language or neighborhood in ways our fraud data cannot explain?
5. What do we report each week: fraud prevented, legitimate people delayed or denied, or both?

If the honest answer to the last item is one number, start there. Adding the missing number changes how every other decision on this list gets made.

With hindsight

Pandemic unemployment fraud proved very large. In September 2023, the Government Accountability Office, Congress’s independent auditor, estimated that fraud in unemployment insurance programs from April 2020 to May 2023 was likely between $100 billion and $135 billion. That is roughly 11 to 15 percent of benefits paid. The Labor Department said the estimate was probably too high; GAO stood by its method. Recovery lagged far behind. GAO reported that, as of May 2023, states had recovered about $1.2 billion of fraudulent overpayments. Figures of that size changed the political conversation. No agency could argue afterwards that identity checks were an optional extra.

Washington’s own accounting came in April 2021, when the State Auditor’s Office published its review of the state’s 2020 programs. It reported that the department had identified $647 million in fraudulent payments as of December 2020 and that the true total was likely higher. It found that the department’s pre-pandemic fraud program had not been built to handle large, sophisticated impostor fraud. It also found that the new fraud controls reduced fraud but significantly increased payment times. That finding is the trade-off of May 2020, confirmed by audit. The department disputed some of the auditor’s figures.

Federal policy closed the gap the inspector general had flagged. The Continued Assistance Act, enacted on December 27, 2020, required people claiming Pandemic Unemployment Assistance to document their employment or self-employment, ending pure self-certification seven months after the warning. In June 2022, GAO added the unemployment insurance system to its High-Risk List, citing program design, outdated infrastructure and integrity risks. The Labor Department reported an improper payment rate of 18.9 percent for fiscal year 2021.

The Department of Labor funded grants to states for identity verification, fraud prevention and equitable access, using CARES Act and American Rescue Plan money. Separate grant streams in 2021 and 2022 covered fraud detection and recovery, equitable access, and fixes recommended by federal “tiger teams” that assessed state systems. The department also offered states access to Login.gov and to in-person verification through the Postal Service. Pairing fraud and access goals in the same program was itself a statement: fraud control and fair access were to be pursued together, not traded against each other one at a time.

Many states adopted commercial online identity verification services during 2020 and 2021. That brought its own controversy, including long waits for video verification. In February 2022, the IRS dropped plans to require facial recognition for online account access after public objections. In March 2023, the General Services Administration’s inspector general found that GSA had misled agencies about whether Login.gov met the NIST standard for remote identity proofing. GSA later added a facial matching option to bring Login.gov up to that standard. In July 2025, NIST finalized the fourth revision of its digital identity guidelines. It barred knowledge-based verification for identity verification, set out trusted referees and applicant references as recognized alternatives, and required providers to assess the customer experience of their proofing.

What held up from May 2020 was the shape of the problem. Stolen-data checks failed, cross-matching did much of the useful work, and human alternatives decided who was left behind. What did not hold up was the hope that one strong check at the front door would settle the matter. Neither half of the trade-off went away. Fraud losses on the scale GAO estimated made stronger proofing politically unavoidable, while the facial recognition backlash showed that claimants and legislators would also judge agencies on whom the checks shut out.

Any organization that pays money out or opens accounts to the public can take a durable framework from 2020. Decide deliberately where each check is placed. Prefer checks that are invisible to honest people. Provide real alternatives for those who cannot pass the digital route. Build redress that is fast and that teaches the rules where they are wrong. And put both numbers, fraud stopped and genuine people harmed, in front of the same decision-makers at the same time. Organizations that do this will still face hard choices, but they will make them with their eyes open.