During pandemic, a flood of fraud
Illinois failed to stem tide of phony unemployment claims
As a professor and policy expert working in Springfield, Richard Funderburg knew the risks of unemployment fraud better than most.
If states don’t take the proper steps, thieves can steal benefits meant for jobless residents by typing stolen personal information into outdated government computer systems, then diverting the money into their own accounts.
Then it happened to him. Like thousands of other Illinoisans last year, Funderburg got a letter from the Illinois Department of Employment Security about a claim filed in his name. He spent weeks trying to alert the agency, which eventually stopped the claim, but only after the state had paid two weeks of benefits to the thief.
Funderburg’s frustrating experience is just a tiny part of a massive wave of fake filings that overwhelmed IDES during the pandemic — even though Illinois, just three years ago, had touted an upgraded anti-fraud system that officials described at the time as “modern and comprehensive.”
Records obtained by the Tribune show the flood of fraud happened after IDES failed to follow federal recommendations to adopt free fraud-fighting tools that were made available in 2019. Only recently did the agency begin using those tools. A separate process to help identify problematic claims also didn’t become fully functional until February, nearly a year into the pandemic.
At the same time, Illinois has not joined some other states in implementing safeguards meant to detect and stop sketchy claims at the door, before they are accepted into an overburdened system. Though critics say these methods can cause problems by interfering with legitimate claims, some officials in other states credit them with significantly decreasing fraud.
The Illinois Department of
Employment Security has yet to report how much money it believes was siphoned away. But if the amount tracks with national estimates, it could involve billions of dollars.
In Illinois, the fraud became so rampant last year that it overwhelmed IDES as its top leadership was undergoing a transition. Five months into her new job as IDES’ top administrator, Kristin Richards lamented to her staff in a December email that she was “stunned by fraudsters’ tenacity.”
In written responses to questions, IDES defended its work. The agency has noted that its already lean staff had to work even harder to expand programs and process new claims. And it said other states have struggled, too.
“It is important to understand that these fraudsters are not your run-of-the-mill criminals; these are highly sophisticated individuals and networks, running international fraud schemes to defraud each state’s unemployment insurance program,” an IDES spokesperson wrote in an email.
IDES said it’s gotten better at detecting fraud, but it also called for federal officials “to provide guidance and ideally, universal solutions” to state officials who have had to figure out antifraud tactics on an “ad hoc basis during a crisis.”
In the meantime, fraud victims continue to surface, such as Kristin Deming.
The Lockport woman said that when she tried to file an unemployment claim in March, she learned someone had already received benefits in her name. Deming said she has spent three months trying to get IDES to rectify the problem.
“It’s time-consuming, and just, not receiving benefits when I’m entitled to them, that’s frustration in itself,” she said.
Warnings of a problem
The claims in the names of Funderburg and Deming are just a tiny part of a massive, coast-to-coast outbreak of unemployment fraud that experts say had been brewing for years, exploded during the pandemic and can be partly blamed on flatfooted bureaucracies that failed to prepare.
Hackers have accumulated a big supply of personally identifying information. Then a pandemic-induced recession gave cover to thieves to use that info to send blasts of fake claims to thinly staffed unemployment agencies trying to get money quickly to desperate families.
IDES officials have described the fraud to state lawmakers as the newest version of an evolving crime trend.
“What we’re seeing now is an extension of the credit card fraud and the retail theft that goes on continuously, as these criminal organizations shift over to target unemployment agencies nationwide,” Adam Ford, the Illinois Department of Innovation and Technology’s chief information security officer, said in March.
But experts had been sounding the alarm about vulnerable state systems for years. One was Haywood Talcove, a top executive with LexisNexis Risk Solutions, a large firm that public and private entities pay to fight fraud.
At annual conferences Talcove helped organize as early as 2016, he warned that criminals, many from overseas, were inputting stolen information into government benefits systems, then having the cash wired to newly created bank accounts or mailed to accomplices, who’d forward the money along.
“It’s not a very sophisticated fraud,” Talcove told the Tribune. “It’s a fraud that was started a long time ago that the banking industry and the e-retailers have all stopped. But government didn’t really keep up in trends in identity verification, because they had this assumption that they didn’t really have a problem.”
Warnings didn’t come only from firms pitching products. Florida officials told peers basically the same thing at a national webinar held in 2016 by Secretaries’ Innovation Group, an association of conservative state government officials. At the time, Illinois was led by a Republican governor, Bruce Rauner.
To leave no doubt, the Florida presentation offered this blunt warning, in all capital letters: “THIS FRAUD IS PROBABLY HAPPENING IN YOUR SYSTEM.”
Under the Rauner administration, IDES was touting a computer upgrade it said provided a “modern and comprehensive fraud detection, prevention, and collection system.” IDES said the system was geared toward preventing people from continuing to collect unemployment after getting new jobs.
The IDES director at the time, Jeff Mays, recently told the Tribune the new system also ensured applicants weren’t using names of inmates or dead people, and even asked people to input the weight listed on their driver’s license or state ID, which was checked against a secretary of state’s office database.
“I don’t know of any state that was better positioned than us by the time we left, based on what we had done,” Mays said.
He said IDES also had plans to boost its efforts even more by using new, federally funded anti-fraud tools collectively called the Integrity Data Hub.
But Mays left when Gov. J.B. Pritzker took office in January 2019. And the new administration didn’t immediately start using the tools when they started to become available later that year.
Then the pandemic hit.
Thieves take advantage
To many identity-theft victims across Illinois, the first signs of trouble were letters from IDES announcing that the agency had begun processing their claims and the money would be on its way within a couple of weeks. But they hadn’t actually applied.
Mays, the former IDES director, said he eventually got four separate form letters from his former agency, all letting him know the system was working on a claim in his name.
Some people scrambled to alert IDES to the fraud, hoping to stop the process before thieves could complete a final step, called certification, then reroute the payments.
Mays said he knew he needed to scribble a note at the top of his forms to deny the claims and fax the paperwork to an IDES office in Springfield.
“I don’t know how well they publicized that,” he said of his former agency. “I just knew it.”
Others told the Tribune all they knew was to try to call. Soon they were stuck in the chaos of IDES’ overwhelmed phone system, along with legitimate filers trying to get answers about their claims. Records show IDES was short-staffed for years before the pandemic hit, and it has since struggled to gear up by adding private call takers.
While scrambling to field calls last year, IDES also didn’t take steps to meet federal anti-fraud guidelines.
In April 2020, the Department of Labor had “strongly” recommended to states that each start using all of the Integrity Data Hub’s fraud-prevention tools. The agency went a step further in August, telling states they were “on notice” that the failure to use such tools could violate a federal requirement to take appropriate steps to prevent, detect and recover improper payments.
By then, IDES had a new director: Richards, a career statehouse aide known for problem-solving. In mid-September, she told a state policy advisory board that the agency would begin using Integrity Data Hub tools once “our operations begin to recover.”
In the meantime, even more fraud complaints poured in. Records show calls to IDES’ fraud unit jumped to more than 2,000 a day around the time of Illinois’ second COVID19 infection wave, before reaching nearly 5,000 a day in mid-December. (IDES’ records did not specify how many were repeat callers.)
IDES couldn’t keep up.
The agency keeps records of calls received by its fraud unit and calls “completed,” which IDES defines as reaching a caller to resolve a problem or trying three times without a callback. On many weekdays last summer, IDES’ fraud unit received more than double the number of calls it completed, agency records show.
It got worse. On one Tuesday in late October, the fraud unit received 1,923 calls and completed 728.
Among those repeatedly calling around then was Funderburg, an associate professor at University of Illinois at Springfield. He said he couldn’t get anyone to pick up the phone. If he was lucky, he said, he got a recording inviting him to leave a message. But he didn’t hear anything back.
Funderburg, who said he worked years ago as a policy analyst at California’s unemployment agency, didn’t want to give up on stopping a slow-motion theft in progress.
In desperation, he reached out to his state representative, Mike Murphy, R-Springfield. Murphy was able to get a message to IDES, and the agency stopped the claim — but only after it had paid out two weeks’ worth of benefits to the thief.
By then, Funderburg had learned that IDES’ system had accepted yet another claim filed in his name. So he called Murphy’s office again. This time, he was told, the claim was stopped before it could be paid out.
“The whole process is just absolutely draining, in every regard,” Funderburg said.
Trying to catch up
Other state employees also had to confront fake claims filed under their names, some of them repeatedly. At times, the IDES anti-fraud system assumed the employees themselves were the thieves and began asking the state comptroller to garnish their wages, officials acknowledged.
The comptroller’s office said it was able to reverse the process, but mounting frustration can be seen in emails that IDES gave the Tribune under the state’s Freedom of Information Act.
In a December email chain, one sender complained her agency had discovered 26 fake claims that day involving that agency’s workers, on top of 11 the prior day, and 185 in all. Some were filed using the same identities IDES had previously been told were stolen.
“I was under the impression that IDES had put some dedicated resources to preventing this,” the sender wrote.
As the email was forwarded up the chain, another unnamed state agency complained that tracking its problems with IDES had become “nearly a full-time job.”
Richards responded that her agency was “trying to catch what we can, as quickly as we can” but there were “several reasons that we are unable to stop all claims before payment is made.”
She didn’t elaborate on the reasons in the email, and IDES did not offer specifics except to say it can be difficult to stop fraud in ways that also don’t slow down payments to legitimate filers.
Some states have implemented front-end checks that seek to vet people’s identities based on the type of techniques financial institutions use. Kansas, for example, has a system that requires two-factor authentication — where applicants have to type in codes sent by email or text — as well as identity verification, which tries to screen out identity thieves by seeing if people can answer questions in a way that matches information drawn from their credit reports.
Such systems can be controversial, with complaints that some legitimate filers get denied by an algorithm and then struggle to reach an agency to clear up the confusion. But states have credited the measures with notably reducing fraud.
“A stronger front door was absolutely what we needed,” said Ryan Wright, the Kansas Department of Labor’s deputy chief of staff. “This almost overnight eliminated those (false claims) because we were stopping people on the front end.”
IDES didn’t take similar steps, but in February of this year — deep into the pandemic — it began running pending claim data through a subscription service that ranks claims by their likelihood of being fraudulent. That helps IDES’ fraud investigators prioritize claims to review. More recently, IDES contracted with two national security firms to provide additional vetting of claims, including using some of the Integrity Data Hub tools.
IDES said it hopes the U.S. Department of Labor will develop a broader national strategy to fight unemployment fraud. (Some
Democrats in Congress have proposed developing national cybersecurity standards for state systems as part of a broader modernization effort.)
“What states really need is tech expertise from (the Labor Department) for assistance with this,” the IDES spokesperson said in email. “This is an international crime problem, and states have engaged various vendor solutions and enrolled in (Integrity Data Hub), but in an ad hoc basis during a crisis.”
How much was lost?
IDES has said it stopped 2 million fake claims last year. But the agency says it doesn’t yet know how many got through, and how much money was stolen.
In a November news conference, Richards told reporters her agency was working to quantify those figures. She told lawmakers the same thing this spring. The IDES spokesperson said it again this month, eight months after the news conference.
IDES notes that many states have yet to release similar figures. But some have, including California and Kansas. Beyond that, IDES did not provide documents and data sought by the Tribune that could shed light on the scope of the problem.
Some states that have released figures did so after a state audit. Illinois lawmakers could order one but haven’t.
State unemployment agencies also must report fraud data to the U.S. Department of Labor. But Illinois is among the states that missed their deadlines to do so.
One hint may come from a record IDES sent to the IRS, which the Tribune pushed IDES to release. The state agency has to tell federal tax collectors how much money was paid out in unemployment benefits, so the IRS knows how much income taxpayers should be claiming.
According to a separate report from the National Association of State Workforce Agencies, IDES reported paying out $21.4 billion in unemployment claims in 2020. IDES later told the IRS it paid out $19.7 billion in claims after adjusting for known fraudulent payments.
The difference is $1.7 billion.
IDES cautioned that figure likely doesn’t represent the true scope of the fraud but said it’s still figuring out the correct number.
One complication is that some fraud may go undetected because no one filed a complaint. Deming, for example, didn’t know someone had put a claim in her name until she had to file for unemployment herself.
Three months after her March claim was rejected, she said she’s still trying to get IDES to sort things out. She said she’d be happy to show up at an IDES office to prove she is who she says she is. But the agency hasn’t yet reopened its offices.
The agency said it couldn’t comment on individual cases but said that, in general, it takes time to untangle which claims are real and which are fake.
For Funderburg, who teaches courses on government finance and policy, his experience with IDES became one more lesson he can share with his students, about what can go wrong when states don’t gear up their systems and workforces.