Every unemployment fraud control had a cost to real claimants

The week

In mid-May 2020, reports emerged of organized fraud against state unemployment insurance systems. The US Secret Service warned that a fraud ring was filing large numbers of claims using stolen personal information, with Washington State among those most affected. Washington’s Employment Security Department temporarily paused payments to review claims and later acknowledged paying large sums to fraudsters, some of which it recovered. Several other states reported similar activity. States were already processing claims at volumes far above normal. They had also just begun administering new federal programs under the CARES Act, including Pandemic Unemployment Assistance for self-employed and gig workers, which initially allowed applicants to self-certify eligibility.

Unemployment insurance agencies in 2020 faced two failures at once. They were too slow for legitimate claimants and too easy for fraudsters. Identity proofing sat at the center of both, because every check that stopped a fraudulent claim could also stop or delay a real one. Where to check is the key design choice, and a claim offers three points: at application, before payment, and after payment. Each point prevents fraud in a different way and places its cost on a different group of legitimate claimants.

At application: checking who is applying

Checking identity at application stops fraud earliest. It also protects people whose stolen identities would otherwise be used to file claims in their names. The cost falls on every claimant, at the moment they most need help. Before 2020, many state systems relied on matching personal details that had already been widely exposed in breaches. That offered little protection against organized fraud using stolen identities.

Stronger online proofing, using document verification and selfie matching, spread through state systems from 2020. It reduced fraud but excluded some legitimate claimants. People without smartphones or valid photo identification struggled. So did people whose appearance or documents produced mismatches, and people with limited English or digital skills. Those claimants needed an alternative, such as in-person or video verification. Many states lacked the capacity to provide it at scale. A three-week wait for an in-person appointment is not a meaningful alternative for someone who has just lost their income.

Proportion matters at this point. A state can apply light checks to most claims and stronger proofing only where risk signals appear, such as a mismatch between the claimant’s details and other records, or many claims from one device. Risk-based proofing reduces friction for most claimants, but it depends on the risk signals being accurate and regularly tested. Agencies should check, at least quarterly, whether the claimants sent to stronger proofing differ by age, language or neighborhood in ways the fraud data does not explain. Vendor contracts should require the data needed to run that check.

Before payment: checking the claim against other data

Cross-matching claims against other records catches fraud without asking anything of the claimant up front. Useful sources include employer wage records, incarceration records, death records and other states’ claims. The checks depend on data-sharing agreements and on systems that can run them quickly. Many state systems were old and could not add new checks easily. The new federal programs also lacked wage records for self-employed applicants, so eligibility rested largely on self-certification at first.

This point gives agencies the most fraud prevention for the least burden on claimants, because checks stay invisible unless they fail. Its cost falls on the minority caught by false matches. A payment hold triggered by a data error can be hard to understand and harder to resolve, especially when the notice does not say what triggered it or what to do. Clear notices are part of the control: which record did not match, what evidence resolves it, and a deadline the agency commits to.

Fraud signals also cross programs. The same stolen identities were used against unemployment, small business relief and tax refunds. A state that shared signals across its own agencies, and with other states through national data hubs, could stop patterns that no single program would see. That needs data-sharing agreements, common identifiers and a team whose remit spans programs.

After payment: recovery and redress

Once a fraudulent payment is made, recovery depends on banks and payment providers, which can freeze or return funds. Banks saw large volumes of unemployment deposits into accounts whose holders did not match the claimant’s name, and many began flagging and returning them. Agencies that set up a fast channel for banks to report and return suspect deposits recovered more.

Recovery has a citizen side. People whose identities were used needed a simple way to report it and to correct tax forms and employer records. Many were still employed and confused about why they had received benefit notices. A dedicated identity theft reporting form, linked to automatic correction of the year-end tax form, spared them weeks of calls.

Redress for legitimate claimants wrongly flagged belongs to the same stage. A fraud control without a fast, fair appeal shifts the cost of fraud onto those least able to bear it. It also generates call volume that slows service for everyone else. Appeals should be tracked by reason, so that recurring false matches feed back into the rules that caused them.

Across all three points, the agencies that did best kept proofing at application proportionate, put most of the work into invisible pre-payment checks, and built real redress. They measured both sides of the trade-off: fraud prevented, and legitimate claimants delayed or denied. An agency that tracks only one number tunes its controls in one direction, and its leaders are surprised by the other.

With hindsight

Pandemic unemployment fraud proved very large. In 2023, the Government Accountability Office estimated that fraud in unemployment insurance programs during the pandemic was likely between $100 billion and $135 billion. Many states adopted commercial online identity verification services during 2020 and 2021. That brought its own controversy. In early 2022, the IRS dropped plans to require facial recognition for online account access after public objections, and debates about equity, accuracy and alternatives continued.

The Department of Labor funded grants to states for identity verification, fraud prevention and equitable access, and promoted cross-matching and data sharing. Neither half of the trade-off went away. Fraud losses on the scale GAO estimated made stronger proofing politically unavoidable, while the facial recognition backlash showed that claimants and legislators would also judge agencies on whom the checks shut out.