Chances are, even if you limited your Paycheck Protection Program (PPP) origination to just customers, you still have some fraud. If you took on new customers, you likely have between 5% and 10% fraud, even with a medium level of screening. According to an Aite Group survey done in June, financial institutions are only catching 1% of their total applications with fraud. This difference matters as the SBA will likely want to see you conducted some level of due diligence to prevent fraud. In this article, we explore some areas that you could be at risk and some simple steps that you can take to highlight those applications that could be fraudulent.

Why Look at This Now During Forgiveness?

Hopefully, your bank has already looked at these issues, as they have been hot topics since June. However, if you have not flagged loans to further investigate, there are two reasons to do this now. One is that the SBA and FBI are actively looking into this, and many banks we spoke with have already had inquiries for more information to include internet connection addresses and history.

The other reason to flag these is that you will now have more information during forgiveness. It is estimated that more than half the fraudsters will attempt to get forgiveness. For these criminals, the logic that if they can get a loan forgiven, they are less likely to stand out and be investigated compared to a bank having a delinquency next year and then looking further into the file.

The problem with forgiving fraudulent borrowers is that it further opens the bank up for liability as it might be accused of not exercising the proper amount of due diligence. Even if you do process these fraudulent transactions, you at least will likely want to show that you made an effort to identify high-risk borrowers.

The Data on Finding Fraud

So far, finding fraud comes down to three main ways – common loan fraud issues, using machine learning on the SBA’s database of known fraudulent loans, and anecdotal evidence from other banks of what their fraudulent loan set looks like. In addition, the SBA’s data release on PPP loan over $150,000 also gives us insight into the borrowers that could be potentially fraudulent.

From these sources, we highlight the below areas where banks may want to run some statistical screens to highlight loans that could have an above-average probability of fraud.

Loans at Other Institutions

Congress estimated that more than $1B of funds alone went to duplicate borrowers. There are 10,856 known duplicates more in the system and likely thousands of more unknown. These duplications come in many forms, but one of the easiest to catch is comparing your list of borrowers to the SBA’s over $150k loan amount list and seeing who pops up. While it wasn’t supposed to be technically possible to obtain multiple loans, there were problems with the check and we know from first hand experience that some borrowers got through either fraudulently or that they applied with multiple institutions and got approved in multiple places and then fraudulently took multiple loans.

At a minimum, your bank should run borrower names against the list of total known borrower names.

Duplicate Loans To the Same Tax ID and SSN

Of course, some of these duplicate loans occurred at the same institution. Few community banks did tax identification cross-referencing. As such, it was quickly circulated on the Dark Web that criminals can apply at their bank using their businesses EIN and then apply again using the owner’s social security number.

Catching these duplicates may be as simple as sorting your list by company name and then researching or as sophisticated as using a third-party database to cross-reference the tax ID.

The Do Not Fly List

Another area where many community banks fell down was the failure to check the Federal government’s ineligibility list. There are more than 613 instances where borrowers were previously disbarred or suspended from doing business with the Federal Government due to past fraud. In a similar vein, there were more than 11,000 borrowers that received loans despite not being eligible for SBA assistance due to past debt issues (e.g., non-payment). Finally, there are loans made to known barred actors such as entities involved in human trafficking, cannabis, and escort services.

These errors came in two forms. Either the bank checked the System for Award Management (SAM), and the borrower came back negative, at which case it is on the SBA, or the bank failed to check the SAM database.

The semi-good news is that if you have loans in this category, it is likely that your bank has already been contacted by the SBA and/or the FBI. If you have been contacted, your bank has likely been flagged as a higher risk lender for future review. If this is the case, additional due diligence on fraudulent borrowers might be considered to head off future problems.

Duplicate or Missing Addresses

A marker for a higher probability of fraud exists when a bank has multiple loans to the same address. While this is common for owners with multiple businesses, it is also common for criminals to duplicate an existing corporate profile and submit loans on behalf of that company. While less common, there are instances where there was no address transmitted and the SBA system, E-trans, accepted the application.

Every duplicate or missing address should be reviewed. Unless the owner has multiple businesses, loans to the same address are markers for a high incidence of fraud.

The Other Address Problem

Addresses are another issue. If you look at those PPP loans that have already been found fraudulent, temporary PO Box-like addresses make up a material amount.  Of those, United Parcel Store addresses make up a large portion of those.

PPP scam artists already had a variety of fake businesses from other scams that they just decided to use to take a PPP loan. A high percentage of these appeared to be medical practices since scammers often use doctor groups for Medicare and Medicaid billing scams. Some of these medical groups have been customers of community banks for the past year and have escaped detection.

It is also suspected that some of the criminals highjacked the identity of legitimate businesses and then subsequently changed the address and telephone number to a rented location where they can complete the impersonation of the company right down to rerouting the PPP loan proceeds.

Banks are well-advised to not only to run their existing PPP loans against a list of known UPS and other rentable addresses but to build this check into any change of address request for all bank products.

Further, prison addresses were also used by scammers and, while less common than UPS addresses, can also be easily checked for each bank’s respective area. Finally, banks should run a check of residential addresses for larger size loans. While it is possible, it is not likely that a firm with 20 or more employees is being run out of a home.

The Jobs Retained Field

There are more than 878,122 applications where the jobs retained field was inputted at zero or left blank. In many cases, banks failed to catch these errors, and it turns out this is also an indication of higher fraud according to machine learning and advanced analytical models. At a minimum, missing information in this field not only points to a borrower that was potentially sloppy with their application but a bank that did not conduct a reasonable standard of care. Either way, it is worth sorting those applications for further inquiry.

Duplicate Payroll Data

Finally, duplicate payroll reports were used in a large number of fraudulent PPP loans. While this one is harder to catch, it is important to train your bank’s reviewers to be aware of criminals using the exact same report as they did with origination across multiple loans and just changed the data.

What To Do If You Suspect A Higher Probability of Fraud

At a minimum, banks should run several data sorts using the criteria above to highlight those borrowers where bankers should have their team relook at loan origination documentation and be prepared during forgiveness. Each of the above tests are relatively easy to run and should be done at a minimum, not only to catch the bad guys but to show the regulators and the SBA that you are trying your best.

It is important to note also that fraud occurred with little correlation to loan size, so bad actors did not always try to maximize their yield as many attempted to “fly under the radar,” knowing that smaller loans would draw less scrutiny.

For many of those PPP loans that have a higher probability of fraud, the criminals may file forgiveness, which will create another rich treasure trove of data that may indicate fraud.

Advanced banks can use the SBA list of known fraudulent PPP loans, combine that with third party data from D&B, Equifax, Lexis-Nexis, Experian, and others and then run machine learning models. These can include cluster analysis, graphic analytics, link analysis, and customized models to uncover traits that may point to a higher probability of fraud.

If you suspect the potential of fraud, your financial crimes or compliance teams can then manually go back through the application and associated documents. If fraud is still suspected, then forgiveness should be frozen, and the borrower reported to the SBA.

Banks did a fantastic job with PPP origination but were under tremendous pressure. It was this pressure that scam artists sought to exploit.  Your PPP portfolio potentially has more fraud than you think. It could be worth your time now to exercise a reasonable effort before you go through the forgiveness process and compound the issue by helping criminals further perpetuate the crime. For at least a portion of the criminals, forgiveness gives law enforcement a chance to engage the bad guys and help stop the further impact on society.

Tags: Published: 09/21/20 by Chris Nichols