The 2022-23 Budget: Assessing Proposals to Address Unemployment Insurance Fraud

The 2022-23 Budget: Assessing Proposals to Address Unemployment Insurance Fraud FEBRUARY 2022 (Updated May 16, 2024) Summary. The 2022-23 Governor’s Budget on top of all UI payments. Under the PUA program, includes $29.8 million General Fund at the self-employed workers could receive payments Employment Development Department (EDD) for retroactively—so-called “backdating”—to the six third-party contracts to prevent future fraud in beginning of the pandemic, even if they applied the state’s Unemployment Insurance (UI) program. for PUA benefits later. Although these temporary (These contracts are in addition to 13 other programs were 100 percent federally funded, the third-party contracts found in the department’s state was responsible for their implementation. These “vendor services” budget change proposal.) With efforts added to the already high workload at EDD. the six fraud contracts, the administration proposes Under Longstanding EDD Practices, Workers to layer additional anti-fraud requirements and Must Pass Multiple Identity Tests. When an processes on top of the major fraud improvements unemployed worker submits a claim for UI payments, EDD took during the pandemic. In this brief, we EDD confirms the worker’s identifying information outline the challenges EDD faced paying legitimate with the federal Social Security Administration and UI claims and preventing fraud during the pandemic, the state Department of Motor Vehicles. EDD also review steps EDD has taken to improve since then, crossmatches the amount the worker reports in prior and assess whether additional anti-fraud efforts are wages against employer-provided salary data. EDD warranted at this time. is able to quickly process many claims using these automated steps. In many cases, however, a worker’s BACKGROUND identity cannot be confirmed to EDD’s standards, often due to incomplete information or minor Unemployment Benefits discrepancies. These cases require workers and/or During the Pandemic employers to provide EDD with additional information. Pandemic Led to Sudden Spike in UI Claims... Collecting this information involves extensive EDD The pandemic pushed unemployment in California staff time. As a result, these “manual claims” take to record highs. Under normal conditions, about much longer to process than automated claims. 40,000 California workers file for UI each week. Time-Consuming Staff Process to Confirm During the first two months of the pandemic, an Identity Led to Backlog During Pandemic. average of 500,000 workers were filing each week. According to the administration, EDD redirects This amount was five times greater than the peak about 40 percent of all UI applications to manual seen during the Great Recession and 15 to 25 times staff processing. At the outset of the pandemic, greater than typical workload at EDD. Figure 1 on EDD could manually process about 2,000 claims per the next page shows a timeline of this and other key day. In May, June, and July 2020, EDD redirected an events related to UI during the pandemic. average of 24,000 claims to manual processing each …At the Same Time That New Federal day. This dramatic increase in manual processing led Benefits Were Launched. In response to the to a backlog of claims waiting to be reviewed before pandemic, the federal government expanded the UI payments could be made. Backlogged claims UI program to include self-employed workers—under were delayed at least three weeks and in many cases the Pandemic Unemployment Assistance (PUA) several months. At its peak in September 2020, the program—and provided an additional $600 per week backlog reached 1.7 million claims. 2022-23 Budget Series 1 At the Same Time, New Federally Figure 1 Funded UI Benefit Hit by Fraud. At the same time that the backlog of delayed Time Line of Key Events During the Pandemic UI claims was increasing, fraudulent activity in the new federal benefit program for 2020 self-employed workers spiked. Figure 2 March shows the sudden and unexpected increase Governor declares state of emergency due to COVID-19 pandemic. in claims for the PUA program during the Widespread business closures, layoffs, furloughs, and hours reductions. early summer of 2020. (The figure also March through July shows claims for regular state UI benefits, UI application workload 15 to 25 times higher than normal levels. which did not show this same spike.) April This fraudulent activity affected UI systems Following USDOL guidance, state begins to fast-track UI claims by throughout the country. In fact, many states issuing payment before confirming final eligibility. were hit harder than California. For instance, July in Arizona, Georgia, Hawaii, Nevada, and Governor forms strike team to address delays at EDD. Benefit delays Rhode Island, more claims for UI were ranged from four weeks to several months. submitted in 2020 than there were workers July and August in those states. The new program was the EDD identifies high level of suspected fraud in federal PUA program. target of fraud for several reasons. First, the federal program presented a larger financial September incentive to commit fraud. Specifically, EDD takes steps to limit fraud exposure, including not automatically backdating claims or allowing multiple claims at same address. federal law allowed self-employed workers to backdate new PUA claims to when Strike team issues exhaustive, critical assessment of delays at EDD. they lost work, meaning a first fraudulent EDD begins implementing key strike team recommendations: two-week check could total several thousand dollars. reset and setting up a new identity verification tool—ID.me. Second, whereas EDD typically verifies Backlog of delayed UI claims peaks at 1.7 million delayed claims. claims against employer payroll records, it could not do so for self-employed workers. October Third, former employers typically provide EDD begins implementing other recommendations from strike team, including recommendation to revisit its approach to fraud prevention a check on the validity of workers’ claims, but this extra level of review did not apply to December self-employed workers. EDD hires Thompson-Reuters to assign “fraud score” to pre-ID.me claims. Based on fraud scores, EDD suspends 1.1 million claims with State Steps to Address no advanced notice. At least 600,000 of the 1.1 million claims were real. Backlog and Fraud California State Auditor releases two EDD audits, pointing out that EDD Took Early Step to Proactively EDD must redetermine eligibility for claims that were fast-tracked early the pandemic. Limit Fraud in Federal Programs. After investigating the spike in claims shown 2021 in Figure 2, EDD stopped automatically July backdating PUA claims. This step closed Due to long delays for scheduling eligibility interviews, EDD begins off the opportunity for fraudulent actors to paying benefits while awaiting eligibility interviews rather than delaying benefits until after interview. receive a large initial payment. EDD notified the U.S. Department of Labor (USDOL) of September their intent to stop backdating PUA claims Temporary federal benefits for self-employed workers and add-on UI payments for all recipients end. to eliminate this financial incentive. Shortly thereafter, USDOL advised all states to take a similar precautionary step. Following this UI = Unemployment Insurance; USDOL = United States Department of Labor; EDD = Employment action, fraudulent PUA claims fell dramatically. Development Department; and PUA = Pandemic Unemployment Assistance. 2022-23 Budget Series 2 Governor’s Strike Team Investigates Backlog surge in workload during the pandemic. In addition, and Issues Recommendations. In July 2020, according to the strike team, the state’s manual the Governor announced the formation of a “strike review process failed to meaningfully capture team” to immediately investigate the claims backlog fraudulent claims—for each 500 claims EDD staff and to make improvements at EDD. The strike flagged for more thorough review, one fraudulent team was overseen by the state’s Government claim was uncovered. Operations Agency. In September, the strike team Strike Team Recommends New, Rational published an exhaustive, critical assessment Approach to Managing Fraud. Given these of delays and fraud at EDD and issued key findings, the strike team recommended that recommendations to address these elements. EDD reassess its approach to preventing fraud. According to Strike Team, Focus on Fraud Specifically, the strike team recommended that Provided Little Benefit and Led to Backlog. “[…] fraud prevention and detection practices The state’s longstanding institutional focus on fraud must be supported by data and evidence and led staff to manually scrutinize roughly 40 percent that justifications for new and existing anti-fraud of all UI applicants’ identity information. In the practices include an analysis not only of their words of the strike team report: “In interviews effectiveness, but also tradeoffs and unintended and observations, stories and anecdotes about consequences of these practices, including adverse fraud and/or suspected fraud were often used to impact on the experience of all claimants.” explain why EDD could not act quickly to avoid the EDD Responded to Strike Team by Setting growth of the backlog. […] There has developed up Automated Identity Verification Tool... at EDD a culture of allowing fear of fraud to trump In response to the administration’s strike team all other considerations…” The department’s assessment, EDD improved its identity verification longstanding institutional design and anti-fraud process by instituting a third-party software— emphasis prevented the department from ID.me. The ID.me service verifies that workers are adequately adjusting its procedures to manage its who they say they are by asking them to take a Figure 2 State Took Steps to Address Fraudulent UI Claims in Federal Programs New Weekly Applications 450,000 EDD takes proactive steps to limit fraud. 400,000 Federal PUA Program EDD adds ID.me to UI application. 350,000 Regular State UI Program 300,000 250,000 200,000 150,000 100,000 50,000 5/2/2020 5/30/2020 6/27/2020 7/25/2020 8/22/2020 9/19/2020 10/17/2020 11/14/2020 12/12/2020 UI = Unemployment Insurance; PUA = Pandemic Unemployment Assistance; and EDD = Employment Development Department. 2022-23 Budget Series 3 photo or video of themselves that is then digitally with Akamai to detect and prevent organized, compared to the documents in their application. automated cyber-attacks—known as “bot The continued decline in new PUA claims after attacks”—that could disrupt or disable EDD’s the state instituted ID.me—as shown in Figure 2 benefit application website. above—suggests that ID.me may have further • Business Intelligence Competency reduced the viability of fraudulent claims. Center Consulting. Consulting contract …But Took Other Actions Inconsistent with Executive Information Systems to With Strike Team Call to Reassess Stance improve reporting of potentially fraudulent on Fraud. While ID.me seemed to move EDD in activity and crossmatching that data with the right direction, the department continued to Department of State Hospitals patient data take actions inconsistent with the strike team’s or California Department of Corrections and recommendation to assess the effectiveness and Rehabilitation records. potential unintended consequences of anti-fraud • Fraud Services. Rehiring Accenture to steps. In December 2020, EDD hired Pondera, continue advising EDD on how to identify and an investigation consulting firm owned by the prevent future fraud. Thompson Reuters news service, to review nearly 10 million claims issued during the pandemic, but ASSESSMENT before ID.me came online, for potentially fraudulent Striking a Balance Between Fraud Prevention characteristics. EDD and the contractor identified and Program Access. State employment 1.1 million claims as potentially fraudulent. EDD insurance programs must balance the need to stopped payments for these claims. Workers prevent fraud with the priority to delivery payments were not notified ahead of time. To reopen their in a timely and straightforward manner. State accounts, workers had to verify their identity agencies also have a responsibility to protect the using ID.me or their accounts would be closed privacy of the constituents they serve. Eliminating all permanently. Ultimately, more than half of the fraud is infeasible. Moreover, attempting to eliminate claims (600,000) flagged as fraudulent were all fraud necessitates onerous eligibility standards confirmed as legitimate. and a lengthy, time-consuming application process. PROPOSAL On the other hand, although a program without fraud controls would be quick and simple, such The 2022-23 Governor’s Budget includes a system would expose the state and employers $29.8 million General Fund at EDD for six to substantial financial risk. Given the importance third-party contracts to prevent future fraud within of UI payments to workers, the economy, and the the state’s UI program. (These contracts are in state during economic downturns, EDD’s policies addition to 13 other third-party contracts found in and practices should be regularly reviewed by the department’s “vendor services” budget change the Legislature and administration to be sure the proposal.) The six fraud-related contracts are: state is striking a workable balance that manages • Automated Batch Review. Thompson fraud while providing prompt and straightforward Reuters software tool used to flag potentially payments to eligible workers. fraudulent claims. Same tool used in January State Already Set up ID.me, Providing 2021 to suspend 1.1 million claims. Substantial Protection Against Fraud… EDD’s • Identity Risk Analytics. Thompson Reuters implementation of ID.me during the pandemic has software contract to allow EDD to review new had two major benefits: (1) with ID.me in place, UI claims daily instead of weekly. Aim of more the department now can automate more claims frequent review is to stop fraud. so fewer are redirected to the time-consuming • Identity Verification. Extension of state’s manual review process; and (2) fraudulent actors existing contract with ID.me. using stolen identity information are no longer able • Website Managed Security Services. to successfully claim benefits. With ID.me now in Expanding an existing statewide partnership place, EDD has taken steps to substantially limit 2022-23 Budget Series 4 opportunities for fraud while also addressing the majority of fraud occurred in the temporary manual review bottleneck that caused the backlog federal programs that now have ended. during pandemic. According to the administration, $18.7 billion …But ID.me Has Come Under Scrutiny in (94 percent) of UI benefit fraud may have Recent Days. The state hired ID.me to confirm occurred in the federally funded PUA program, workers’ identities using so-called “one-to-one” while EDD suspects $1.3 billion (6 percent) in face matching; that is, when a computer algorithm state UI benefits fraud. matches the photo or video submitted by the • Administration’s Estimates of Fraud in worker to the worker’s identification card. Earlier State UI Benefits Likely Significantly this month, the company CEO admitted to Overstated. The $1.3 billion estimate of misleading ID.me clients: although ID.me uses fraud in the state UI benefits program likely one-to-one matching to confirm identity, the is overstated. EDD counts state UI claims as company also made so-called “one-to-many” fraudulent if a worker did not confirm their matches without their client’s knowledge. identity when EDD requested additional One-to-many matches scan one person’s face documentation or verification. Yet there are against large databases and therefore could several reasons why workers with legitimate help identify fraudulent actors who claim multiple claims may not have followed up with EDD. benefits. However, privacy experts warn that these Many of the suspected fraudulent claimants matching systems are prone to error, suffer from already had run out of benefits, meaning systematic racial bias, and have the potential to legitimate claimants would have had little be misused. In light of this scrutiny, the Internal reason to log in to confirm their identity. Other Revenue Service recently called off its planned claimants may have given up in frustration adoption of ID.me for tax filing. (After the publication after trying unsuccessfully to send requested of this report, the IRS reinstated its use of ID.me, documentation to EDD. While widespread but with added safeguards.) frustration and an inability to contact EDD New Anti-Fraud Proposals No Longer Needed and Figure 3 Run Counter to Strike Team Recommendations. Moving Temporary Federal Benefits, Not State Benefits, forward at this time with additional Were the Primary Target of Fraud layers of fraud protection is not necessary because (1) recent fraud was concentrated in temporary federal benefit programs that have now ended, (2) recent fraud in the state’s regular UI program appears to have been minimal, SSuussppeecctteedd and (3) adopting additional fraud aass FFrraauudduulleenntt protection now runs counter to the strike team recommendations. • Recent Fraud Concentrated in Temporary Federal Federal Benefits $146 billion Benefits That Have Ended. Figure 3 shows the administration’s estimate of State Benefits $35 billion suspicious or confirmed UI Likely Fraud benefit fraud that occurred during the pandemic. The vast 2022-23 Budget Series 5 are problematic for other reasons, the reduced fraud in the temporary federal programs. claims from this group of workers did not In hindsight, the strike team’s recommendation to represent fraudulent activity so including them set up ID.me was warranted during the pandemic, contributes to the overstatement. Another when the magnitude of the claims backlog called estimate of likely fraud in the state’s program for prompt and decisive action. Now that this (based on findings in the administration’s critical period has passed, we recommend the strike team report) suggests that state UI fraud Legislature pause and carefully consider the during the pandemic could be much smaller— implications of requiring third-party biometric just $100 million in fraud out of $35 billion in scanning—in this case, facial recognition performed benefits paid. (The small red area represents by artificial intelligence. this smaller likely fraud estimate.) Given that …And Direct Administration to Gather relatively little fraud seems to have targeted More Information, Assess Alternatives. As the the state’s regular UI program, new, additional Legislature considers the ongoing use of facial layers of fraud prevention are not needed. recognition software for the state’s UI system, • Runs Counter to Key Strike Team we recommend that it direct the administration to Recommendation. Moving forward at this follow through on the strike team recommendation time with new, additional layers of fraud to assess the trade-offs and potential unintended protection also would move the department consequences of anti-fraud measures, in this case further out of balance by again prioritizing for ID.me. The Legislature also may wish to task fraud elimination at the expense of prompt the administration with presenting alternatives and straightforward payments. To ensure to biometric scanning that achieve the same (or that an anti-fraud emphasis does not come similar) level of automated security but that pose at the expense of prompt and straightforward fewer potential privacy risks and equity concerns. payments, the strike team recommended that Reject Proposals to Make Pandemic Era new anti-fraud proposals must be supported Anti-Fraud Tools Permanent. We recommend by data and take into consideration how the Legislature reject the pandemic era anti-fraud the new protocols might impact legitimate contracts with Thompson Reuters for automated claimants. The department’s use of the batch review and identity risk analytics because the Thompson Reuters software to suspend state’s use of these programs adversely impacted 1.1 million claims, of which at least 600,000 the experience of several hundred thousand were legitimate, raises concerns that EDD has unemployed workers with legitimate claims and not internalized the strike team’s fraud-related are not likely to be useful now that automated recommendations. Moving forward with this identity verification is in place. The Legislature contract and others therefore runs counter may wish to ask the administration whether these to the administration’s own assessment software tools could be useful in more targeted, and recommendations and would move the special circumstances. department further out of balance. Reject Anti-Fraud Consulting Contracts, Require EDD to Outline Benefits and Consider RECOMMENDATIONS Trade-Offs First. We also recommend that the Legislature reject the Business Intelligence Approve Contract to Prevent Website Competency Center Consulting and Fraud Services Disruptions. We suggest the Legislature approve contracts until the administration reports on the the administration’s contract with Akamai to prevent “the effectiveness, but also the trade-offs and coordinated bot attacks that could disrupt or shut unintended consequences of these practices” as down EDD’s website at critical times. recommended by the strike team. Withhold Action on ID.me… Setting up automated identity verification substantially sped up EDD processes so benefits could be paid promptly during the pandemic. The software likely also 2022-23 Budget Series 6 2022-23 Budget Series 7 LAO PUBLICATIONS This post was prepared by Chas Alamo, and reviewed by Brian Uhler and Carolyn Chu. The Legislative Analyst’s Office (LAO) is a nonpartisan office that provides fiscal and policy information and advice to the Legislature. 2022-23 Budget Series 8