When millions of Americans were given unemployment benefits to help them weather the crisis, scammers developed a new way to steal cash directly from recipients' accounts, according to a study by CNBC.
When a single mother's bank account ran out, she had to break into her child's piggy bank to survive. Another victim choked on telling CNBC how she left a grocery store empty-handed. One musician said he had to live in his car for a few weeks after his money was stolen.
At the heart of the problem is the technology underlying most of the debit cards used to distribute unemployment insurance in certain states, experts say. Unlike traditional consumer debit cards, government prepaid cards often lack a chip – instead, they use outdated magnetic stripe technology – making it easier for hackers to break into.
Vanessa Rivera (left), Azuri Moon (center), Candace Koole (right) say their unemployment insurance has been stolen from their accounts.
“A chipless card that's easy to copy,” said Charles Henderson, global managing partner and head of X-Force at IBM Security. "If a criminal gets access to the data on this magnetic stripe and can either reset the cardholder PIN or get access to the PIN, they can make a card and go to an ATM."
A CNBC analysis found that states like California and Nevada experienced an oversized proportion of so-called transaction fraud during the pandemic because, with few exceptions, their unemployment insurance was distributed via chipless debit cards. Other states, like Hawaii, reported insignificant cases of funds stolen as most of the benefits were deposited directly into recipients' bank accounts.
Still, 45 states and Washington, D.C. Debit cards as an option for unemployment insurance.
During the pandemic, a wave of unemployment made the welfare world a prime target for fraud. The Department of Labor estimated the inappropriateness of payments in January totaled nearly $ 40 billion nationwide.
Most of this fraud involved identity theft – using false information to leave criminals unemployed. But the transactional fraud that has deleted thousands of unemployment insurance accounts is different. These are unauthorized transactions, in some cases copying cards and redeeming accounts through ATMs.
Bank of America, which distributes government benefits cards in California, told CNBC that fewer than 2% of their cardholders had their benefits stolen during the pandemic.
Azuri Moon, 30, witnessed it first hand. As a part-time performer and music teacher, Moon was unemployed for the first time in his life during the pandemic.
The California resident took out unemployment insurance in March. Around October, when he tried to buy lunch in a taco truck, his card was rejected. He said he went to an ATM to withdraw cash in vain.
"My entire account has been deleted," Moon said in an interview with CNBC, referring to the account that held his unemployment benefits. "And that was actually the first time I really had to rely on it to rent it this month."
While we had a global health pandemic, we had a national pandemic of identity fraud and theft.
Moon said he called Bank of America and learned that there were two unauthorized ATM withdrawals in the days before he discovered the scam. A total of around 1,800 US dollars were stolen. Moon said it took him 11 hours to file an application with the bank. He was told it would take at least 30 days to get his money back. Having no money to pay the rent, Moon said he was temporarily homeless and lived in his car.
About a month after he filed his claim, Moon said a bank agent told him he was responsible for the stolen money and that the company would not provide a loan. Moon said the bank encouraged him to file a police report, which he did.
After months of communication, Moon said Bank of America added the stolen funds to his account, but only after joining a class action lawsuit against the bank.
Class action, injunction
The lawsuit, which Moon is affiliated with, alleges that the company "did not take reasonable steps to protect the plaintiffs 'and classmates' benefits from fraud". The complaint, originally filed in the US District Court for the Northern District of California, stated that Bank of America had failed to implement “fraud prevention” chip technology into plaintiffs' cards, which made them “easily prone to cloning " make.
Brian Danitz, a partner at Cotchett, Pitre & McCarthy and lead lawyer for the class action plaintiffs, said he received more than 800 calls "from people wanting to join" since the case was filed.
In this case, a judge in San Francisco last month issued an injunction preventing Bank of America from denying fraud claims and freezing accounts based on its automated filter.
In response to the injunction, Bank of America said it went "far beyond what is required by law". The company said in court documents that approximately 255,000 fraud claims were filed from October 2020 to March 2021, of which the company approved repayments of about half.
The bank said part of the risk is criminals falsely claiming fraud and then obtaining temporary loans, which according to court documents cost the company $ 200 million in 2020 in California alone. A provisional credit is a credit that is temporarily added to an account when a fraud claim is assessed. Based on the result of a review, it can be made permanent or removed.
"No more food in the house"
Vanessa Rivera and her son.
Source: Vanessa Rivera
Legitimate recipients say they got caught in the crosshairs. Single mothers Candace Koole, 29, and Vanessa Rivera, 30, said they had an experience similar to Moon. Koole, a doula, and Rivera, a pawnbroker, said they got unemployed last spring and received California benefits.
Koole discovered her money was missing when she tried to buy groceries from the grocery store. She said she was unable to get the stolen $ 9,000 back quickly.
"I never knew if I would be homeless. I never knew if … you know if I would get birthday presents for my child," Koole said in an interview with CNBC. "I never knew what was going on. It was around Christmas time, that was also very tough."
Upon discovering $ 800 in benefits stolen, Rivera said she needed to siphon off her family's savings.
"At some point I actually had to break my son's piggy bank because I ran out of gas and he didn't – we – didn't have any food in the house," Rivera told CNBC. The two are also plaintiffs in the same class action lawsuit as Moon.
Bank of America did not comment on the situation of Moon, Koole and Rivera. The bank said in a statement to CNBC that its "# 1 goal has always been to ensure that legitimate recipients can access its benefits."
Bill Halldin, a company spokesman, said the company increased its team for these programs "from hundreds to more than 6,000 people over the past year, dramatically reducing waiting times to answer calls and review claims." . Halldin said the bank is committed to "additional measures to help unemployed beneficiaries who have been victims of fraud get their benefits as soon as possible."
The higher cost of chips
Candace Koole and her son.
Source: Candace Koole
Moon, Koole and Rivera said their debit cards did not contain any chips.
Card experts told CNBC that prepaid government cards typically don't have chips as they can be around 50% more expensive to make. In addition, unlike typical debit and credit cards for bank customers, these performance cards are limited in time – they only take several months for the recipient to find full-time employment.
CNBC has received an agreement between Bank of America and California to distribute state benefits as of 2016. In it, the state only required a magnetic stripe, never a chip, so the bank did not have to include chips in the cards it issued to Californians.
California recently renewed its deal with Bank of America, despite the bank telling CNBC that it "wants to end this deal as soon as possible."
Bank of America recently stopped this type of work in Iowa, Kansas, Maryland, and Nevada.
U.S. Bank, Comerica and KeyBank are the other three largest providers of unemployment benefits. The US bank and Comerica did not respond to CNBC's requests for comment. KeyBank declined to comment on any fraud incidents due to the ongoing investigation.
Meanwhile, California and other states are trying to mitigate the onslaught of transaction fraud that has spread through their systems during the pandemic.
"I envision that if these cards contained anti-fraud chip technology, there would be a lot less fraud," said David Chiu, a Democrat who leads reform of the California Department of Employment Development, which runs the benefits on behalf of the state.
California unemployment cards do not contain security chips.
As part of a package of bills, California lawmakers want to allow unemployment insurance recipients to bypass cards entirely in order to deposit funds directly into their regular bank accounts.
California's Department of Employment Development and Bank of America announced to CNBC that they are in the process of switching to cards with chips to improve security for recipients.
Maryland recently moved from debit cards to direct deposits or paper checks for unemployment insurance. Nevada is the only other state that doesn't allow direct deposit but has recently switched providers with new cards with chips, the state told CNBC.
Other states, like Oklahoma, are employing technological solutions to their recent fraud problems. IDEMIA provides identity verification solutions for 34 government agencies that use facial recognition and biometric identification technology.
Oklahoma's Employment Security Commission is one of those agencies that implemented the security solution in December 2020. Shelley Zumwalt, executive director of the commission, said the state had been able to prevent about 40% of fraud cases within the first 30 days of implementing the IDEMIA solution.
"While we had a global health pandemic, we had a national pandemic of identity fraud and theft," said Matt Thompson, IDEMIA's senior vice president of Civil Identity for North America.
For those who say their benefits have already been stolen, these funds can mainly be replenished through the banks that monitor the accounts and debit cards.
Ultimately, Moon, Koole, and Rivera received a loan from Bank of America for their missing funds. But they say their life has already been turned upside down.
"This is the life of the people you mess with," said Rivera. "I feel very badly hit in the stomach."
Please email tips to firstname.lastname@example.org.