WEBVTT - How Scammers Took $32 Billion in Unemployment Aid 0:00:00.120 --> 0:00:04.040 It's Friday, January eight. I'm Oscar Ramirez from the Daily 0:00:04.080 --> 0:00:08.119 Dive podcast in Los Angeles, and this is reopening America. 0:00:08.400 --> 0:00:12.320 Throughout the pandemic, many have had issues with claiming unemployment benefits, 0:00:12.360 --> 0:00:15.320 some waiting months for payments, but there has also been 0:00:15.360 --> 0:00:17.560 scammers cashing in on fraud in the system to the 0:00:17.600 --> 0:00:20.680 tune of thirty two billion dollars. Many of the scammers 0:00:20.720 --> 0:00:23.040 are coming out of Nigeria, but they can't do it 0:00:23.079 --> 0:00:26.759 alone and use mule networks to get it done. Many 0:00:26.760 --> 0:00:29.240 of the victims are also people who are employed but 0:00:29.320 --> 0:00:33.599 have had their identity stolen. Nick pens And Stadler, reporter 0:00:33.720 --> 0:00:36.960 at USA Today, joins us for how scammers are cashing 0:00:36.960 --> 0:00:40.440 in on unemployment. Thanks for joining us, Nick, They're happy 0:00:40.479 --> 0:00:43.680 to be here. We've been doing some stories recently about 0:00:43.920 --> 0:00:48.080 unemployment benefits and how you know it's taking months over 0:00:48.120 --> 0:00:51.000 a million people months and months to actually receive any 0:00:51.120 --> 0:00:55.520 unemployment aid. Obviously, there's a bunch of backlogs they're working 0:00:55.560 --> 0:00:58.480 through to try to root out any fraud that's going on. 0:00:58.800 --> 0:01:01.000 And then I came across your ard goal talking about 0:01:01.000 --> 0:01:04.920 how scammers have siphoned off about thirty six billion dollars 0:01:04.920 --> 0:01:08.800 in fraudulent unemployment payments from the United States, and you know, 0:01:08.880 --> 0:01:11.280 it's kind of an all too familiar theme. I guess. 0:01:11.280 --> 0:01:13.959 You know, it's people that are kind of imposters, posing 0:01:13.959 --> 0:01:16.520 as someone else, throwing out some of the information that 0:01:16.560 --> 0:01:19.840 they can buy some of these hacks databases pretty easy, 0:01:19.920 --> 0:01:22.440 it seems like for these scammers. And you actually got 0:01:22.480 --> 0:01:25.240 to speak to somebody who was involved in some of this, 0:01:25.600 --> 0:01:27.240 So Nick, tell us a little bit about what we're 0:01:27.280 --> 0:01:29.600 seeing and how you know people are just scamming the 0:01:29.680 --> 0:01:33.479 unemployment benefits. Sure, I think it's important to think about 0:01:33.800 --> 0:01:37.120 that hacked information. You know, it's your data breaches. You 0:01:37.120 --> 0:01:39.160 hear about that in the news a lot, and I 0:01:39.200 --> 0:01:41.200 think a lot of people shrug it off when it 0:01:41.240 --> 0:01:44.600 happens because nothing immediately happens to you. There's and there 0:01:44.600 --> 0:01:47.360 aren't really the consequences until maybe down the line. And 0:01:47.400 --> 0:01:51.400 this is exactly that scenario where compromise information has been 0:01:51.440 --> 0:01:54.560 floating kind of on the dark web for years maybe, 0:01:54.680 --> 0:01:57.760 and now the bad guys are exploiting it through this 0:01:58.000 --> 0:02:00.320 series of transactions to get this money. And the way 0:02:00.320 --> 0:02:03.600 it works is they're using a stolen social Security number 0:02:03.680 --> 0:02:05.280 and a day of birth and a name that I'll 0:02:05.320 --> 0:02:08.880 match to file for unemployment in that person's name. So 0:02:08.919 --> 0:02:11.720 it's not like synthetic fake person. It's a real person 0:02:11.800 --> 0:02:14.880 who's had their identity stolen with a bad guy using 0:02:14.919 --> 0:02:18.000 it to file for the unemployment. Yeah, and sometimes you 0:02:18.040 --> 0:02:20.200 need a little bit of extra information, you know, the 0:02:20.240 --> 0:02:23.160 office is asking you for other stuff and in that way, 0:02:23.400 --> 0:02:25.520 you know, they'll go on some sites like family Tree 0:02:25.560 --> 0:02:28.799 now truth finder to get other information that they might 0:02:28.840 --> 0:02:31.440 need to be able to fill out these applications. And 0:02:31.639 --> 0:02:33.440 you know, they're very successful. I think one of the 0:02:33.480 --> 0:02:35.840 people that you spoke to that has been partaking in 0:02:35.880 --> 0:02:38.560 some of this said that one in six attempts are 0:02:38.600 --> 0:02:41.280 successful for them, and a lot of these scammeras are 0:02:41.280 --> 0:02:43.440 coming out of Nigeria. That was the case for the 0:02:43.440 --> 0:02:46.400 person you spoke to. What was that like, Yeah, we 0:02:46.400 --> 0:02:49.200 had this pretty rare opportunity to talk to a scammera. 0:02:49.240 --> 0:02:53.040 They're called threat actors by the cybersecurity folks who deal 0:02:53.080 --> 0:02:56.440 with them, and the firm we interviewed, you know, spends 0:02:56.520 --> 0:02:59.600 time with these people to try to learn how they're 0:03:00.240 --> 0:03:02.680 how they're running these scams, and they pay them for 0:03:02.720 --> 0:03:05.600 the information so the scammers are all too happy to 0:03:05.760 --> 0:03:08.320 share a little bit because they share it widely. There 0:03:08.320 --> 0:03:11.600 are these channels that share these scripts and these methods, 0:03:11.960 --> 0:03:13.680 and they're all in on it. So this guy came 0:03:13.720 --> 0:03:16.480 on an interview with us and walked us through each 0:03:16.480 --> 0:03:18.280 step of the process. And you know, we're able to 0:03:18.320 --> 0:03:20.440 ask them, you know what happens when they're pressing for 0:03:20.560 --> 0:03:23.040 your identity and how much time do you spend on it? 0:03:23.080 --> 0:03:25.000 Do you do this all day? And this one gentleman 0:03:25.040 --> 0:03:26.560 told us he does. He does it all day long. 0:03:27.000 --> 0:03:28.799 He takes a break during the day and he's made 0:03:28.800 --> 0:03:33.480 about fifty dollars since the pandemic started, just on unemployment scams. 0:03:33.960 --> 0:03:36.400 So it's this full time job. One of the interesting 0:03:36.440 --> 0:03:39.000 questions you asked too if they felt any remorse for this, 0:03:39.400 --> 0:03:41.080 and he said, no, not at all. We don't know 0:03:41.120 --> 0:03:43.680 these people, we don't know who or where they are, 0:03:43.960 --> 0:03:47.000 so to them, it doesn't bother me one bit, right, 0:03:47.040 --> 0:03:49.720 And that's the same case with some of these romance 0:03:49.720 --> 0:03:51.760 scams that are also tied in with this. So a 0:03:51.760 --> 0:03:54.840 lot of times to extract the money from the system, 0:03:54.840 --> 0:03:57.680 they're not actually getting paid from, you know, the state 0:03:57.760 --> 0:04:00.000 unemployment system. To the scammer, it has to go through 0:04:00.000 --> 0:04:03.280 to a few different channels, so they often exploit people 0:04:03.320 --> 0:04:06.800 that they've been running as either a romance scam victim 0:04:06.960 --> 0:04:10.120 or maybe some other type of email based scam to 0:04:10.400 --> 0:04:13.320 receive the money in the United States before sending it 0:04:13.360 --> 0:04:17.200 overseas to them. You contacted all fifty states to see 0:04:17.240 --> 0:04:20.600 how much fraud money had been paid out. Not everybody 0:04:20.640 --> 0:04:23.719 got back, obviously, we heard some stories. California said that 0:04:23.760 --> 0:04:26.479 they suspect as much as two billion dollars was paid 0:04:26.480 --> 0:04:29.640 out in improper payments. One of the states you focus 0:04:29.680 --> 0:04:32.480 on heavily, and this is Washington. For a time they 0:04:32.520 --> 0:04:34.400 had to stop sending out some money so that they 0:04:34.400 --> 0:04:37.400 can catch back up. I think in two weeks when 0:04:37.440 --> 0:04:40.200 everything started, when the Cares Act had been passed, they 0:04:40.200 --> 0:04:43.520 found about six hundred million dollars had been paid out already. 0:04:43.560 --> 0:04:45.119 So tell us a little bit of how these states 0:04:45.120 --> 0:04:48.359 were handling it. If you remember, Washington was kind of 0:04:48.440 --> 0:04:51.120 first in the United States for getting hit so hard 0:04:51.120 --> 0:04:53.200 with the pandemic and shutting things down, so that led 0:04:53.240 --> 0:04:57.279 to that big surgeon unemployment claims. So fraudsters took notice 0:04:57.279 --> 0:05:00.400 of that. They tried to exploit and hammer the Washington 0:05:00.480 --> 0:05:03.279 system with all of these claims that were bogus, and 0:05:03.320 --> 0:05:07.000 it took a few weeks before Washington State realized, you know, 0:05:07.200 --> 0:05:10.080 one a ton of these are fraud and two we 0:05:10.120 --> 0:05:12.960 need to catch up with our systems to flag them 0:05:13.000 --> 0:05:15.160 and then try to get the money back. So that 0:05:15.240 --> 0:05:19.000 particular state had been sending money through green Dot accounts, 0:05:19.160 --> 0:05:22.800 which is a mobile banking app, and those state folks say, 0:05:22.920 --> 0:05:25.800 the people who normally use those accounts are exactly who 0:05:25.800 --> 0:05:28.600 they're trying to help. It's usually the unbanked, the underbanked. 0:05:28.920 --> 0:05:30.880 They don't go to a normal brick and mortar bank 0:05:30.920 --> 0:05:34.960 every day. But fraudster is again exploited that and use 0:05:35.080 --> 0:05:38.000 some of the flexibilities of those mobile banking accounts to 0:05:38.080 --> 0:05:40.040 get the money and get it quickly and then transfer 0:05:40.120 --> 0:05:43.120 it before the state could realize what was happening. What 0:05:43.160 --> 0:05:45.120 do we know about how much money some of these 0:05:45.120 --> 0:05:48.680 states might have recovered, because in the Washington example, they 0:05:48.720 --> 0:05:51.760 noticed about six hundred million that was stolen. They were 0:05:51.760 --> 0:05:54.520 able to recover about three d and fifty million of that, 0:05:54.560 --> 0:05:57.479 maybe a little bit more. But are these states disclosing 0:05:57.520 --> 0:05:59.200 any of that or how do we find some of 0:05:59.200 --> 0:06:02.760 that out. Yeah, states are much more transparent about the 0:06:02.800 --> 0:06:06.120 money they have gotten back at the moment the suspected 0:06:06.160 --> 0:06:09.120 fraud they stopped. They're less transparent about what's gone out 0:06:09.120 --> 0:06:11.200 the door that they don't think they'll ever get back. 0:06:11.279 --> 0:06:14.480 So New York has publicized that they've gotten millions back. 0:06:15.080 --> 0:06:18.200 It really depends on what type of scam was being operated. 0:06:18.240 --> 0:06:21.679 So if it was money sent directly to a bank, 0:06:22.200 --> 0:06:23.839 and the state can go right to that bank and 0:06:23.880 --> 0:06:26.000 say we know this is fraud. This is how we know. 0:06:26.120 --> 0:06:28.520 Here's proof, the bank will send it right back. The 0:06:28.600 --> 0:06:31.000 FBI is not involved, there isn't much law enforcement, no 0:06:31.080 --> 0:06:33.920 civil suits. It's just transferred right back. Things get a 0:06:33.960 --> 0:06:37.240 lot more complicated if that money has already been transferred 0:06:37.320 --> 0:06:39.680 or gone through a few different layers, and it's much 0:06:39.760 --> 0:06:42.760 less likely that they'll ever see that money back. There's 0:06:42.760 --> 0:06:45.440 a lot of interesting aspects of this whole thing. You know. 0:06:45.600 --> 0:06:48.320 Part of it is is that the scammers need actual 0:06:48.480 --> 0:06:51.960 people to file some of these fictitious claims, which is 0:06:52.480 --> 0:06:54.880 kind of crazy, you know, who would subject to themselves 0:06:54.880 --> 0:06:56.360 to some of this. But they use kind of these 0:06:56.680 --> 0:06:59.880 mule networks and you mentioned, you know, mobile banking apps 0:07:00.000 --> 0:07:02.520 and cash apps and things, and they use these things 0:07:02.600 --> 0:07:06.040 to get around some of the traditional banking methods. Yeah, 0:07:06.080 --> 0:07:09.279 so these money mules are really a problem in the 0:07:09.320 --> 0:07:11.600 United States. The FBI has key down this during the 0:07:11.600 --> 0:07:16.360 pandemic because they're either winning mules and automating unwitting mules 0:07:16.440 --> 0:07:18.280 that either they know what's going on and they don't 0:07:18.280 --> 0:07:20.280 know what's going on. And a lot of times they're elderly. 0:07:20.920 --> 0:07:24.800 They've been contacted for maybe years with someone and they 0:07:24.840 --> 0:07:27.520 think that it's you know, their friend online and then 0:07:27.720 --> 0:07:31.080 now the moment is right where the scammers saying I'm 0:07:31.120 --> 0:07:33.000 in some trouble. I'm going to get some money transferred 0:07:33.000 --> 0:07:34.800 into your account, and I need you to transfer it 0:07:34.840 --> 0:07:37.760 to me, you know, via PayPal. That's how they get them, 0:07:37.800 --> 0:07:41.040 because they need it to be laundered from you know, 0:07:41.120 --> 0:07:44.400 and they elicit piece of cash to bitcoin, which can't 0:07:44.400 --> 0:07:47.440 be traced or a normal a t M. So we 0:07:47.480 --> 0:07:51.960 saw cases of unemployment money being paid out to regular 0:07:52.000 --> 0:07:55.360 bank accounts and then withdrawn and cash packaged up and 0:07:55.400 --> 0:07:57.680 mailed across the country to another mule before it was 0:07:57.720 --> 0:08:00.600 sent overseas well. And as you mean too, a lot 0:08:00.640 --> 0:08:03.760 of these victims are people with stolen identities. You had 0:08:03.800 --> 0:08:06.920 an example in your article of a woman who was 0:08:06.960 --> 0:08:09.600 currently working. She had a job, but she kept getting, 0:08:09.720 --> 0:08:12.960 you know, notifications or messages saying that, oh, we sent 0:08:13.040 --> 0:08:15.520 you some unemployment money. It's been flagged as FROD you 0:08:15.520 --> 0:08:17.840 need to pay it back. And she's like, well, I 0:08:17.920 --> 0:08:20.120 never received any of this money. You know, I didn't 0:08:20.120 --> 0:08:22.440 go through this process. I have a job. And she 0:08:22.480 --> 0:08:25.680 had to have her employer get involved to help stop that. Yeah, 0:08:25.760 --> 0:08:27.720 that's the most frustrating part of this for a lot 0:08:27.760 --> 0:08:30.600 of people is fully employed people finding out that someone 0:08:30.600 --> 0:08:33.000 had filed for unemployment in their name just creates a 0:08:33.080 --> 0:08:35.000 huge headache for them. So that was one of the 0:08:35.040 --> 0:08:37.160 tips coming out of this is even if you are 0:08:37.200 --> 0:08:39.280 employed and you don't expect to lose your job or 0:08:39.280 --> 0:08:41.840 need unemployment, you can still go and set up your 0:08:41.880 --> 0:08:44.920 profile in a state unemployment site just to kind of 0:08:44.960 --> 0:08:46.840 lock it down and secure it so no one else 0:08:46.880 --> 0:08:49.440 can go put your Social Security number and birthdate in 0:08:49.679 --> 0:08:51.360 and to access it. So that's the one thing you 0:08:51.360 --> 0:08:54.000 can do to try to protect yourself. We've heard tons 0:08:54.040 --> 0:08:57.200 of stories of this is like, this is how people 0:08:57.200 --> 0:08:59.640 are interacting with this where they don't file for unemployment 0:08:59.640 --> 0:09:01.760 they never have, they don't think they're a victim, but 0:09:01.840 --> 0:09:05.079 all of a sudden, someone's using their identity to pull 0:09:05.120 --> 0:09:08.559 off this scam. It's just a really unfortunate situation because 0:09:08.559 --> 0:09:12.760 we're hearing stories from these people that legitimately need unemployment 0:09:12.760 --> 0:09:14.880 aid and it's taking months and months to work through 0:09:14.880 --> 0:09:18.200 the backlog to work through these fraudulent checks. You know, 0:09:18.240 --> 0:09:20.880 if somebody gets flagged, it takes months to resolve some 0:09:20.960 --> 0:09:23.559 of these things, and in the meantime, not always obviously, 0:09:23.559 --> 0:09:25.920 but sometimes these scammers are getting through and getting some 0:09:25.960 --> 0:09:28.200 of that money. So that's just so unfortunate to hear. 0:09:28.240 --> 0:09:30.960 But these are kind of the problems that these agencies 0:09:31.000 --> 0:09:33.520 are facing in the background. So we'll definitely keep a 0:09:33.559 --> 0:09:35.880 monitor on this to see what else comes of it. 0:09:36.280 --> 0:09:39.760 Nick pens and Stadler, reporter at USA Today. Thank you 0:09:39.840 --> 0:09:44.800 very much for joining us. Yeah, you're welcome. I'm Oscar 0:09:44.880 --> 0:09:48.600 Ramirez and this has been reopening America. Don't forget effort 0:09:48.600 --> 0:09:50.480 Today's big news stories and check me out on the 0:09:50.559 --> 0:09:53.720 Daily Dive podcast every money the Fridays, So follow us 0:09:53.760 --> 0:09:56.280 on I Heart Radio or wherever you get your podcast.