The Impact of Rampant Unemployment Fraud

The pandemic has had a huge economic impact, leaving many people hurting financially, particularly after losing their jobs. Even as governments enact programs to help reduce the burden on the unemployed, fraudsters have regarded the current crisis as a chance to commit massive unemployment fraud. COVID-19 accelerated the digital shifts that had already started and have given fraudsters unprecedented opportunities—while states struggle to keep up with the pace of change.

Unfortunately, the problem is widespread. According to a December 31, 2020 article in USA Today, 2020 pandemic-related unemployment fraud losses totaled $36 Billion. Unemployment fraud has been pervasive since the start of the crisis, affecting nearly every U.S. state.

So, how does unemployment fraud happen? While there are different kinds, the version most commonly seen during the current crisis involves filing false unemployment claims. Here are fraudsters’ most common tactics:

• Purchase stolen identities from the underground via the dark web
• Use the information to submit unemployment claims
• Receive benefits at a drop account

Fraudsters are able to easily scale these efforts due to a perfect storm of circumstances. An F5 Labs blog post from May 22, 2020, explains that unemployment fraud “stands out from others because it requires attackers to have a legitimate social security number. Unfortunately, that’s not a problem for attackers. Massive data breaches in 2015, 2017, and 2019 at healthcare providers, credit bureaus, credit card companies, and retailers (among others) compromised virtually every American's social security number.” As a result, there are plenty of stolen identities available, and it’s very easy to purchase them.

After a fraudster has acquired stolen identities, they submit a fraudulent unemployment claim. Online tutorials (for $5-100) are available to teach this process. They also manage to get away with using nearly any physical address to file a false claim. CBS Los Angeles discovered that uninhabited mansions for sale had been listed as the physical address for hundreds or thousands of fraudulent claims.

In addition, states are overwhelmed and unequipped just to handle the deluge of unemployment claims, let alone noting inconsistencies that might indicate fraud. As a result, the pandemic has created a perfect opportunity for unemployment fraud. Few states have controls in place to prevent fraud or much fraud detection capability. They are also under pressure to pay benefits first and ask questions later.

In our research, F5 has found that the following behaviors that indicate unemployment fraud:

• Device indicators

o Recognizing devices and users online

o Multiple people using the same device

o Unusual time zones

• Network indicators

o Unlikely countries

o ASNs located in hosting environments

o Unlikely time zones paired with US ASNs

• Environment spoofing indicators

o Transactions using VPN, anonymizing proxies, or other techniques to hide environments

o Frequent similar transactions from the same device

o Previously unseen, unique browser fingerprints

o Small changes in the device’s integrity, identity, and legitimacy—noticeable through browser interrogation

• Behavior indicators

o Specific typing patterns, including keys pressed, typing speed, and suspicious quantities of copy and paste, particularly in first and last name fields

o Browser windows that occupy only part of the screen (indicating that a text file for copying and pasting is open as well)

o Mouse movements to outside the browser (indicating copying and pasting from a text file)

Fortunately, there are simple steps that states can take to detect and prevent unemployment fraud. Fraud solutions, such as the Shape AI Fraud Engine (SAFE), can identify and stop suspicious and anomalous activity.

SAFE protects against unemployment fraud in many ways, such as detecting:

• Frequent applications from the same device or email address
• Suspicious behavior patterns, including:

o Copying and pasting personal information

o Filing unemployment applications very rapidly

o Quickly navigating the site, demonstrating familiarity with it

o Continuously referring to another window

o Trying to evade detection (by connecting from a VPN or the cloud)

o Filing multiple applications without subsequently logging in

o Repeatedly submitting the same form from the same device

• Suspicious environmental signals. For example, submitting an unemployment claim in Oregon from a device outside the U.S.
• Many unemployment benefits sent to the same drop account
• Many unemployment claims with the identical physical address
• Suspicious combinations of the above behaviors

Deploying SAFE is a very simple and straightforward process. Organizations can have SAFE up and running in a matter of hours.

Implementing controls to prevent fraud and fraud monitoring lets agencies greatly reduce the amount of unemployment fraud that happens on their watch. Establishing oversight of the unemployment application process is a great start for a state. Combining it with a fraud detection and prevention platform further empowers agencies to combat unemployment fraud, reducing losses and saving money.

Shape has facilitated millions of dollars in fraud savings for its clients. Our data and signal capabilities have detected twice as much fraud as other vendors’ fraud solutions, thus helping clients prevent fraud losses.

The pandemic has created chaos in many areas of our lives, exacerbated by an accompanying surge in unemployment fraud. Instead of surrendering and choosing to accept billions of dollars in losses each year, state agencies can now take action. The Shape AI Fraud Engine (SAFE) can empower state agencies to identify and prevent different types of fraud, including unemployment fraud.