Unemployment Fraud

The Secret Service posted an alert regarding a widespread fraud ring using mules to create fake unemployment claims. (https://krebsonsecurity.com/2020/05...t-state-unemployment-insurance-programs/). I'm curious if anyone has come across fraudulent unemployment claims from WA or any other state for that matter. I'm also curious if there is a repository for unemployment descriptions from every state. I would like to run a query against our ACH report to compare the unemployment state to our customers state of residence.

WA state company name for unemployment: WA ST EMPLOY SEC
In the description: UI BENEFIT

Caveat: This information was provided as a screenshot of another institution's ACH file. I'm guessing on the fields, but the information should be correct.

Hope this helps! I am hearing stories of romance/job type scams associated with the fraudulent deposits. Same scams, different source of funds.

I have two affected accounts so far and would also appreciated some keywords to look some more. Mine are from Massachusetts.
Search for:
MA DUA

For one account the ACH description also included an individual name that was not the customer name. That customer received 9 incoming ACH credits totaling to $6003. The other one had the customer name and the description MA UI Tax. There were three of those totaling to $4840. Any information on other states would be most appreciated.

Is it the bank who originated the ACH that takes the loss on these? (That is how I understand the NACHA rules - that the originating bank will take the loss.) Example: John smith receives one of these fraudulent ACH's in his acct for $10,500, and immediately withdraws $10,000 of it. We find out later it's one of the fraudulent ones mentioned above. Do we take the hit or does the originating bank? What do we do with the $500 left in his account (his profit from this fraud)?

As long as the ACH was credited to the correct account number according to the ACH transaction received, it is never the receiving institution that would take the loss. As far as the funds left over, they would stay there until withdrawn by the customer or someone comes and gets them or they are escheated.

Thank you for the confirmation!

We would also like to try and get the agency descriptions (company ID) for each state's unemployment agency. I was thinking of emailing the contact in the alert.

I can't vouch for the accuracy but I just spent some time manually looking at our reports and google searching the descriptions. *Notice* there are some duplicate states descriptors which lead me to believe that this list is not 100% accurate. Also I wasn't able to locate all 50 states. Please feel free to add or correct any errors.

Hope this helps!

Colorado (CDLE UI BENEFITS)
Delaware (DELABOR UNEMPINS)
Alabama (DEPT OF LABOR)
Georgia (GA DEPT OF LABOR)
Kansas (KS DEPT OF LABOR)
Massachusetts (MA DUA)
Maine (Maine Dept Labor)
Minnesota (MN DEPT OF DEED)
Minnisota (MPLS USPS PDC MN)
Minnisota (MN DEPT OF REVEN)
North Carolina (NCDES-UIBENEFITS)
New Mexico (New Mexico DWS)
New York (NYS DOL UI DD)
New York (NY STATE)
Rhode Island (RIDLT-UI)
South Carolina (SCESC-UIBENEFITS)
Indiana (STATE OF INDIANA)
Tennessee (TN DUA PAYMENTS)
Tennessee (TN UI PAYMENTS)
Tennessee (STATE OF TENNESS)
Texas (TWC-BENEFITS)
Michigan (UIA PRE-PAID CAR)
Michigan (STATEOFMICHIGAN)
Kentucky (Kentucky UNEMPLOYMENT INS)
Washington (WA ST EMPLOY SEC)
Wisconsin (WISCONSIN-DWD-UI)
Pennsylvania (COMM OF PA UCD)
Mississippi (MDES)
New Jersey (STATE OF NJ – LA)
Missouri (MODES)
Virginia (VEC – VIRGINIA)
Illinois (IDES)
Connecticut (CTDOL UNEMP COMP)
Ohio (ODJFS)
Ohio (STATE OF OHIO)
Alaska (Alaska DOL)
Montana (STATE OF MONTANA)
Maryland (ST. OF MARYLAND)
Arkansas (AK DEPT OF LABOR)
Idaho (ID DEPT OF LABOR)

I just encountered an instance where they were using a romance scam to use our customers account to receive ACH Credits from the Massachusetts Pandemic Assistance (PUA) and requesting he send them money. We are nowhere near MA by the way.

We caught it but wanted to give a heads up to you wonderful people.

What was the description on the ACH - company ID # and name?

Company Name: MA DUA
Company Discretionary Data: MA PUA PROGRAM
Company ID: C046002284
Company Entry: CARES ACT

When aggregating for SAR consideration, are you all aggregating on the payments posted/attempted that are identified as fraud or are you looking at it at the customer level?

What about the notification to the Secret Service if you are filing a SAR- any concerns that is breaching confidentiality.

Once the SAR is filed you can speak to law enforcement about its existence. This is covered by your safe harbor and law enforcement does not need a subpoena.

FYI- I have filed these on Michigan, Massachusetts, Washington and now Maine. I intended to notify LE after filing, and I was already getting calls like the day it probably showed up in their FinCEN database. LE is being very proactive about these.

US Attorney's Office and/or DOJ will be calling you!! I filed one and a week later I had a call requesting supporting documentation. They indicated these are a priority right now!

Our affected account was from MA DUA as well - military romance scam. Our customer had a copy of her "boyfriend's" military ID she was more than willing to share after finding out she was being used as a money mule. You could plainly see the ID had been doctored. We had 10 ACH transactions totaling $6870

our customer has received multiple ACH deposits from Massachusetts and Maine all exactly as noted in the previous posts. at one time this customer withdrew $7,000.00 in cash. days later came in to withdraw $4,000.00 in cash for a money order and the remaining in cash. the teller - after the fact - noticed the ACH transactions were from the two states MA and ME and thought well that's odd - we're no where near either and our customer would not have been working there either to receive them. looked at he ACH details and noticed the names on the payments were for 3 different people. teller checked with other staff to see if these people were somehow connected to the customer. nope.

this customer also conducted some ACH debits to COINBASE,COM totaling $4,000.00

quickly called the customer who returned to the bank with money order and cash in hand. it was explained what was discovered and concerned the customer may be unknowingly involved in a scam. she mentioned a boyfriend who information she shared with the bank. we did file a SAR. we left the account opened to see if there may be other ACH transactions to come and notified LE.

our bank VP tried via websites and emails to notify the appropriate authorities in the states and has not heard back from any. the Chief of Police, who had many challenges to finding the appropriate people / channels to report to, also has not heard from either of the states.

we totaled over $13,000.00 for these fraudulent ACH transactions.

We have found our local US Secret Service office (via phone call) to be our best contact for these. Have you tried that?

Ironically my husband filed for unemployment 2 months ago and we haven't seen a red cent. Always some kind of technicality with the forms etc... He's back at work now but glad to know the crooks are getting through.

If we do file a SAR and leave the account opened to see if any more deposits come in, do we have to do a 90 day review of the SAR?

yes, technically even if you close the account you would need to do a 90 day review and file if it meets the threshold for attempts to post to the account

When you filed the SAR did you report on your customers in which accounts that they went into and then in the narrative put the names of the info on the ACH file? I'm at a loss here....

in our case we very much believe the customer did not have any idea they were being scammed by a "boyfriend" so the SAR pertained to the names connected to the ACH transactions but the customer was included in the SAR narrative

So, we have only had one customer that came in and withdrew funds saying this was a "loan"(in which I will report on), but the others seem to not even know or haven't contacted us about their deposits... So I am really not understanding if this is fraud why would our customers not come in wondering where their deposits are?

we included our customers and the names as subjects because they each were acting as mules and indicated why we put them there in the narrative.

because if it is fraud they have likely been coached on not approaching the bank if the funds are not available as they should not draw attention to the fraudulent activity.

Ditto

We consider our customers subjects too. The FBI's money mule guidance made it clear that it's a crime to be a mule whether you're witting or unwitting. It can be law enforcement's decision whether or not the person should be prosecuted.

Arkansas is ADWS and not AK (Alaska)

the identifier for Louisiana is LDOLUIBEN

How this is still an issue kind of surprises me, yet doesn't at the same time. It's a well known enough issue that you'd figure by now every unemployment agency in every state would be taking extra precautions to verify applicant info.

agreed PQ, yet we see new items coming through daily. heck, we are still getting fraudulent ones from Washington, where it essentially started...

Washington has RECOVERED over $300 million, and they still have a likely loss of at least that amount.

I am sorry if this question has been asked already but, can we return these ACH credits if we are sure they are fraud?

We have a customer who we cannot determine is willingly or not a mule for these scams. We have filed a SAR. She has already received ACH credits from STATE OF ARIZONA BENEFITS and NCDOR (NORTH CAROLINA DEPARTMENT OF REVENUE) and now has a very large one pending from IDES (ILLINOINS DEPARTMENT OF EMPLOYMENT SECURITY). Each one has a different persons name. I would very much like to return this most recent ACH that is pending.

If the name does not match, you can return an ACH. The real question is why is the account still open.

Well, we were giving her the benefit of the doubt that she did not know what she got into and realized she was being scammed and it would stop but, now that we got this one, it's outa here!!!

Thanks!

We are returning them. I agree with Randy, they would be a noncustomer at our bank.

Hey bcompliance, what return reason code do you use to return an ACH credit like this?

R03 Return Code – No account or unable to locate account

The account number structure is valid and it passes the C heck digit validation, but the account number does not correspond to the individual identified in the entry, or the account number designated is not an existing account.

ok, new question...if these ACH credits are a week or two old, can they be returned still? If they cant, how can we get these funds back to the states that issued them (ODJFS-Ohio ad State of Airzona)?

since I asked my first question I have another customer with the same deal but she wants the money sent back, doesn't want to have anything to do with them.

At the request of the customer, I think it is R23. I would verify that and get the request in writing.

Other than that, there is no much you can do.

In my 725 years of so of dealing with ACH, I have yet to hear of any Originator or ODFI that refused a credit return item as "untimely". Happens daily with debits, but never with credits. If the funds are in the account, by all means, return. So, if you identify them as fraudulent based on your own research, return R03. if the customer confirms they are suspicious and wants them returned, R23. Both technically have the 2nd business day return timeframe, but that would be the least of my concerns.

I thought you had 2 days on a R23 from when the customer notified you?

yes it is within 2 days notice from customer...my point was even if after 2 days, no originator or ODFI would refuse