Billions of dollars have been stolen from California's unemployment benefits. Criminals have targeted the state's Employment Development Department, which was unprepared for the wave of applications it received because of the coronavirus pandemic.
"Those benefits have attracted the largest cyber attack in terms of fraud in American history," said Blake Hall, CEO of the authentication company ID.me. "The fraud rates that we're seeing are over 10 times what we usually see at federal agencies."
ID.me is a company used to verify that people are who they say they are. Hall says they've worked to verify identities everywhere from the Social Security Administration to doctors writing prescriptions for medication.
"Identity verification is an enormously complex space," said Hall.
Hall says if you had talked about increasing the security of California's unemployment department's computer systems a year and a half ago, no one would have taken you seriously.
"EDD, like many of the other state workforce agencies we work with, are on 1980s technology," said Hall. "We have a duty to sound the alarm bell to say if you're going to distribute $600, $700 billion in aid, you better make sure you have the right security measures in place."
Part of the problem is many of our authentication systems are out of date.
"We have been focusing on where the bad guys were, not where they are," said James Lee, COO of the Identity Theft Resource Center. "The whole unemployment fraud situation has been the biggest wakeup call in a decade."
That fraud is hurting people who actually need the money. Hall says criminals are applying for the checks in California because it is a richer state. That means the fake applications are clogging up the system.
"We have always seen a fraud rate north of 50% every single time," said Hall. "If a criminal files in the name of somebody who needs unemployment, if that person files second, they're going to get locked out."
That means if someone has your information, they could steal the money that you qualify for. Hall showed NBC 7 screenshots from chat rooms on the dark web listing drivers licenses and other identifying information for sale.
"When you have an identity that can be turned into $20,000 plus, literally every criminal and crime ring in the world is going to target these workforce agencies," said Hall.
Hall says if the current trend continues, more than $300 billion might be lost to fraud nationwide.
"It's like having a train full of gold from Fort Knox go out and there's just no security guards on the cars," said Hall. "I'd be surprised if any large state made it out with less than tens of billions of dollars in fraud."
California's EDD started working with ID.me last fall to try and reduce the amount of fraud. Hall says by catching fake applications, they hope they can help speed up the process for people who actually qualify for the money to receive it. A January press release from the EDD read:
EDD estimates that the department’s existing fraud screening measures and new security protections put into place last fall prevented up to $60 billion in payments to fraudulent claims... ...EDD experienced more than five times as many unemployment claims in 2020 than in 2010, the worst full year of the Great Recession. In fact, EDD processed as many claims within the first eight weeks of the pandemic
"If we can shrink the problem down and get over 9 out of 10 people out of line, now the problem's actually small enough that our state work force agency partners can manage it," said Hall.
Right now more than two dozen state unemployment departments are working with ID.me to try and cut back on fraud. Privacy experts say this wave of fraud shows just how much work needs to be done in the cyber security field.
"Criminals have found ways to get around our authentication and we have got to catch up," said Lee. "We've got to find a better way for people to prove they are who they say they are."
If you are having trouble with the EDD and verifying your identity, ID.me has a help section you can access here.