Early last month, a Rhode Island bank received an application for a $144,050 loan under the Paycheck Protection Program, the massive federal effort to assist small businesses hurt by the coronavirus crisis.
The application purported to be on behalf of the owners of Remington House, a restaurant on Post Road in Warwick, R.I. It listed 18 employees and an average monthly payroll of $46,000.
But when a bank official drove past the building, there were indications that the restaurant had been shut down before the pandemic. There were dumpsters on the property and notices ordering the stoppage of work were posted on the door and windows.
The once-popular restaurant had been closed since November 2018, according to
The case is the first criminal fraud prosecution in connection with the paycheck program. Industry officials warn that it will not be the last — not by a long shot. In fact, individuals who are working with banks to combat misconduct in the $660 billion program — including former California banking commissioner Walter Mix — estimate that fraud rates could be as high as 10% to 12%.
Those estimates, which are based on initial reviews of loan files at dozens of banks, are roughly consistent with what has happened after other disasters. In the aftermath of Hurricane Rita and Hurricane Katrina, a
“History shows that when government relief programs are put together quickly in response to a disaster, fraud is fairly rampant,” said Derek Cohen, a former federal prosecutor who now represents white-collar defendants at Goodwin Procter.
In early April, the Small Business Administration said that lenders would be held harmless for borrowers’ failure to comply with the paycheck program’s criteria.
But bankers still fear that they will ultimately be on the hook — at least in certain circumstances. They are grappling with a wide range of questions about the steps they should take both to prevent fraud and shield themselves from liability, even as they face pressure to approve the emergency loans quickly.
“This program has a lot of opportunities for lenders to face consequences for the way they’re handling these loans,” said Vivian Merker, a partner at the consulting firm Oliver Wyman.
Risks rose in round two
Bankers have been worried about the potential for fraud since the program’s inception in early April.
Brad Kessel, CEO of the $3.6 billion-asset Independent Bank in Grand Rapids, Mich., warned early last month of potential scammers posing as small-business owners to get their hands on the money.
"There is going to be a lot of fraud," Kessel said at the time. "We are seeing some of our people get all sorts of emails."
But in the program’s initial days, much of the focus at banks was on getting funds out the door as quickly as possible. Nearly 5,000 lenders worked — often
Since then, the PPP has almost doubled in size, with $310 billion having been added to the initial $349 billion allocation. Government officials have also begun placing a stronger emphasis on deterring fraud in the program.
Assistant Attorney General Brian Benczkowski told The Wall Street Journal
Treasury Secretary Steven Mnuchin and SBA Administrator Jovita Carranza have pledged to review all PPP loans of $2 million or more.
Also in recent weeks, many banks have begun accepting applications from new small-business customers, which has left them more vulnerable to fraud.
Existing small-business customers are generally seen as safer, because bankers have already satisfied rules that require them to know those customers. Often, they have met the business owner face-to-face and shaken hands.
“The risk of fraud in the first round was probably not very significant because everybody was cherry-picking their customers,” said Adam Jiwan, chairman and CEO of Spring Labs, a Los Angeles technology company that offers tools to ferret out fraud. “The likelihood of fraud in phase two is high, as banks move beyond their existing relationships.”
The relatively late addition of online lenders to the program may have also increased the risk of fraud, since those companies are less likely than traditional banks to have a personal relationship with their customers. On the other hand, online lenders may have relatively sophisticated risk management procedures.
“Whenever you have a situation where you have a lot of money that needs to move out the door quickly in a purely digital environment, the conditions for fraud are hot,” Jiwan said.
Loan stacking poses threat
The coronavirus relief law, which was enacted in late March as the economic damage from the pandemic spread quickly, addressed the possibility of fraud. The law requires the SBA to register loans using a taxpayer identification number in order to prevent the same borrower from getting more than one loan, a problem known as loan stacking.
Once a loan has been submitted, the SBA’s E-Tran system returns a unique application number to the lender that is supposed to eliminate most of the risk of duplicate applications.
But questions are now emerging about the SBA’s system for checking taxpayer ID numbers. Jiwan said that while E-Tran captures basic forms of loan stacking, fraudsters can easily manipulate the system.
Small businesses often have multiple taxpayers IDs, and multiple layers of ownership or limited liability companies in the same operating company. Moreover, fraudsters are known for “TIN-spoofing,” that is, creating multiple identifying factors and applications.
“There was an assumption that E-Tran was actually doing a comprehensive screening for loan stacking,” Jiwan said. “What we encountered was everything moved so quickly, and there was so much misunderstanding, that it was difficult to implement real-time, secure information sharing.”
SBA representatives did not respond to a request for comment.
The Office of the Comptroller of the Currency held an April 20 listening session with bankers about fraud in the PPP. Individuals who took part and spoke on condition of anonymity said that there remained confusion about a host of issues, including fraud checks and payroll verification.
During the session, several participants raised concerns about the potential for synthetic identity fraud, which can involve the combination of real and fictional information to create a believable identity, according to a summary of the meeting that was made public on Thursday. Participants also indicated that relying solely on a taxpayer identification number increases the risk of fraud, since different taxpayer identification numbers could be used to obtain multiple loans for the same small business.
Banks lack clarity on loan forgiveness
Under the rules of the paycheck program, small businesses can receive low-interest loans for two and a half times the amount of their monthly payroll obligations. The loans are fully forgivable if at least 75% of the proceeds are spent on payroll costs.
No loans have been forgiven yet, but the time is approaching when borrowers will be required to submit more detailed documentation to their banks in order to prove that they spent the funds in ways that entitle them to forgiveness.
The opportunity for loan forgiveness is a big part of why the program has proven so popular with small businesses from coast to coast. But it could also tempt many legitimate small-business owners to inflate their payroll costs.
Bankers are worried that the government ultimately will not forgive many of the loans, forcing lenders that faced pressure to approve applications quickly to hold the loans on their books.
The ex-regulator Mix, who is a managing director and financial services leader at Berkeley Research Group, said that he can foresee the SBA acting like an insurance company and denying lots of loan-forgiveness claims.
In that scenario, banks would be stuck with a 1% loan on their books for two years, he said. If banks are forced to hold onto many low-yielding loans, they should not be at risk of credit losses, since the PPP includes a government guarantee.
Still, bankers are confused by the guidance that the SBA has provided about their responsibilities.
One SBA document stated that while lenders are expected to perform a “good faith review” within a reasonable time of the borrower’s calculations and supporting documents for average monthly payroll costs. But it also stated that “lenders may rely on borrower representations.”
Identity thieves lick their chops
Another potential means of committing fraud in the program is identity theft. In this scenario, a criminal poses as an actual small-business owner. This kind of fraud can be committed on a large scale, using stolen identity data.
“There’s ample opportunity for crime rings to go down the list and impersonate businesses,” said Steven Minsky, CEO of LogicManager, a provider of risk management software. “You can just cut and paste, and populate, and repeat.”
He said criminals are likely identifying and targeting the banks that have the worst controls. “When they find one that’s weak, they funnel as many loans as they can through that program,” Minsky said.
The alleged fraud scheme in Rhode Island involved identity theft, according to prosecutors, though not on a large scale. A man named David Staveley allegedly posed as his own brother to apply for PPP funds. Staveley had a criminal history, which would have disqualified him from the program.
It is unclear how much of the detective work was done by the bank that received the application, the $1.7 billion-asset BankNewport, and how much was completed by law enforcement officials.
Police in Berlin, Mass., received a tip about Staveley. But the Rhode Island bank also conducted an April 17 drive-by of the restaurant property, which found it in disrepair, according to an FBI affidavit in the case. Loan funds have not been disbursed.
Banks that approve and fund similarly fraudulent loan applications may potentially be financially liable if one of their employees was involved in the scheme, industry officials said.
Jon Prior contributed to this story.
