Track 2: EBT Fraud Prevention and Security Measures

Transcription:

Amy Duncan (00:09):

Hi everybody. Welcome to EBT Fraud Prevention and Security Measures session. Today we're going to do a case study on Washington State and some of the things that they are doing to address this issue. My name's Amy Duncan. I am a Founding Board Member of the EBT Community Council. So I'll echo what Tim said. We would like as many voices on the council as possible. So if you haven't joined us, please stop by our table. We've got a QR code to sign up and we'll get you added to our list. We really want to hear what everyone has to say about the topic of EBT. There's so many different things going on as you've just heard from Lisa, and you're going to hear from us. So joining me today, well, Erica is not listed on the screen, but she's sitting here next to me. Erica Kane is the Chief issuance support branch, issuance policy and innovation division for the Supplemental Nutrition Assistance Program at the Food and Nutrition Service, United States Department of Agriculture. I decided against acronyms today, and that's a lot to say.

Erica Kane (01:16):

I support you in that decision.

Amy Duncan (01:18):

Thank you. And joining us is Donald Paul. He's the E-B-T-E-F-T Direct Deposit Programs Administrator with the Department of Social and Health Services in Washington State. So we're going to start off talking a little bit about what this fraud thing is that we're talking about because it's a pretty complicated topic. So Erica, why don't you get us all up to speed?

Erica Kane (01:46):

Well, thanks Amy. So Amy has graciously given me a few minutes to just to set the stage for everyone in the room, especially for those who are relatively new or learning EBT for the first time or are in that other category that Tim talked about earlier. So the basics SNAP is a federal program. We have our authority to run this program through Congress and the Food and Nutrition Act, which Larry has all given us a brief education on that and how every five years Congress updates the Food and Nutrition Act through what's called the Farm Bill. And this is an exciting year for us because it is a farm bill year. So when the farm bill is passed, it means a whole bunch of new work for FNS or the Feds, but then it also means a whole bunch of new work for our state partners.

(02:37):

So we are a federal program, but we are state administered. So what that means is the SNAP benefit is a hundred percent federally funded benefit, and that states they administer the program. So they're the ones that are authorizing clients and issuing them benefits. So the state expenses, in order to run the program, the feds pick up 50% of that and then the states match the other 50% of that. Now, this is an extremely important partnership that we have in order for SNAP to be successful. It takes people like us, my friend Donald, over here to work together. And currently one of the things that we're partnering on and challenges that we're faced with is benefit theft. Our clients SNAP households, they are being targeted as victims, targeted as victims of crimes. Their benefits are being stolen through no fault of their own card skimming, card cloning.

(03:40):

They're getting hit with phishing schemes, they're getting hit with algorithm attacks, they're in line at grocery stores. And when they go check out, they're realizing that that benefit that they rely on a monthly basis in order to feed their families is not there. So what happened in December of 22, the law changed surprisingly, as Tim mentioned with Reg Snap is exempted from Reg E, so states could not replace SNAP benefits. And then in December, Congress changed the law and they put in some thresholds in place around how states could go about replacing benefits. But the important thing is that there's now a recourse available to clients. So clients. So states can make clients to some degree whole.

(04:35):

In addition to that, the law also required states to make sure that they have fraud prevention measures in place. Now, I could talk about the requirements and I could talk about compliance, but let's face it, most of the folks in this room are state agencies and I think the last thing they want is to see a deck from FNS. So I am excited today to showcase one of the partnerships that we have. And I'm here at the state of Washington and Donald who's going to tell us his story and he's going to share with us what he is doing in the state of Washington to better protect benefits and to make clients whole. So Donald, I thank you for all of your efforts. Your work is noticed and it's greatly appreciated, and I'm excited that you agreed to join us today.

Donald Paul (05:25):

Thank you.

Amy Duncan (05:27):

Okay, thank you Erica. So Donald, I just want to talk about some of the trends that you've identified and what have you identified for trends about how benefits are being stolen in your state.

Donald Paul (05:42):

Okay. Can you guys hear me okay? Oh, perfect. Well, before I get going, I wanted to say that I'm here representing my team who is full of incredibly brilliant people who could not be here today. So I'm just one of many who has a little bit of information about this topic. So I'm really humbled to be here with you all as I try to share what I know, knowing that it's not everything. So in Washington, we realize there is a problem with theft in actually 2019, and we started seeing a lot of our clients reporting their benefits being stolen. We determined that it was due to card cloning. So we implemented what we call Cal with FIS and the track two data, and we did a mass card replacement project and we've completed that in early 2020. And that pretty much decreased the numbers of reports we started seeing because most of our clients had the new cards with a calf on the mag strip. But shortly after that, the pandemic hit and then we started getting all these calls where people started saying their benefits being stolen. And I thought it was a good idea to start tracking those reports and try to get as much information as possible from the client. So I kind of coerced some people in my team to create an Excel spreadsheet, and this Excel spreadsheet became huge over time. And then we realized this is card skimming, it's not card cloning, and we started to make the connection to the skimmers throughout the community.

Amy Duncan (07:47):

So fraud prevention is an important aspect of safeguarding benefits. How have you adjusted your fraud detection tools to account for the benefit theft trends? And what type of fraud prevention measures have you implemented and how effective have they been? All those questions.

Donald Paul (08:07):

Through the detailed tracking of the reports that the customers were giving us, we started to track the client where they shopped, the time they shopped, how much benefits was stolen. And we have this Excel spreadsheet and we can go back and look and see, okay, this person shopped at this location on this day, at that time, how many other reports of similar activities happened at the same time. So we're able to identify the commonalities there. Also through that, we're able to locate where a possible skimmer is located through this Excel spreadsheet and these reports. And then we're able to notify our, in Washington, we call them the Office of Fraud and Accountability. And they're in essence like the team that has defeat and the manpower, the work with the law enforcement. They can go out to the retailers and actually go and see if there's any skimmers on site.

(09:12):

So we make a referral to offa, they send someone out there and see if there's a skimmer. Also with another team we work with, it's called the Department of Program Integrity, and that's part of Washington as well. And we call them DPI for sure. And DPI has this incredibly smart group of people who work with data analytics. They have a Tableau program, so they're able to take all this data from all these reports and run it through this Tableau program and sort of pinpoint where an anomaly a shopping anomaly is occurring or a card use anomaly. And then from there they dial down even further and they can detect where there are skimmers even across the nation, across the country. And so we've really been working with them to be more of our eyes because my team, we have several responsibilities and we can't dedicate three or four people to dig through data like DPI can. And so they've been incredibly helpful.

Amy Duncan (10:28):

That's a lot. Your Excel spreadsheet sounds like a big undertaking. So it sounds like it made a difference though. Erica mentioned that benefit replacement is somewhat new, just being something you've been doing for the past few years. What was your biggest challenge in implementing your benefit replacement process?

Donald Paul (10:49):

Well, in Washington we have this program we call Barcode, and it's like a client repository of data, excuse me, their case, their application, their reviews, and then it also shows us where they shopped. And so that information gets uploaded in the barcode. And our staff throughout the state in Washington are very familiar with using barcodes. So we decided that we're going to create this automated claim for a replacement of benefits in barcode so that when someone comes into the office or they call us on the phone, the worker who's interacting with that customer, they go through this checklist on this automated claim and document where they shopped, how much benefits were stolen, stolen, did they have the card in their possession at all times, and do they agree to the attestation at the end that they're being truthful and honest? And so building that system, this claim form and barcode was incredibly difficult. Our IT department had to stand it up as quickly as possible. Along the lines, there was different iterations of it because the one we built initially included cash and food. Later we decided we have to remove the cash section because we don't want customers to get confused. And so now it's just food because that's what the approval was for.

(12:26):

And so having that built took a lot of effort and a lot of manpower, but we were able to get it done. That was the first challenge. The second challenge was getting our staff trained across the state to know what to do when someone calls in and reports that their benefits have been stolen, getting to go to that barcode system and completing that online claim form and then knowing when to weed out certain people from completing the claim because once the claim is complete, then it goes to my team and my team. We essentially review the data on the claim to make sure that it's a valid claim. So we validate the claim and then we determine the amount of benefits the client is eligible to receive, given that it's twice in one program year. And I think it's the amount of the benefits for that month before I may be messing up the exact qualifications, but it's pretty technical as you know, to qualify for reimbursement. So the manpower from my team to process the claims and to date, we've gone through over 5,000 of those claims, and on my team, there's two people who look at every one of those claims. So it's an incredible amount of work.

Amy Duncan (13:53):

That sounds like a lot. So as you think about the future, what do you foresee as the most effective strategies you can implement against fraud?

Donald Paul (14:06):

So notifying the public, our clients on how to protect their benefits because there are ways for them to protect their benefits. My EBT vendors, FIS. So through the mobile app and the EBT Edge login portal, the customer can log in and they can put a freeze on their account. They can block out-of-state transactions, they can block internet transactions, they can lift the freeze when they want to go shopping. These are all things that our customers can do. Number one, they have to know that it exists. And then also they have to know what to look out for when they're shopping. Does the terminal have a skimmer on it? Do they touch it and they wiggle it and see if it's loose and oh, there's a skimmer, I shouldn't use this one. Or are they giving their pin number out to someone or are they using the same pin they've had forever? 1, 2, 3, 4, change your pen to something that's not common. And so also with FIS, we implemented the common pin block, so the 20 most common pins we're blocking in Washington, and so we've seen success with that.

Amy Duncan (15:35):

Sounds like you've implemented a lot of great solutions, and I'm sure a lot of folks in the room would want to hear more, but I'm going to ask the question that Erica might not want me too. What kinds of things can the federal government do to support you in combating the fraud that you're seeing in your state?

Erica Kane (15:58):

Be honest.

Donald Paul (16:01):

This is being recorded. I won't be too honest, but I think the feds can pony up and pay for the states to replace their mag stripe cards with chip cards. Chip cards are so much more effective. They're not foolproof, but they're so much more effective. And we don't have to rely on our customers who are struggling. They may not be tech savvy, they may not know how to log in to the EBT Edge and implement the card securities. So let's try to make our system, our product as safe and secure as possible for our very, very vulnerable population.

Erica Kane (16:55):

I hear you again into Ron's question earlier that the 50 50 is the reality that is available right now, but I think we're all excited to hear how our appropriators respond in this area.

Amy Duncan (17:18):

So Donald, you have some data you wanted to share on your PowerPoint, so I'm going to turn things to you and ask you to click through and show us what you've got.

Donald Paul (17:28):

So if you can turn on the PowerPoint, Pete, that'd be great. Is it on? Oh, there it is. So this is all about Washington, what you're about to see and kind of our journey through this theft down, if we're going to go down this road of theft here. So I'm going to go to the next slide here.

(17:59):

Yeah, let me try it again. There it is. Oh, I went too far. Okay, let's try this again. Okay, there it is.

(18:13):

So what you're looking at here is a very, very busy graph here. And so in April, 2022, the department, we started receiving the reports of stolen benefits, exactly 15 reports. And then in May, that's when I said we created the Excel spreadsheet that start tracking all of these skimming reports and then reports of skimming numbers remain low in the first couple of months, as you can see. Then they started to really climb in September.

(18:47):

And at that time, we started sending out communications to our staff and for our staff to start telling clients what's happening, how they can protect themselves, how to freeze their card block internet transactions out of state. So we started informing our customers on what they could do. And then October is when it really exploded. As you can see, October of 2022 and over 2300 unique clients reported losses of food and cash tolling almost of 450,000 in a single month. And so that's when we joined forces with DPI department, program integrity and the integrity insurance team, IAT for short. The skiers, the numbers remain steady over the next few months. And then December of 2022, the DPI team, they started reaching out to clients and calling them, telling them how they could safeguard their accounts. And shortly after that, we created a brochure EBT card skimming brochure that we went through publication and everything.

(20:04):

So now we are handing that out to our customers and tells them how they can protect their account and gives them valuable tips. March of 2023 FIS began blocking the 20 most common pins, and then in May of 2023, we got our replacement of stolen food benefits plan approved by FNS, and we started processing those claims. And then a little bit later in November, DPI, their team, they really ramped up more efforts. I think they got some more staff so they could reach out to clients a little bit more. And then this year in January is when we started this thing with us notify, and that's where we started texting customers telling that we think your account is going to be scammed, get a new card right away. So we're sending out texts to customers now through the US No FIFY project for free. Let's talk about some of the reported losses here. As you can see, March 22 through February, 2024, there was a total of 7,126 unique clients reported benefits theft totaling 4.7 million and 27,255 unauthorized transactions. So that's an average of $172 or for the whole household, $653. So that's quite a bit.

(21:57):

And since February 21st, we have replaced two and a half million in stolen food benefits through the approval. So we're getting there. So let's take a look at how the benefits are being used here. We have a map of the country. You're looking at the top 10 states for the skimming losses over the past two years. So as you can see, the losses just aren't happening in Washington. Majority of them are, but there's a lot of other states where our customers benefits are being used at 59%. Let's see here, 59% of the total losses is at the point of sale, or 815,000, 49% is at the ATMs, and 1% is online purchases. So in California, the skimming losses are 27%, 76 of the losses are point of sale transactions totaling almost a million. So let's get down a little bit further here to the specific states. So Washington 30%, California 27%, Texas 9%, Oregon 6%, Florida 6%. New York, 5% Arkansas, 3%. The reason why Arkansas comes up there is because that's Walmart's headquarters with the online purchases. And then we've got Michigan 3%, Maryland 2%, and Illinois 2%. So how can customers protect their accounts? What we're doing is we're encouraging the replacement of EBT cards, social media, post and protect your EBT card's, skimming brochure, and that's what it looks like right there. Unfortunately, I didn't bring any of those with me, but we've got the blocking the common news pins, and then we've got the information we're posting throughout the local offices around the state, and then the skimming prevention efforts by our contact center staff to educate clients that are calling in.

(24:39):

And as I mentioned before, we have our texting pilot that's going on. And so what you're looking at right now is the brochure. We're going to actually, the poster we're going to put up in our community services offices lobbies to let them know that the text is real. We've seen that a lot of our customers get the text and they think it's fake, think it's a scam. So we want them to know that this is real and this is what you need to do. I, so I have a bunch of copies of those. Did you get our text flyers? I'm going to put those at the table, the ECC table. So if you want a copy of that, come back and get one. As you can see, it has a couple different QR codes. One is connects you to the F-I-S-E-B-T-H mobile app, and the other will actually take you to our DSHS state portal so they can download that brochure. So we try to make it as easy as possible for our customers.

Amy Duncan (25:58):

Thank you. Thank you. I think the PowerPoint is also available in the app. I think I saw it attached to this session, so that might be another place to look. If it's not there, then I apologize for that, but I think we have time for a question or two, so we'll rely on you all to tell us what's out there.

Audience Member Lulu (26:22):

Hi, Lulu from Snap Bowl. Again, just a really basic question. Where does the funding for making the client's whole come from? Is it federal funds? Is it state funds? Is it a combination? Does it come from a different pot? How does that work?

Donald Paul (26:39):

I'll take it. Yeah, it's federal funding.

Erica Kane (26:45):

I will say, I know we have some states in the room that are doing this. As we have mentioned, the replacement value is limited based upon the law. So there are instances in which a client had their benefits stolen that they may not, their replacement benefit may not be the same amount, and we are aware of some state agencies that are adding in their own state funds to supplement those replacement efforts.

Audience Member 1 (27:19):

Can you go into a little more detail about how the Barco works on your stolen and benefits claims, how that actually works? And if there was a way to link that back as far as tracking, were you able to do any sort of tracking with that? Is that possible when you looked into your barcodes?

Donald Paul (27:34):

I'm sorry, I couldn't hear your whole question.

Audience Member 1 (27:37):

So, your bar coding, can you go into a little more detail about how that works with your stolen benefits? And is there any ability for you to do any tracking with that to shorten up your use of your Excel spreadsheets?

Donald Paul (27:51):

Well, our barcode system does track the reports and the amounts that are reported on the claim form. And so we have the ability to create ad hoc reports from that, which is being helpful when we have to report the data to FNS on a quarterly basis. But those Excel spreadsheets still are more comprehensive. And so we find ourselves sometimes going back to the Excel spreadsheet, especially when the customer reports that they got their cash skimmed, and at this time we can't replace the cash. Does that help? Definitely saves us time so that the person who's receiving the report from the worker who's receiving the report from the customer can just put all that information in. There's not a second step where they have to report it up, send an email to my team to document. It does save a lot of time.

Amy Duncan (28:58):

Do we have time for one more?

Panel Support Member (29:00):

Let's do one more. Can we have time for one more question?

Audience Member Ron (29:08):

This is Ron from Illinois. And actually I have a question for FNS here. So we have this online purchasing pilot, and so I've heard a bunch of conversation that led me to this question. It takes a long time to implement changes, and we're always behind the curve in terms of fraud and things like that. So that as we look forward, this online purchasing pilot, what are we doing to prevent that type of fraud? So we see Walmart stepping in and being someone that we're having problems with for online purchasing, but as we get out of this pilot program, are we going to run into more instances where we're seeing spoofing of FNS numbers or spoofing of online things? So as we have to act really slowly because of regulations and rules, are there rules and regulations in this online purchasing to prevent the future attacks on online purchasing in our customers?

Erica Kane (30:14):

Oh, yeah. But I will say, Ron, can you talk a little bit more in particular about the speak directly to the fraud that you're referring to?

Audience Member Ron (30:26):

So right now, we deal with the majority of our fraud is through cloning, and then they use those benefits through a spoofed FNS number. So they are taking and spending benefits and taking our customer's benefits in a very legal way, and they've sidetracked our approval process or F and s's approval process to become a retailer. They're just stealing that number. So we have this for our online purchasing. We're not really experiencing theft from fraudulent stores. We're experiencing theft of those EBT card numbers that were skimmed. And so as we bring more stores on, have we been more proactive in preventing online fraud where our customers are going to go, right? They're all going to go online at some point because it's going to become more convenient, we're going to have more stores. And so I'm really curious, did we go forward on that one to make those fraud preventions? Yeah,

Erica Kane (31:27):

So I will yield to my colleague Eden Temple, who is day-to-Day, works with our online retailers.

Audience Member 2 (31:38):

So I'll start this one off by saying, oh, I was pleasantly surprised to see that it doesn't seem like there is as much fraud occurring online based on Donald's data that he showed. But I do know that we've all noted the balance inquiries that have been coming through with online, and we've of course been working closely with retailers to implement protections on their front end side of their website. I'm going to plug my next session with Tom and Jamie. I think we're going to talk a little bit more about that card security code that we see on the back of our cards, as well as expiration date and how those can be used a little bit as well to help prevent fraud that might occur online. And then to your later part about the FNS numbers in the online space, we actually, knowing that we didn't have a good idea of what the landscape looks like in the brick and mortar world, and there's a lot of players, a lot of hops, a lot of TPPs independent sales orgs and people and folks that are onboarding retailers with these f and s numbers to do these transactions.

(33:02):

We've been working in the online space very closely with the TPPs that have those secure pin solution providers so that we don't start seeing the same thing in the online space as well. As you probably already know from your system build when an internet transaction is coming through, it has to be a retailer that's coded as an internet retailer. So I think that also helps a little bit. Does that answer your question a little, Ron? Oh, and yeah, and we're working on these. Thank you, Lisa. We're working on these similar things in the brick and mortar world as well. So I don't know if you want to expand a little on that at all Erica.

Erica Kane (33:48):

If you would like to know more, come find us at the EBT Community Council table tomorrow. I don't want to take time for your presentation even.

Amy Duncan (33:57):

Thank you everyone and have a good day.