Changes in store for Arizona's unemployment insurance program in wake of massive fraud

At the start of the pandemic, Sheri Calzadillas was working from home doing political survey calls, but the job ended and she was left with few other work options.

Diagnosed with chronic obstructive pulmonary disease, Calzadillas, 48, is in a high-risk category when it comes to contracting COVID-19, so she applied for financial assistance and started looking for work through online job boards.

Her problems multiplied when her unemployment insurance payments from the state abruptly stopped.

"They had been paying me from February to June and then all of the sudden ... they thought it was fraud," Calzadillas said.

She filed an appeal. But it wasn't until the state Department of Economic Security contacted her at the end of August that she learned the address on her unemployment insurance account had been changed in February to a business in Los Angeles, unbeknownst to her. The phone number and email had also been changed.

When the Los Angeles business whose address was on her UI account returned a piece of mail to the DES, the agency flagged her account for fraud.

Calzadillas is one of thousands of Arizonans who fell victim to identity theft during the pandemic, resulting in delayed or denied payments and, for many — as it was for her — financial devastation.

Calzadillas and her husband ended up being displaced from their home.

One expert says that a simple modernization and security upgrade to Arizona's  decades-old unemployment insurance program could not only have saved victims the trouble, but also could have saved the state billions of dollars in fraudulently obtained funds.

And now, a plan to do just that is underway.

Tech upgrades
on the way

In October, the DES will begin accepting proposals for a contract to one or multiple companies to modernize the unemployment insurance benefits system, said a recent blog on the agency's website from Director Michael Wisehart.

With an unprecedented number of Arizonans experiencing unemployment during the pandemic, people were forced to rely on the state's unemployment insurance, the then-new Pandemic Unemployment Assistance program and other forms of state and federal assistance, Wisehart noted.

The DES collaborated with federal, state and local partners during the pandemic to provide support to people impacted by job loss and other COVID-related issues and made improvements to existing programs to meet the surge in demand for services, he wrote. That work will continue.

The department will use funding from the Families First Coronavirus Response Act, the American Rescue Plan Act of 2021 and a "small surplus in a UI administration fund" to pay for the technology upgrade, a decision resulting from the pandemic-related demand, Wisehart said.

This is part of a larger plan to "advance every part" of the state's workforce development system, to reinforce "the foundation upon which our economy continues to grow," he said.

The state will seek additional funding in the 2023 fiscal year budget to close any potential gaps in funding the overall project.

"The age and complexity of the existing UI system will cost the state significantly more over the years as we continue to maintain, adjust and repair," Wisehart said.

"System modernization is not only sensible from a fiscal perspective, it is a crucial investment into our labor force. It will help to support those who face disruptions in employment as the rest of the workforce development system works with them to rebound and find their place again in the state’s economy."

False job listings
opened the door 

There's no disputing the benefits of modernizing the state's system, and it was long overdue, said Haywood Talcove, CEO of LexisNexis Risk Solutions Government Group.

And, while the DES's effort to prevent fraud was valiant, it still fell short, he said.

"What happened was something that was completely preventable," Talcove told the Star.

In addition to an unprecedented number of unemployment claims, the pandemic also saw unprecedented amounts of fraud, due to a variety of reasons.

Data breaches before and during the pandemic resulted in a "pile of personal identifiable information being collected by adversaries," Talcove said.

Breaches like this aren't uncommon in modern times, and fraudsters are always looking for new sources of income, like the PUA program.

Arizona also saw job posting scams, in which criminal groups placed good-looking ads on reliable job boards. Thousands of unemployed Arizonans  applied for these jobs, received a real interview and were hired.

"All of a sudden you have a job that pays significantly more than you were making previously," Talcove said. "You get excited, then they say they need to verify your identity."

Using that form of social engineering, fraudsters were able to manipulate applicants into providing their personal information, then use that information to apply for unemployment on the applicants' behalf, locking the legitimate claimant out of the system, Talcove said.

With roughly 18,000 false job listings having been identified online, the effect was disastrous.

"Each identity they got was worth approximately $26,000. They found systems that were completely open," Talcove said.

Talcove said this type of fraud has been known since at least 2013, when LexisNexis published a book detailing how transnational criminal groups use stolen identities to access these systems.

While the total amount lost to fraud is still unknown, the U.S. Labor Department has estimated $87 billion in losses nationwide, Talcove said.

Based on LexisNexis' estimations, it is more like $250 billion, which is based on the 14% unemployment rate that was seen across the country last year.

While that number is substantially higher that the federal estimation, Talcove says it may still be conservative. With the potential for up to 50% of all unemployment claims to have been fraudulent, more than $400 billion could have been lost to criminals, Talcove said.

Lost payments
took heavy toll

Calzadillas was able to straighten out her case, and earlier this month, was finally paid for the first time since June 12.

That wasn't soon enough, though, as she and her husband ended up having to leave their home.

Back to homepage

Subscriber Login

Keep reading with a digital access subscription.

Subscribe now

Her husband, who is diabetic and also has to be careful about working outside of the home and risking COVID exposure, had separately been disqualified from Pandemic Unemployment Assistance in December, after they accidentally sent the DES the wrong tax documents.

“Now they are saying we owe it back,” Calzadillas said, adding that they're appealing the decision and hoping to get the seven weeks of PUA her husband is owed.

Then, after her state payments stopped, she said they had to sell many of their personal items just to survive.

“That was just for us to live and keep going,” she said. “Thank God we had family to help. If not for them, we would be on the street right now.”

They moved from their three-bedroom, two-bathroom home on a half-acre of land into a fifth-wheel trailer on a neighbor's property.

Potential losses
are massive

Based on the number of unemployment claims in Arizona, it appears that 67% of people in the state were unemployed, Talcove said. In actuality, Arizona's unemployment rate fluctuated between 4.8% and 14.2% during the pandemic, according to U.S. Bureau of Labor statistics.

LexisNexis estimates Arizona's potential loss to fraud at nearly $2 billion, though a full accounting has yet to be performed.

While it's statistically impossible to reduce the loss to fraud to zero, when the loss is somewhere between 10% and 50%, it's just not sustainable, Talcove said.

"There isn't a bank, a financial institution, a hotel or an e-retailer that hasn't solved this. Identity verification tools in the private sector can actually mitigate this," he said, adding that 22 other states have already implemented improvements to their UI systems. "It's not a hard problem to solve and it's not an expensive problem to solve."

While Arizona made efforts to mitigate fraud by using the identity verification tool ID.me, Talcove said that system is problematic in that it treats applicants like fraudsters and requires them to provide government documents and in some cases visually confirm via video that they are the same person.

Pete Eskew, General Manager of Public Sector for ID.me, said Talcove’s opinion here is misleading.

”ID.me follows the federal guidelines for identity verification … By implementing ID.me’s identity verification tool, the State of Arizona has saved $40 billion from payouts on fraudulent unemployment claims,” Eskew said, adding: “ID.me’s self-service identity verification process takes people only a few minutes to complete.”

Talcove said there are less burdensome and more effective identity verification processes that take seconds, rather than hours.

A simple multi-factor authentication process to verify the user's actual identity — similar to those that banks use for online transactions — would be fast and easy to put into place, Talcove said.

But it's going to take more than that to fix the problem. With a 35-year-old system in place in Arizona, there are vast improvements to be made, he said.

There needs to be an email verification system in place, he said, to ensure that the email accounts are legitimate, and a device assessment component to make sure the device being used to file the claim hasn't been involved in previous fraud. The system should also apply some public record component to its verification process, to ensure that physical addresses being claimed are real.

"In one state, 774 applications out of one house didn't raise a flag. And the house was for sale on Zillow," Talcove said.

Checks like this could drive the total national loss to fraud down to below the $10 million or $15 million range, he said.

Talcove said an upgrade to the state's system would cost roughly $1 million.

"This is not a victimless crime. We have a lot of people who can’t get access to their benefits, and they can’t get access because they’re socially engineered," he said.

No breaches
to the DES

Arizona DES press secretary Tasya Peterson said in an email to the Star that fraudulent claims were a problem in all 50 states during the pandemic, but the DES took "proactive and aggressive action" to combat fraud in its programs, adding layers of protection to its systems to meet the evolving threat.

"It is important to note that the vast majority of fraud seen nationwide was within the federal PUA program, not the state unemployment insurance program," Peterson said.

The DES has not been the victim of any known data breaches, she said, adding:  "It is also important to note that states with newer UI systems still experienced a significant increase in criminal activity."

The PUA program designed by Congress required very little documentation from applicants, making it vulnerable to fraud, Peterson said, adding that revised legislation was eventually passed to reduce the program's vulnerability, but by then, Arizona had already acted to make sure its program's integrity is intact.

In addition, she said, Arizona was one of the first states to engage with experts to establish patterns among millions of fraudulent claims, and one of the first to utilize the verification company ID.me when fraudsters initially began attempting to infiltrate unemployment systems across the U.S. last year. The DES has been using the program since October of last year, resulting in a "significant decrease in suspected fraudulent initial claims," Peterson said.

In December, the DES expanded its use of the ID.me system to the state's entire PUA population, who filed weekly certifications to claim benefits. This allowed the DES to provide benefits to legitimate claimants faster and to prevent additional weekly fraudulent claims, according to Peterson.

"When the opportunity for PUA fraud was cut off, fraudsters switched to targeting the regular UI system and we went a step further and added identity verification to the regular UI system Feb. 6, 2021," Peterson said.

Criminals still tried to defraud Arizona's UI system in bulk, but she said the safeguards within the system prevented payments from being issued. With fraud no longer an issue, the state is able to focus its efforts on other things, Peterson said.

"The goals of the UI benefits system modernization is to increase staffing flexibility, decrease time needed to implement programmatic changes and result in a better experience for both the clients served and the businesses that fund the system," Peterson said.

'Where to go
from here'

As for the Calzadillases, Pima County paid for the first month of their new rental.

She then used a large portion of her unemployment-insurance back-payment to pay their rent through December.

"Now we're broke again," she said.

With President Joe Biden's decision to end the PUA program on Sept. 6, their future is once again up in the air.

“I don’t think it’s fine, especially with the delta variant happening like it is right now,” she said. "We're trying to get jobs. We're both high-risk, but we're going ahead and trying to figure out where to go from here."