Identity Theft in the PPP Loan Program

According to a recent article in the New York Times, as much as 15% of the money allotted to the Paycheck Protection Program (PPP) has been lost to fraud.  While the methodology used to determine this loss is suspect, we should assume that the amount lost to fraud from the program is staggering.  Often times, when massive fraud is alleged, the heavy hand of the government falls on all of those who availed themselves of the program ensnaring the innocent along with the guilty or turning a minor transgression into a major felony.  As white-collar defense lawyers, much of our work involves determining exactly what happened and whether a crime occurred.  We serve as a buffer between the government and protect the innocent from the nearly unlimited power of the government.

There are a couple of points that must be emphasized when talking about PPP Fraud:

  • Not everything that looks like fraud is fraud.
  • Sometimes activities that seem legal may turn out to be fraudulent.
  • It is frequently not possible to determine whether fraud has occurred until a full investigation has been conducted.
  • Even if “fraud” has occurred, it can frequently be remedied without criminal prosecution.
  • The earlier an experienced white-collar attorney is brought into the case, the greater the chances for a successful resolution of the matter.

The investigation and prosecution of PPP fraud is still in its infancy; however, there is one particular problem we wish to discuss in the article:  Identity Theft.  Identity Theft is a specific crime that occurs when a bad actor “steals” the identity of an unsuspecting victim.  It occurs frequently in bank fraud and credit fraud schemes where the bad actors will obtain personal identifying information from an unsuspecting individual and then borrow money or open credit cards in his or her name.  The results for the individual can be devastating[1], and it is rare that the guilty parties are caught and prosecuted.

Not every unauthorized PPP loan, however, will be the result of Identity Theft, and before a report is made to the government, the entity making the report must make sure that they are correct.  A false report of Identity Theft in a PPP loan can boomerang and actually cause the entity more problems; especially if the company does not have a complete understanding of what happened before the report is made.  A report of Identity Theft should absolutely be made if Identity Theft has occurred.

So, what exactly is Identity Theft?

Aggravated Identity Theft in the PPP Loan Process.

Identity theft is one of the most common forms of fraud in the United States today.  Every state[2] has an Identity Theft statute, and the U.S. Code has a felony statute for Aggravated Identity Theft, 18 U.S.C. 1028A.  The statute creates a separate crime for someone who uses another person’s identity to perpetrate a fraud or a theft.  In the case of the PPP, some individuals have stolen the identities of corporations and then applies for PPP loans on behalf of the company and then misdirecting the proceeds of those loans to some third party.  The company becomes indebted to a bank (financial institution), and the proceeds of the loan are to be used for certain statutory purposes.  The scheme results in multiple victims.  The company is a victim of Wire Fraud and Identity Theft.  The bank is the victim of Bank Fraud and Wire Fraud.

Often times, the individuals who appear to have received the money are mere cutouts or strawmen who give the ultimate fraudsters cover.  They delay the investigation at a minimum, and, in some cases, prevent the government from finding the ultimate source of the fraud.

Sometimes, however, conduct that may at the beginning appear to be Identity Theft may turn out to be something entirely different.  It could be that an employee applies for a PPP loan on the company’s behalf and that the company received the funds.  It could be that the owners of the company did not understand the limitation of PPP loan proceeds (or they may have thought the PPP loan was simply a regular loan).  In these cases, the authority of the individual who obtained the loan may be questionable, but there would not be an “Identity Theft”.

There may also be situations where an employee obtained a PPP loan for a company and had authority to obtain the loan.  The employee may then divert these loan proceeds to his or her own use either by simply taking the money (theft) or by creating non-existent vendors and sending false invoices from these non-existent vendors to be paid.  While this conduct may deplete the company of the proceeds it received from the PPP loan, it is not, strictly speaking, PPP fraud or Identity Theft.  Rather, it is an embezzlement.

In other cases, a bad actor may purchase a company’s account information or even tax returns on the dark web (or buy them from an employee, steal them in a hack, or simply ask for them from a naïve employee) and then create false documents identifying third parties as CEOs or CFOs, creating corporate resolutions that appear real and then changing the address where the loan proceeds will be received.  Because of the economic crisis associated with the COVID-19 pandemic, loans were processed very quickly without the customary safeguards being followed.  This is a classic Identity Theft situation.

However, regardless of the scenario, the company should determine exactly what happened before filing a report with the government.

What Should a Company Do if it Suspects it is the Victim of Identity Theft with a PPP Loan?

If a company believes that it may have been the victim of Identity Theft in a PPP loan scam, there are a couple of steps the company should take immediately.

First, the company must find out exactly what happened.  If a company has been a victim of Identity Theft, the theft should be reported to the Small Business Administration using the “Declaration of Identity Theft” form provided by the agency.  However, as the small print on the bottom of the form notes, filing a false Declaration of Identity Theft is a felony with significant penalties.

We have seen instances where corporate executives failed to conduct a proper investigation and then find themselves in trouble because they provided false information to government investigators.  The report then results in the company or corporate executives becoming a “target” of a federal investigation.  Attempting to resolve these issues after the fact can be costly and result in unnecessary civil penalties or even criminal prosecution.  A thorough investigation is absolutely necessary.

Second, the investigation should be undertaken by an experienced white-collar attorney.   PPP fraud is a serious matter, and inexperienced lawyers or lawyers who do not regularly deal with white-collar criminal matters can make matters worse.  An experienced white-collar attorney will understand how an investigation should be conducted.  Ideally, he or she will have conducted these investigations in the past.  An outside attorney will also provide a detached and neutral perspective to the situation which will result in the company receiving the best legal advice.

Once all of the facts are known, the company will be in a better position to determine what steps to take vis-à-vis the government.  An investigation may reveal, for example, that there has not been any fraud.  In such a case, no action may be necessary.  On the opposite side of the spectrum, the investigation may reveal that the company was an innocent victim of Identity Theft.  In this case, the proper course of action would most likely be to report the Identity Theft to the Small Business Administration and take other corrective actions to prevent additional identity theft in the future.

A company always needs to make sure it is “clean” before reporting a matter to the federal government.  The vast majority of small to mid-sized companies believe that they are clean, but with over 3,000 federal felony statutes (not to mention state felony statutes), companies frequently violate statutes they did not know existed.  Once a company reports criminal conduct to the federal government, it invites the government to peruse its books and records.  A company can move from “victim” to “target” quickly.  An experienced white-collar attorney will spot these issues and help to resolve them.  It is important that the government understand the company is a victim and not a potential defendant

A Note About PPP Fraud.

We have used the term “PPP Fraud” throughout this article, but PPP Fraud is not a specific charge under the U.S. Criminal Code.  Rather, it is conduct that violates other federal statutes, most often wire fraud or banking fraud or false statements.  This is an extremely complex area of the law with many pitfalls and traps for the unwary.

If you suspect PPP Fraud may have occurred or that you may have been the victim of Identity Theft, contact us immediately.

[1] The Federal Trade Commission (FTC) provides consumers with assistance when they are the victims of Identity Theft.  Click here to access the FTC website.

[2] In Pennsylvania, Identity Theft is defined at 18 Pa.C.S. 4120.  New York identifies Identity Theft in a series of statutes beginning at New York Penal Law 190.77 and continuing thereafter.  The Maryland Identity Theft law is located at Maryland Code 8-301.  DC Code 22-3227.02 makes Identity Theft a crime in the District of Columbia.  All of these statutes define Identity Theft slightly differently, but they all make it a crime to steal another person’s identity for the purposes of perpetrating a fraud.

Author – Dennis E. Boyle