Public Sector Fraud and Improper Payments

Public Sector Fraud & Improper Payments
Federal improper payments, FY2025	About $186 billion (15 agencies, 64 programs); about $3 trillion since FY2003
GAO fraud estimate	$233–$521 billion per year (FY2018–2022 data)
SBA OIG pandemic loan estimate	Over $200 billion potentially fraudulent (EIDL and PPP)
DOL OIG unemployment estimate	At least $191 billion potentially improper; over $76 billion fraud
Key bodies	GAO, OIGs, PRAC, Treasury Do Not Pay, DOJ COVID-19 Fraud Enforcement Task Force

Public sector fraud is the deliberate deception of a government to obtain payments, benefits or contracts to which the perpetrator is not entitled. It must be distinguished from improper payments, which are payments that should not have been made or were made in the wrong amount, including administrative error, missing documentation and eligibility mistakes. Improper payments include fraud but are mostly not fraud; treating the two as synonyms is the most common error in public discussion of the numbers. This article sets out the best available estimates, the major pandemic-era schemes, and the data techniques investigators use.

1 Improper payments versus fraud: the estimates

Under the Payment Integrity Information Act of 2019 (PIIA), agencies must estimate improper payments in programs susceptible to significant error. GAO's April 2026 report (GAO-26-108694) states that 15 agencies reported about $186 billion in estimated improper payments for FY2025 across 64 programs, up about $24 billion from the prior year; about 82% ($153 billion) were overpayments. Five programs account for about 73% (roughly $136 billion): Medicare ($57 billion), Medicaid ($37 billion), the Earned Income Tax Credit ($21 billion), SNAP ($10 billion) and the SBA Shuttered Venue Operators Grant program ($10 billion). Cumulative agency estimates since FY2003 total about $3 trillion. The estimate omits some programs deemed susceptible, such as TANF.^[1]

Fraud is harder to measure because undetected fraud is unobserved. In April 2024 GAO published its first government-wide estimate (GAO-24-105833): direct annual losses to fraud of roughly $233 billion to $521 billion for FY2018–2022, a 90% interval built from adjudicated cases, detected potential fraud, and modeled undetected fraud. The range reflects the heightened risk environment of the pandemic years.^[2] Neither figure should be added to the other: they overlap and use different methods.

2 Pandemic relief fraud

Congress authorized the Paycheck Protection Program (PPP) and the SBA's COVID-19 Economic Injury Disaster Loan (EIDL) program in 2020. Both relied heavily on applicant self-certification. The SBA Office of Inspector General's June 2023 report 23-09 estimated that SBA disbursed over $200 billion in potentially fraudulent COVID-19 EIDL and PPP funds—about $136 billion in EIDL and $64 billion in PPP—at least 17% of roughly $1.2 trillion disbursed, and attributed it to weakened controls and a "pay and chase" environment. Nearly $30 billion had been seized or returned at that time.^[3] "Potentially fraudulent" was defined by indicators such as use of SSNs of the deceased or minors, duplicate bank accounts, and applications from addresses and IPs tied to multiple filings; it is a risk flag, not an adjudication.

Typical PPP schemes: fictitious businesses with fabricated payroll and tax documents; inflated headcount or payroll at real businesses; "loan mills" and third-party processors who file bulk applications for fees; and misuse of proceeds (luxury cars, real estate, crypto). A representative public conviction: a co-founder of the PPP lender service provider Blueacorn was sentenced in late 2025 to 10 years in prison and ordered to pay over $66 million in restitution for a scheme involving over 530 fraudulent loans and more than $65 million in losses; the prosecution alleged fabricated tax documents and bank statements.^[4]

Limitation periods matter: Congress extended the criminal statute of limitations for PPP and for COVID-19 EIDL fraud to ten years in 2022 legislation, which in practice allows charging into 2030–2031. DOJ's COVID-19 Fraud Enforcement Task Force (created 2021) is reported to have charged more than 3,500 defendants and recovered more than $1.4 billion, and civil False Claims Act pandemic settlements continue.^[5] Treat these as law-firm summaries of DOJ figures and check DOJ releases for current totals.

3 Unemployment insurance and benefits fraud

The Department of Labor OIG estimated that of more than $888 billion in pandemic-era unemployment insurance benefits, at least $191 billion could have been improperly paid, "with a significant portion attributable to fraud" (over $76 billion by an earlier estimate). The Pandemic Unemployment Assistance program's reliance on self-certification without verification of eligibility or wages in its first months made it especially susceptible.^[6] Common patterns: identity theft with stolen PII; multi-state filing with one identity; claims by incarcerated persons; and organized rings routing benefits to prepaid cards and drop accounts.

Beyond pandemic programs, steady-state benefit fraud includes Medicare and Medicaid billing (the 2025 National Health Care Fraud Takedown charged 324 defendants involving $14.6 billion in alleged false claims), SNAP trafficking (selling EBT benefits for cash), Social Security and VA payments continued after death, and tax-credit fraud (see Elder Financial Exploitation for the overlap with beneficiary exploitation).^[7]

4 Oversight and enforcement architecture

• Offices of Inspector General investigate their agencies' programs and report semiannually; see Federal Enforcement Agencies for the criminal investigators (FBI, Secret Service, HSI, IRS-CI, postal inspectors).
• Pandemic Response Accountability Committee (PRAC), created by the CARES Act, supports OIGs with a data analytics center. Originally scheduled to sunset in September 2025, it was extended to 30 September 2034 by Public Law 119-21 (July 2025), which also gave it $88 million and wider jurisdiction. Its reported support: over 1,200 investigations, over 24,000 subjects and over $2.5 billion in potential fraud loss as of November 2025.^[8]
• Treasury's Do Not Pay (DNP), authorized in PIIA, lets agencies check payees against sources such as the System for Award Management exclusion list and death data before paying. Full access to the Social Security Death Master File was temporary (three years from December 2023) until legislation in February 2026 (the Ending Improper Payments to Deceased People Act) reportedly made it permanent.^[9]
• DOJ brings criminal prosecutions and False Claims Act civil actions (treble damages plus per-claim penalties). Qui tam relators have driven many PPP FCA cases.

5 Forensic techniques: finding program fraud in data

5.1 Eligibility re-performance against independent records

For each application, recompute what the program formula permits from independently obtained data. PPP first-draw loans equalled 2.5 times average monthly payroll (capped at $10 million); self-employed applicants were capped at 2.5 times monthly Schedule C net profit with profit limited to $100,000, i.e. $20,833. Example: an applicant claims 40 employees and $480,000 monthly payroll, producing a $1,200,000 loan (2.5 × $480,000). The IRS Forms 941 show wages of $38,000 per quarter for 6 employees, or about $12,667 per month; 2.5 × $12,667 is about $31,700. The loan is about 38 times what the filings support. Evidence: the side-by-side recomputation, the 941 transcripts and state wage records.

5.2 Duplicate and shared-identifier clustering

Build a graph in which applications are nodes and shared attributes (bank account, phone, email, device or IP, mailing address, registered agent, loan processor) are edges, then look at connected components. Illustration for unemployment claims: if one account receives weekly deposits for 14 different claimants at $1,000 per week (the sum of a $400 state benefit and the $600 federal supplement in the first months of the pandemic), that is $14,000 per week, or $364,000 over 26 weeks, flowing to one account holder. A rule of thumb used in screening is to review any account tied to more than three unrelated claimants. See Fraud Detection Analytics.

5.3 Master-file matching

Match payee SSNs and EINs against death records, prisoner lists, SAM exclusions, state business registries (a firm incorporated after the program's eligibility date, such as 15 February 2020 for PPP payroll eligibility, is ineligible) and NAICS codes versus the stated business. Quantify match hits as an error rate on the population and drill into the top-dollar hits. Beware of false positives in death matches (SSN transposition, late reporting); verification should use secondary identifiers.

5.4 Statistical screens

Apply Benford's Law to loan amounts or claim totals by lender or processor. Fabricated applications often cluster at round numbers or at program ceilings; for instance, an excess of loans at exactly $20,833 or $20,832 for sole proprietors implies formula-driven filing. Compare each lender's or processor's loan-size distribution and average jobs per dollar with peers, and flag outliers beyond three standard deviations.

5.5 Document and metadata review

Examine submitted tax forms, bank statements and payroll reports for font and layout anomalies, identical templates across unrelated applicants, PDF creation metadata (creator software, timestamps after the purported document date), and arithmetic inconsistencies (see Document Examination). Evidence: side-by-side exhibits and metadata dumps.

5.6 Tracing proceeds

Follow loan proceeds through the receiving account in the first 10–30 days: transfers to personal accounts, vehicle and real-estate purchases, and crypto exchange deposits. Use the lowest-intermediate-balance and similar methods covered in Litigation Support and Damages, with Asset Tracing and Cryptocurrency Tracing for destinations, and Money Laundering typologies for structured withdrawals. Output: a flow-of-funds chart tying specific dollars to specific uses, supporting forfeiture and restitution.

6 Evidence and prosecution

Common charges include wire fraud (18 U.S.C. § 1343), bank fraud (§ 1344), false statements to SBA or a financial institution, aggravated identity theft (§ 1028A), money laundering (§§ 1956–1957) and, for benefits, theft of government funds (§ 641). Civil False Claims Act liability turns on knowing false claims and materiality. Loss is typically calculated as the amount of the loan or benefit less any legitimate portion, and sentencing under the Guidelines scales with loss. Experts frame these computations and their reliability under Daubert.

See also: Federal Enforcement Agencies, Fraud Detection Analytics, Elder Financial Exploitation, Internal Controls and Fraud Risk Assessment.

References

1. GAO (27 April 2026). GAO-26-108694, improper payments, fiscal year 2025. gao.gov
2. GAO (April 2024). GAO-24-105833, fraud risk management: estimate of government-wide fraud losses. gao.gov
3. SBA OIG (27 June 2023). Report 23-09, COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape. oversight.gov
4. U.S. Department of Justice. Sentencing of co-founder of PPP lender service provider (Blueacorn). justice.gov
5. Winston & Strawn. "DOJ continues False Claims Act enforcement of PPP loans into 2026." winston.com
6. Congressional Research Service. "Unemployment Insurance Fraud: Background and Recent Data" (IN12117). everycrsreport.com; DOL OIG hearing statement (5 March 2026): oig.dol.gov
7. Mintz (7 July 2025). "Health care fraud enforcement developments: 2025 takedown." mintz.com
8. PRAC. Semiannual Report to Congress, 1 April–30 September 2025. pandemicoversight.gov
9. Ways and Means Committee. "Ending Improper Payments to Deceased People Act" one-pager. waysandmeans.house.gov; Treasury DNP release: treasury.gov