Expedited Assistance for Victims of Hurricanes Katrina and Rita: FEMA's Control Weaknesses Exposed the Government to Significant Fraud and Abuse
Published: 2006-06-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In the wake of Hurricanes Katrina and Rita, the Federal Emergency Management Agency (FEMA) faced the challenge of providing assistance quickly while having sufficient controls to provide assurance that benefits were paid only to those eligible under the Individuals and Households Program (IHP). On February 13, 2006, GAO testified on the initial results of its ongoing work related to whether (1) controls are in place and operating effectively to limit assistance to qualified applicants, (2) indications exist of fraud and abuse in the application for and receipt of assistance payments, and (3) controls are in place and operating effectively over debit cards to prevent duplicate payments and improper usage.
section_title: What GAO Found
paragraphs: GAO identified significant flaws in the process for registering disaster victims that leave the federal government vulnerable to fraud and abuse of expedited assistance (EA) payments. For Internet applications, limited automated controls were in place to verify a registrant's identity. However, there was no independent verification of the identity of those who applied for disaster assistance via the telephone. GAO demonstrated the vulnerability inherent in the call-in applications by using falsified identities, bogus addresses, and fabricated disaster stories to register for IHP. FEMA's automated system frequently identified potentially fraudulent registrations, such as multiple registrations with identical social security numbers (SSN) but different addresses. However, the manual process used to review these flagged applications did not prevent EA and other payments from being issued. Other control weaknesses include the lack of any validation of damaged property addresses for both Internet and telephone registrations. Given these weak or nonexistent controls, it is not surprising that GAO's data mining and investigations showed substantial potential for fraud and abuse of EA. Thousands of registrants misused IHP by applying for assistance using SSNs that were never issued or belonged to deceased or other individuals. GAO's case study investigations of several hundred registrations also indicate the use of bogus damaged property addresses. Visits to over 200 of these damaged properties in Texas and Louisiana showed that at least 80 of these addresses were bogus--including vacant lots and nonexistent apartments. FEMA also made duplicate EA payments to about 5,000 of the nearly 11,000 debit card recipients--once through the distribution of debit cards and again by check or electronic funds transfer. In addition, while debit cards were used predominantly to obtain cash, food, clothing, and personal necessities, a small number were used for adult entertainment, bail bond services, and weapons purchase, which do not appear to be items or services required to satisfy disaster-related needs.

section_title: Letter
paragraphs: On February 13, 2006, we testified before the Senate Committee on  Homeland Security and Governmental Affairs on the initial results of our  ongoing forensic audits and related investigations of assistance provided  by the Federal Emergency Management Agency (FEMA) to individuals and  households affected by Hurricanes Katrina and Rita. The Individuals and  Households Program (IHP), a major component of the federal disaster  response efforts established under the Robert T. Stafford Disaster Relief  and Emergency Assistance Act (Stafford Act), is designed to provide  financial assistance to individuals and households who, as a direct result of  a major disaster, have necessary expenses and serious needs that cannot be  met through other means.  In the wake of Hurricanes Katrina and Rita,  FEMA provided $2,000 in IHP payments to affected households via its  Expedited Assistance (EA) program. Victims who received EA may qualify  for up to $26,200 in IHP assistance. As of mid-December 2005, IHP  payments totaled about $5.4 billion, with $2.3 billion provided in the form  of EA. These payments were made via checks, electronic fund transfers,  and a small number of debit cards. Our initial work focused on whether (1)  controls are in place and operating effectively so that expedited assistance  payments are only made to qualified registrants, (2) indications exist of  fraud and abuse in the registration for and receipt of expedited assistance  and other payments, and (3) controls are in place and operating effectively  over debit cards to prevent duplicate payments and improper usage. This  report summarizes our testimony, which is reprinted in Appendix I, and  makes specific recommendations for corrective actions. These  recommendations relate only to the limited scope of work completed for  our testimony and will therefore not prevent all improper and fraudulent  IHP payments.  In the future, we will continue to audit and investigate the  assistance provided by FEMA in the aftermath of hurricanes Katrina and  Rita, and we will issue further recommendations designed to create a more  comprehensive fraud prevention program for IHP.
Overview of Testimony In our testimony, we stated that weaknesses in the process that FEMA used  to review registrations for disaster relief and approve assistance payments  left the government vulnerable to fraud and abuse. Our work indicated that  FEMA put in place limited procedures designed to prevent, detect, and  deter certain types of duplicate and potentially fraudulent disaster  registrations. Specifically, individuals could apply for disaster assistance  via the Internet or telephone. FEMA subjected the Internet registrations to  a limited verification process whereby a FEMA contractor used credit and  other information to validate the identity of registrants. Those who failed  the Internet verification process were advised to contact FEMA via  telephone to reregister. However, FEMA did not apply the identity  validation process to telephone registrations.  Of the more than 2.5 million  registrations recorded in FEMA’s database as of mid-December 2005, 60  percent (more than 1.5 million) were exempt from any identity verification  because they were submitted via the telephone. Our data mining and  investigations confirmed FEMA’s representation. For example, using  falsified identities, bogus addresses, and fabricated disaster stories, we  applied for disaster assistance over the telephone and obtained $2,000  expedited assistance payments.
Other control weaknesses further increased the government’s exposure to  fraud and abuse. For example, we found that FEMA instituted automated  checks that flagged hundreds of thousands of potentially duplicate  registrations in the computer system FEMA used to process and approve  IHP registrations for payments. FEMA officials informed us that these  flagged registrations were subjected to additional reviews to conclude  whether they were, in fact, duplicates. However, while the additional  review process may have prevented some potentially fraudulent and  improper payments, it did not prevent other potentially fraudulent and  improper payments based on duplicate registrations. We also found that  FEMA did not implement procedures to validate whether damaged  addresses used to register for assistance were bogus, for either Internet or  telephone registrations.
With limited or nonexistent validation of registrants’ identities and  damaged addresses, it is not surprising that our data mining and  investigations found substantial indicators of potential fraud and abuse  related to false or duplicate information submitted on disaster  registrations. For example, according to Social Security Administration  (SSA) data, FEMA made millions of dollars in payments to thousands of  registrants who submitted Social Security Numbers (SSN)  that have not  been issued or belonged to deceased individuals. Our data mining also  detected that FEMA made tens of thousands of payments to registrants  who provided other false or duplicate information on their registrations.  Specifically, we investigated 20 case studies with multiple registrations. A  majority of these registrations—165 of 248—contained SSNs that,  according to the SSA, were never issued, belonged to deceased individuals,  or did not match the name provided. In addition, about 80 of the over 200  alleged disaster addresses that we attempted to validate were bogus  addresses. Also, our case study registrants did not live in many of the  remaining valid addresses. In one specific case example, 17 individuals,  some of whom shared the same last name and current addresses, used 34  different SSNs that did not belong to them and addresses that were either  bogus or were not their residences to receive more than $103,000 in FEMA  payments. In addition, because the hurricanes had destroyed many homes,  we could not determine if approximately 15 of the alleged disaster  addresses had ever existed.
Similar to the control weaknesses over expedited assistance payments  distributed through checks and electronic funds transfers, we found that  FEMA did not validate the identities of debit card recipients at three relief  centers in Texas who registered via the telephone. Consequently, FEMA  issued $2,000 debit cards to over 60 registrants who provided SSNs that  were never issued or belonged to deceased individuals. We also found that  FEMA made multiple expedited assistance payments to over 5,000 of the  11,000 debit card recipients. That is, FEMA provided the registrant both a  $2,000 debit card and a $2,000 check or electronic fund transfer. Further, at  the time of debit card issuance, unlike the recipients who received  expedited assistance payments via checks or EFTs, FEMA did not issue  specific instructions to debit card recipients on the use of the cards. We  found that debit cards were used predominantly to obtain cash and thus are  unable to determine how the money was actually used. The majority of the  remaining debit card purchases were for food, clothing, and personal  necessities. However, in isolated instances, a few debit cards were used to  pay for items or services that, on their face, do not seem essential to satisfy  disaster related needs. For example, these debit cards were used in part to  purchase adult entertainment, a .45 caliber hand gun, jewelry, bail bond  services, and to pay for prior traffic violations.
subsections: section_title: Conclusions
paragraphs: FEMA has a substantial challenge in balancing the need to get money out  quickly to those who are actually in need and sustaining public confidence  in disaster programs by taking all possible steps to minimize fraud and  abuse. Nevertheless, FEMA could reasonably be expected to have mature,  fully tested processes, along with business partners in the federal, state,  and private sector, that can provide it with real time access to the data  required to validate identities and addresses for those seeking disaster  assistance. Once fraudulent registrations are made and money is disbursed,  detecting and pursuing those who committed fraud in a comprehensive  manner is costly and may not result in recoveries. Further, many of those  fraudulently registered in the FEMA system already received expedited  assistance and will likely receive more money, as each registrant can  receive as much as $26,200 per registration.
Another key element to preventing fraud in the future is to ensure there are  consequences for those that commit fraud. We are referring the fraud cases  that we are investigating to the Katrina Fraud Task Force for further  investigation and, where appropriate, prosecution. We believe that  prosecution of individuals who have obtained disaster relief payments  through fraudulent means will send a message for future disasters that  there are consequences for defrauding the government.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of the Department of Homeland Security  (DHS) direct the Director of the Federal Emergency Management Agency  to take six actions to address the weaknesses we identified in the  administration of IHP.  These six recommendations relate only to the  limited scope of work that we have completed to date and will not prevent  all types of improper and fraudulent IHP payments.  Consequently, we will  continue to audit and investigate the assistance provided by FEMA in the  aftermath of hurricanes Katrina and Rita and we will issue further  recommendations designed to create a more comprehensive fraud  prevention program for IHP.  To address the concerns raised in our  February 13, 2006, testimony, we recommend that DHS and FEMA do the  following:  Establish an identity verification process for Individuals and  Households Program (IHP) registrants applying via both the Internet  and telephone, to provide reasonable assurance that disaster assistance  payments are made only to qualified individuals.  Within this process  establish detailed criteria for registration and provide clear  instructions to registrants on the identification information required,  create a field within the registration that asks registrants to provide  their name exactly as it appears on their Social Security Card in order  to prevent name and Social Security Number (SSN) mismatches,  fully field test the identity verification process prior to   ensure that call center employees give real-time feedback to  registrants on whether their identities have been validated, and   establish a process that uses alternative means of identity  verification to expeditiously handle legitimate applicants that are  rejected by identity verification controls.
Develop procedures to improve the existing review process of duplicate  registrations containing the exact same SSN and to identify the reasons  why registrations flagged as invalid or as potential duplicates have been  overridden and approved for payment.
Establish an address verification process for IHP registrants applying  via both the Internet and telephone, to provide reasonable assurance  that disaster assistance payments are made only to qualified individuals.  Within this process   create a uniform method to input street names and numbers and  apartment numbers into the registration,  institute procedures to check IHP registration damaged addresses  against publicly available address databases so that payments are not  made based on bogus property addresses,  fully field test the address verification process prior to   ensure that call center employees can give real time feedback to  registrants on whether addresses have been validated, and  establish a process that uses alternative means of address  verification to expeditiously handle legitimate applicants that are  rejected by address verification controls.
Explore entering into an agreement with other agencies, such as the  Social Security Administration, to periodically authenticate information  contained in IHP registrations.
Establish procedures to collect duplicate expedited assistance  payments or to offset these amounts against future payments. Such  duplicate payments include  the payments made to IHP recipients who improperly received the  $2,000 debit cards and an additional $2,000 EA check or Electronic  Funds Transfer (EFT) and  the thousands of duplicate EA payments made to the same IHP  registration number.
Ensure that any future distribution of IHP debit cards includes  instructions on the proper use of IHP funds, similar to those instructions  provided to IHP check and EFT recipients, to prevent improper usage.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, which are reprinted in  appendix II, DHS and FEMA made a number of observations that were not  related to any specific recommendation, concurred fully with four of our  six recommendations, and partially concurred with the remaining two  recommendations. In general comments, FEMA and DHS stated that they  could benefit more from the report if information sharing between GAO  and FEMA had been reciprocal.  We believe that we employed such an  arrangement throughout this engagement. We regularly briefed DHS and  FEMA concerning the progress of the audit.  For example, we notified  FEMA management immediately after we detected that duplicate EA  payments were made to individuals who had received debit cards, and  worked closely with FEMA’s Disaster Finance Center to resolve other  issues related to payments that appeared to exceed the $26,200 limit for  specific recipients.
DHS and FEMA also expressed concern over the objectivity and fairness of  our report.  Specifically, DHS and FEMA noted that our selection of 248  registrations was not a representative sample and was geared specifically  toward identifying and reporting on registrations that had problems.  Our  testimony clearly states that the case studies we used were intended to  demonstrate the type of fraud and abuse that occurred because of weak or  nonexistent controls over the registration process and did not represent a  statistical sample of registrations.  The primary findings of our work relate  to weak or nonexistent controls that leave the government vulnerable to  substantial fraud and abuse in the IHP.  Furthermore, as represented at the  February 13, 2006, hearing, we are continuing our work in this area.   Specifically, we have taken a statistical sample of IHP payments so that we  can statistically estimate the magnitude of improper and potentially  fraudulent claims.  We have nearly completed this work and plan to report  our findings later this month.
FEMA and DHS also found problems with our assertion that EA payments  were the gateway to future IHP payments.  Specifically, FEMA and DHS  noted that future IHP payments are subjected to additional scrutiny.  We  did not test this additional scrutiny as part of our February 13, 2006,  testimony.  However, we continue to believe that accepting registrations for  individuals using invalid identity and damaged property information  subjects the federal government to a high risk of fraud and abuse beyond  EA payments.  We believe that our ongoing audit and investigative work  sheds further light on whether the additional scrutiny that FEMA asserts  does in fact prevent fraudulent and improper payments related to rental  assistance and other covered losses.
FEMA and DHS further noted that we made several references to isolated  incidents where debit cards were used for purchases that did not appear to  be for disaster needs, and FEMA questioned whether highlighting those  examples was appropriate.  We specifically noted in each reference to  these purchases that they were isolated and were not representative of the  general breakdown of known debit card usage.  We also clearly stated that  over 60 percent of debit card transactions were used to obtain cash and  could not be tracked further to identify the final use of the IHP funds.  We  identified the non-disaster-related purchases to highlight the fact that  FEMA did not provide any instruction to debit card recipients on the  appropriate use of IHP funds.
With regard to specific recommendations, FEMA and DHS concurred fully  that FEMA (1) improve procedures to review registrations containing the  same SSNs and other duplicate information; (2) subject all registration  addresses to verification during the registration process; (3) explore  entering into agreements with other agencies, such as the Social Security  Administration, to periodically authenticate IHP information; and (4) issue  proper instructions to any future debit card recipients.  FEMA and DHS  stated that they have already taken actions to address these  recommendations.  These actions include instituting an Internet  application process that will prevent all duplicate registrations from the  Internet, implementing procedures so that call centers will no longer  accept duplicate registrations with the same SSN in the same disaster, and  conducting conference calls and conducting data sharing tests with SSA.   In addition, DHS and FEMA stated that, starting in June 2006, all  registration addresses (even phone-in) will be subjected to an online  verification during the registration process.  While these are steps in the  right direction, we will follow up on whether the actions taken fully  address our recommendations.
FEMA and DHS partially concurred with our recommendation concerning  duplicate payments.  FEMA and DHS took exception with our  categorization of some payments as being potential duplicates, and with  our assessment that they should initiate actions to collect duplicate EA  payments or offset these amounts in the future, stating that it was unclear  whether some of the of the payments were in fact valid due to the  “separated households” policy instituted for hurricanes Katrina and Rita.   With respect to duplicate registrations, we maintain that these registrations  are very likely duplicates because the payments were made to several  individuals with the same last names, same damaged addresses, and the  same current addresses; FEMA’s own database clearly indicates that these  were not separated households.  For all our case study examples, we  conducted further investigative work to confirm that the payments were  made to actual duplicates, not covered by the separated household policy,  and were therefore improper payments.
As for initiating actions to collect duplicate payments, DHS and FEMA  stated that they had processed for recoupment nearly all the payments they  believed were duplicates as of April 1, 2006.  While we have not assessed  the effectiveness of FEMA’s recoupment process, we continue to believe  that FEMA should attempt to recoup as many dollars of improper payments  as possible, including those duplicate payments that we identified that  FEMA questioned.
FEMA also stated that many of what we identified as duplicate payments  effectively will be offset because the registrant will ultimately be eligible  for more than the amount of the duplicate payments, up to a maximum of  $26,200 that a single household can receive.  We believe that FEMA’s  position is shortsighted because it does not reflect the likelihood that some  individuals are not entitled to, and will not receive, additional funds  regardless of the cap limitations.  Thus, FEMA should not use $26,200 as  the aggregate dollar test.  Rather, FEMA should follow its own policy of  limiting EA to $2,000; adhere to the statutory caps that are allowed for  specific categories of aid; and promptly recover the amounts that exceed  the category limits.  Therefore, we continue to believe that FEMA should  review all the registrations we identified as potential duplicates to access  whether collection is necessary.
We also disagree with FEMA’s statement that its “management was keenly  aware” that a recipient could receive more than one EA payment, and that  it knowingly issued these duplicate payments partly because individuals in  shelters did not have access to their banking institution (and thus their EA  payments) and therefore were in need of immediate assistance in the form  of debit cards.  While we recognize that providing individuals access to  immediate funds was a priority following the hurricanes, FEMA’s data and  its representations made to us months ago do not support its claim that it  knowingly made those payments.  For example, when we questioned the  official responsible for managing FEMA’s national disaster assistance  processing center about the more than duplicate 5,000 EA payments to  individuals who had already received debit cards, he told us that he was  unaware of the magnitude of the duplicate payments.  After researching the  issue, he informed us that the duplicate payments in question were made as  a result of a “system glitch” and not as a result of a deliberate action on the  part of FEMA management.  In addition, the more than 5,000 duplicate  payments in question were all made within the span of several hours  roughly a week after FEMA completed issuing all the debit cards. An  analysis of the more than 5,000 duplicate payments indicates that there was  no apparent reason why only about half of the roughly 10,000 debit card  recipients received the duplicate payments.  Using FEMA’s rationale, all  10,000 registrants who received a debit card should have received a  duplicate EA payment.
FEMA and DHS partially concurred with our recommendation to establish  identity verification processes for IHP registrants applying via the phone  and Internet.  FEMA and DHS stated that they had implemented identity  proofing on call center applications.  As noted in our report, FEMA  instituted identity proofing for Internet registrants at the time of the two  hurricanes, and FEMA and DHS response to our report indicates that  FEMA instituted identity proofing for call center registrants.  In future  work, we will follow up on whether these actions fully address our  recommendations. FEMA and DHS additionally commented that they did  not see the necessity of requiring registrants to also provide their name  exactly as it appears on their Social Security Card, noting that their data  contractor is able to use logic to find aliases and nicknames. While we do  not object to FEMA collecting the nicknames or aliases of registrants  applying for disaster assistance, we continue to believe that registrants  should be instructed to provide their name as it appears on their Social  Security Card to prevent name and social security mismatches.  Instructing  registrants to provide the name that appears on their Social Security Card  can only help—not hinder—the registrant verification process.
FEMA and DHS’s responses indicate that they are attempting to address  some of the systemic problems we identified in the IHP program.  Going  forward it will be important for FEMA to establish effective controls to  prevent fraudulent and improper payments before they occur, because  fraud prevention is a far more effective control than detecting improper  and potentially fraudulent payments after they are made.  Our experience  with organizations that rely on a process that attempts to detect improper  and potentially fraudulent payments after they are made is that the  organization recovers only a fraction of the payments that should not have  been made.
We are sending copies of this report to the Secretary of the Department of  Homeland Security, and the Director of Federal Emergency Management  Agency. We will make copies available to others upon request. In addition,  the report will be available at no charge on the GAO Web site at  http://www.gao.gov. Please contact me at (202) 512-7455 or kutzg@gao.gov  if you or your staffs have any questions concerning this report. Contact  points for our Offices of Congressional Relations and Public Affairs may be  found on the last page of this report.
section_title: Testimony on FEMA’s Control Weaknesses over Expedited Assistance for Victims of Hurricanes Katrina and Rita
subsections: section_title: Highlights
paragraphs: A  result of wdespred congressinaanpubinterein  the federl respnse to hrranKtrina anRi, GAO cocted an aut of the Iua and Household Prom (IHP) under Comtroller Geerl of the United Ste tory authory.
We deed signiant fl in the rocess for registeringisaster vcttht leve the federovermet verable to frauanabuse of EA  paymes.  For Iteret appns, lted automted cotrol were in pce to ver  registran’s dey. However, we founindedet  ver of the de of registran who registered for disaster assisance over the teleho. To demonstrte the verabi inherein the cll-in appns, we used fsied de, gus ddress, and  fabted disaster tor to register for IHP. Below is  copy of oe of the  $2,000 check tht we receved to dte for ogus telehoappns.
Hrran Ktrina anRidetroed homes and dispced mllns of inuas. I the wke  of thenal disaster, FEMA fced the chllenge of roving assisance quickl and wth mini“red tape,” whle hing sufft cotrol to rovde assuance thef were paid oto eligible inuas and households. I respnse to this chllenge, FEMA rovded $2,000 in IHP paymeto ffected householdia  Expedted Assisance (EA) ro. Vctwho receved EA mayua for up  to $26,200 in IHP assisance. A of  md-Decemer 200, IHP paymetotled abt $5.bill, wth $2.bill rovded in the form of EA.  Thepayme were mde via check, electronic fund transfer,  an ll nuer of debit crds.
We o found tht FEMA’s automted system freqtl deed oteiall fraulet registrns, such asltiple registrnsth  deociaec nuer (SSN) but dffereddresss. However, the manuarocess used to revew thee registrnsot revet EA and other payme from ing issued. Other cotrol wess inclde the lck of any of daged roert ddress for oth Iteret  and telehoe registrns.
GAO’s temonyll rovde the result to dte relted to whether (1) cotrol re in ce and oering effectvel to lt EA to  quaed appan, (2) inns xist of frauanabusin the appfor and receipt of EA  and other payme, and (3) cotrol re in ce and oering effectvel over debit crd to revet dupte EA  payme anroer usag.
Gve the wek or xistet cotrol, is ot suising tht or dining aninveigans to dte how the oteial for subsanial frauanabuse of EA. Thousan of registranisused SSN, i.., used SSN  tht were ever issued or elonged to deceased or other inuas. Or  cas inveigans of everl hundred registrns inte signiant misuse of SSN and the use of gusaged roert  ddresss. For exale, or visi to over 200 of the casaged  roert in Texas and Louisiana howed tht least 80 of theroert  were gus—inclingant lot anxisteapartmes. www..gov/cg-bin/getrpt?GAO-06-403T.
To vew the fll prodct, nclng the cope  nd methodology, clck on the lnk above. For more nformon, contct Gregory Ktz t  (202) 512-7455 or ktzg@g.gov.
We found tht FEMA o mde dupte EA payme to ab,000 of the  rl 11,000 debit crd recipi—oce through the distribu of debit  crd anagain by check or electronic fun transfer. We found tht whle  debit crd were used redominantl to oainash, food, clothing, anernaecessi,  ll nuer were used for lt etertainmet, baiervce and weapns purchase, whch do ot appr to tem or  ervcethre essial to saisisaster relted essiaeeds.
Cairman and Memer of the Commttee:  Than for the opportuni to disussr onging forensiauand  relted inveigans of assisance rovded to inua and householdrelted to hrran Ktrina anRia. The Iua and HouseholdProm (IHP), ajor comt of the federl disaster respnse effortabished under the Rert T. Sfford Disaster Relef and EmerAssisance Act (Sfford Act), is designed to rovde finaniaassisance  to inua and household who, as rect result of ajor disaster,  hve ecessaxpns anerus eed tht cannot e met through  other means. A of md-Decemer 200, the Federl Emer  Managemet A (FEMA) hd distributed rl $5.bill in IHP  assisance o more thanll registrns. Hrran Ktrina anRi detroed home and dispced inua cross the gulf coast  regin. I the wke of thee massive nal disaster, FEMA fced the formable chllenge of roving t leasome iniiaassisance to over ll registranuicklth mini“red tape,” whle hing sufft  cotrol in ce to rovde assuance thef were paid o to  eligible inua and households.
Disaster relef covered by IHP inclde temor housing assisance, reanernaroert repaiand recemet, and other ecessaxpns relted to isaster. IHP assisance is erll delvered fter an inspectas ee cocted to ver the etet of loss and  determine eligibiy. Because of the tremedous devasaused byrran Ktrina anRi, FEMA ctted expedted assisance to  rovde fast trck mo—in the form of $2,000 inxpedted assisance payme—to eligible disaster vct to helth mmediate, emer  eed of food, helter, clothing, anernaecessis. This ft  respnse wasin helpingct of hrran Ktrina anRia.  FEMA speced tht expedted assisance payme were to rovded  o to inua and household who, as  result of hrran Ktrina  anRi, were dispced from theredisaster  residece anPub. L. 93-288, 88 S. 143 (1974) (meded 2000). ted assisance rocess is ot specll authorzed in the Sfford Act. However, FEMA revusas asserted, and we hve agreed, tht has legaauthor  under the ct to lemet expedted, or fast trck, rocedres. Disster Assistance: Gidance Needed for FEMA’s “Fst Tr” Hosig Assistance Process, GAO-RCED-98-1 (Wasingto, D.C.: Oct. 1997). were in eed of helter. Typill  householdan receve oxpedted assisance payme. Ecens re mde in siuans where  household memer re dispced to pate locns, in whch case  more thane memer of the household may e eligible for paymes.  FEMA rovded expedted assisance payme relted to hrranKtrina anRi redominantl through electronic fun transfer (EFT)  and check t to the registrans’rreddresss. I dd, FEMA  rovded ted mount of expedted assisance via debit crdistributed t three locns in Texas.
A of md-Decemer 200 howed tht the agd  delvered 44 ercet ($2.) of the $5. in IHP aid through  expedted assisance to hrran Ktrina anRi registran cross t  least 17 coun in 4 dfferetes. Almot $1.bill wet to  inuath daged ddress in Louisiana, more than $400 mll  to inua in Texas, and over $300 mll to inua in Alabaa and Mississippi. Rgistran determined to e eligible for expedted  assisance may e eligible to receve ddnal IHP payme up to  the overll IHP cap of $26,200.
Or crreauaninveiga is ing erformed under the tor  author give to the Comtroller Geerl of the United Stes. Oauaninveiga is cocted under the remise tht whle the federovermeeed to rovde ft and compassinate assisance to the vct of nal disaster, pubc codece in an effectve disaster relef rom tht tke ll ssible teps to minize fraud, waste, anabuseed to reerved. Today, we wll summze the result from  or onging forensiauand relted inveigans of the IHP ro.
The Act’s lemeing reguns defin household as ll erns (incling lt and chldre) who lved in the redisaster residece, as well as any other erns ot ret the tme but who re expected to reting the assisance erod.C.F.R. §..
Curreddress refer to the ddress t whch the disaster vctisrretl resiing.  Daged ddress re the ddress whch were ffected by the hrrans.
The debit crd rois  pilot rolemeted  to rovde expedted assisance to inua and householdhoused t three Texas helters. The debit crd, whch reemle credt crd anr the MasterCard loo, can used t ATM anany commercial otlet thcce MasterCard.  re o releasing today the result of or lted inveiga into llegans tht  M Me, R-To-Et rns inteded for usin the hrrane relef effort were  insteold to the pubc o the Iteret auct site eBay. See GAO, Ivestigtion: Militry Mels, Redy-To-Et Sold o eB, GAO-06-410R (Wasingto, D.C.: Feb. 13,  2006).
This temonyll rovde the resultof or work relted to whether (1)  cotrol re in ce and oering effectvel to lt expedted assisance to quaed registran, (2) innsxist of frauanabusin the  registr for and receipt of expedted assisance and other payme,  and (3) cotrol re in ce and oering effectvel over debit crd to  revet dupte payme anroer usag. We an to issu  detailed reort wth recommens the result of oau.
Thusr, or work has focused  the IHP registr rocess  ecausinua whoe registrns re approved hve ccess to  expedted assisance payme ansubseqtl the fll range of IHP  efs. To assss the design of cotrol, we erformed wlkthroug of  FEMA’s rocess for cceing registrns anrdingxpedted assisance funs. To determine whether innsxisted of frauanabusinxpedted assisance and other disbueme, we rovded  FEMA d to the SociaSec Administr (SSA) to ver against  ther record of vociaecy nuer (SSN), and revewed the  FEMA dabase of IHP registrns for other anom usingining technis. To determine whether registrns resulted in oteiall  fraulet or roer payme, we elected  rereve elect of 248 registrns from or dining result for frther  inveigans. The 248 registrns rereted 20 cas—ome  involvingltiple registran—tht we linked toether througdename, SSN, daged ddress and/or crreddresss. Oanaysis  of oteiall frauleuse of SSN and other dining effort re  onging, and we an to reort o ddnal result in the fre. For  pu of this temony, we dot coct sufft work to roect the magnide of oteiall frauleanroer IHP paymes. We  roctvel teted the dequa of cotrol over the registrn process for disaster assisance by subtting clai for relef usingsied de, gus ddress, and fabted disaster tors. Thee  te were erformed efore FEMA rovded us any inform relted to the rocess used to cree IHP registrns anreclde ome fraulet registrns. Addnal detaicoand methodologi re inclded in appix I. we reqted has ot ee rovded. O Janua 18, 2006, the Departmeof HomelanSec (DHS) Offce of GeerCunsel drovde usth well less thanlf of the docme tht were reqted. Whle the  dabasand other d rovded by FEMA enabled us to design procedre to tet the effectvess of FEMA’s system of internal cotrol, t dot enable us to fll determine the root caus of wek or - existet cotrol and formte detailed recommens. For exale,  asll e disussed lter, FEMA and the DHSot rovded us  docme to enable us to coclusivel determine the reas tht  FEMA subtted ome registrns, and dot subt other  registrns, to den por to issuingxpedted assisance paymes.
We cocted oauaninveigans from Octoer 200 through  Janua. Ecet for retrctnsisussed revus relted to the lns tht DHS ced o the coe oaut work, we cocted oaut work in ccordance wth erll cceted overmeauing anrd and cocted inveigave work in ccordance wth  the anrd recribed by the Preside’s Cunl o Ite and  Effy. Or finings today focus  the result to dte from  of or dining aninveigave technis.
subsections: section_title: FEMA’s Controls to Prevent Potentially Fraudulent Payments Were Not Effective
paragraphs: We found wek or xistet cotrols in the rocess tht FEMA used to revew disaster registrns anapprove assisance payme tht leve the federovermet verable to frauanabus. I the crftermth of hrran Ktrina anRi, FEMA moved ftl to  distribute expedted assisance payme to llow disaster vct to  migate and overcome the effect of the disasters. I this cotet, the  eabishmet of an effectve cotrol eromet was  signiant  chlleng. Specll, we found tht FEMA hlemeted ome  cotrol or to the disaster to rovde automted v of the  de of registran who apped for assisance via the Iteret. Or  work thusinte tht this resulted in FEMA reecting ome registran who rovded name anSSN tht dot pass the vte. However, FEMA dot lemet the same reveve cotrol for thoe who apped via the teleho. Ouse of fctus name, gus  ddress, and fabted disaster tor to oainxpedted assisance  der the Act’s lemeing reguns, FEMA may recover fun tht determin  were rovded erroeous, tht were spinapproiatel, or were oained through fraulet means.C.F.R. § .116 () payme from FEMA demonstrted the ease wth whch expedted assisance cold e oained by rovinginform over the  teleho. Because expedted assisance is  gateway to frther IHP  payme (up to $26,200 er registr), approvl for expedted assisance payme oteiallxp FEMA, and the federovermet, to more frauanabuse relted to temor housing, home  repaiand recemet, and other eed assisance.
subsections: section_title: Pressure to Swiftly Deliver Aid Led to Approval of Expedited Assistance Payments with Minimal Verification
paragraphs: Ding the coe of oauaninveiga, FEMA offia ted  tht theot ver whether registraninsuance and whether registran were unable to lve in ther home or to approvingxpedted  assisance paymes. According to FEMA offia, the unprecedeted  le of the two disaster and the eed to move quickl to migate thepact led FEMA to lemet expedted assisance. Expedted assisance dffer from the trnal way of delveringisaster assisance  in tht cll for FEMA to rovde assisance wthot requiing roof of  loss and verying the etet of such losss. Cnseqtl, FEMA  lemeted lted cotrol to ver eligibi for the iniial expedted assisance paymes. According to FEMA offia, thee cotrol were  retrcted to determining whether the daged residece was in the  disaster re and lted vof the deof registran who used  the Iteret. Rgistran who FEMA thought met thee quans based o ther lted assssme were deemed eligible for expedted assisance.
section_title: FEMA Did Not Validate Identity of Registrants Who Applied for Assistance via Telephone
paragraphs: FEMA lemeted dffererocedre whe rocessingisaster  registrns subtted via the Iteret and telehoe clls. Of the more  than.5ll registrns recorded in FEMA’sabase, i..,  registrns tht were successll recorded—60 ercet (more than.5 ll) were eemt from any de ver ecause the were  subtted via the teleho. Pror to ingt expedted assisance  payme, FEMA dot hve rocedre in ce for Iteret or  telehoe registrns thcreeed ot registrns where the lleed daged ddressas  gus ddress. The lck of de ver for telehoe registrns anany ddressxped the overmet to frauanabuse of the IHP ro. aiing the Iteret, the FEMA cotrctor took teps to ver  registrans’ des. The ver teps involved corming tht the SSN mtched wth  SSN in pubc record, tht the name anSSN  combinatched wth an de registered in pubc record, and  tht the SSN was ot associated wth  deceased inua. The FEMA  cotrctor was respnsible for locking any registrns for whch any of thee three consas ot met. Addnall, registran who passed the fgate hd to rovde answer to  nuer of qns aimed t  frther corrooring the registrans’ des. Rgistran who were  reected via the Iteret were dvised to coct FEMA via teleho. Oauaninveigave work inted tht this vern process heled  deter ous fraulet Iteret registrns usingname anSSNs. However, FEMA keo record of the name, SSN, and other  inform relted to the reected registrns, ano record of the  reasns tht the FEMA cotrctor locked the registr from ing  forwrd. FEMA ckowleded tht was coceable thinuawho were reected ecause of finform subtted via the Iteret cold et expedted assisance payme by roving the same finform over the teleho.
Although the de ver rocess appred to hve worked for  mot Iteret registrns, t dot de  ll nuer of  registrnsth inSSNs. According to inform we receved from the SSA, rl 60 Iteret registran who receved FEMA payme  rovded SSN tht were ever issued or elonged to inua who were  deceased or to the hrrans. Rsult inte tht theinuaayve passed the ver rocess ecauspubc record used to  ver registrans’ de were flwed. For exale, oe credt histor  we oained inted th registrant hd eabished  credt histor  using an inSSN. verfor telehoe registrns sir to thoused for the  Iteret. FEMA o rereted to us tht de to buet constrain another considerns, the change was ot lemeted inme to respd to hrran Ktrina anRia. However, to dte we hve ot receved docme to vte thee rerens.
subsections: section_title: Ctrol Wess Enabled GAO to Oain $2,000 Expedted Assisance Check
paragraphs: The lck of de ver of hoe registran or to disbusingunke FEMA verable to authoringxpedted assisance  payme based o frauleinform subtted by registrans. Pror  to oaining inform the cotrol rocedre FEMA used to  authorze expedted assisance payme, we teted the cotrol by  tteming to register for disaster relef through two orts: (1) the  Iteret via FEMA’s We site and (2) telehoe cll to FEMA. For oth  ort, we teted FEMA’s cotrol by rovingsied de angus ddresss. I ll insance, FEMA’s We site dot llow us to  successllinaze or registrns. Insted, the We site inted tht there were rolemth or registrns andvised us to coct the FEMA toll-free nuer f we thought tht we were eligible for assisance.  This is consistet wth FEMA’s rere tht Iteret registrns were compared against thrd-part inform to ver des.
Oinveigave work o cormed tht the lck of sir cotrol  over telehoe registrnsxped FEMA to frauanabus. Specll, in insance where we subtted via the telehoe the same  exact inform tht hee reected o the Iteret, i.., fsied  de angus ddress, the informas cceted as. Subseqtl, the clai were rocessed and $2,000 expedted assisance  check were issued. Figure 1 rovde anxale of anxpedted assisance check rovded to GAO. rovde assuance tht the disaster ddressas ot  gus ddress, ther for Iteret or telehoe registrns.
FEMA’s cotrolailed to revet thousan of registrnsth  dupte inform from ing rocessed anpai. Or work inte  tht FEMA insted lted automted checkthin NEMIS to de  registrns coaining upte inform, e.g., mltiple registrns th the same SSN, dupte daged ddress telehonuer, and  dupte bank roing nuers. D FEMA rovded enabled us to  corm tht NEMIS deed rl900,000 registrns—ot of 2.5ll totl registrns—as oteial duptes. FEMA offiarther  rereted to us tht the registrns deed asupte by the  system were “frozen” from frther payme unddnal revew cold e cocted. The pue of the ddnal revewas to determine whether the registrns were tre dupte, and therefore paymes shold coinue to e denied, or whether innsxisted tht the  registrns were ot tre dupte, and therefore FEMA hold mke  thopaymes. It appred from FEMA d tht the automted check  and the subseqt revew rocess reveted hundred of thousan of  payme from ingde oupte registrns. However, FEMA  d and or cas inveigans inte tht the ddnal revew rocessas ot erel effectve ecausllowed paymes based oupte informn.
We o found tht FEMA dot lemet effectve cotrol for  telehoand Iteret registrns to ver tht the ddress claimed by  registran as ther daged ddressxisted. All e disussed frther  elow, many of or cas of oteial frauhow thpayme  were receved based o claide lising gusaged ddresss. Oundercover work o corroorted tht FEMA rovded expedted  assisance to registranth gus ddresss.
section_title: Potentially Fraudulent Activities Resulting from Weak or Nonexistent FEMA IHP Controls
paragraphs: thousan of doll of IHP payme based o frauleand dupte  informn. Thee cas re ot isolted insance of frauanabus. Rather, or dining result to dte inte tht the re  llustrve of the wder internal cotrol wess t FEMA—cotrol wess tht led to thousan of paymede to inua who  rovded FEMA wth incorrect inform, e.g., incorrect SSN angus address, and thousan more mde to inua who subtted  mltiple registrns for paymes.
subsections: section_title: Case Study Examples Show That Control Weaknesses Have Been Exploited
paragraphs: Oau aninveigans of 20 cas demonstrte tht the wek or xistet cotrol over the registr anpaymerocessve  oed the door to roer payme aninua eeking to oain IHP payme through fraulet means. Specll, ajor of or  cas registrns—16 of 248—coained SSN tht were ever issued or elonged to deceased or other inuas. At 20 of the 248 registrns we revewed were subtted via the Iteret. Frther, of the  over 200 lleed daged ddress tht we tred to visit, abt 80 dot exis. Some were vant lot, othered ot to gus apartmebuildings anunis. Because the hrrand detroed many home,  we were unable to corm whether abt 1 ddnaddressd  ever existed. We deed other fraucheme unrelted to the weanxistet v anrepaymet cotrol revusisussed,  such as registran who subtted registrns usingddress tht  were ot ther resideces.
I totl, the cas registran of whom we cocted inveigans ve collected hundred of thousan of doll in payme based o  oteiall fraulects. Thepayme inclde mo for  expedted assisance, reassisance, and other IHP paymes. Frther,  asr work roress, we re uncovering evdece of ler cheme  involvingltiple registran thre inteded to defraud FEMA. We  found thecheme ecause the registran red the same lasname,  crreddress, and/or daged ddress—ome of whch we were  able to corm dot exis. Whle the fct surrouning the cas  rovded usth intor thoteial fraud mayve een peretrted, frther teing aninveigans eed to e cocted to  determine whether theinua were intenall trying to defrauus intor such as dename, SSN, daged ddress, and  crreddress to link mltiple registrns toether into the 20 cass. the overmet or whether the discrepan aninacc were the  result of other errors. Cnseqtl, we re coctingrther inveigans into thee cass. Table 1 highlight 10 of the 20 cas we deed through dining tht we inveigated. I dd, ome inua in the casted elow subtted ddnal registrns but hot receved payme as of md Decemer 2005.
Bogus Properties Used to Receive At least 10  Seventeen ndua receved pyment on 36 registronusing 34 SSN tht were not thes.
Of the 17 ddress we visited, 13 were from the same  rtment buildng, of whch 6 dd not exis.   ddonddress were nv.
Pyment nclded 31 expedted assisnce pyment totng $62,000, nd 18 n other pyment, nclng rentl pyments.
At least 8  One ndual receved pyment on 15 dfferent SSN—only one of whch elonged to tht peron.
Inveve work howed tht 3 ddress were vbut were not ddress of the registrnt.
Pyment nclded 13 expedted assisnce pyment totng $26,000 nd $15,000 n other assisnce, nclng housing.
The ndual my hve commtted bank frauusing nvSSN to open ccont.
The ndual hd eabished credusing 2 SSN tht dd not  elong to the ndua.
None  One ndual receved 8 expedted assisnce pyment using  the same nme, SSN, nd crrent ddress.
Of the 8 ddress declred asged, two ppered to  elong to the ndua.
FEMA’ automted ed dented t least 7 registron as  plte, neverthelessyment were issued.
At least 14  Two ndua receved expedted assisnce pyment on 23  SSN – 21 of whch were not thes.
Pubc records indte tht the nduad not lve ny of  the 9 vddresss.
Pyment nclded 22 expedted assisnce pyment nd 1 housing assisnce pyment.
subsections: section_title: Number of Registrations with Payments/ SSNs
paragraphs: Bogus Properties Used to Receive At least 10   Sinduareceved 38 pyment on dfferent SSN—only 1  of whch was trced back to them.
Pyment nclded 37 expedted assisnce pyment totng $74,000 nd over $2,000 n other assisnce.
Indual receved 18 expedted assisnce pyment using the  same nme nd 18 dfferent SSN—only 1 of whch elonged to  the peron.
Inveve work nd pubc record ndte tht the  ndual hd never lved ny of the 6 remaing vddresss.
At least 22  A grop of 8 ndua receved pyment on 31 registronusing 26 SSN tht dd not elong to them.   22 of the registron were for ddress tht dd not exis. The remaing ddress were not vted.
Pyment nclde 32 pyment for expedted assisnce nd over $28,000 for other assisnce nclng housing assisnce.
None  Sipprent memer of the same household registered 6  me using the same dged ddresss.
Fve of the 6 nduas ared the same crrent ddress.
Pyment nclded 5 expedted assisnce pyment nd $13,000 n other pyment nclng housing assisnce.
None  Seven pprent memer of the same household receved yment using the same dged ddress.
One fly memer used  SSN tht dd not elong to the  ly memer.
Six of the 7 ndua red the same crrent ddress.
Pyment nclded 7 pyment for expedted assisnce.
None  Seven pprent memer of the same household registered using the same dged ddress.
Pyment nclded 6 expedted assisnce pyment nd $68,000 n other assisnce.
Amont reflecttotl pyment for IHP, whch nclde expedted assisnce, temporry housing assisnce, pyment for repaind replcement of rend peronl property, nd pyment for other needs such as medl, trporton, nd other necessis.
One ddress cold associated wth mltple registrons.
The following rovde llustrve detailed inform everl of the ass.
Casnuer 1 involveinua, everl of whom hd the same lasname, who subtted t least 36 registrns claiing to e disaster vct of oth Ktrina anRia. All 36 registrns were subtted  through the telehoe, using 36 dffereSSN and 4 dfferet crreddresss. Theinua used ther ow SSN 2 of the registrns,  but the remainingSSN were ever issued or elonged to deceased or  other inuas. The inua receved over $103,000 in IHP payme,  incling $62,000 inxpedted payme and $41,000 in payme for  other assisance, incling temor housing assisance.  Oanaysis  how tht the inua claimed 13 dfferet daged ddressthin   single apartmebuilding, and 4 other ddressthin the same lock  in Louisiana. However, oysiinspect of theddress reveled  tht 10 of the ddress were gus ddresss. Frther auaninveigave work how tht theinuaay ot hve lved any of the vd disaster ddress t the tme of hrran Ktrina anRia. We re cocting addnainveigans  thisas.
Casnuer 2 involve an inual who used 1ffereSSN—oe of  whch was the inua’s ow—to subt least 1 registrns over  the teleho. The inual claimed fferet daged ddress ll  1 registrns, anused 3 dfferet crreddress—incling  t offce , where the inual receved paymes. The inual receved 16 payme toting over $41,000 o of the registrns. I  ll, the inual receved 13 expedted assisance payme, 2 temor  housing assisance payme, ananother paymet of $10,. Frther  inveigave work discloed tht the inual mayve commtted bank  frauby using SSN to o  banccoun. Other pubcl  aiable record inte tht the inual hused 2 SSN tht were  issued to other eole to eabish credt histors. thee registrns as oteial duptes. I spite of the edt flags, FEMA  clered the registrns for roer expedted assisance paymes.
Casnuer 4 involveinua who appr to e ling toether the same crreddress in Texas. Thee 2 inua receved paymefor 23 registrns subtted over the telehousing 23 dffereSSN— two of whch elonged to them—to oain more than $46,000 inisaster  assisance. The inform the registran rovded relted to many of the disaster ddress appred f. The ddressther dot exist, or  there was roof the inuad ever lved t theddresss.
Casnuer 8 relte to 6 registranth the same lasname who  registered for disaster assisance using the same daged ddress, wth   of the 6 using the same crreddress. FEMA crteria spec thinuawho reside toether t the same ddress and who re dispced  to the same ddress re etled to oe expedted assisance payme. However, ll 6 ssible f memer receved 12 payme toting  over $23,000—$10,000 inxpedted assisance and more than $13,000 in other assisance, incling reassisance.
section_title: Data Mining Indicates Potential Fraud and Abuse Beyond Our Case Studies
paragraphs: The cas we deed and reorted re ot isolted insance of  oteial frauanabus. Rather, or dining result how tht the  re inve of frauanabusd thee cas, anint  drectl to the wess in cotrol tht we hve deed. The  wess deed through dining inclde ineffectve cotrol to detect (1) SSN tht were ever issued or elonged to deceased or other  inua, (2) SSN used more thance, and (3) other dupte  informn.
subsections: section_title: Misuse of SociaSec Ner Rgistrns
paragraphs: tch wth the name rovded o the registrns. A revus  isussed, frther teing aninveigans eed to e cocted to  determine whether this inual was intenall trying to defraud the  overmet or whether the discrepan aninaccwere the  result of other errors.
section_title: Same SociaSec NerUed o Mltiple Rgistrns
paragraphs: Or dining and cas clerl how tht FEMA’s cotrol do  ot reveinua from mingltiple IHP registrns using the  same SSN. We found thousan of SSN tht were used o more thane  registr associated wth the same disaster. Becausan inual can receve disaster relef ois or her  residece an SSN is   uninuer assigned to an inual, the same SSN hold ot used to receve assisance for the same disaster. This rolem is llustrted inase 3 above, where an inual registered for IHP 8 tme using the  same name, same SSN, ansame crreddress—and thus cold hve  quaed for o 1 expedted assisance payme—buinsted receved expedted assisance payme of $2,000 for 8 dfferet registrns.
section_title: Mltiple Payme Mde to DffereRgistrns Caining the Same Ke Iform
paragraphs: Or dining and cas how tht the IHP cotrol to  revet dupte paymeot revet FEMA from ming paymeto tens of thousan of dfferet registran who used the same ke  registr informn. FEMA’s eligibi crteria spec thinuawho reside toether t the same ddress and who re dispced to the  same ddress re typilltled to oe expedted assisance payme. FEMA ol rovde for expedted assisance payme to  more thane memer of the household in unusual crcance, such  as whe  household wasispced to dfferet locns. However, oth  oinveigans and dining found thousan of insance where  FEMA mde more thanpaymet to the same household thred  the same lasname and daged and crreddresss. A llustrted inase 8,  of 6 inuath the same lasname, the same daged ddress, and the same crreddress receved mltiple expedted assisance payme, insted of just oe for whch theuaed. Whle  ot ll of the registrns thused the same ke inform were  subtted frauletl, ddnainveigans need to e cocted to  determine whether or ot the ere fastled to expedted and  other IHP assisance.
U.S.C. § 1001,  er who kowing and wllfllke anyterialle, fctus, or frauletemet or rere ll e fined or ised up to  , or oth.
Or dining o found tht FEMA mde dupte expedted assisance payme to tens of thousan of inua for the same  FEMA registr nuer. FEMA ol te tht registran hold  o receve oe expedted assisance payme. However, in ome cas,  FEMA paiasany as for $2,000 expedted assisance payme to the  same FEMA registr nuer. Aisussed lter, we o found tht  FEMA issued expedted assisance payme to more than ,000 registran who hlre receved debit crds. FEMA offia  rereted to us tht the trced ome of thee ousupte payme to  computer error thinadvertetlaused the dupte paymes. However, the rovded supporting docmen.
section_title: Controls over Debit Cards Were Ineffective in Preventing Duplicate Payments and Improper Use
paragraphs: I the days followingrrane Ktrina, FEMA expermeted wth the use  of debit crd to expedte payme of $2,000 to abt 11,000 disaster  vct t three Texas helter who, ccording to FEMA, hd dfflt  ccessing thebanccouns. Figure 2 is anxale of  FEMA debit  crd. helter were locted in Dllas, Housto, anSan Atoni.
The debit crd rom was an effectve means of distribuing relef  quickl to thoe moin eed. However, we found thecause FEMA dot vte the deof debit crd recipi who registered over the telehoe, ome inua who supped FEMA wth SSN tht dot  elong to them o receved debit crds. We o found tht cotrol over  the debit crd rom were ot effectvel designed anlemeted to  revet debit crd recipi from receingupte expedted assisance payme, oce through the debit crd anagain through check  or EFT. Finall, unke the guiance rovded to other IHP registran, t  the tme FEMA distributed the debit crd, FEMA dot rovde  instrctns informing them tht the fun ther crdusused for  approiate pus.
subsections: section_title: Debit Cards Issued to Individuals Providing Invalid Social Security Numbers
paragraphs: Aisussed revus, FEMA dot ver the de of inuas and/or household who subtted disaster registrns over the teleho. This wess occrred in the debit crd roas well.  FEMA required the comlet of isaster registr or to   household or inuaing able to receve  debit crd. According to  FEMA offia, registran t the three ceter apped for assisance via  the telehoand Iteret. Therefore, to the etet tht registrns for  the debit crd were tke over the telehoe, FEMA dot subject the  de of the registran to  ver rocess. Cnseqtl, we  deed 0 debit crd issued to registranising SSN tht the SSA ho record of issuing, and 12 crd issued to registran using SSN  elonging to deceased inuas. For exale, oe registranused an  inSSN to receve  $2,000 debit crd anused abt $00 of tht  mo to pay or trffc volns to reinste  drver’scens. I  another case,  registranused the SSN of an inual who ded into receve  $2,000 debit crd. FEMA subseqtl desited an ddna$7,in IHP payme to tht debit crd ccount for ddnal clai  subtted by thinua. This registrant wthdrew mot of the $9,4 desited into the debit crd ccounbyaining ATM cash wthdrs.
section_title: Thousands of Debit Card Recipients Received Multiple Expedited Assistance Payments
paragraphs: to ther home ddress or banccoun and therefore eeded mmediate assisance in the form of debit crds. Or revew of FEMA d  isproved FEMA’s elef tht o  few inua who receved debit crd o receved other disaster assisance paymes. Insted,  thousan, or rllf, of the inua who receved debit crd o  receved check or EFT tht were mde everl days fter the debit crdee issued. The result was tht FEMA paid more than $10 mll  doll inupte expedted assisance payme to inua who hlre receved ther $2,000 of expedted assisance.
I erl, oce FEMA receve isaster registr, FEMA    package coaining IHP inform and detailed instrctns, incling  instrctns how to follow up ef, how to appf denied ef, and the roer use of IHP paymes. However, FMS and FEMA  offia informed us tht FEMA dot specll rovde instrctns  how the debit crd hold o used for ecessaxpns anerus eed relted to the disaster t the same tme the debit crd  were distributed. We found thin isolted insance, debit crd were  used for lt etertainmet, to purchase weapns, and for purchas assagparlor tht hee revusaided by locolce for  ron.
Oanaysis of debit crd transact rovded by JP Morgan Case found tht the debit crd were used redominantl to oainash whch  dot llow us to determine how the moas ctuall used. The  major of the remaining transactnsas associated wth purchas of  food, clothing, anernaecessis. Figure 3 how  rekdow of  the typ of purchasde byrdholders.
section_title: Conclusions
paragraphs: FEMA has  subsanial chllengin baaning the eed to et mot  quickl to thoe who re ctuall in eed ansusaining pubc codece inisaster ro bying ll ssible teps to minize frauanabus. Based or work to dte, we eleve tht more can e doe to  revet fraud through v of de and dagddress and  eanced use of automted system ver inteded to revet fraulet disbuemes. Oce fraulet registrns re mde anmo isisbued, detecting anpusuing thoe who commtted frauin a comrehensive manner is more cotl and may ot result in recovers.  Frther, many of thoe frauletlregistered in the FEMA system  lre receved expedted assisance and wll lkel receve more mo,  asch registrant can receve asch as $26,200 er registrn.
Aother ke elemet to reveing frauin the fre is to ensure there  re conseqce for thoe tht commt frau. For the fraud cas tht we re inveigaing, we an to refer them to the Ktrina Fraud Task Force  for frther inveiga and, where approiate, roecn. We eleve throec of inua who hve oained disaster relef paymethrough fraulet meansll  message for fre disaster tht  there re conseqce for defrauing the overme.
MCairman and Memer of the Commttee, this coclde  teme.  I wold leased to answer anyns th or other  memer of the commttee mayve t thisme.
subsections: section_title: Contacts and Acknowledgements
paragraphs: For frther inform abt this temony, lease coct Greor D.  Ktz t (202) 12-74 or ktz@ga.gov.  Cct in for or Offce of  CngressinaRelns and Pubc Affaiay e found o the laspage  of this temony.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: To assss cotrol in ce over the Federl Emer ManagemeA (FEMA)’s Iua and Household Prom (IHP), we  intervewed FEMA offia anerformed wlkthroug t the Nnal  Processing Servce Cter in Wincheter, Va. We revewed the Sfford  Act, Pub. L. 93-288, the lemeing reguns, and FEMA’s instrctns  to disaster registran aiable via the Iteret. I dd, to roctveltet cotrol in ce, we apped for assisance usingsied de,  gus ddress, and fctusisaster tor to determinf IHP  payme cold e oained based o frauleinformn. Because of  everl key unanswered req for docme from the Departmet  of HomelanSec (DHS), inform eeded to fll assss the  expedted assisance rom wasted. For exale, FEMA and DHSot rovded us docme to enable us to coclusivel determine  the reas tht FEMA subtted ome registrns, and dot subt  other registrns, to de or to issuingxpedted  assisance paymes. Cnseqtl, or work wasted to oanaysis  of the FEMA dabas, inveigans we cocted, ddel  aiable to the pubc via the Iteret, aninform FEMA offia  orll rovded to us.
To determine the magnide and chcteris of IHP payme, we  oained the FEMA IHP dabasas of Decemer 2005. We vted tht the dabase was comlete and reliable by compaing the totl disbueme against reort FEMA rovded to the Snate Approians Commttee o Ktrina/Riisbuemes. We summzed the moun of IHP rovded byype of assisance anby loc of  disaster ddress. paymes. We deed insance where roups of registranay  ve ee involved in cheme to defraud FEMA. We found thecheme  ecause the registran rovded the same SSN, lasname, crreddress, and/or daged ddress ther registrns. Or mcro  anaysis of oteiall frauleuse of SSN and other dining re  onging, and we an to reort ddnal result re dte. For  pu of this temony, we dot coct sufft work to roect the magnide of oteiall frauleanroer payme of IHP. We  o visited over 200 of the claimed daged ddress relted to or cas to determine whether or ot the ddress were v.
To assss the typ of purchasde wth FEMA debit crdistributed  t relef ceter, we revewed abase of transactns rovded by JP  Morgan Case, the dministring bank for the debit crds. SSA assisted us to compare crdholder dth SSA record to determine  whether registran receing debit crdrovded vdes. We  erformed dining debit crd transactns to de purchas  tht dot appr to inve of ecessaxpns as defined by  the Sfford Act’s lemeing reguns. Finall, we vted specc transactns deed in the dabasbyaining inform ctuatem purchased from the vedors.
I the coe of or work, we mde numerous wrtte req for ke  docme anet of d relted to the IHP, mot ding back to  Octoer 2005. Whle FEMA offia romtl comed wth oe ke part of or reqt—this FEMA mde aiable dabas of IHP registran  anpayme—the major of tem reqted hve ot ee rovded.  O Janua 18, 2006, the Departmet of HomelanSec Offce of  GeerCunsel rovded usth well less thanlf of the docmetht were reqted. For exale, FEMA and the DHSot rovded us docme to enable us to coclusivel determine the reas tht  FEMA subtted ome registrns, and dot subt other  registrns, to den por to issuingxpedted assisance paymes. Whle the dabasand other d rovded by FEMA enabled  us to design rocedre to tet the effectvess of the FEMA’s system of  internal cotrol, t dot enable us to comrehensivel determine the  root caus of wek or -existet cotrols.
Octoer 200 through Januain ccordance wth erll cceted overmeauing anrd and qua anrd for inveigans as et forth by the Preside’s Cunl o Ite and Effy.
GAO-0-403T This is  work of the U.S. government nd is not subject to copyrght protecton n the  Unted Stes. It me reprodced nd distributed  entrety wthot frther permission from GAO. However, ecause this work my contain copyrghted ge or  other mterial, permission from the copyrght holder me necessary f yoish to  reprodce thisteriaeptely.
subsections: section_title: GAO’s Mission
paragraphs: The Govermet Accounabi Offce, the aut, evuan aninveigave rm of Cngress, exis to support Cngress in meeting   consnal respnsibi and to hel rove the erformance anccounabi of the federovermet for the Ameran eole. GAO  exain the use of pubc funs; evuate federro anols;  anrovde anays, recommens, and other assisance to help Cngresske informed oversight, ol, and funing decisins. GAO’s  commtmet to ood overmeis reflected in  core v of  ccounabi, inte, and reliabiy.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fasteand easit way to oain copi of GAO docme o cois through GAO’s We site (www.ga.gov). Ech weekday, GAO   ewl released reort, temony, and correspdece o  We site. To hve GAO e-mai ist of ewl ted rodct ever fteroo, o  to www.ga.gov anelect “Subscribe to Utes.”
subsections: section_title: Order by Mail or Phone
paragraphs: The ft copy of ech inted reort is free. Addnal copi re $2 ech. A check or mo order hold e mde ot to the Superintedet of  Docmes. GAO cce VISA and Mastercrd. Order for 100 or  more copiailed to  single ddress re discounted 2 erce. Order  hold t to:  U.S. Govermet Accounabi Offce 441 G Street NW, Room LM  Wasingto, D.C.
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Congressional Relations
paragraphs: Gloria Jrmo, Managing Drector, JrmoG@ga.gov (202) 12-4400 U.S. Govermet Accounabi Offce, 441 G Street NW, Room 712  Wasingto, D.C.
section_title: Public Affairs
paragraphs: Paul Ader, Managing Drector, AderP1@ga.gov (202) 12-4800 U.S. Govermet Accounabi Offce, 441 G Street NW, Room 7149 Wasingto, D.C.
section_title: Appendix II