Hurricanes Katrina and Rita Disaster Relief: Improper and Potentially Fraudulent Individual Assistance Payments Estimated to Be Between $600 Million and $1.4 Billion
Published: 2006-06-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Hurricanes Katrina and Rita destroyed homes and displaced millions of individuals. In the wake of these natural disasters, Federal Emergency Management Agency (FEMA) responded to the need to provide aid quickly through the Individuals and Households Program (IHP) program, which provides housing assistance, real and personal property assistance, and for other immediate, emergency needs. As of February 2006, FEMA made 2.6 million payments totaling over $6 billion. Our testimony today will (1) provide an estimate of improper and potentially fraudulent payments through February 2006 related to certain aspects of the disaster registrations, (2) identify whether improper and potentially fraudulent payments were made to registrants who were incarcerated at the time of the disaster, (3) identify whether FEMA improperly provided registrants with rental assistance payments at the same time it was paying for their lodging at hotels, and (4) review FEMA's accountability over debit cards and controls over proper debit card usage. To estimate the magnitude of IHP payments made on the basis of invalid registrations, we selected a random statistical sample of 250 payments made to hurricanes Katrina and Rita registrants as of February 2006. We also conducted data mining and investigations to further illustrate the effects of control breakdowns.
section_title: What GAO Found
paragraphs: We estimate that through February 2006, FEMA made about 16 percent or $1 billion in improper and potentially fraudulent payments to registrants who used invalid information to apply for disaster assistance. Based on our statistical sample, we are 95 percent confident that the range of improper and potentially fraudulent payments is from $600 million to $1.4 billion. In our assessment of whether a payment was improper and potentially fraudulent, we did not test for other evidence of impropriety or potential fraud, such as insurance fraud and bogus damage claims. This means our review potentially understates the magnitude of improper payments made. Examples of fraud and abuse include payments to registrants who used post office boxes, United Parcel Service stores, and cemeteries as their damaged property addresses. Absent proper verification, it is not surprising that FEMA continued to pay fictitious disaster registrations set up by GAO as part of our ongoing forensic audit. In one case, FEMA paid nearly $6,000 to our registrant who submitted a vacant lot as a damaged address. Below is a copy of a rental assistance check sent to GAO after FEMA received feedback from its inspector that the GAO undercover registrant did not live at the damaged address, and after a Small Business Administration inspector reported that the damaged property could not be found. We also found that FEMA provided expedited and housing assistance to individuals who were not displaced. For example, millions of dollars in expedited and housing assistance payments went to registrations containing the names and social security numbers of individuals incarcerated in federal and state prisons during the hurricanes. In addition, FEMA improperly paid individuals twice for their lodging--paying their hotels and rental assistance at the same time. For example, at the same time that FEMA paid $8,000 for an individual to stay in California hotels, this individual also received three rental assistance payments for both hurricane disasters. Finally, we found that FEMA could not establish that 750 debit cards worth $1.5 million went to hurricane Katrina victims. We also found debit cards that were used for a Caribbean vacation, professional football tickets, and adult entertainment.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss our ongoing forensic audit and  related investigations of disaster relief assistance provided to individuals  and households for hurricanes Katrina and Rita. In a hearing held in  February 2006 before the Senate Committee on Homeland Security and  Governmental Affairs to discuss results of ongoing work, we testified that  significant flaws in the process for registering disaster victims left the  federal government vulnerable to substantial fraud and abuse related to  expedited assistance payments. Due to the magnitude of potential fraud  and abuse we observed in our February 2006 testimony, we plan to issue a  report containing recommendations to Department of Homeland Security  (DHS) and Federal Emergency Management Agency (FEMA) to improve  internal controls over the Individuals and Households Program (IHP). This  testimony reflects additional findings from the work we have performed  since February. We plan to continue reviewing other aspects of IHP.
As we previously reported, expedited assistance—a component of the IHP  program for hurricanes Katrina and Rita—took the form of $2,000  payments provided to disaster victims to help with the immediate,  emergency needs for food, shelter, clothing, and personal necessities.  Individuals and/or households who received expedited assistance may  also be eligible to receive other IHP payments for temporary housing  assistance, real and personal property repair and replacement, and other  necessary expenses related to a disaster—up to a cap of $26,200. As of  mid-February 2006, FEMA data showed that the agency had delivered  about $6.3 billion in IHP aid for hurricanes Katrina and Rita. Thirty seven  percent (approximately $2.3 billion) of this amount was delivered through  expedited assistance (EA) to hurricanes Katrina and Rita registrants. Of  the remaining payments, about $2 billion was delivered through temporary  housing assistance, and another approximately $2 billion was for repair  and replacement of real and personal property, and for other  miscellaneous categories.
As we previously testified, the need to provide assistance quickly led  FEMA to issue payments to hurricanes Katrina and Rita registrants  without first validating the identity and damaged property addresses of all  registrants and without first verifying that the registrants incurred losses  and had needs related to the hurricanes. However, with limited  exceptions, FEMA policy required that subsequent payments for  temporary housing assistance, real and personal property repair and  replacement, and other miscellaneous expenses be made only after FEMA  had conducted an inspection and determined that the extent of loss  merited further assistance. Addresses that were exempt from inspections  had to go through an electronic verification of ownership and occupancy  with a third-party contractor prior to FEMA providing registrants in those  areas with rental assistance and/or other nonexpedited assistance  payments.
Today’s testimony summarizes the results from our ongoing forensic audit  and investigative work reviewing the type and extent of fraud and abuse  for the IHP program. This testimony will (1) provide an estimate of  improper and potentially fraudulent payments related to certain aspects  of the disaster registrations, (2) identify whether FEMA made improper or  potentially fraudulent IHP payments to registrants who were incarcerated  at the time of the disaster, (3) identify whether FEMA provided registrants  with rental assistance payments at the same time it was paying for their  lodging at hotelrooms, and (4) review FEMA’s accountability over debit  cards and controls over proper debit card usage.
To estimate the magnitude of IHP payments made on the basis of invalid  registrations, we selected a random sample of 250 payments of the 2.6  million IHP payments made to hurricanes Katrina and Rita registrants as  of February 2006. We excluded 3 of the 250 payments from our analysis  because these payments had been returned to the U.S. Government at the  time of our review, and the U.S. Government was therefore not susceptible  to potential fraud for them. We derived our estimate of improper and  potentially fraudulent payments by summing the dollars associated with  improper and potentially fraudulent payments in our sample and  multiplying that sum by a weighting factor to project the total from the  sample to the population. The weighting factor we used was the number of  payments “represented” by each of our randomly sampled payments,  namely, the number of payments in the population divided by the number  of payments we sampled. To validate sample registration data, we used a  combination of site visits, comparisons with publicly available data and  Social Security Administration (SSA) data, interviews with residents and  their neighbors, interviews with local postal officials, and duplicate  registration analysis. We also data mined IHP registration data to identify  case studies of registrants who provided invalid and potentially fraudulent  information.
To further illustrate the effects of control breakdowns, we continued our  undercover operations with bogus registrations to obtain additional IHP  payments beyond the original expedited assistance. To identify IHP  registrants who were prisoners, we obtained a database of federal inmates  as well as databases of inmates at state prisons in and around the areas  affected by hurricanes Katrina and Rita. We then compared prisoner data  to IHP registration data to identify registrations containing prisoner names  and SSNs. To identify case studies of individuals who received rental  assistance at the same time that they were housed in government-paid for  hotels, we compared the IHP registration data to information provided by  the hotels, e.g. driver’s licenses. However, because data provided on hotel  residents did not contain FEMA registration numbers, we were unable to  determine the magnitude of duplicate payments.
To assess accountability over FEMA debit cards, we interviewed officials  from FEMA, Department of Treasury’s Financial Management Service  (FMS), and JPMorgan Chase. To assess the usage patterns of FEMA debit  cards, we data mined debit card purchases and identified transactions that  appeared to be unrelated to emergency disaster needs. Further details on  our scope and methodology can be found in appendix I.
We conducted our audit and investigations from February 2006 through  June 8, 2006. We conducted our audit work in accordance with generally  accepted government auditing standards and conducted investigative  work in accordance with the standards prescribed by the President’s  Council on Integrity and Efficiency.
subsections: section_title: FEMA Paid About $1 Billion to Individuals Who Provided Invalid Registration Data
paragraphs: Because of FEMA’s failure to establish basic upfront validation controls  over registrants’ identity and address information, we estimate that FEMA  made approximately $1 billion of improper and potentially fraudulent  payments based on invalid registrations.  This represents 16 percent of all  individual assistance payments for hurricanes Katrina and Rita. The  improper and potentially fraudulent payments included cases where  individuals and households used invalid SSNs, used addresses that were  fictitious or not their primary residence, and for submitted earlier  registrations. These improper payments based on phony or duplicate  registration data were not only restricted to the initial expedited  assistance payments that we previously reported on, but also included  payments for rental assistance, housing repair, and housing replacement.  For example, rental assistance payments were made to registrants that  used a post office box and a cemetery as damaged properties. In fact, as  part of our ongoing forensic audit, FEMA continues to provide rental  assistance to GAO based on registrations that contained fictitious  identities and bogus damaged addresses. In one case, FEMA even sent  GAO a check for expedited assistance after an inspector could not confirm  that the property existed, and FEMA had decided not to provide housing  assistance to this registration. Our projection likely understates the total  amount of improper and potentially fraudulent payments since our  examination of sample payments focused only on invalid registrations and  did not include other criteria, such as insurance policies, which may make  registrants ineligible for IHP payments.
subsections: section_title: Statistical Sample Results Indicate About $1 Billion in Potentially Fraudulent and Improper IHP Payments
paragraphs: Based on our statistical sample we estimate that 16 percent of all  payments were based on invalid registrations. We considered a  registration invalid if it contained an invalid identity, invalid address  information, or was paid from duplicate registration information. Some  registrations failed more than one attribute. We drew our statistical  sample from a population of 2.6 million payments made in the wake of  hurricanes Katrina and Rita, totaling over $6 billion through mid-February  2006. Based on these results, we project that FEMA made about $1 billion  in assistance payments based on improper or potentially fraudulent  registrations. The 95 percent confidence interval associated with our  estimate of improper and potentially fraudulent registrations ranges from  a low of $600 million to a high of $1.4 billion in improper and potentially  fraudulent payments. Table 1 shows the attributes we tested, the estimated  failure rate in each attribute, and the overall projected failure amount.
As shown in table 1, some registrations failed more than one attribute;  therefore the total number of registrations which failed our attribute tests  is less than the sum of the failures of each attribute. For example, all  payments made to registrations containing bogus damaged property  addresses also failed the primary residence test because the registrants  could not have lived there at the time of the disaster. Additional details on  the 39 registrants in our sample where we found a problem are as follows:  Payments to Registrants Whose Damaged Property Address Was  Not Their Primary Residence – Twenty six payments failed the primary  residence test. These include individuals who had never lived at the  damaged property, did not live at the damaged property at the time of the  disasters, or used bogus property addresses on their registrations. We  made these determinations after reviewing publicly available records,  conducting site visits, and interviewing current residents and/or  neighboring residents. We provide additional details related to failures in  this attribute in table 2.
Registrant received $2,000 in expedited assistance, $2,358 in rental assistance, and more than  $15,000 in personal property replacement.
Registrant originally claimed damage at a street address several houses away from the damaged  property address currently in FEMA’s database. At some point in the disaster assistance process, the  registrant made changes to the damaged property address.
No physical inspection occurred at the damaged property. Personal property payment was based on  geospatial data due to the level of devastation in the area.
GAO reviews of publicly available information and credit report data showed that the registrant had  never lived at the damaged property address for which she was paid.
Registrant used valid physical property as damaged address to receive three payments for expedited  assistance, rental assistance, and personal property replacement.
GAO audit and investigative work found no evidence that the individual ever lived at the property. After  receiving the payments, the registrant withdrew the application without ever having a physical  inspection performed or returning the disaster payments to FEMA.
Registrant used damaged property in Kenner, Louisiana, as primary residence to qualify for one  expedited assistance payment and two rental assistance payments.
Registrant did not live at property at the time of disaster.
Owner of the property told us that the registrant had moved out of the damaged property a month prior  to hurricane Katrina.
Registrant used damaged property as primary residence to receive one expedited assistance and two  rental assistance payments.
Residents at the property had never heard of the registrant.
Registrant used post office box in McIntosh, Alabama, as the damaged property address to receive  expedited assistance and rental assistance.
The local postal inspector stated that the post office box was linked to other individuals associated  with known fraudulent activity.
Payments to Duplicate Registrations—12 other payments in our  sample failed because they were made to registrants whose damaged  property addresses and current addresses had previously been submitted  under other registrations and had received payments on those previous  registrations. For example, one sample registrant submitted a registration  containing the same damaged and current property addresses as those  used previously by another registrant. Both registrations received  payments for rental assistance for $2,358 in September 2005.
Payments to Registrations with Bogus Property Addresses – Three  payments in our sample were made to registrations containing bogus  property addresses. For example, we found that one individual used  several pieces of bogus information to receive expedited assistance.  Specifically, the registrant used a SSN that was valid but the name did not  match the name in records maintained by the Social Security  Administration. The registrant also used a damaged property address in  the 3000 block that was determined to be invalid through our on-site  inspection, as street numbers on that street only went up to the 1000s.  After the initial payment, the registration was withdrawn voluntarily by the  registrant. In effect, this registrant was able to use completely bogus  information to receive $2,000 from FEMA and then withdraw the  registration to avoid further scrutiny.
Payments to Registrations Containing Invalid Social Security  Numbers — Two of the payments in the sample were made to individuals  that used invalid SSNs (e.g., SSNs that have never been issued or SSNs that  did not match the name provided on the registration). For example, one  individual used a SSN that had never been issued to receive FEMA  payments for expedited and rental assistance.
Overall, we observed that 17 of our sample failures (44 percent) were  related specifically to expedited assistance payments. The high level of  expedited assistance-related failure was expected because these payments  needed to be made quickly and, typically, prior to a physical inspection of  the damaged property. However, we found that the other 22 failures (56  percent) were related to rental assistance and personal and real property  repair and replacement payments. In its response to a draft GAO report,  FEMA represented to us that all nonexpedited assistance payments,  including the $2,358 in housing assistance payments, were subject to much  more stringent requirements. Specifically, FEMA represented that the  registrants had to demonstrate that they occupied the damaged property at  the time of the disaster. However, the 22 failures we found indicate that  these requirements were not effective in preventing improper and  potentially fraudulent registrations from receiving nonexpedited  assistance payments.
section_title: Sample Testing Understates Improper and Potentially Fraudulent Payments
paragraphs: Our estimate likely understates the total amount of improper and  potentially fraudulent payments because we did not test our samples for  all potential reasons why a disaster assistance payment could be  fraudulent or improper. For example, our testing criteria did not include  reviewing whether registrants had insurance policies that covered  hurricane damages, which may have made them ineligible for IHP  payments. We also did not test whether FEMA inspectors accurately  assessed the damage to each sampled damaged property, or whether the  registrants were displaced from their homes, an eligibility factor for rental  assistance.
During the course of our work, we found that these problems affected  some of our sampled payments and, therefore, these payments may be  improper or potentially fraudulent. However, because the problems did  not relate to identity and address information, they passed our testing  criteria. For example, an individual in our statistical sample provided a  valid SSN and lived in a declared disaster area. However, the individual  informed GAO that he did not incur any hurricane-related damage. Despite  this fact, the individual received $2,000 in expedited assistance. We did not  test whether registrants received duplicate benefits from other FEMA  programs, such as free hotel lodging and trailers, which would have  resulted in FEMA paying duplicate housing benefits to the same registrant.  Later in this testimony, we provide examples where registrants received  from FEMA free hotel rooms in addition to rental assistance. Finally, our  estimate would include payments FEMA has identified for potential  recoupment.
section_title: Undercover Investigations and Case Study Examples of Fraudulent and Improper IHP Payments
paragraphs: Given the considerable amount of potentially fraudulent and improper  payments identified in our statistical sample, it is not surprising that FEMA  continued to provide rental assistance payments to GAO investigators  based on bogus registrations. In one instance, rental assistance was made  even after a FEMA inspector was unable to find the damaged property.  Similarly, our sample testing and data mining work also identified  additional examples of payments made on the basis of bogus information.
In our previous testimony, we reported that we were able to obtain  $2,000 expedited assistance checks from FEMA using falsified identities,  bogus property addresses, and fabricated disaster stories. FEMA has  continued to provide us with additional disaster-related assistance  payments even after FEMA received indications from various sources that  our registrations may be bogus. GAO has not cashed these checks and  plans to return the checks to the Department of Treasury upon the  conclusion of our work. The following provides details of two of our  undercover operations:    Case #1 relates to a registration submitted by GAO for hurricane Rita that  cited a bogus address in Louisiana as the damaged property. In October  2005, GAO received notice that the inspector assigned to inspect the  property was not able to find the house despite numerous attempts to  verify the address with the phone book, post office, and with a physical  inspection. The registration was subsequently returned to FEMA by the  inspector and coded as withdrawn because no contact was made with the  registrant. Even though GAO never met with the inspector to prove that  the damaged property existed, FEMA sent GAO a check for $2,000 in early  2006.
Case # 2 relates to a GAO disaster registration for an empty lot in  Louisiana for hurricane Katrina. Although the damaged property address  was bogus, FEMA notified GAO that an inspection was performed and  confirmed that the property was damaged. However, FEMA stated that  the registration could not be processed because FEMA was unable to  corroborate that the GAO lived at the damaged property. GAO  subsequently submitted a fictitious driver’s license that included the bogus  address, which FEMA readily accepted. Based on the fictitious driver’s  license, FEMA issued GAO a $2,358 rental assistance check, as shown in  figure 1. Subsequent to FEMA issuing the $2,358 check, a Small Business  Administration (SBA) inspector who was responsible for inspecting the  damaged property in evaluation of a potential SBA loan reported that the  property did not exist. Although SBA discovered that the property was  bogus, FEMA issued another rental assistance check to GAO, bringing the  total rental assistance on this bogus registration to about $6,000. We found  that the discrepancy between FEMA’s result (which confirmed that the  property existed), and SBA’s result (which showed that the property did  not exist) occurred because FEMA did not conduct a physical inspection  on the property but instead used geospatial mapping to determine losses.
section_title: Data Mining Continued to Find Other Illustrative Examples of Improper and Potentially Fraudulent Payments
paragraphs: We have previously testified regarding potentially fraudulent case studies  we uncovered through data mining and investigative techniques. The  potential fraud in those cases was hundreds of thousands of dollars. We  have continued our data mining work find additional examples where  FEMA made payments, sometimes totaling over $100,000, to improper or  potentially fraudulent registrations, including payments made to  registrants where cemeteries and post office boxes were claimed as  damaged property addresses. Table 3 provides several additional examples  of improper and potentially fraudulent payments.
The following provides illustrative information for three of the cases.
Case number 1 involves 8 individuals who claimed several different  damaged property addresses, but the same current address which is a  single apartment. Public record searches also determined that only 2 of the  8 individuals actually lived at the current address. Four individuals were  members of the same household who shared the same damaged property  address. However, the 4 individuals each received one expedited and one  rental assistance payment. FEMA criteria specified that members from the  same household who were displaced to the same location should be  entitled to only one IHP payment. According to public records, the other 4  individuals were not living at the address claimed as damaged at the time  of the hurricane.
Case number 2 involves an individual who used 13 different SSNs— including one of the individual’s own—to receive payments on 13  registrations. The individual claimed 13 different damaged property  addresses and used one single current address to receive FEMA payments.  According to publicly available records, this individual had no established  history at any of the 13 properties in Louisiana, Mississippi, and Alabama,  which the individual claimed as damaged. The individual received  approximately $139,000 consisting of 8 expedited assistance payments, 4  rental assistance payments, and 14 other payments, including 3 payments  of $10,500 each, and 3 payments ranging from over $12,000 to over $17,000  for personal property replacement. Further audit and investigative work  indicates that 8 of the 13 addresses did not exist or do not have public  ownership records.
Case number 4 involves a registrant who used the address of a cemetery to  make an IHP claim. Specifically, the registrant used a damaged property  address located within the grounds of Greenwood Cemetery, in New  Orleans, Louisiana, to request disaster assistance from FEMA. Public  records show no record of the registrant ever living in New Orleans.  Instead, public records indicate that for the past five years, the registrant  has resided in West Virginia at the address provided to FEMA as the  registrant’s current address.
As discussed previously, one statistical sample item we tested related to  an improper and potentially fraudulent payment FEMA made to an  individual who received expedited and rental assistance as a result of  using a post office box as a damaged property address. According to the  Postal Inspector, this post office box was also linked to individuals that  are associated with fraudulent activity. In total, we found that FEMA made  over 2,000 payments totaling about $5.3 million to registrants who  provided a post office box as their damaged residence. While not all  payments made to post office boxes are improper or potentially  fraudulent, the number of potentially fraudulent payments could be  substantially reduced if FEMA put in place procedures to instruct disaster  recipients to provide actual street addresses of damaged property when  claiming disaster assistance.
section_title: Registrants Using Prisoner Identities Received Millions in Disaster Assistance Payments
paragraphs: FEMA paid millions of dollars to over 1,000 registrants who used names  and SSNs belonging to state and federal prisoners for expedited and  housing assistance. FEMA guidelines specify that eligibility for disaster  assistance is predicated on the registrant being displaced from their  primary residence due to the disaster, thus having need for shelter. These  eligibility criteria should have generally excluded prisoners incarcerated  throughout the disaster period. Given the weaknesses we identified earlier  related to the number of individuals who claimed damages based on  invalid property addresses, we can not ascertain whether FEMA properly  verified that these registrations were valid, and therefore deserving of IHP  payments. The following are three cases where prisoner identities were  used to improperly receive IHP payments.
Case 1 involves a convicted felon, housed in a Louisiana prison from April  2001 to the present, who registered for IHP assistance by telephone. The  registrant made a FEMA claim using a post office box address in Louisiana  as his damaged property address to qualify for IHP payments for expedited  assistance, rental assistance, and personal property replacement. Two of  these payments were made via checks sent to the address he falsely  claimed as his current residence, and the final payment was sent via  electronic funds transfer (EFT) to someone who also listed the same  current address on the checking account. FEMA paid over $20,000 to the  registrant even though the damaged property address on the registration  was a post office box address and the registrant was incarcerated  throughout the disaster period.
Case 2 involves a registrant who has been incarcerated in a Louisiana state  penitentiary since February 2005. Several weeks after the disaster, the  registrant applied by telephone for individual disaster relief assistance  claiming a Louisiana address. Based on his registration information, FEMA  paid the inmate over $14,000 in checks mailed to an address in Texas that  he listed as his current address, and an EFT was sent to his checking  account. Payments included expedited assistance, rental assistance, and  personal property replacement funds.
Case 3 involves a registrant who has been incarcerated in a Mississippi  correctional facility since 2004. The registrant used his name and SSN over  the telephone to apply for and receive $2,000 in expedited assistance and  $2,358 in rental assistance. The individual listed his correct current  address, at the prison, to receive these payments.
section_title: Rental Assistance Payments Sent to Individuals Living in FEMA-Paid-For Hotels
paragraphs: Following hurricane Katrina, FEMA undertook massive efforts to house  individuals and households who were displaced by the hurricane. Among  other efforts, FEMA provided hotel accommodations to individuals who  were at that time displaced across the United States. We found that  although FEMA was responsible for paying hotel costs, FEMA did not  require hotels to collect registration information (such as FEMA  registration identification numbers or SSN) on individuals to whom it  provided hotel accommodations. Without this information, FEMA was not  able to identify individuals who were housed in hotels, and, thus, FEMA  was unable to determine whether rental assistance should be provided to  individuals to whom the federal government was providing free lodging.  As a result, FEMA made rental assistance payments which covered the  same period of time that the registrant was staying at a FEMA-paid  hotels. Table 4 provides examples of some of these cases.
Because the hotels were not required to collect identification numbers, we  were unable to determine the magnitude of individuals who received these  duplicate benefits. However, as illustrated in table 4, our data mining  identified a number of individuals housed in FEMA-paid for hotels who  have received more than one rental assistance payment. Without an  effective means of reconciling individuals in FEMA hotels with those  individuals receiving rental assistance payments, FEMA may have wasted  taxpayer dollars by paying twice for housing assistance to hurricane  victims.
section_title: FEMA Lacked Controls over Accountability and Use of Debit Cards
paragraphs: FEMA did not establish proper accountability for debit cards. As a result,  FEMA disbursed about $1.5 million of taxpayer money for over 750 debit  cards that FEMA cannot establish went to disaster victims. In addition, as  reported previously, we continued to find cases where recipients  purchased goods and services that did not meet serious disaster related  needs as defined by federal regulations.
subsections: section_title: Control Weaknesses over Accountability of FEMA Debit Cards
paragraphs: FEMA lacked controls for accounting for debit cards issued, resulting in  the loss of accountability for over 750 debit cards valued at about $1.5  million. The lack of controls over debit cards is particularly troubling  given that debit cards are, in essence, cash that can be used to purchase  goods and services. In September 2005, JPMorgan Chase was initially paid  approximately $22.7 million for about 11,374 cards that the bank believed  were issued to FEMA registrants. However, prior to our inquiries  beginning in November 2005, we found that neither FEMA nor the bank  had reconciled the actual number of cards distributed with the number of  cards for which payment was made. From our numerous inquiries, both  JPMorgan Chase and FEMA began to reconcile their records to the debit  cards issued. As a result,    JPMorgan Chase performed a physical count of cards remaining to identify  the number of cards distributed. This resulted in JPMorgan Chase  determining that it distributed 10,989 cards, not 11,374 cards. Upon  identification of the 385 undistributed debit cards, JPMorgan Chase  refunded to FEMA $770,000 attributable to these undistributed debit cards.
FEMA attempted to perform a reconciliation of the distributed cards to the  cards recorded in its disaster recipient database. As of May 26, 2006,  FEMA can only account for 10,608 cards of the 10,989 cards JPMorgan  Chase claimed that it has distributed. As a result, FEMA cannot properly  account for 381 debit cards, worth about $760,000.
section_title: Lack of Guidance for Proper Use of Debit Cards
paragraphs: Since initially paying JPMorgan Chase $22.7 million, FEMA has expanded  the use of debit cards as a payment mechanism for future IHP payment for  some registrants. Through this process, FEMA made about $59 million in  additional payments of rental assistance and other benefits. As of March  2006, over 90 percent of money funded to the debit cards has been used by  recipients to obtain cash and purchase a variety of goods and services. Our  analysis of data provided by JPMorgan Chase found that the debit cards  were used predominantly to obtain cash which did not allow us to  determine how the money was actually used. The majority of the  remaining transactions was associated with purchases of food, clothing,  and personal necessities.
Similar to findings in our February 13, 2006, testimony, we continue to find  some cases where cardholders purchased goods and services that did not  appear to meet legitimate disaster needs. In this regard, FEMA regulations  provide that IHP assistance be used for items or services that are essential  to a registrant’s ability to overcome disaster-related hardship. Table 5  details some of the debit cards activities we found that are not necessary  to satisfy legitimate disaster needs.
section_title: Concluding Comments
paragraphs: FEMA faces a significant challenge in ensuring that IHP relief payments  are only sent to valid registrants while also distributing those relief  payments as fast as possible. To ensure the success of the program, FEMA  must build the American taxpayers confidence that federal disaster  assistance only goes to those in need, and that adequate safeguards exist  to prevent assistance from going to those who submit improper and  potentially fraudulent registrations. To that effect, FEMA must develop  and strengthen controls to validate information provided at the  registration stage. As we have stated in prior audit work, and as FEMA had  learned from prior experience, pursuing collection activities after disaster  relief payments have been made is costly, time-consuming, and ineffective.  Upfront controls are all the more crucial given the estimated $1 billion  dollars that had gone to improper and potentially fraudulent registrations  related to hurricanes Katrina and Rita. It is key that FEMA address  weaknesses in its registration process so that it can substantially reduce  the risk for fraudulent and improper payments before the next hurricane  season arrives.
In addition, to help deter future fraudulent registrations, FEMA must  ensure there are consequences for those who commit fraud. We plan to  refer potentially improper payments to FEMA for further review, and hope  that FEMA will take the necessary recoupment actions. Further, we have  referred, and plan to refer additional cases of potential fraud to the Katrina  Fraud Task Force for further investigations and, if warranted, indictments.  Finally, we plan to issue a report in the future with recommendations for  addressing problems identified in this testimony.
Mr. Chairman and Members of the Committee, this concludes our  statement. We would be pleased to answer any questions that you or other  members of the committee may have at this time.
section_title: Contacts and Acknowledgement
paragraphs: For further information about this testimony, please contact Gregory Kutz  at (202) 512-7455 or kutzg@gao.gov, John Kelly at (202) 512-6926 or  kellyj@gao.gov.
Major contributors to this testimony include Kord Basnight, James Berry  Jr., Gary Bianchi, Valerie Blyther, Matthew Brown, Norman Burrell,  Jennifer Costello, Paul Desaulniers, Steve Donahue, Dennis Fauber,  Christopher Forys, Adam Hatton, Aaron Holling, Jason Kelly, Sun Kim,  Crystal Lazcano, Tram Le, John Ledford, Jennifer Leone, Barbara Lewis,  Jonathan Meyer, Gertrude Moreland, Richard Newbold, Kristen Plungas,  John Ryan, Sidney Schwartz, Robert Sharpe, Gail Spear, Tuyet-Quan Thai,  Patrick Tobo, Matthew Valenta, Tamika Weerasingha, and Scott  Wrightson.
section_title: Appendix I: Objectives, Scope and Methodology
paragraphs: Our objectives were to (1) provide an estimate of improper and potentially  fraudulent payments related to certain aspects of the disaster  registrations, (2) identify whether FEMA made improper or potentially  fraudulent IHP payments to registrants who were incarcerated at the time  of the disaster, (3) identify whether FEMA provided registrants with rental  assistance payments at the same time it was paying for their hotel rooms,  and (4) review FEMA’s accountability over debit cards and controls over  proper debit card usage.
To provide an estimate of improper and potentially fraudulent payments  related to certain aspects of the disaster registrations, we drew a statistical  sample of 250 payments from the Federal Emergency Management Agency  (FEMA)’s Individuals and Households Program (IHP) payments. Three of  the 250 were considered out of scope for our study because the payment  has been returned to the U.S. government by the time of our review.  Therefore, our review examined 247 payments for which the government  was subject to financial loss. Potentially fraudulent and invalid payments  are claims that contained (1) bogus identities, (2) addresses that did not  exist, (3) addresses where there was no evidence that the address was the  primary residence of the registrant at the time of the disaster, and (4)  addresses that had been previously registered using duplicate information  (such information would include same SSNs, same damaged address,  and/or same current address). We conducted searches of public records,  available FEMA data, and/or made physical inspections of addresses to  determine if registrations were improper and/or potentially fraudulent.
Because we followed a probability procedure based on random selections,  our sample is only one of a large number of samples that we might have  drawn. Since each sample could have provided different estimates, we  express our confidence in the precision of our particular sample’s results  as a 95 percent confidence interval (e.g., plus or minus 5 percentage  points). This is the interval that would contain the actual population value  for 95 percent of the samples we could have drawn. As a result, we are 95  percent confident that each of the confidence intervals in this report will  include the true values in the study population.
To identify whether FEMA made improper or potentially fraudulent IHP  payments to registrants who were incarcerated at the time of the disaster,  we obtained the FEMA IHP database as of February 2006. We obtained  databases containing state prisoner data since August 2005, including  releases and new incarcerations, from the states of Louisiana, Texas,  Mississippi, Alabama, Georgia, and Florida. We also obtained federal  prisoner data since August 2005, including releases and new  incarcerations, from the Department of Justice. We validated the  databases were complete by comparing totals against available public  information on prisoner populations. We compared these databases  against the population of IHP payments to identify prisoner SSN/name  combinations that received payments from FEMA. We restricted this  comparison to prisoners who were in state or federal prisons at the time of  the disasters. We also interviewed prisoners who registered for disaster  relief and prison officials to determine if prisoners were incarcerated at  the time of the disaster.
To identify whether FEMA improperly provided registrants with rental  assistance payments at the same time it was paying for their hotel rooms,  we reviewed FEMA policies and procedures to determine how FEMA  administered its hotel program, and obtained FEMA data on its hotel  registrants. We also used data mining and forensic audit techniques to  identify registrants who stayed in hotels paid for by FEMA who also  received rental assistance payments through the IHP program. To  determine whether registrations from our data mining resulted in  duplication of housing benefits, we used a selection of 10 case studies for  further investigation. We obtained documentation from hotel officials to  substantiate that case study registrants stayed at hotels paid for by FEMA.  We also gathered available FEMA data on case study registrations that  received multiple rental assistance payments to determine what  information they had provided FEMA in order to receive additional rental  assistance.
To review FEMA’s accountability over debit cards and controls over  proper debit card usage, we reviewed databases of transactions and  accounts provided by JPMorgan Chase, the administering bank for the  debit cards, as well as FEMA’s database of debit card accounts. We  interviewed bank, FEMA, and Treasury officials regarding the  reconciliation of debit card accounts against IHP registrants and reviewed  documentation related to the payment flow of debit cards. We also  performed data mining on debit card transactions to identify purchases  that did not appear to be indicative of necessary expenses as defined by  the Stafford Act’s implementing regulations.
During the course of our audit work, we identified multiple cases of  potential fraud. For cases that we investigated and found significant  evidence of fraudulent activity, we plan to refer our cases directly to the  Hurricane Katrina Fraud Task Force. We performed our work from  February 2006 through June 8, 2006 in accordance with generally accepted  government auditing standards and quality standards for investigations as  set forth by the President’s Council on Integrity and Efficiency.
subsections: section_title: Data Reliability
paragraphs: To validate that the National Emergency Management Information System  database was complete and reliable, we compared the total disbursements  against reports FEMA provided to the Senate Appropriations Committee  on Katrina/Rita disbursements. We also interviewed FEMA officials and  performed electronic testing of the database on key data elements.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.