Hurricanes Katrina and Rita caused catastrophic destruction to the Gulf Coast region, with an estimated combined total of $160 billion in damage. Estimates indicate that Hurricanes Gustav and Ike also caused billions of dollars in damage along the Gulf Coast region. FEMA assists disaster victims in part through its Individuals and Households Program (IHP), a component of the federal disaster-response efforts established under the Robert T. Stafford Disaster Relief and Emergency Assistance Act. FEMA determines whether individuals or households meet eligibility requirements for IHP assistance after they apply for registration either online or over the telephone. Applicants must submit identification information, including name, Social Security Number (SSN), and date of birth. Applicants must also provide a legitimate address affected by the hurricane; FEMA guidelines specify that eligibility for housing assistance is predicated on the registrant being displaced from his or her primary residence. IHP assistance can include temporary housing, home repair and personal property replacement, and other necessary expenses related to a disaster. For Hurricanes Katrina and Rita, FEMA also activated expedited assistance to provide immediate cash--in the form of $2,000 payments--to eligible disaster victims to help with emergency needs for food, shelter, clothing, and personal necessities. Activating expedited assistance allowed FEMA to provide aid to disaster victims without requiring proof of property damage or other losses. FEMA did not activate expedited assistance for Hurricanes Gustav and Ike, although it did offer limited fast- track payments for individuals with critical needs as a result of Hurricane Gustav. As of March 2009, FEMA states that it has distributed approximately $665 million in IHP assistance to victims of Hurricanes Gustav and Ike, as compared to almost $8 billion for Hurricanes Katrina and Rita. This amount includes rental assistance, lodging, repairs, replacement, and other needs assistance. Since Hurricanes Katrina and Rita, FEMA has improved its controls over identity and address verification and inspections, housing assistance in FEMA-paid-for hotels, and duplicate registrations. Improvements in these three key areas have reduced FEMA's risk of making payments based on fraudulent disaster assistance registrations. For example, for Hurricanes Ike and Gustav, FEMA conducted identity and address verification on all applications and required inspections prior to approving rental assistance. In addition, FEMA required individuals in need of housing assistance to provide valid registration numbers before checking into FEMA-paid-for hotels. FEMA has also taken steps to flag duplicate registrations submitted for the same disaster. Although these improvements are significant, our work shows that an identity thief or a persistent fraudster with basic counterfeiting skills could still obtain rental or hotel assistance by exploiting existing weaknesses in the registration and approval processes. In particular, we were able to bypass verification controls by submitting more sophisticated bogus identities and by providing FEMA with fictitious documentation to validate our registration information. For one of our registrations, these weaknesses allowed us to obtain thousands of dollars in rental assistance, approval for transitional housing, and duplicate reimbursements for fictitious hotel expenses. We were successful on this application not only because we submitted fictitious documentation, but also because FEMA's inspector failed to properly inspect our bogus damaged address. For other applications, falsified supporting documentation allowed us to obtain approval for transitional housing, and in one case we subsequently checked into two different hotels. Finally, we found that FEMA was unable to prevent duplicate registrations submitted for more than one disaster. The following information describes (1) the control weaknesses related to identity and address verification and inspections that we identified during our work on Hurricanes Katrina and Rita, (2) the improvements we found as a result of our undercover tests during Hurricanes Gustav and Ike, and (3) flaws that still exist in the identity and address verification and inspection processes. Weaknesses in Address and Identity Verification and Inspections Identified after Hurricanes Katrina and Rita: As we reported previously, we found significant flaws in the process that FEMA used to approve individuals for disaster assistance payments after Hurricanes Katrina and Rita. For example, although FEMA subjected Internet applications to an identification verification process, it did not use this verification process for phone applications. Specifically, for Internet applications, a FEMA contractor used credit and other information to confirm that (1) the applicant's SSN matched with an SSN in public records and (2) that the SSN did not belong to a deceased individual. Applicants who were rejected through the Internet were advised to apply over the phone. However, phone applications were exempt from any identity verification. In addition, prior to providing assistance payments, FEMA did not use public records or inspections to verify the physical location of damaged addresses, nor did it confirm that applicants actually occupied a damaged address at the time of the disasters. As a result of these weaknesses, we were able to receive disaster assistance by using fictitious names and nonexistent addresses. For example, for one of our Hurricane Katrina applications, we used an empty lot in Louisiana as our damaged address. Although this damaged property address was clearly bogus, FEMA notified us that an inspector had confirmed that the property was damaged and subsequently sent us thousands of dollars in rental assistance. Through data mining, we identified cases where other applicants received assistance by using SSNs belonging to deceased individuals and by using storefronts, post office boxes, cemeteries, and nonexistent apartments as damaged addresses. Other cases we identified involved applicants that claimed to live at valid damaged addresses, even though they were actually incarcerated or living in states not affected by the Hurricanes. Improvements Identified during the Response to Hurricanes Gustav and Ike: FEMA made several improvements to the verification and inspection processes. For example, FEMA told us that the same identity-verification process is now automatically performed when an applicant applies through the Internet and over the phone. In addition, both Internet and phone applications are now subject to automatic address and occupancy verification. Address verification includes checks to confirm that an address is deliverable; is not a post office box or a business address; and is not a "high-risk," address such as a tattoo parlor, or a pawn shop. Occupancy/ownership verification confirms that an applicant occupies or owns the property through a check of property records. Applicants who register over the telephone and fail any of these verification tests still receive registration numbers, but FEMA requests additional documentation prior to any payments being made. According to FEMA, applicants can verify their identities by submitting tax forms, marriage licenses, or government-issued identification. Address and occupancy can be verified by submitting documents such as drivers' licenses, utility bills, and property-tax records. An applicant can fax the supporting documentation to FEMA or wait and provide them to an inspector. FEMA also told us that even if an applicant passed both identity and address verification, an inspector must meet with an applicant to further verify occupancy and to confirm that a property was damaged in order to be eligible for rental assistance. Our undercover applications for Hurricanes Gustav and Ike confirm these improvements, as described in the following examples: Five of our 10 applications initially failed identity verification. For these 5 applications, we used falsified identification information similar to what we used for Hurricanes Katrina and Rita. Specifically, for these applications, we used either completely fabricated names and SSNs, or names with valid dates of birth and SSNs but without any credit history, such as credit card or bank activity. We could not successfully register some identities by using the Internet and were instructed to apply by phone. At the end of the phone application process, FEMA call center operators provided us with registration numbers but also told us that there were "verification errors" associated with our registrations. Although the operators told us that inspectors would be contacting us to schedule an inspection of our property, we were instructed to provide additional documentation to validate our identities. All 10 of our applications initially failed address and occupancy verification. For all 10, we used fabricated address information, including street addresses that did not exist and the addresses of local municipal buildings. When we later reviewed our applications with FEMA, we found that all 10 were flagged as having errors, in part because the addresses we used were not deliverable or because the names we used did not match property records associated with the addresses. The inspection process prevented us from receiving rental assistance for 9 of our 10 applications. Specifically, the 9 addresses we selected for these applications were either not private residences or they were not actually damaged by the hurricanes. Therefore, although FEMA inspectors left messages requesting that we schedule inspections, we did not meet with them. For example, for 1 of our applications we used the address of a Texas elementary school in an area affected by Hurricane Ike. Prior to scheduling an inspection, the inspector called us from the school requesting clarification as to where we resided. We discontinued the application as a result of this call. Continued Weaknesses in Address and Identity Verification and Inspections: We were able to circumvent FEMA's initial controls by using valid identities with credit histories and by submitting fabricated identification and address information. For one of our registrations, these weaknesses, coupled with FEMA's failure to correctly inspect our fictitious address, allowed us to obtain rental assistance and duplicate reimbursements for fictitious hotel expenses. Six of our 10 applications passed identity-verification controls on the first try through the Internet and over the phone, in part because we simulated the actions of an identity thief by using identities with legitimate dates of birth, SSNs, and credit histories. Because some of these identities were valid, FEMA appropriately did not find any verification errors. However, FEMA also did not identify the fact that one of the identities with a credit history showed that we lived outside the areas affected by the hurricanes. For 1 of our applications, we used a name and SSN that were linked to credit records in Virginia, with no record of activity in Texas or the surrounding area. In this way, a fraudster could steal an identity from anyone in the country and use it to pass FEMA's identity tests. Five of our 10 applications eventually passed either identity or address verification or both because FEMA accepted fabricated supporting documents we submitted as legitimate. For example, for 1 of the applications, we registered by phone using a completely fake name, date of birth, and "999-XX-XXXX" as our SSN. FEMA requested that we provide additional documentation to prove our identity, so we faxed in a bogus college transcript. When we subsequently reviewed our applications with FEMA, we found that this bogus transcript was deemed sufficient proof of identification. Similarly, we were able to submit fabricated tax forms and utility bills to prove address and occupancy. When we asked FEMA officials about the process for handling supporting documentation, they told us they do not take any steps to verify the documents. The officials said that they only check to see whether the document appears to be tampered with. If it does, FEMA case workers or contractors will verify the document by calling any phone numbers listed on the document or performing Internet research. If the document appears to be valid, then no additional checks are performed. According to FEMA, our fabricated documents did not appear to be tampered with and therefore were immediately accepted as legitimate. One of our applications received thousands of dollars in rental assistance because FEMA accepted our fabricated supporting documents and because FEMA approved the application without the inspector correctly inspecting the property or meeting with us in person. This application was also approved for a free hotel room and received duplicate payments for previously incurred hotel expenses. For this application, we used a name with a valid date of birth and SSN, but without any credit history. For our damaged address, we used a nonexistent street number on a real street in an area of Texas affected by Hurricane Ike. In response to FEMA's request for identity verification, we submitted an IRS form 1099, which can easily be found on the Internet, claiming that we worked for a bogus landscaping company on a nonexistent street. We also submitted a fabricated utility bill to verify our occupancy. A FEMA inspector attempted to contact us to schedule a date for an inspection, but we never set up a meeting. Ultimately, we were notified that we were eligible for rental assistance and housing assistance in a FEMA-paid-for hotel. However, because the approved dates for obtaining a hotel room were about to expire, we subsequently asked FEMA to reimburse us for previously incurred hotel expenses. As proof of our stay in the hotel, we submitted a bogus bill we created by changing the name and address on a letterhead from a hotel in the Washington, D.C., area. In total, we received just over $6,600 in assistance from FEMA for this application, including $4,465 for rental assistance and $2,197 for hotel- expense reimbursements. The $2,197 in hotel-expense reimbursements we received included duplicate reimbursements for our hotel expenses: one check for $1,098.50 from FEMA and another check in the same amount from FEMA's hotel contractor. Figure 1 depicts one of the rental assistance checks. In reviewing this application with FEMA officials, we asked why we received rental assistance without an inspection. FEMA told us that the inspector had performed an inspection and noted that the entire street where our fictitious address was supposed to be was destroyed. Although FEMA initially blocked us from receiving assistance because we were not present during the inspection, the case worker chose to override this decision because the case worker believed that the destruction of the entire street indicated that we had an immediate need for assistance. FEMA officials emphasized that the case worker should not have taken this action and we should not have received rental assistance. Finally, with regard to the duplicate payments we received for hotel expenses, FEMA told us that we may have received these payments because of a breakdown in the reimbursement process. Specifically, both FEMA and its lodging contractor made payments for expenses incurred at hotels by approved disaster applicants. FEMA typically sends a list of payments it has already made to the contractor. Using a manual process, the contractor reviews this list to determine what payments need to be made. With regard to the duplicate payment we received, the FEMA officials we spoke with speculated that the contractor simply missed the payment by FEMA during its review. After we brought this issue to their attention, FEMA officials told us that they were already conducting a review of the process to if the duplicate payment problem was widespread. As a result of this review, FEMA found that the lodging contractor made four additional duplicate payments. FEMA has flagged these payments for recoupment. The following information describes (1) the control weaknesses related to FEMA's hotel housing program that we identified d Hurricanes Katrina and Rita, (2) the improvements we found as a result of our undercover tests during Hurricanes Gustav and Ike, and (3) flaws tha t still exist in the hotel-assistance approval process. Weaknesses in the Hotel-Assistance Approval Process Iden after Hurricanes Katrina and Rita: Following Hurricane Katrina, FEMA provided displaced individuals with free hotel accommodations. However, FEMA did not require the hotels to collect registration information (such as FEMA registration numbers or SSNs) on individu staying in the free rooms. Without this information, FEMA was not abl ensure that only valid disaster victims were receiving free hotel accommodation s. As a result, we found that individuals stayed in free hotel rooms even though they were not eligible to receive any type of disaster assistance because they had never lived in residences dama the hurricanes. Improvements Identified during the Response to Hurricanes Gustav and Ike: According to FEMA, it strengthened controls over hotel assistance by requiring applicants seeking free lodging to (1) obtain a registration number from FEMA and (2) pass both identity and address verification. Once registrants received approval to check in to a h had to provide the hotel with a valid registration number, picture ID, the last four digits of an SSN so that the hotel could check this inform against a database maintained by FEMA's hotel contractor. Our undercover work confirmed that these controls were effective. For example, without applying for assistance and obtaining registration numbers, our investigators tried seven times to obtain hotel rooms just by claiming that they were victims of Hurricane Ike and showing bogus Tex drivers' licenses . They were denied rooms every time. In addition, when we tried to obtain hotel rooms with FEMA registration numbers that had not passed the identity and address-verification process, we were again denied rooms. cess: Continued Weaknesses in the Hotel Assistance Approval Pro Despite the improvements we identified, we were still approved for hotel assistance on 4 of our 10 applications after we obtained registration numbers and passed identity and address verification using bogus supporting documentation. For one of these applications, we still rec approval for transitional housing even though FEMA noted that the utility ill we submitted to prove our address was illegible. Ultimately, we b checked into two different hotels using one of our bogus identities. The following information describes (1) the control weaknesses related to duplicate payments and registrations we identified during our work on Hurricanes Katrina and Rita, (2) the improvements we found as a result of our undercover tests during Hurricanes Gustav and Ike, and (3) flaws thatstill exist in the process FEMA uses to detect duplicate registrati ons. Weaknesses in Detecting Duplicate Registrations Identified after Hurricanes Katrina and Rita: FEMA did not detect duplicate registrations or prevent duplicate payments after Hurricanes Katrina and Rita. We identified instances where FEMA made more than one payment to the same household that shared the same last name and damaged an d current addresses. FEMA also made millions of dollars in duplicate payments to thousands of individuals who submitted claims for damages to the same primary residences for both Hurricanes Katrina and Rita. FEMA officials explained that victims of both disasters are allowed only one set of IHP payments for the same damaged address and therefore on entitled to payments based on a single registration. Improvements Identified during the Response to Hurricanes Gustav and Ike: Improved data checks enabled FEMA to successfully prevent us from applying twice for Hurricane Gustav using the same identity. For example, we used the same damaged and current address information for two of our applications. When we subsequently revie our applications with FEMA officials, we saw that one of the applica had been flagged as being a duplicate and was about to be cancelled. ded We observed several deficiencies in the customer service FEMA provito disaster victims. Specifically, had we been real disaster victims without e Internet access, we would probably have been unable to obtain assistanc in the immediate aftermath of the hurricanes. We also called actual disaster victims, many of whom told us that they experienced similar problems. According to FEMA, these problems occurred in part because the initial call center staffing model it developed for the 2008 hurricane season was overwhelmed by members of the media and high-level government officials encouraging the public to contact FEMA. However, data we received from FEMA show that these call centers were actually staffed well below FEMA's own estimates of peak staffing needs fo the hurricanes. FEMA told us that this staffing deficiency was caused, in part, by difficulties associated with one of its co that it had not planned to staff call centers up to levels necessary to handle peak call-volume needs. Despite problems we noted with FEMA's ntractors, but also stated customer service following the hurricanes, it intends to rely on the operational plan for the 2009 hurricane season. Although we encountered little or no difficulty when applying for assistance over the Internet, we observed several problems with FEMA's customer service when we made applications by phone. The following examples describe some of the problems we encountered: Busy phone lines and long wait times. We could not immediatel get through to the call centers when applying by phone. For one of o Hurricane Ike applications, an investigator had to call nine times over the course of 3 days before being able to speak to a call center staf member. During these calls, the investigator either got a recording saying "all agents are busy; try later" or was put on hold for 15 to 20 minutes before hanging up. On another Hurricane Ike application, the investigator called five times over the course of three days before getting through to a call center, experiencing similar busy messages and wait times. On a Hurricane Gustav application, the investigator had to call after 1:00 a.m. in order to speak with an operator. We identified similar problems when calling FEMA's help line to check on the s tatus of our applications. For example, one investigator called the help line 13 times over the course of 8 days but never got through to an operator. Incorrect information. Call center staff did not always give us accurate information. For example, although some of our fictitious applicants were told that inspectors would call to schedule inspection even though the applicant did not know the extent of damage to his property, one of our inv for an inspection unless he provided a more precise account of his property damages. For another application, we had to fax supp documentation in multiple times because we were initially given an incorrect fax number. estigators was told he would not be scheduled Delayed notification for hotel assistance. For two of our registrations that were approved for temporary housing, FEMA did no notify us in a timely manner, which prevented us from obtaining a hot room. s, In an effort to understand the experiences of actual disaster victim we contacted registrants chosen from a database provided by FEMA About half of the individuals we spoke with told us that they did not experience any problems with FEMA's application process; the other half confirmed that they encountered delays in getting through to . FEMA operators, problems scheduling inspections, and difficulties obtaining hotel rooms once they had been approved. FEMA permits registration for assistance over the Internet, but power outages may have forced many victims to seek assistance over the telephone. Table 1 highlights 10 of our conversations with disaster victims. FEMA cited several factors that contributed to poor customer service in the aftermath of Hurricanes Ike and Gustav: a higher-than-expected call volume, unmet staffing needs, contractor failure, and problems with its automatic call system. FEMA told us that although it intends to use a different contractor for the 2009 hurricane season, the agency will make no other changes to its call center operational plan. Higher-than-Expected Call Volume: FEMA told us that they received what they described as an overwhelming number of calls, especially from individuals that may not have otherwise asked for assistance, because the media and high-level government officials strongly encouraged the public to contact FEMA. For example, FEMA estimated that it would receive approximately 530,291 calls requesting assistance for Hurricanes Gustav and Ike, but it actually received a total of 1,195,213 calls--125 percent more than expected. FEMA officials also stated that many individuals who called FEMA had unrealistic expectations as a result of the widespread coverage of hurricane Katrina. In particular, many applicants called because they expected to receive an immediate $2,000 expedited assistance payment. Projected Call Center Needs Unmet: Data provided by FEMA show that FEMA fell short of its anticipated peak staffing needs. According to FEMA, call centers are typically staffed with a baseline number of personnel before a disaster takes place. To determine staffing, FEMA primarily relies on historical models, and the type and the size of a disaster. If FEMA determines that additional staff are needed after a disaster occurs, it relies on an interagency agreement with the Internal Revenue Service (IRS) and on contractors. According to FEMA, its four call centers were staffed with a baseline of 684 staff before Hurricanes Gustav and Ike hit. In preparation for Hurricane Gustav, FEMA determined that peak staffing levels at the call centers could be as high as 6,300 staff by September 4, 2008, 3 days after the hurricane would make landfall. However, FEMA data show that actual staffing levels were just below 1,100. In addition, FEMA determined that peak staffing levels at the call centers could be nearly 11,000 staff by September 15 in order to handle calls for both Hurricanes Ike and Gustav. However, once Hurricane Ike made landfall on September 13, FEMA data show there were only 1,378 personnel staffed at the call centers--75 percent below staffing estimates for that day. When asked about the significant difference between staff on hand and anticipated staffing requirements, FEMA officials stated staffing to meet short-term peaks is inefficient as it would require substantial resources to hire and train staff to peak levels, only to release them shortly thereafter due to decreased call volume. Contractor Failures: FEMA said that one contractor was not able to supply a sufficient number of staff in a short period of time, resulting in a lack of staff available at call centers. Specifically, FEMA told us that it entered into a temporary service contract awarded through the General Services Administration (GSA) to augment its call center staff. This contract limited the proposals to only those companies on the GSA schedule that were small businesses--businesses that FEMA believes were not equipped to handle its staffing issues. FEMA said that by the time it learned that only small businesses were under consideration, it could not afford to consider alternative routes. In addition, FEMA said that one of the small businesses it chose to work with indicated that it intended to team up with a large national staffing services company with greater resources, which initially gave FEMA confidence that the contractor could meet its staffing needs. However, FEMA said that it took over 2 weeks for the contractor to supply the numbers of temporary workers required to address the large call volume. In addition, as a change after Hurricane Katrina, call center operators had to undergo security screening prior to being able to work at the call centers. Before Katrina, operators could start work while the security check was in progress. FEMA said that this heightened security check prevented the contractor from providing additional staff in a timely fashion. FEMA officials told us they will not be using the same contractor for the upcoming hurricane season. Automatic Call System Issues: With regard to the issues we identified related to obtaining timely hotel approval, FEMA officials said that they received a large number of requests for free lodging. As a result, they established (1) a separate fax line to accept verification documentation and (2) an auto-dial system to inform people they were approved to check into a hotel. However, according to FEMA, there were problems with the auto-dial system, and therefore some individuals were not promptly informed that they were eligible for housing assistance. This investigation shows that FEMA has made significant progress in addressing the challenge of providing urgent disaster relief to individuals and communities in need of assistance, while simultaneously safeguarding its programs from fraud and abuse. By improving controls over IHP, FEMA has taken steps to provide reasonable assurance that fraud and abuse in this program is minimized. Given that the current hurricane season has begun, FEMA should incorporate lessons learned from our investigation to continue to improve its fraud-prevention program and address all of the customer-service issues we identified. We recommend that the Secretary of Homeland Security direct the Administrator of FEMA to take the following two actions: Establish random checks to assess the validity of supporting documentation submitted by applicants to verify identity and address. Assess the customer-service findings from this investigation and make improvements for future hurricane seasons in areas such as contractor readiness. In written comments on a draft of this report, the Department of Homeland Security concurred with and agreed to implement both of our recommendations. We are sending copies of this report to the Secretary of Homeland Security, the FEMA Administrator, and interested committees. In addition, the report will be available at no charge on GAO's Web site at http://www.gao.gov. If you or your staff have any questions regarding this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report.

Summary:
GAO's previous work on Hurricanes Katrina and Rita identified fraud, waste, and abuse resulting from a lack of fraud-prevention controls within the Federal Emergency Management Agency's (FEMA) assistance programs. For example, FEMA did not verify the identities or addresses of individuals applying for aid under its Individuals and Households Program (IHP). FEMA also did not verify the eligibility of individuals seeking shelter in FEMA-paid-for hotels and made duplicate payments to individuals who applied multiple times. GAO made numerous recommendations designed to improve these controls. To follow up on this work, GAO conducted undercover tests of the IHP process during the response to Hurricanes Gustav and Ike. This report discusses (1) whether FEMA's controls have improved since Katrina and Rita and (2) issues GAO identified related to the customer service that FEMA provided. GAO submitted bogus applications for disaster assistance, met with FEMA officials, and contacted actual disaster victims to determine their experiences applying for aid. FEMA has significantly improved its fraud prevention controls over disaster assistance. For example, FEMA now conducts identity and address verification on all applications and requires inspections prior to approving rental assistance. In addition, FEMA requires individuals in need of housing assistance to provide valid registration numbers before checking into FEMA-paid-for hotels. FEMA has also taken steps to flag and cancel duplicate registrations for the same disaster. These improvements made it more difficult for GAO to penetrate IHP controls for Hurricanes Gustav and Ike--only 1 of 10 fraudulent applications submitted by GAO received cash payments. However, GAO found flaws in FEMA's controls that still leave the government vulnerable to fraud, waste, and abuse. GAO's undercover tests show that a persistent fraudster can bypass many of these controls by submitting fabricated documents to prove identity or address and, as a result, obtain housing assistance. GAO also received duplicate payments for bogus hotel expenses. In addition, FEMA failed to properly inspect a bogus address GAO used to apply for assistance, ultimately sending GAO multiple checks for thousands of dollars in rental assistance. GAO observed several problems with FEMA's customer service, which made it difficult for many real victims to apply for assistance or obtain shelter in a timely fashion. For example, one of GAO's investigators called nine times over the course of 3 days--several times being put on hold for 20 minutes----before being connected to an operator. Other investigators received incorrect information about the application process. Actual disaster victims confirmed these problems. One applicant reported having to call FEMA at 4 a.m. in order to reach an operator. FEMA cited several factors that contributed to this poor service, including a higher-than-expected call volume and an inability to meet projected call center staffing needs because a contractor failed to provide adequate staffing. Despite these issues, FEMA told GAO that it has made few changes in preparation for the 2009 hurricane season.