Because of FEMA’s failure to establish basic upfront validation controls over registrants’ identity and address information, we estimate that FEMA made approximately $1 billion of improper and potentially fraudulent payments based on invalid registrations. This represents 16 percent of all individual assistance payments for hurricanes Katrina and Rita. The improper and potentially fraudulent payments included cases where individuals and households used invalid SSNs, used addresses that were fictitious or not their primary residence, and for submitted earlier registrations. These improper payments based on phony or duplicate registration data were not only restricted to the initial expedited assistance payments that we previously reported on, but also included payments for rental assistance, housing repair, and housing replacement. For example, rental assistance payments were made to registrants that used a post office box and a cemetery as damaged properties. In fact, as part of our ongoing forensic audit, FEMA continues to provide rental assistance to GAO based on registrations that contained fictitious identities and bogus damaged addresses. In one case, FEMA even sent GAO a check for expedited assistance after an inspector could not confirm that the property existed, and FEMA had decided not to provide housing assistance to this registration. Our projection likely understates the total amount of improper and potentially fraudulent payments since our examination of sample payments focused only on invalid registrations and did not include other criteria, such as insurance policies, which may make registrants ineligible for IHP payments. Based on our statistical sample we estimate that 16 percent of all payments were based on invalid registrations. We considered a registration invalid if it contained an invalid identity, invalid address information, or was paid from duplicate registration information. Some registrations failed more than one attribute. We drew our statistical sample from a population of 2.6 million payments made in the wake of hurricanes Katrina and Rita, totaling over $6 billion through mid-February 2006. Based on these results, we project that FEMA made about $1 billion in assistance payments based on improper or potentially fraudulent registrations. The 95 percent confidence interval associated with our estimate of improper and potentially fraudulent registrations ranges from a low of $600 million to a high of $1.4 billion in improper and potentially fraudulent payments. Table 1 shows the attributes we tested, the estimated failure rate in each attribute, and the overall projected failure amount. As shown in table 1, some registrations failed more than one attribute; therefore the total number of registrations which failed our attribute tests is less than the sum of the failures of each attribute. For example, all payments made to registrations containing bogus damaged property addresses also failed the primary residence test because the registrants could not have lived there at the time of the disaster. Additional details on the 39 registrants in our sample where we found a problem are as follows: Payments to Registrants Whose Damaged Property Address Was Not Their Primary Residence – Twenty six payments failed the primary residence test. These include individuals who had never lived at the damaged property, did not live at the damaged property at the time of the disasters, or used bogus property addresses on their registrations. We made these determinations after reviewing publicly available records, conducting site visits, and interviewing current residents and/or neighboring residents. We provide additional details related to failures in this attribute in table 2. Registrant received $2,000 in expedited assistance, $2,358 in rental assistance, and more than $15,000 in personal property replacement. Registrant originally claimed damage at a street address several houses away from the damaged property address currently in FEMA’s database. At some point in the disaster assistance process, the registrant made changes to the damaged property address. No physical inspection occurred at the damaged property. Personal property payment was based on geospatial data due to the level of devastation in the area. GAO reviews of publicly available information and credit report data showed that the registrant had never lived at the damaged property address for which she was paid. Registrant used valid physical property as damaged address to receive three payments for expedited assistance, rental assistance, and personal property replacement. GAO audit and investigative work found no evidence that the individual ever lived at the property. After receiving the payments, the registrant withdrew the application without ever having a physical inspection performed or returning the disaster payments to FEMA. Registrant used damaged property in Kenner, Louisiana, as primary residence to qualify for one expedited assistance payment and two rental assistance payments. Registrant did not live at property at the time of disaster. Owner of the property told us that the registrant had moved out of the damaged property a month prior to hurricane Katrina. Registrant used damaged property as primary residence to receive one expedited assistance and two rental assistance payments. Residents at the property had never heard of the registrant. Registrant used post office box in McIntosh, Alabama, as the damaged property address to receive expedited assistance and rental assistance. The local postal inspector stated that the post office box was linked to other individuals associated with known fraudulent activity. Payments to Duplicate Registrations—12 other payments in our sample failed because they were made to registrants whose damaged property addresses and current addresses had previously been submitted under other registrations and had received payments on those previous registrations. For example, one sample registrant submitted a registration containing the same damaged and current property addresses as those used previously by another registrant. Both registrations received payments for rental assistance for $2,358 in September 2005. Payments to Registrations with Bogus Property Addresses – Three payments in our sample were made to registrations containing bogus property addresses. For example, we found that one individual used several pieces of bogus information to receive expedited assistance. Specifically, the registrant used a SSN that was valid but the name did not match the name in records maintained by the Social Security Administration. The registrant also used a damaged property address in the 3000 block that was determined to be invalid through our on-site inspection, as street numbers on that street only went up to the 1000s. After the initial payment, the registration was withdrawn voluntarily by the registrant. In effect, this registrant was able to use completely bogus information to receive $2,000 from FEMA and then withdraw the registration to avoid further scrutiny. Payments to Registrations Containing Invalid Social Security Numbers — Two of the payments in the sample were made to individuals that used invalid SSNs (e.g., SSNs that have never been issued or SSNs that did not match the name provided on the registration). For example, one individual used a SSN that had never been issued to receive FEMA payments for expedited and rental assistance. Overall, we observed that 17 of our sample failures (44 percent) were related specifically to expedited assistance payments. The high level of expedited assistance-related failure was expected because these payments needed to be made quickly and, typically, prior to a physical inspection of the damaged property. However, we found that the other 22 failures (56 percent) were related to rental assistance and personal and real property repair and replacement payments. In its response to a draft GAO report, FEMA represented to us that all nonexpedited assistance payments, including the $2,358 in housing assistance payments, were subject to much more stringent requirements. Specifically, FEMA represented that the registrants had to demonstrate that they occupied the damaged property at the time of the disaster. However, the 22 failures we found indicate that these requirements were not effective in preventing improper and potentially fraudulent registrations from receiving nonexpedited assistance payments. Our estimate likely understates the total amount of improper and potentially fraudulent payments because we did not test our samples for all potential reasons why a disaster assistance payment could be fraudulent or improper. For example, our testing criteria did not include reviewing whether registrants had insurance policies that covered hurricane damages, which may have made them ineligible for IHP payments. We also did not test whether FEMA inspectors accurately assessed the damage to each sampled damaged property, or whether the registrants were displaced from their homes, an eligibility factor for rental assistance. During the course of our work, we found that these problems affected some of our sampled payments and, therefore, these payments may be improper or potentially fraudulent. However, because the problems did not relate to identity and address information, they passed our testing criteria. For example, an individual in our statistical sample provided a valid SSN and lived in a declared disaster area. However, the individual informed GAO that he did not incur any hurricane-related damage. Despite this fact, the individual received $2,000 in expedited assistance. We did not test whether registrants received duplicate benefits from other FEMA programs, such as free hotel lodging and trailers, which would have resulted in FEMA paying duplicate housing benefits to the same registrant. Later in this testimony, we provide examples where registrants received from FEMA free hotel rooms in addition to rental assistance. Finally, our estimate would include payments FEMA has identified for potential recoupment. Given the considerable amount of potentially fraudulent and improper payments identified in our statistical sample, it is not surprising that FEMA continued to provide rental assistance payments to GAO investigators based on bogus registrations. In one instance, rental assistance was made even after a FEMA inspector was unable to find the damaged property. Similarly, our sample testing and data mining work also identified additional examples of payments made on the basis of bogus information. In our previous testimony, we reported that we were able to obtain $2,000 expedited assistance checks from FEMA using falsified identities, bogus property addresses, and fabricated disaster stories. FEMA has continued to provide us with additional disaster-related assistance payments even after FEMA received indications from various sources that our registrations may be bogus. GAO has not cashed these checks and plans to return the checks to the Department of Treasury upon the conclusion of our work. The following provides details of two of our undercover operations: Case #1 relates to a registration submitted by GAO for hurricane Rita that cited a bogus address in Louisiana as the damaged property. In October 2005, GAO received notice that the inspector assigned to inspect the property was not able to find the house despite numerous attempts to verify the address with the phone book, post office, and with a physical inspection. The registration was subsequently returned to FEMA by the inspector and coded as withdrawn because no contact was made with the registrant. Even though GAO never met with the inspector to prove that the damaged property existed, FEMA sent GAO a check for $2,000 in early 2006. Case # 2 relates to a GAO disaster registration for an empty lot in Louisiana for hurricane Katrina. Although the damaged property address was bogus, FEMA notified GAO that an inspection was performed and confirmed that the property was damaged. However, FEMA stated that the registration could not be processed because FEMA was unable to corroborate that the GAO lived at the damaged property. GAO subsequently submitted a fictitious driver’s license that included the bogus address, which FEMA readily accepted. Based on the fictitious driver’s license, FEMA issued GAO a $2,358 rental assistance check, as shown in figure 1. Subsequent to FEMA issuing the $2,358 check, a Small Business Administration (SBA) inspector who was responsible for inspecting the damaged property in evaluation of a potential SBA loan reported that the property did not exist. Although SBA discovered that the property was bogus, FEMA issued another rental assistance check to GAO, bringing the total rental assistance on this bogus registration to about $6,000. We found that the discrepancy between FEMA’s result (which confirmed that the property existed), and SBA’s result (which showed that the property did not exist) occurred because FEMA did not conduct a physical inspection on the property but instead used geospatial mapping to determine losses. We have previously testified regarding potentially fraudulent case studies we uncovered through data mining and investigative techniques. The potential fraud in those cases was hundreds of thousands of dollars. We have continued our data mining work find additional examples where FEMA made payments, sometimes totaling over $100,000, to improper or potentially fraudulent registrations, including payments made to registrants where cemeteries and post office boxes were claimed as damaged property addresses. Table 3 provides several additional examples of improper and potentially fraudulent payments. The following provides illustrative information for three of the cases. Case number 1 involves 8 individuals who claimed several different damaged property addresses, but the same current address which is a single apartment. Public record searches also determined that only 2 of the 8 individuals actually lived at the current address. Four individuals were members of the same household who shared the same damaged property address. However, the 4 individuals each received one expedited and one rental assistance payment. FEMA criteria specified that members from the same household who were displaced to the same location should be entitled to only one IHP payment. According to public records, the other 4 individuals were not living at the address claimed as damaged at the time of the hurricane. Case number 2 involves an individual who used 13 different SSNs— including one of the individual’s own—to receive payments on 13 registrations. The individual claimed 13 different damaged property addresses and used one single current address to receive FEMA payments. According to publicly available records, this individual had no established history at any of the 13 properties in Louisiana, Mississippi, and Alabama, which the individual claimed as damaged. The individual received approximately $139,000 consisting of 8 expedited assistance payments, 4 rental assistance payments, and 14 other payments, including 3 payments of $10,500 each, and 3 payments ranging from over $12,000 to over $17,000 for personal property replacement. Further audit and investigative work indicates that 8 of the 13 addresses did not exist or do not have public ownership records. Case number 4 involves a registrant who used the address of a cemetery to make an IHP claim. Specifically, the registrant used a damaged property address located within the grounds of Greenwood Cemetery, in New Orleans, Louisiana, to request disaster assistance from FEMA. Public records show no record of the registrant ever living in New Orleans. Instead, public records indicate that for the past five years, the registrant has resided in West Virginia at the address provided to FEMA as the registrant’s current address. As discussed previously, one statistical sample item we tested related to an improper and potentially fraudulent payment FEMA made to an individual who received expedited and rental assistance as a result of using a post office box as a damaged property address. According to the Postal Inspector, this post office box was also linked to individuals that are associated with fraudulent activity. In total, we found that FEMA made over 2,000 payments totaling about $5.3 million to registrants who provided a post office box as their damaged residence. While not all payments made to post office boxes are improper or potentially fraudulent, the number of potentially fraudulent payments could be substantially reduced if FEMA put in place procedures to instruct disaster recipients to provide actual street addresses of damaged property when claiming disaster assistance. FEMA paid millions of dollars to over 1,000 registrants who used names and SSNs belonging to state and federal prisoners for expedited and housing assistance. FEMA guidelines specify that eligibility for disaster assistance is predicated on the registrant being displaced from their primary residence due to the disaster, thus having need for shelter. These eligibility criteria should have generally excluded prisoners incarcerated throughout the disaster period. Given the weaknesses we identified earlier related to the number of individuals who claimed damages based on invalid property addresses, we can not ascertain whether FEMA properly verified that these registrations were valid, and therefore deserving of IHP payments. The following are three cases where prisoner identities were used to improperly receive IHP payments. Case 1 involves a convicted felon, housed in a Louisiana prison from April 2001 to the present, who registered for IHP assistance by telephone. The registrant made a FEMA claim using a post office box address in Louisiana as his damaged property address to qualify for IHP payments for expedited assistance, rental assistance, and personal property replacement. Two of these payments were made via checks sent to the address he falsely claimed as his current residence, and the final payment was sent via electronic funds transfer (EFT) to someone who also listed the same current address on the checking account. FEMA paid over $20,000 to the registrant even though the damaged property address on the registration was a post office box address and the registrant was incarcerated throughout the disaster period. Case 2 involves a registrant who has been incarcerated in a Louisiana state penitentiary since February 2005. Several weeks after the disaster, the registrant applied by telephone for individual disaster relief assistance claiming a Louisiana address. Based on his registration information, FEMA paid the inmate over $14,000 in checks mailed to an address in Texas that he listed as his current address, and an EFT was sent to his checking account. Payments included expedited assistance, rental assistance, and personal property replacement funds. Case 3 involves a registrant who has been incarcerated in a Mississippi correctional facility since 2004. The registrant used his name and SSN over the telephone to apply for and receive $2,000 in expedited assistance and $2,358 in rental assistance. The individual listed his correct current address, at the prison, to receive these payments. Following hurricane Katrina, FEMA undertook massive efforts to house individuals and households who were displaced by the hurricane. Among other efforts, FEMA provided hotel accommodations to individuals who were at that time displaced across the United States. We found that although FEMA was responsible for paying hotel costs, FEMA did not require hotels to collect registration information (such as FEMA registration identification numbers or SSN) on individuals to whom it provided hotel accommodations. Without this information, FEMA was not able to identify individuals who were housed in hotels, and, thus, FEMA was unable to determine whether rental assistance should be provided to individuals to whom the federal government was providing free lodging. As a result, FEMA made rental assistance payments which covered the same period of time that the registrant was staying at a FEMA-paid hotels. Table 4 provides examples of some of these cases. Because the hotels were not required to collect identification numbers, we were unable to determine the magnitude of individuals who received these duplicate benefits. However, as illustrated in table 4, our data mining identified a number of individuals housed in FEMA-paid for hotels who have received more than one rental assistance payment. Without an effective means of reconciling individuals in FEMA hotels with those individuals receiving rental assistance payments, FEMA may have wasted taxpayer dollars by paying twice for housing assistance to hurricane victims. FEMA did not establish proper accountability for debit cards. As a result, FEMA disbursed about $1.5 million of taxpayer money for over 750 debit cards that FEMA cannot establish went to disaster victims. In addition, as reported previously, we continued to find cases where recipients purchased goods and services that did not meet serious disaster related needs as defined by federal regulations. FEMA lacked controls for accounting for debit cards issued, resulting in the loss of accountability for over 750 debit cards valued at about $1.5 million. The lack of controls over debit cards is particularly troubling given that debit cards are, in essence, cash that can be used to purchase goods and services. In September 2005, JPMorgan Chase was initially paid approximately $22.7 million for about 11,374 cards that the bank believed were issued to FEMA registrants. However, prior to our inquiries beginning in November 2005, we found that neither FEMA nor the bank had reconciled the actual number of cards distributed with the number of cards for which payment was made. From our numerous inquiries, both JPMorgan Chase and FEMA began to reconcile their records to the debit cards issued. As a result, JPMorgan Chase performed a physical count of cards remaining to identify the number of cards distributed. This resulted in JPMorgan Chase determining that it distributed 10,989 cards, not 11,374 cards. Upon identification of the 385 undistributed debit cards, JPMorgan Chase refunded to FEMA $770,000 attributable to these undistributed debit cards. FEMA attempted to perform a reconciliation of the distributed cards to the cards recorded in its disaster recipient database. As of May 26, 2006, FEMA can only account for 10,608 cards of the 10,989 cards JPMorgan Chase claimed that it has distributed. As a result, FEMA cannot properly account for 381 debit cards, worth about $760,000. Since initially paying JPMorgan Chase $22.7 million, FEMA has expanded the use of debit cards as a payment mechanism for future IHP payment for some registrants. Through this process, FEMA made about $59 million in additional payments of rental assistance and other benefits. As of March 2006, over 90 percent of money funded to the debit cards has been used by recipients to obtain cash and purchase a variety of goods and services. Our analysis of data provided by JPMorgan Chase found that the debit cards were used predominantly to obtain cash which did not allow us to determine how the money was actually used. The majority of the remaining transactions was associated with purchases of food, clothing, and personal necessities. Similar to findings in our February 13, 2006, testimony, we continue to find some cases where cardholders purchased goods and services that did not appear to meet legitimate disaster needs. In this regard, FEMA regulations provide that IHP assistance be used for items or services that are essential to a registrant’s ability to overcome disaster-related hardship. Table 5 details some of the debit cards activities we found that are not necessary to satisfy legitimate disaster needs. FEMA faces a significant challenge in ensuring that IHP relief payments are only sent to valid registrants while also distributing those relief payments as fast as possible. To ensure the success of the program, FEMA must build the American taxpayers confidence that federal disaster assistance only goes to those in need, and that adequate safeguards exist to prevent assistance from going to those who submit improper and potentially fraudulent registrations. To that effect, FEMA must develop and strengthen controls to validate information provided at the registration stage. As we have stated in prior audit work, and as FEMA had learned from prior experience, pursuing collection activities after disaster relief payments have been made is costly, time-consuming, and ineffective. Upfront controls are all the more crucial given the estimated $1 billion dollars that had gone to improper and potentially fraudulent registrations related to hurricanes Katrina and Rita. It is key that FEMA address weaknesses in its registration process so that it can substantially reduce the risk for fraudulent and improper payments before the next hurricane season arrives. In addition, to help deter future fraudulent registrations, FEMA must ensure there are consequences for those who commit fraud. We plan to refer potentially improper payments to FEMA for further review, and hope that FEMA will take the necessary recoupment actions. Further, we have referred, and plan to refer additional cases of potential fraud to the Katrina Fraud Task Force for further investigations and, if warranted, indictments. Finally, we plan to issue a report in the future with recommendations for addressing problems identified in this testimony. Mr. Chairman and Members of the Committee, this concludes our statement. We would be pleased to answer any questions that you or other members of the committee may have at this time. For further information about this testimony, please contact Gregory Kutz at (202) 512-7455 or kutzg@gao.gov, John Kelly at (202) 512-6926 or kellyj@gao.gov. Major contributors to this testimony include Kord Basnight, James Berry Jr., Gary Bianchi, Valerie Blyther, Matthew Brown, Norman Burrell, Jennifer Costello, Paul Desaulniers, Steve Donahue, Dennis Fauber, Christopher Forys, Adam Hatton, Aaron Holling, Jason Kelly, Sun Kim, Crystal Lazcano, Tram Le, John Ledford, Jennifer Leone, Barbara Lewis, Jonathan Meyer, Gertrude Moreland, Richard Newbold, Kristen Plungas, John Ryan, Sidney Schwartz, Robert Sharpe, Gail Spear, Tuyet-Quan Thai, Patrick Tobo, Matthew Valenta, Tamika Weerasingha, and Scott Wrightson. Our objectives were to (1) provide an estimate of improper and potentially fraudulent payments related to certain aspects of the disaster registrations, (2) identify whether FEMA made improper or potentially fraudulent IHP payments to registrants who were incarcerated at the time of the disaster, (3) identify whether FEMA provided registrants with rental assistance payments at the same time it was paying for their hotel rooms, and (4) review FEMA’s accountability over debit cards and controls over proper debit card usage. To provide an estimate of improper and potentially fraudulent payments related to certain aspects of the disaster registrations, we drew a statistical sample of 250 payments from the Federal Emergency Management Agency (FEMA)’s Individuals and Households Program (IHP) payments. Three of the 250 were considered out of scope for our study because the payment has been returned to the U.S. government by the time of our review. Therefore, our review examined 247 payments for which the government was subject to financial loss. Potentially fraudulent and invalid payments are claims that contained (1) bogus identities, (2) addresses that did not exist, (3) addresses where there was no evidence that the address was the primary residence of the registrant at the time of the disaster, and (4) addresses that had been previously registered using duplicate information (such information would include same SSNs, same damaged address, and/or same current address). We conducted searches of public records, available FEMA data, and/or made physical inspections of addresses to determine if registrations were improper and/or potentially fraudulent. Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent confidence interval (e.g., plus or minus 5 percentage points). This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95 percent confident that each of the confidence intervals in this report will include the true values in the study population. To identify whether FEMA made improper or potentially fraudulent IHP payments to registrants who were incarcerated at the time of the disaster, we obtained the FEMA IHP database as of February 2006. We obtained databases containing state prisoner data since August 2005, including releases and new incarcerations, from the states of Louisiana, Texas, Mississippi, Alabama, Georgia, and Florida. We also obtained federal prisoner data since August 2005, including releases and new incarcerations, from the Department of Justice. We validated the databases were complete by comparing totals against available public information on prisoner populations. We compared these databases against the population of IHP payments to identify prisoner SSN/name combinations that received payments from FEMA. We restricted this comparison to prisoners who were in state or federal prisons at the time of the disasters. We also interviewed prisoners who registered for disaster relief and prison officials to determine if prisoners were incarcerated at the time of the disaster. To identify whether FEMA improperly provided registrants with rental assistance payments at the same time it was paying for their hotel rooms, we reviewed FEMA policies and procedures to determine how FEMA administered its hotel program, and obtained FEMA data on its hotel registrants. We also used data mining and forensic audit techniques to identify registrants who stayed in hotels paid for by FEMA who also received rental assistance payments through the IHP program. To determine whether registrations from our data mining resulted in duplication of housing benefits, we used a selection of 10 case studies for further investigation. We obtained documentation from hotel officials to substantiate that case study registrants stayed at hotels paid for by FEMA. We also gathered available FEMA data on case study registrations that received multiple rental assistance payments to determine what information they had provided FEMA in order to receive additional rental assistance. To review FEMA’s accountability over debit cards and controls over proper debit card usage, we reviewed databases of transactions and accounts provided by JPMorgan Chase, the administering bank for the debit cards, as well as FEMA’s database of debit card accounts. We interviewed bank, FEMA, and Treasury officials regarding the reconciliation of debit card accounts against IHP registrants and reviewed documentation related to the payment flow of debit cards. We also performed data mining on debit card transactions to identify purchases that did not appear to be indicative of necessary expenses as defined by the Stafford Act’s implementing regulations. During the course of our audit work, we identified multiple cases of potential fraud. For cases that we investigated and found significant evidence of fraudulent activity, we plan to refer our cases directly to the Hurricane Katrina Fraud Task Force. We performed our work from February 2006 through June 8, 2006 in accordance with generally accepted government auditing standards and quality standards for investigations as set forth by the President’s Council on Integrity and Efficiency. To validate that the National Emergency Management Information System database was complete and reliable, we compared the total disbursements against reports FEMA provided to the Senate Appropriations Committee on Katrina/Rita disbursements. We also interviewed FEMA officials and performed electronic testing of the database on key data elements. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Hurricanes Katrina and Rita destroyed homes and displaced millions of individuals. In the wake of these natural disasters, Federal Emergency Management Agency (FEMA) responded to the need to provide aid quickly through the Individuals and Households Program (IHP) program, which provides housing assistance, real and personal property assistance, and for other immediate, emergency needs. As of February 2006, FEMA made 2.6 million payments totaling over $6 billion. Our testimony today will (1) provide an estimate of improper and potentially fraudulent payments through February 2006 related to certain aspects of the disaster registrations, (2) identify whether improper and potentially fraudulent payments were made to registrants who were incarcerated at the time of the disaster, (3) identify whether FEMA improperly provided registrants with rental assistance payments at the same time it was paying for their lodging at hotels, and (4) review FEMA's accountability over debit cards and controls over proper debit card usage. To estimate the magnitude of IHP payments made on the basis of invalid registrations, we selected a random statistical sample of 250 payments made to hurricanes Katrina and Rita registrants as of February 2006. We also conducted data mining and investigations to further illustrate the effects of control breakdowns. We estimate that through February 2006, FEMA made about 16 percent or $1 billion in improper and potentially fraudulent payments to registrants who used invalid information to apply for disaster assistance. Based on our statistical sample, we are 95 percent confident that the range of improper and potentially fraudulent payments is from $600 million to $1.4 billion. In our assessment of whether a payment was improper and potentially fraudulent, we did not test for other evidence of impropriety or potential fraud, such as insurance fraud and bogus damage claims. This means our review potentially understates the magnitude of improper payments made. Examples of fraud and abuse include payments to registrants who used post office boxes, United Parcel Service stores, and cemeteries as their damaged property addresses. Absent proper verification, it is not surprising that FEMA continued to pay fictitious disaster registrations set up by GAO as part of our ongoing forensic audit. In one case, FEMA paid nearly $6,000 to our registrant who submitted a vacant lot as a damaged address. Below is a copy of a rental assistance check sent to GAO after FEMA received feedback from its inspector that the GAO undercover registrant did not live at the damaged address, and after a Small Business Administration inspector reported that the damaged property could not be found. We also found that FEMA provided expedited and housing assistance to individuals who were not displaced. For example, millions of dollars in expedited and housing assistance payments went to registrations containing the names and social security numbers of individuals incarcerated in federal and state prisons during the hurricanes. In addition, FEMA improperly paid individuals twice for their lodging--paying their hotels and rental assistance at the same time. For example, at the same time that FEMA paid $8,000 for an individual to stay in California hotels, this individual also received three rental assistance payments for both hurricane disasters. Finally, we found that FEMA could not establish that 750 debit cards worth $1.5 million went to hurricane Katrina victims. We also found debit cards that were used for a Caribbean vacation, professional football tickets, and adult entertainment.