FEMA has a substantial challenge in balancing the need to get money out quickly to those who are actually in need and sustaining public confidence in disaster programs by taking all possible steps to minimize fraud and abuse. Nevertheless, FEMA could reasonably be expected to have mature, fully tested processes, along with business partners in the federal, state, and private sector, that can provide it with real time access to the data required to validate identities and addresses for those seeking disaster assistance. Once fraudulent registrations are made and money is disbursed, detecting and pursuing those who committed fraud in a comprehensive manner is costly and may not result in recoveries. Further, many of those fraudulently registered in the FEMA system already received expedited assistance and will likely receive more money, as each registrant can receive as much as $26,200 per registration. Another key element to preventing fraud in the future is to ensure there are consequences for those that commit fraud. We are referring the fraud cases that we are investigating to the Katrina Fraud Task Force for further investigation and, where appropriate, prosecution. We believe that prosecution of individuals who have obtained disaster relief payments through fraudulent means will send a message for future disasters that there are consequences for defrauding the government. We recommend that the Secretary of the Department of Homeland Security (DHS) direct the Director of the Federal Emergency Management Agency to take six actions to address the weaknesses we identified in the administration of IHP. These six recommendations relate only to the limited scope of work that we have completed to date and will not prevent all types of improper and fraudulent IHP payments. Consequently, we will continue to audit and investigate the assistance provided by FEMA in the aftermath of hurricanes Katrina and Rita and we will issue further recommendations designed to create a more comprehensive fraud prevention program for IHP. To address the concerns raised in our February 13, 2006, testimony, we recommend that DHS and FEMA do the following: Establish an identity verification process for Individuals and Households Program (IHP) registrants applying via both the Internet and telephone, to provide reasonable assurance that disaster assistance payments are made only to qualified individuals. Within this process establish detailed criteria for registration and provide clear instructions to registrants on the identification information required, create a field within the registration that asks registrants to provide their name exactly as it appears on their Social Security Card in order to prevent name and Social Security Number (SSN) mismatches, fully field test the identity verification process prior to ensure that call center employees give real-time feedback to registrants on whether their identities have been validated, and establish a process that uses alternative means of identity verification to expeditiously handle legitimate applicants that are rejected by identity verification controls. Develop procedures to improve the existing review process of duplicate registrations containing the exact same SSN and to identify the reasons why registrations flagged as invalid or as potential duplicates have been overridden and approved for payment. Establish an address verification process for IHP registrants applying via both the Internet and telephone, to provide reasonable assurance that disaster assistance payments are made only to qualified individuals. Within this process create a uniform method to input street names and numbers and apartment numbers into the registration, institute procedures to check IHP registration damaged addresses against publicly available address databases so that payments are not made based on bogus property addresses, fully field test the address verification process prior to ensure that call center employees can give real time feedback to registrants on whether addresses have been validated, and establish a process that uses alternative means of address verification to expeditiously handle legitimate applicants that are rejected by address verification controls. Explore entering into an agreement with other agencies, such as the Social Security Administration, to periodically authenticate information contained in IHP registrations. Establish procedures to collect duplicate expedited assistance payments or to offset these amounts against future payments. Such duplicate payments include the payments made to IHP recipients who improperly received the $2,000 debit cards and an additional $2,000 EA check or Electronic Funds Transfer (EFT) and the thousands of duplicate EA payments made to the same IHP registration number. Ensure that any future distribution of IHP debit cards includes instructions on the proper use of IHP funds, similar to those instructions provided to IHP check and EFT recipients, to prevent improper usage. In written comments on a draft of this report, which are reprinted in appendix II, DHS and FEMA made a number of observations that were not related to any specific recommendation, concurred fully with four of our six recommendations, and partially concurred with the remaining two recommendations. In general comments, FEMA and DHS stated that they could benefit more from the report if information sharing between GAO and FEMA had been reciprocal. We believe that we employed such an arrangement throughout this engagement. We regularly briefed DHS and FEMA concerning the progress of the audit. For example, we notified FEMA management immediately after we detected that duplicate EA payments were made to individuals who had received debit cards, and worked closely with FEMA’s Disaster Finance Center to resolve other issues related to payments that appeared to exceed the $26,200 limit for specific recipients. DHS and FEMA also expressed concern over the objectivity and fairness of our report. Specifically, DHS and FEMA noted that our selection of 248 registrations was not a representative sample and was geared specifically toward identifying and reporting on registrations that had problems. Our testimony clearly states that the case studies we used were intended to demonstrate the type of fraud and abuse that occurred because of weak or nonexistent controls over the registration process and did not represent a statistical sample of registrations. The primary findings of our work relate to weak or nonexistent controls that leave the government vulnerable to substantial fraud and abuse in the IHP. Furthermore, as represented at the February 13, 2006, hearing, we are continuing our work in this area. Specifically, we have taken a statistical sample of IHP payments so that we can statistically estimate the magnitude of improper and potentially fraudulent claims. We have nearly completed this work and plan to report our findings later this month. FEMA and DHS also found problems with our assertion that EA payments were the gateway to future IHP payments. Specifically, FEMA and DHS noted that future IHP payments are subjected to additional scrutiny. We did not test this additional scrutiny as part of our February 13, 2006, testimony. However, we continue to believe that accepting registrations for individuals using invalid identity and damaged property information subjects the federal government to a high risk of fraud and abuse beyond EA payments. We believe that our ongoing audit and investigative work sheds further light on whether the additional scrutiny that FEMA asserts does in fact prevent fraudulent and improper payments related to rental assistance and other covered losses. FEMA and DHS further noted that we made several references to isolated incidents where debit cards were used for purchases that did not appear to be for disaster needs, and FEMA questioned whether highlighting those examples was appropriate. We specifically noted in each reference to these purchases that they were isolated and were not representative of the general breakdown of known debit card usage. We also clearly stated that over 60 percent of debit card transactions were used to obtain cash and could not be tracked further to identify the final use of the IHP funds. We identified the non-disaster-related purchases to highlight the fact that FEMA did not provide any instruction to debit card recipients on the appropriate use of IHP funds. With regard to specific recommendations, FEMA and DHS concurred fully that FEMA (1) improve procedures to review registrations containing the same SSNs and other duplicate information; (2) subject all registration addresses to verification during the registration process; (3) explore entering into agreements with other agencies, such as the Social Security Administration, to periodically authenticate IHP information; and (4) issue proper instructions to any future debit card recipients. FEMA and DHS stated that they have already taken actions to address these recommendations. These actions include instituting an Internet application process that will prevent all duplicate registrations from the Internet, implementing procedures so that call centers will no longer accept duplicate registrations with the same SSN in the same disaster, and conducting conference calls and conducting data sharing tests with SSA. In addition, DHS and FEMA stated that, starting in June 2006, all registration addresses (even phone-in) will be subjected to an online verification during the registration process. While these are steps in the right direction, we will follow up on whether the actions taken fully address our recommendations. FEMA and DHS partially concurred with our recommendation concerning duplicate payments. FEMA and DHS took exception with our categorization of some payments as being potential duplicates, and with our assessment that they should initiate actions to collect duplicate EA payments or offset these amounts in the future, stating that it was unclear whether some of the of the payments were in fact valid due to the “separated households” policy instituted for hurricanes Katrina and Rita. With respect to duplicate registrations, we maintain that these registrations are very likely duplicates because the payments were made to several individuals with the same last names, same damaged addresses, and the same current addresses; FEMA’s own database clearly indicates that these were not separated households. For all our case study examples, we conducted further investigative work to confirm that the payments were made to actual duplicates, not covered by the separated household policy, and were therefore improper payments. As for initiating actions to collect duplicate payments, DHS and FEMA stated that they had processed for recoupment nearly all the payments they believed were duplicates as of April 1, 2006. While we have not assessed the effectiveness of FEMA’s recoupment process, we continue to believe that FEMA should attempt to recoup as many dollars of improper payments as possible, including those duplicate payments that we identified that FEMA questioned. FEMA also stated that many of what we identified as duplicate payments effectively will be offset because the registrant will ultimately be eligible for more than the amount of the duplicate payments, up to a maximum of $26,200 that a single household can receive. We believe that FEMA’s position is shortsighted because it does not reflect the likelihood that some individuals are not entitled to, and will not receive, additional funds regardless of the cap limitations. Thus, FEMA should not use $26,200 as the aggregate dollar test. Rather, FEMA should follow its own policy of limiting EA to $2,000; adhere to the statutory caps that are allowed for specific categories of aid; and promptly recover the amounts that exceed the category limits. Therefore, we continue to believe that FEMA should review all the registrations we identified as potential duplicates to access whether collection is necessary. We also disagree with FEMA’s statement that its “management was keenly aware” that a recipient could receive more than one EA payment, and that it knowingly issued these duplicate payments partly because individuals in shelters did not have access to their banking institution (and thus their EA payments) and therefore were in need of immediate assistance in the form of debit cards. While we recognize that providing individuals access to immediate funds was a priority following the hurricanes, FEMA’s data and its representations made to us months ago do not support its claim that it knowingly made those payments. For example, when we questioned the official responsible for managing FEMA’s national disaster assistance processing center about the more than duplicate 5,000 EA payments to individuals who had already received debit cards, he told us that he was unaware of the magnitude of the duplicate payments. After researching the issue, he informed us that the duplicate payments in question were made as a result of a “system glitch” and not as a result of a deliberate action on the part of FEMA management. In addition, the more than 5,000 duplicate payments in question were all made within the span of several hours roughly a week after FEMA completed issuing all the debit cards. An analysis of the more than 5,000 duplicate payments indicates that there was no apparent reason why only about half of the roughly 10,000 debit card recipients received the duplicate payments. Using FEMA’s rationale, all 10,000 registrants who received a debit card should have received a duplicate EA payment. FEMA and DHS partially concurred with our recommendation to establish identity verification processes for IHP registrants applying via the phone and Internet. FEMA and DHS stated that they had implemented identity proofing on call center applications. As noted in our report, FEMA instituted identity proofing for Internet registrants at the time of the two hurricanes, and FEMA and DHS response to our report indicates that FEMA instituted identity proofing for call center registrants. In future work, we will follow up on whether these actions fully address our recommendations. FEMA and DHS additionally commented that they did not see the necessity of requiring registrants to also provide their name exactly as it appears on their Social Security Card, noting that their data contractor is able to use logic to find aliases and nicknames. While we do not object to FEMA collecting the nicknames or aliases of registrants applying for disaster assistance, we continue to believe that registrants should be instructed to provide their name as it appears on their Social Security Card to prevent name and social security mismatches. Instructing registrants to provide the name that appears on their Social Security Card can only help—not hinder—the registrant verification process. FEMA and DHS’s responses indicate that they are attempting to address some of the systemic problems we identified in the IHP program. Going forward it will be important for FEMA to establish effective controls to prevent fraudulent and improper payments before they occur, because fraud prevention is a far more effective control than detecting improper and potentially fraudulent payments after they are made. Our experience with organizations that rely on a process that attempts to detect improper and potentially fraudulent payments after they are made is that the organization recovers only a fraction of the payments that should not have been made. We are sending copies of this report to the Secretary of the Department of Homeland Security, and the Director of Federal Emergency Management Agency. We will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Please contact me at (202) 512-7455 or kutzg@gao.gov if you or your staffs have any questions concerning this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. A result of wdespred congressinaanpubinterein the federl respnse to hrranKtrina anRi, GAO cocted an aut of the Iua and Household Prom (IHP) under Comtroller Geerl of the United Ste tory authory. We deed signiant fl in the rocess for registeringisaster vcttht leve the federovermet verable to frauanabuse of EA paymes. For Iteret appns, lted automted cotrol were in pce to ver registran’s dey. However, we founindedet ver of the de of registran who registered for disaster assisance over the teleho. To demonstrte the verabi inherein the cll-in appns, we used fsied de, gus ddress, and fabted disaster tor to register for IHP. Below is copy of oe of the $2,000 check tht we receved to dte for ogus telehoappns. Hrran Ktrina anRidetroed homes and dispced mllns of inuas. I the wke of thenal disaster, FEMA fced the chllenge of roving assisance quickl and wth mini“red tape,” whle hing sufft cotrol to rovde assuance thef were paid oto eligible inuas and households. I respnse to this chllenge, FEMA rovded $2,000 in IHP paymeto ffected householdia Expedted Assisance (EA) ro. Vctwho receved EA mayua for up to $26,200 in IHP assisance. A of md-Decemer 200, IHP paymetotled abt $5.bill, wth $2.bill rovded in the form of EA. Thepayme were mde via check, electronic fund transfer, an ll nuer of debit crds. We o found tht FEMA’s automted system freqtl deed oteiall fraulet registrns, such asltiple registrnsth deociaec nuer (SSN) but dffereddresss. However, the manuarocess used to revew thee registrnsot revet EA and other payme from ing issued. Other cotrol wess inclde the lck of any of daged roert ddress for oth Iteret and telehoe registrns. GAO’s temonyll rovde the result to dte relted to whether (1) cotrol re in ce and oering effectvel to lt EA to quaed appan, (2) inns xist of frauanabusin the appfor and receipt of EA and other payme, and (3) cotrol re in ce and oering effectvel over debit crd to revet dupte EA payme anroer usag. Gve the wek or xistet cotrol, is ot suising tht or dining aninveigans to dte how the oteial for subsanial frauanabuse of EA. Thousan of registranisused SSN, i.., used SSN tht were ever issued or elonged to deceased or other inuas. Or cas inveigans of everl hundred registrns inte signiant misuse of SSN and the use of gusaged roert ddresss. For exale, or visi to over 200 of the casaged roert in Texas and Louisiana howed tht least 80 of theroert were gus—inclingant lot anxisteapartmes. www..gov/cg-bin/getrpt?GAO-06-403T. To vew the fll prodct, nclng the cope nd methodology, clck on the lnk above. For more nformon, contct Gregory Ktz t (202) 512-7455 or ktzg@g.gov. We found tht FEMA o mde dupte EA payme to ab,000 of the rl 11,000 debit crd recipi—oce through the distribu of debit crd anagain by check or electronic fun transfer. We found tht whle debit crd were used redominantl to oainash, food, clothing, anernaecessi, ll nuer were used for lt etertainmet, baiervce and weapns purchase, whch do ot appr to tem or ervcethre essial to saisisaster relted essiaeeds. Cairman and Memer of the Commttee: Than for the opportuni to disussr onging forensiauand relted inveigans of assisance rovded to inua and householdrelted to hrran Ktrina anRia. The Iua and HouseholdProm (IHP), ajor comt of the federl disaster respnse effortabished under the Rert T. Sfford Disaster Relef and EmerAssisance Act (Sfford Act), is designed to rovde finaniaassisance to inua and household who, as rect result of ajor disaster, hve ecessaxpns anerus eed tht cannot e met through other means. A of md-Decemer 200, the Federl Emer Managemet A (FEMA) hd distributed rl $5.bill in IHP assisance o more thanll registrns. Hrran Ktrina anRi detroed home and dispced inua cross the gulf coast regin. I the wke of thee massive nal disaster, FEMA fced the formable chllenge of roving t leasome iniiaassisance to over ll registranuicklth mini“red tape,” whle hing sufft cotrol in ce to rovde assuance thef were paid o to eligible inua and households. Disaster relef covered by IHP inclde temor housing assisance, reanernaroert repaiand recemet, and other ecessaxpns relted to isaster. IHP assisance is erll delvered fter an inspectas ee cocted to ver the etet of loss and determine eligibiy. Because of the tremedous devasaused byrran Ktrina anRi, FEMA ctted expedted assisance to rovde fast trck mo—in the form of $2,000 inxpedted assisance payme—to eligible disaster vct to helth mmediate, emer eed of food, helter, clothing, anernaecessis. This ft respnse wasin helpingct of hrran Ktrina anRia. FEMA speced tht expedted assisance payme were to rovded o to inua and household who, as result of hrran Ktrina anRi, were dispced from theredisaster residece anPub. L. 93-288, 88 S. 143 (1974) (meded 2000). ted assisance rocess is ot specll authorzed in the Sfford Act. However, FEMA revusas asserted, and we hve agreed, tht has legaauthor under the ct to lemet expedted, or fast trck, rocedres. Disster Assistance: Gidance Needed for FEMA’s “Fst Tr” Hosig Assistance Process, GAO-RCED-98-1 (Wasingto, D.C.: Oct. 1997). were in eed of helter. Typill householdan receve oxpedted assisance payme. Ecens re mde in siuans where household memer re dispced to pate locns, in whch case more thane memer of the household may e eligible for paymes. FEMA rovded expedted assisance payme relted to hrranKtrina anRi redominantl through electronic fun transfer (EFT) and check t to the registrans’rreddresss. I dd, FEMA rovded ted mount of expedted assisance via debit crdistributed t three locns in Texas. A of md-Decemer 200 howed tht the agd delvered 44 ercet ($2.) of the $5. in IHP aid through expedted assisance to hrran Ktrina anRi registran cross t least 17 coun in 4 dfferetes. Almot $1.bill wet to inuath daged ddress in Louisiana, more than $400 mll to inua in Texas, and over $300 mll to inua in Alabaa and Mississippi. Rgistran determined to e eligible for expedted assisance may e eligible to receve ddnal IHP payme up to the overll IHP cap of $26,200. Or crreauaninveiga is ing erformed under the tor author give to the Comtroller Geerl of the United Stes. Oauaninveiga is cocted under the remise tht whle the federovermeeed to rovde ft and compassinate assisance to the vct of nal disaster, pubc codece in an effectve disaster relef rom tht tke ll ssible teps to minize fraud, waste, anabuseed to reerved. Today, we wll summze the result from or onging forensiauand relted inveigans of the IHP ro. The Act’s lemeing reguns defin household as ll erns (incling lt and chldre) who lved in the redisaster residece, as well as any other erns ot ret the tme but who re expected to reting the assisance erod.C.F.R. §.. Curreddress refer to the ddress t whch the disaster vctisrretl resiing. Daged ddress re the ddress whch were ffected by the hrrans. The debit crd rois pilot rolemeted to rovde expedted assisance to inua and householdhoused t three Texas helters. The debit crd, whch reemle credt crd anr the MasterCard loo, can used t ATM anany commercial otlet thcce MasterCard. re o releasing today the result of or lted inveiga into llegans tht M Me, R-To-Et rns inteded for usin the hrrane relef effort were insteold to the pubc o the Iteret auct site eBay. See GAO, Ivestigtion: Militry Mels, Redy-To-Et Sold o eB, GAO-06-410R (Wasingto, D.C.: Feb. 13, 2006). This temonyll rovde the resultof or work relted to whether (1) cotrol re in ce and oering effectvel to lt expedted assisance to quaed registran, (2) innsxist of frauanabusin the registr for and receipt of expedted assisance and other payme, and (3) cotrol re in ce and oering effectvel over debit crd to revet dupte payme anroer usag. We an to issu detailed reort wth recommens the result of oau. Thusr, or work has focused the IHP registr rocess ecausinua whoe registrns re approved hve ccess to expedted assisance payme ansubseqtl the fll range of IHP efs. To assss the design of cotrol, we erformed wlkthroug of FEMA’s rocess for cceing registrns anrdingxpedted assisance funs. To determine whether innsxisted of frauanabusinxpedted assisance and other disbueme, we rovded FEMA d to the SociaSec Administr (SSA) to ver against ther record of vociaecy nuer (SSN), and revewed the FEMA dabase of IHP registrns for other anom usingining technis. To determine whether registrns resulted in oteiall fraulet or roer payme, we elected rereve elect of 248 registrns from or dining result for frther inveigans. The 248 registrns rereted 20 cas—ome involvingltiple registran—tht we linked toether througdename, SSN, daged ddress and/or crreddresss. Oanaysis of oteiall frauleuse of SSN and other dining effort re onging, and we an to reort o ddnal result in the fre. For pu of this temony, we dot coct sufft work to roect the magnide of oteiall frauleanroer IHP paymes. We roctvel teted the dequa of cotrol over the registrn process for disaster assisance by subtting clai for relef usingsied de, gus ddress, and fabted disaster tors. Thee te were erformed efore FEMA rovded us any inform relted to the rocess used to cree IHP registrns anreclde ome fraulet registrns. Addnal detaicoand methodologi re inclded in appix I. we reqted has ot ee rovded. O Janua 18, 2006, the Departmeof HomelanSec (DHS) Offce of GeerCunsel drovde usth well less thanlf of the docme tht were reqted. Whle the dabasand other d rovded by FEMA enabled us to design procedre to tet the effectvess of FEMA’s system of internal cotrol, t dot enable us to fll determine the root caus of wek or - existet cotrol and formte detailed recommens. For exale, asll e disussed lter, FEMA and the DHSot rovded us docme to enable us to coclusivel determine the reas tht FEMA subtted ome registrns, and dot subt other registrns, to den por to issuingxpedted assisance paymes. We cocted oauaninveigans from Octoer 200 through Janua. Ecet for retrctnsisussed revus relted to the lns tht DHS ced o the coe oaut work, we cocted oaut work in ccordance wth erll cceted overmeauing anrd and cocted inveigave work in ccordance wth the anrd recribed by the Preside’s Cunl o Ite and Effy. Or finings today focus the result to dte from of or dining aninveigave technis. We found wek or xistet cotrols in the rocess tht FEMA used to revew disaster registrns anapprove assisance payme tht leve the federovermet verable to frauanabus. I the crftermth of hrran Ktrina anRi, FEMA moved ftl to distribute expedted assisance payme to llow disaster vct to migate and overcome the effect of the disasters. I this cotet, the eabishmet of an effectve cotrol eromet was signiant chlleng. Specll, we found tht FEMA hlemeted ome cotrol or to the disaster to rovde automted v of the de of registran who apped for assisance via the Iteret. Or work thusinte tht this resulted in FEMA reecting ome registran who rovded name anSSN tht dot pass the vte. However, FEMA dot lemet the same reveve cotrol for thoe who apped via the teleho. Ouse of fctus name, gus ddress, and fabted disaster tor to oainxpedted assisance der the Act’s lemeing reguns, FEMA may recover fun tht determin were rovded erroeous, tht were spinapproiatel, or were oained through fraulet means.C.F.R. § .116 () payme from FEMA demonstrted the ease wth whch expedted assisance cold e oained by rovinginform over the teleho. Because expedted assisance is gateway to frther IHP payme (up to $26,200 er registr), approvl for expedted assisance payme oteiallxp FEMA, and the federovermet, to more frauanabuse relted to temor housing, home repaiand recemet, and other eed assisance. Ding the coe of oauaninveiga, FEMA offia ted tht theot ver whether registraninsuance and whether registran were unable to lve in ther home or to approvingxpedted assisance paymes. According to FEMA offia, the unprecedeted le of the two disaster and the eed to move quickl to migate thepact led FEMA to lemet expedted assisance. Expedted assisance dffer from the trnal way of delveringisaster assisance in tht cll for FEMA to rovde assisance wthot requiing roof of loss and verying the etet of such losss. Cnseqtl, FEMA lemeted lted cotrol to ver eligibi for the iniial expedted assisance paymes. According to FEMA offia, thee cotrol were retrcted to determining whether the daged residece was in the disaster re and lted vof the deof registran who used the Iteret. Rgistran who FEMA thought met thee quans based o ther lted assssme were deemed eligible for expedted assisance. FEMA lemeted dffererocedre whe rocessingisaster registrns subtted via the Iteret and telehoe clls. Of the more than.5ll registrns recorded in FEMA’sabase, i.., registrns tht were successll recorded—60 ercet (more than.5 ll) were eemt from any de ver ecause the were subtted via the teleho. Pror to ingt expedted assisance payme, FEMA dot hve rocedre in ce for Iteret or telehoe registrns thcreeed ot registrns where the lleed daged ddressas gus ddress. The lck of de ver for telehoe registrns anany ddressxped the overmet to frauanabuse of the IHP ro. aiing the Iteret, the FEMA cotrctor took teps to ver registrans’ des. The ver teps involved corming tht the SSN mtched wth SSN in pubc record, tht the name anSSN combinatched wth an de registered in pubc record, and tht the SSN was ot associated wth deceased inua. The FEMA cotrctor was respnsible for locking any registrns for whch any of thee three consas ot met. Addnall, registran who passed the fgate hd to rovde answer to nuer of qns aimed t frther corrooring the registrans’ des. Rgistran who were reected via the Iteret were dvised to coct FEMA via teleho. Oauaninveigave work inted tht this vern process heled deter ous fraulet Iteret registrns usingname anSSNs. However, FEMA keo record of the name, SSN, and other inform relted to the reected registrns, ano record of the reasns tht the FEMA cotrctor locked the registr from ing forwrd. FEMA ckowleded tht was coceable thinuawho were reected ecause of finform subtted via the Iteret cold et expedted assisance payme by roving the same finform over the teleho. Although the de ver rocess appred to hve worked for mot Iteret registrns, t dot de ll nuer of registrnsth inSSNs. According to inform we receved from the SSA, rl 60 Iteret registran who receved FEMA payme rovded SSN tht were ever issued or elonged to inua who were deceased or to the hrrans. Rsult inte tht theinuaayve passed the ver rocess ecauspubc record used to ver registrans’ de were flwed. For exale, oe credt histor we oained inted th registrant hd eabished credt histor using an inSSN. verfor telehoe registrns sir to thoused for the Iteret. FEMA o rereted to us tht de to buet constrain another considerns, the change was ot lemeted inme to respd to hrran Ktrina anRia. However, to dte we hve ot receved docme to vte thee rerens. The lck of de ver of hoe registran or to disbusingunke FEMA verable to authoringxpedted assisance payme based o frauleinform subtted by registrans. Pror to oaining inform the cotrol rocedre FEMA used to authorze expedted assisance payme, we teted the cotrol by tteming to register for disaster relef through two orts: (1) the Iteret via FEMA’s We site and (2) telehoe cll to FEMA. For oth ort, we teted FEMA’s cotrol by rovingsied de angus ddresss. I ll insance, FEMA’s We site dot llow us to successllinaze or registrns. Insted, the We site inted tht there were rolemth or registrns andvised us to coct the FEMA toll-free nuer f we thought tht we were eligible for assisance. This is consistet wth FEMA’s rere tht Iteret registrns were compared against thrd-part inform to ver des. Oinveigave work o cormed tht the lck of sir cotrol over telehoe registrnsxped FEMA to frauanabus. Specll, in insance where we subtted via the telehoe the same exact inform tht hee reected o the Iteret, i.., fsied de angus ddress, the informas cceted as. Subseqtl, the clai were rocessed and $2,000 expedted assisance check were issued. Figure 1 rovde anxale of anxpedted assisance check rovded to GAO. rovde assuance tht the disaster ddressas ot gus ddress, ther for Iteret or telehoe registrns. FEMA’s cotrolailed to revet thousan of registrnsth dupte inform from ing rocessed anpai. Or work inte tht FEMA insted lted automted checkthin NEMIS to de registrns coaining upte inform, e.g., mltiple registrns th the same SSN, dupte daged ddress telehonuer, and dupte bank roing nuers. D FEMA rovded enabled us to corm tht NEMIS deed rl900,000 registrns—ot of 2.5ll totl registrns—as oteial duptes. FEMA offiarther rereted to us tht the registrns deed asupte by the system were “frozen” from frther payme unddnal revew cold e cocted. The pue of the ddnal revewas to determine whether the registrns were tre dupte, and therefore paymes shold coinue to e denied, or whether innsxisted tht the registrns were ot tre dupte, and therefore FEMA hold mke thopaymes. It appred from FEMA d tht the automted check and the subseqt revew rocess reveted hundred of thousan of payme from ingde oupte registrns. However, FEMA d and or cas inveigans inte tht the ddnal revew rocessas ot erel effectve ecausllowed paymes based oupte informn. We o found tht FEMA dot lemet effectve cotrol for telehoand Iteret registrns to ver tht the ddress claimed by registran as ther daged ddressxisted. All e disussed frther elow, many of or cas of oteial frauhow thpayme were receved based o claide lising gusaged ddresss. Oundercover work o corroorted tht FEMA rovded expedted assisance to registranth gus ddresss. thousan of doll of IHP payme based o frauleand dupte informn. Thee cas re ot isolted insance of frauanabus. Rather, or dining result to dte inte tht the re llustrve of the wder internal cotrol wess t FEMA—cotrol wess tht led to thousan of paymede to inua who rovded FEMA wth incorrect inform, e.g., incorrect SSN angus address, and thousan more mde to inua who subtted mltiple registrns for paymes. Oau aninveigans of 20 cas demonstrte tht the wek or xistet cotrol over the registr anpaymerocessve oed the door to roer payme aninua eeking to oain IHP payme through fraulet means. Specll, ajor of or cas registrns—16 of 248—coained SSN tht were ever issued or elonged to deceased or other inuas. At 20 of the 248 registrns we revewed were subtted via the Iteret. Frther, of the over 200 lleed daged ddress tht we tred to visit, abt 80 dot exis. Some were vant lot, othered ot to gus apartmebuildings anunis. Because the hrrand detroed many home, we were unable to corm whether abt 1 ddnaddressd ever existed. We deed other fraucheme unrelted to the weanxistet v anrepaymet cotrol revusisussed, such as registran who subtted registrns usingddress tht were ot ther resideces. I totl, the cas registran of whom we cocted inveigans ve collected hundred of thousan of doll in payme based o oteiall fraulects. Thepayme inclde mo for expedted assisance, reassisance, and other IHP paymes. Frther, asr work roress, we re uncovering evdece of ler cheme involvingltiple registran thre inteded to defraud FEMA. We found thecheme ecause the registran red the same lasname, crreddress, and/or daged ddress—ome of whch we were able to corm dot exis. Whle the fct surrouning the cas rovded usth intor thoteial fraud mayve een peretrted, frther teing aninveigans eed to e cocted to determine whether theinua were intenall trying to defrauus intor such as dename, SSN, daged ddress, and crreddress to link mltiple registrns toether into the 20 cass. the overmet or whether the discrepan aninacc were the result of other errors. Cnseqtl, we re coctingrther inveigans into thee cass. Table 1 highlight 10 of the 20 cas we deed through dining tht we inveigated. I dd, ome inua in the casted elow subtted ddnal registrns but hot receved payme as of md Decemer 2005. Bogus Properties Used to Receive At least 10 Seventeen ndua receved pyment on 36 registronusing 34 SSN tht were not thes. Of the 17 ddress we visited, 13 were from the same rtment buildng, of whch 6 dd not exis. ddonddress were nv. Pyment nclded 31 expedted assisnce pyment totng $62,000, nd 18 n other pyment, nclng rentl pyments. At least 8 One ndual receved pyment on 15 dfferent SSN—only one of whch elonged to tht peron. Inveve work howed tht 3 ddress were vbut were not ddress of the registrnt. Pyment nclded 13 expedted assisnce pyment totng $26,000 nd $15,000 n other assisnce, nclng housing. The ndual my hve commtted bank frauusing nvSSN to open ccont. The ndual hd eabished credusing 2 SSN tht dd not elong to the ndua. None One ndual receved 8 expedted assisnce pyment using the same nme, SSN, nd crrent ddress. Of the 8 ddress declred asged, two ppered to elong to the ndua. FEMA’ automted ed dented t least 7 registron as plte, neverthelessyment were issued. At least 14 Two ndua receved expedted assisnce pyment on 23 SSN – 21 of whch were not thes. Pubc records indte tht the nduad not lve ny of the 9 vddresss. Pyment nclded 22 expedted assisnce pyment nd 1 housing assisnce pyment. Bogus Properties Used to Receive At least 10 Sinduareceved 38 pyment on dfferent SSN—only 1 of whch was trced back to them. Pyment nclded 37 expedted assisnce pyment totng $74,000 nd over $2,000 n other assisnce. Indual receved 18 expedted assisnce pyment using the same nme nd 18 dfferent SSN—only 1 of whch elonged to the peron. Inveve work nd pubc record ndte tht the ndual hd never lved ny of the 6 remaing vddresss. At least 22 A grop of 8 ndua receved pyment on 31 registronusing 26 SSN tht dd not elong to them. 22 of the registron were for ddress tht dd not exis. The remaing ddress were not vted. Pyment nclde 32 pyment for expedted assisnce nd over $28,000 for other assisnce nclng housing assisnce. None Sipprent memer of the same household registered 6 me using the same dged ddresss. Fve of the 6 nduas ared the same crrent ddress. Pyment nclded 5 expedted assisnce pyment nd $13,000 n other pyment nclng housing assisnce. None Seven pprent memer of the same household receved yment using the same dged ddress. One fly memer used SSN tht dd not elong to the ly memer. Six of the 7 ndua red the same crrent ddress. Pyment nclded 7 pyment for expedted assisnce. None Seven pprent memer of the same household registered using the same dged ddress. Pyment nclded 6 expedted assisnce pyment nd $68,000 n other assisnce. Amont reflecttotl pyment for IHP, whch nclde expedted assisnce, temporry housing assisnce, pyment for repaind replcement of rend peronl property, nd pyment for other needs such as medl, trporton, nd other necessis. One ddress cold associated wth mltple registrons. The following rovde llustrve detailed inform everl of the ass. Casnuer 1 involveinua, everl of whom hd the same lasname, who subtted t least 36 registrns claiing to e disaster vct of oth Ktrina anRia. All 36 registrns were subtted through the telehoe, using 36 dffereSSN and 4 dfferet crreddresss. Theinua used ther ow SSN 2 of the registrns, but the remainingSSN were ever issued or elonged to deceased or other inuas. The inua receved over $103,000 in IHP payme, incling $62,000 inxpedted payme and $41,000 in payme for other assisance, incling temor housing assisance. Oanaysis how tht the inua claimed 13 dfferet daged ddressthin single apartmebuilding, and 4 other ddressthin the same lock in Louisiana. However, oysiinspect of theddress reveled tht 10 of the ddress were gus ddresss. Frther auaninveigave work how tht theinuaay ot hve lved any of the vd disaster ddress t the tme of hrran Ktrina anRia. We re cocting addnainveigans thisas. Casnuer 2 involve an inual who used 1ffereSSN—oe of whch was the inua’s ow—to subt least 1 registrns over the teleho. The inual claimed fferet daged ddress ll 1 registrns, anused 3 dfferet crreddress—incling t offce , where the inual receved paymes. The inual receved 16 payme toting over $41,000 o of the registrns. I ll, the inual receved 13 expedted assisance payme, 2 temor housing assisance payme, ananother paymet of $10,. Frther inveigave work discloed tht the inual mayve commtted bank frauby using SSN to o banccoun. Other pubcl aiable record inte tht the inual hused 2 SSN tht were issued to other eole to eabish credt histors. thee registrns as oteial duptes. I spite of the edt flags, FEMA clered the registrns for roer expedted assisance paymes. Casnuer 4 involveinua who appr to e ling toether the same crreddress in Texas. Thee 2 inua receved paymefor 23 registrns subtted over the telehousing 23 dffereSSN— two of whch elonged to them—to oain more than $46,000 inisaster assisance. The inform the registran rovded relted to many of the disaster ddress appred f. The ddressther dot exist, or there was roof the inuad ever lved t theddresss. Casnuer 8 relte to 6 registranth the same lasname who registered for disaster assisance using the same daged ddress, wth of the 6 using the same crreddress. FEMA crteria spec thinuawho reside toether t the same ddress and who re dispced to the same ddress re etled to oe expedted assisance payme. However, ll 6 ssible f memer receved 12 payme toting over $23,000—$10,000 inxpedted assisance and more than $13,000 in other assisance, incling reassisance. The cas we deed and reorted re ot isolted insance of oteial frauanabus. Rather, or dining result how tht the re inve of frauanabusd thee cas, anint drectl to the wess in cotrol tht we hve deed. The wess deed through dining inclde ineffectve cotrol to detect (1) SSN tht were ever issued or elonged to deceased or other inua, (2) SSN used more thance, and (3) other dupte informn. tch wth the name rovded o the registrns. A revus isussed, frther teing aninveigans eed to e cocted to determine whether this inual was intenall trying to defraud the overmet or whether the discrepan aninaccwere the result of other errors. Or dining and cas clerl how tht FEMA’s cotrol do ot reveinua from mingltiple IHP registrns using the same SSN. We found thousan of SSN tht were used o more thane registr associated wth the same disaster. Becausan inual can receve disaster relef ois or her residece an SSN is uninuer assigned to an inual, the same SSN hold ot used to receve assisance for the same disaster. This rolem is llustrted inase 3 above, where an inual registered for IHP 8 tme using the same name, same SSN, ansame crreddress—and thus cold hve quaed for o 1 expedted assisance payme—buinsted receved expedted assisance payme of $2,000 for 8 dfferet registrns. Or dining and cas how tht the IHP cotrol to revet dupte paymeot revet FEMA from ming paymeto tens of thousan of dfferet registran who used the same ke registr informn. FEMA’s eligibi crteria spec thinuawho reside toether t the same ddress and who re dispced to the same ddress re typilltled to oe expedted assisance payme. FEMA ol rovde for expedted assisance payme to more thane memer of the household in unusual crcance, such as whe household wasispced to dfferet locns. However, oth oinveigans and dining found thousan of insance where FEMA mde more thanpaymet to the same household thred the same lasname and daged and crreddresss. A llustrted inase 8, of 6 inuath the same lasname, the same daged ddress, and the same crreddress receved mltiple expedted assisance payme, insted of just oe for whch theuaed. Whle ot ll of the registrns thused the same ke inform were subtted frauletl, ddnainveigans need to e cocted to determine whether or ot the ere fastled to expedted and other IHP assisance. U.S.C. § 1001, er who kowing and wllfllke anyterialle, fctus, or frauletemet or rere ll e fined or ised up to , or oth. Or dining o found tht FEMA mde dupte expedted assisance payme to tens of thousan of inua for the same FEMA registr nuer. FEMA ol te tht registran hold o receve oe expedted assisance payme. However, in ome cas, FEMA paiasany as for $2,000 expedted assisance payme to the same FEMA registr nuer. Aisussed lter, we o found tht FEMA issued expedted assisance payme to more than ,000 registran who hlre receved debit crds. FEMA offia rereted to us tht the trced ome of thee ousupte payme to computer error thinadvertetlaused the dupte paymes. However, the rovded supporting docmen. I the days followingrrane Ktrina, FEMA expermeted wth the use of debit crd to expedte payme of $2,000 to abt 11,000 disaster vct t three Texas helter who, ccording to FEMA, hd dfflt ccessing thebanccouns. Figure 2 is anxale of FEMA debit crd. helter were locted in Dllas, Housto, anSan Atoni. The debit crd rom was an effectve means of distribuing relef quickl to thoe moin eed. However, we found thecause FEMA dot vte the deof debit crd recipi who registered over the telehoe, ome inua who supped FEMA wth SSN tht dot elong to them o receved debit crds. We o found tht cotrol over the debit crd rom were ot effectvel designed anlemeted to revet debit crd recipi from receingupte expedted assisance payme, oce through the debit crd anagain through check or EFT. Finall, unke the guiance rovded to other IHP registran, t the tme FEMA distributed the debit crd, FEMA dot rovde instrctns informing them tht the fun ther crdusused for approiate pus. Aisussed revus, FEMA dot ver the de of inuas and/or household who subtted disaster registrns over the teleho. This wess occrred in the debit crd roas well. FEMA required the comlet of isaster registr or to household or inuaing able to receve debit crd. According to FEMA offia, registran t the three ceter apped for assisance via the telehoand Iteret. Therefore, to the etet tht registrns for the debit crd were tke over the telehoe, FEMA dot subject the de of the registran to ver rocess. Cnseqtl, we deed 0 debit crd issued to registranising SSN tht the SSA ho record of issuing, and 12 crd issued to registran using SSN elonging to deceased inuas. For exale, oe registranused an inSSN to receve $2,000 debit crd anused abt $00 of tht mo to pay or trffc volns to reinste drver’scens. I another case, registranused the SSN of an inual who ded into receve $2,000 debit crd. FEMA subseqtl desited an ddna$7,in IHP payme to tht debit crd ccount for ddnal clai subtted by thinua. This registrant wthdrew mot of the $9,4 desited into the debit crd ccounbyaining ATM cash wthdrs. to ther home ddress or banccoun and therefore eeded mmediate assisance in the form of debit crds. Or revew of FEMA d isproved FEMA’s elef tht o few inua who receved debit crd o receved other disaster assisance paymes. Insted, thousan, or rllf, of the inua who receved debit crd o receved check or EFT tht were mde everl days fter the debit crdee issued. The result was tht FEMA paid more than $10 mll doll inupte expedted assisance payme to inua who hlre receved ther $2,000 of expedted assisance. I erl, oce FEMA receve isaster registr, FEMA package coaining IHP inform and detailed instrctns, incling instrctns how to follow up ef, how to appf denied ef, and the roer use of IHP paymes. However, FMS and FEMA offia informed us tht FEMA dot specll rovde instrctns how the debit crd hold o used for ecessaxpns anerus eed relted to the disaster t the same tme the debit crd were distributed. We found thin isolted insance, debit crd were used for lt etertainmet, to purchase weapns, and for purchas assagparlor tht hee revusaided by locolce for ron. Oanaysis of debit crd transact rovded by JP Morgan Case found tht the debit crd were used redominantl to oainash whch dot llow us to determine how the moas ctuall used. The major of the remaining transactnsas associated wth purchas of food, clothing, anernaecessis. Figure 3 how rekdow of the typ of purchasde byrdholders. FEMA has subsanial chllengin baaning the eed to et mot quickl to thoe who re ctuall in eed ansusaining pubc codece inisaster ro bying ll ssible teps to minize frauanabus. Based or work to dte, we eleve tht more can e doe to revet fraud through v of de and dagddress and eanced use of automted system ver inteded to revet fraulet disbuemes. Oce fraulet registrns re mde anmo isisbued, detecting anpusuing thoe who commtted frauin a comrehensive manner is more cotl and may ot result in recovers. Frther, many of thoe frauletlregistered in the FEMA system lre receved expedted assisance and wll lkel receve more mo, asch registrant can receve asch as $26,200 er registrn. Aother ke elemet to reveing frauin the fre is to ensure there re conseqce for thoe tht commt frau. For the fraud cas tht we re inveigaing, we an to refer them to the Ktrina Fraud Task Force for frther inveiga and, where approiate, roecn. We eleve throec of inua who hve oained disaster relef paymethrough fraulet meansll message for fre disaster tht there re conseqce for defrauing the overme. MCairman and Memer of the Commttee, this coclde teme. I wold leased to answer anyns th or other memer of the commttee mayve t thisme. For frther inform abt this temony, lease coct Greor D. Ktz t (202) 12-74 or ktz@ga.gov. Cct in for or Offce of CngressinaRelns and Pubc Affaiay e found o the laspage of this temony. To assss cotrol in ce over the Federl Emer ManagemeA (FEMA)’s Iua and Household Prom (IHP), we intervewed FEMA offia anerformed wlkthroug t the Nnal Processing Servce Cter in Wincheter, Va. We revewed the Sfford Act, Pub. L. 93-288, the lemeing reguns, and FEMA’s instrctns to disaster registran aiable via the Iteret. I dd, to roctveltet cotrol in ce, we apped for assisance usingsied de, gus ddress, and fctusisaster tor to determinf IHP payme cold e oained based o frauleinformn. Because of everl key unanswered req for docme from the Departmet of HomelanSec (DHS), inform eeded to fll assss the expedted assisance rom wasted. For exale, FEMA and DHSot rovded us docme to enable us to coclusivel determine the reas tht FEMA subtted ome registrns, and dot subt other registrns, to de or to issuingxpedted assisance paymes. Cnseqtl, or work wasted to oanaysis of the FEMA dabas, inveigans we cocted, ddel aiable to the pubc via the Iteret, aninform FEMA offia orll rovded to us. To determine the magnide and chcteris of IHP payme, we oained the FEMA IHP dabasas of Decemer 2005. We vted tht the dabase was comlete and reliable by compaing the totl disbueme against reort FEMA rovded to the Snate Approians Commttee o Ktrina/Riisbuemes. We summzed the moun of IHP rovded byype of assisance anby loc of disaster ddress. paymes. We deed insance where roups of registranay ve ee involved in cheme to defraud FEMA. We found thecheme ecause the registran rovded the same SSN, lasname, crreddress, and/or daged ddress ther registrns. Or mcro anaysis of oteiall frauleuse of SSN and other dining re onging, and we an to reort ddnal result re dte. For pu of this temony, we dot coct sufft work to roect the magnide of oteiall frauleanroer payme of IHP. We o visited over 200 of the claimed daged ddress relted to or cas to determine whether or ot the ddress were v. To assss the typ of purchasde wth FEMA debit crdistributed t relef ceter, we revewed abase of transactns rovded by JP Morgan Case, the dministring bank for the debit crds. SSA assisted us to compare crdholder dth SSA record to determine whether registran receing debit crdrovded vdes. We erformed dining debit crd transactns to de purchas tht dot appr to inve of ecessaxpns as defined by the Sfford Act’s lemeing reguns. Finall, we vted specc transactns deed in the dabasbyaining inform ctuatem purchased from the vedors. I the coe of or work, we mde numerous wrtte req for ke docme anet of d relted to the IHP, mot ding back to Octoer 2005. Whle FEMA offia romtl comed wth oe ke part of or reqt—this FEMA mde aiable dabas of IHP registran anpayme—the major of tem reqted hve ot ee rovded. O Janua 18, 2006, the Departmet of HomelanSec Offce of GeerCunsel rovded usth well less thanlf of the docmetht were reqted. For exale, FEMA and the DHSot rovded us docme to enable us to coclusivel determine the reas tht FEMA subtted ome registrns, and dot subt other registrns, to den por to issuingxpedted assisance paymes. Whle the dabasand other d rovded by FEMA enabled us to design rocedre to tet the effectvess of the FEMA’s system of internal cotrol, t dot enable us to comrehensivel determine the root caus of wek or -existet cotrols. Octoer 200 through Januain ccordance wth erll cceted overmeauing anrd and qua anrd for inveigans as et forth by the Preside’s Cunl o Ite and Effy. GAO-0-403T This is work of the U.S. government nd is not subject to copyrght protecton n the Unted Stes. It me reprodced nd distributed entrety wthot frther permission from GAO. However, ecause this work my contain copyrghted ge or other mterial, permission from the copyrght holder me necessary f yoish to reprodce thisteriaeptely. The Govermet Accounabi Offce, the aut, evuan aninveigave rm of Cngress, exis to support Cngress in meeting consnal respnsibi and to hel rove the erformance anccounabi of the federovermet for the Ameran eole. GAO exain the use of pubc funs; evuate federro anols; anrovde anays, recommens, and other assisance to help Cngresske informed oversight, ol, and funing decisins. GAO’s commtmet to ood overmeis reflected in core v of ccounabi, inte, and reliabiy. The fasteand easit way to oain copi of GAO docme o cois through GAO’s We site (www.ga.gov). Ech weekday, GAO ewl released reort, temony, and correspdece o We site. To hve GAO e-mai ist of ewl ted rodct ever fteroo, o to www.ga.gov anelect “Subscribe to Utes.” The ft copy of ech inted reort is free. Addnal copi re $2 ech. A check or mo order hold e mde ot to the Superintedet of Docmes. GAO cce VISA and Mastercrd. Order for 100 or more copiailed to single ddress re discounted 2 erce. Order hold t to: U.S. Govermet Accounabi Offce 441 G Street NW, Room LM Wasingto, D.C. Gloria Jrmo, Managing Drector, JrmoG@ga.gov (202) 12-4400 U.S. Govermet Accounabi Offce, 441 G Street NW, Room 712 Wasingto, D.C. Paul Ader, Managing Drector, AderP1@ga.gov (202) 12-4800 U.S. Govermet Accounabi Offce, 441 G Street NW, Room 7149 Wasingto, D.C.

Summary: In the wake of Hurricanes Katrina and Rita, the Federal Emergency Management Agency (FEMA) faced the challenge of providing assistance quickly while having sufficient controls to provide assurance that benefits were paid only to those eligible under the Individuals and Households Program (IHP). On February 13, 2006, GAO testified on the initial results of its ongoing work related to whether (1) controls are in place and operating effectively to limit assistance to qualified applicants, (2) indications exist of fraud and abuse in the application for and receipt of assistance payments, and (3) controls are in place and operating effectively over debit cards to prevent duplicate payments and improper usage. GAO identified significant flaws in the process for registering disaster victims that leave the federal government vulnerable to fraud and abuse of expedited assistance (EA) payments. For Internet applications, limited automated controls were in place to verify a registrant's identity. However, there was no independent verification of the identity of those who applied for disaster assistance via the telephone. GAO demonstrated the vulnerability inherent in the call-in applications by using falsified identities, bogus addresses, and fabricated disaster stories to register for IHP. FEMA's automated system frequently identified potentially fraudulent registrations, such as multiple registrations with identical social security numbers (SSN) but different addresses. However, the manual process used to review these flagged applications did not prevent EA and other payments from being issued. Other control weaknesses include the lack of any validation of damaged property addresses for both Internet and telephone registrations. Given these weak or nonexistent controls, it is not surprising that GAO's data mining and investigations showed substantial potential for fraud and abuse of EA. Thousands of registrants misused IHP by applying for assistance using SSNs that were never issued or belonged to deceased or other individuals. GAO's case study investigations of several hundred registrations also indicate the use of bogus damaged property addresses. Visits to over 200 of these damaged properties in Texas and Louisiana showed that at least 80 of these addresses were bogus--including vacant lots and nonexistent apartments. FEMA also made duplicate EA payments to about 5,000 of the nearly 11,000 debit card recipients--once through the distribution of debit cards and again by check or electronic funds transfer. In addition, while debit cards were used predominantly to obtain cash, food, clothing, and personal necessities, a small number were used for adult entertainment, bail bond services, and weapons purchase, which do not appear to be items or services required to satisfy disaster-related needs.