Because of FEMA’s failure to establish basic upfront validation controls over registrants’ identity and address information, we estimate that FEMA made approximately $1 billion of improper and potentially fraudulent payments based on invalid registrations. This represents 16 percent of all individual assistance payments for hurricanes Katrina and Rita. The improper and potentially fraudulent payments included cases where individuals and households used invalid SSNs, used addresses that were fictitious or not their primary residence, and for submitted earlier registrations. These improper payments based on phony or duplicate registration data were not only restricted to the initial expedited assistance payments that we previously reported on, but also included payments for rental assistance, housing repair, and housing replacement. For example, rental assistance payments were made to registrants that used a post office box and a cemetery as damaged properties. In fact, as part of our ongoing forensic audit, FEMA continues to provide rental assistance to GAO based on registrations that contained fictitious identities and bogus damaged addresses. In one case, FEMA even sent GAO a check for expedited assistance after an inspector could not confirm that the property existed, and FEMA had decided not to provide housing assistance to this registration. Our projection likely understates the total amount of improper and potentially fraudulent payments since our examination of sample payments focused only on invalid registrations and did not include other criteria, such as insurance policies, which may make registrants ineligible for IHP payments. Based on our statistical sample we estimate that 16 percent of all payments were based on invalid registrations. We considered a registration invalid if it contained an invalid identity, invalid address information, or was paid from duplicate registration information. Some registrations failed more than one attribute. We drew our statistical sample from a population of 2.6 million payments made in the wake of hurricanes Katrina and Rita, totaling over $6 billion through mid-February 2006. Based on these results, we project that FEMA made about $1 billion in assistance payments based on improper or potentially fraudulent registrations. The 95 percent confidence interval associated with our estimate of improper and potentially fraudulent registrations ranges from a low of $600 million to a high of $1.4 billion in improper and potentially fraudulent payments. Table 1 shows the attributes we tested, the estimated failure rate in each attribute, and the overall projected failure amount. As shown in table 1, some registrations failed more than one attribute; therefore the total number of registrations which failed our attribute tests is less than the sum of the failures of each attribute. For example, all payments made to registrations containing bogus damaged property addresses also failed the primary residence test because the registrants could not have lived there at the time of the disaster. Additional details on the 39 registrants in our sample where we found a problem are as follows: Payments to Registrants Whose Damaged Property Address Was Not Their Primary Residence – Twenty six payments failed the primary residence test. These include individuals who had never lived at the damaged property, did not live at the damaged property at the time of the disasters, or used bogus property addresses on their registrations. We made these determinations after reviewing publicly available records, conducting site visits, and interviewing current residents and/or neighboring residents. We provide additional details related to failures in this attribute in table 2. Registrant received $2,000 in expedited assistance, $2,358 in rental assistance, and more than $15,000 in personal property replacement. Registrant originally claimed damage at a street address several houses away from the damaged property address currently in FEMA’s database. At some point in the disaster assistance process, the registrant made changes to the damaged property address. No physical inspection occurred at the damaged property. Personal property payment was based on geospatial data due to the level of devastation in the area. GAO reviews of publicly available information and credit report data showed that the registrant had never lived at the damaged property address for which she was paid. Registrant used valid physical property as damaged address to receive three payments for expedited assistance, rental assistance, and personal property replacement. GAO audit and investigative work found no evidence that the individual ever lived at the property. After receiving the payments, the registrant withdrew the application without ever having a physical inspection performed or returning the disaster payments to FEMA. Registrant used damaged property in Kenner, Louisiana, as primary residence to qualify for one expedited assistance payment and two rental assistance payments. Registrant did not live at property at the time of disaster. Owner of the property told us that the registrant had moved out of the damaged property a month prior to hurricane Katrina. Registrant used damaged property as primary residence to receive one expedited assistance and two rental assistance payments. Residents at the property had never heard of the registrant. Registrant used post office box in McIntosh, Alabama, as the damaged property address to receive expedited assistance and rental assistance. The local postal inspector stated that the post office box was linked to other individuals associated with known fraudulent activity. Payments to Duplicate Registrations—12 other payments in our sample failed because they were made to registrants whose damaged property addresses and current addresses had previously been submitted under other registrations and had received payments on those previous registrations. For example, one sample registrant submitted a registration containing the same damaged and current property addresses as those used previously by another registrant. Both registrations received payments for rental assistance for $2,358 in September 2005. Payments to Registrations with Bogus Property Addresses – Three payments in our sample were made to registrations containing bogus property addresses. For example, we found that one individual used several pieces of bogus information to receive expedited assistance. Specifically, the registrant used a SSN that was valid but the name did not match the name in records maintained by the Social Security Administration. The registrant also used a damaged property address in the 3000 block that was determined to be invalid through our on-site inspection, as street numbers on that street only went up to the 1000s. After the initial payment, the registration was withdrawn voluntarily by the registrant. In effect, this registrant was able to use completely bogus information to receive $2,000 from FEMA and then withdraw the registration to avoid further scrutiny. Payments to Registrations Containing Invalid Social Security Numbers — Two of the payments in the sample were made to individuals that used invalid SSNs (e.g., SSNs that have never been issued or SSNs that did not match the name provided on the registration). For example, one individual used a SSN that had never been issued to receive FEMA payments for expedited and rental assistance. Overall, we observed that 17 of our sample failures (44 percent) were related specifically to expedited assistance payments. The high level of expedited assistance-related failure was expected because these payments needed to be made quickly and, typically, prior to a physical inspection of the damaged property. However, we found that the other 22 failures (56 percent) were related to rental assistance and personal and real property repair and replacement payments. In its response to a draft GAO report, FEMA represented to us that all nonexpedited assistance payments, including the $2,358 in housing assistance payments, were subject to much more stringent requirements. Specifically, FEMA represented that the registrants had to demonstrate that they occupied the damaged property at the time of the disaster. However, the 22 failures we found indicate that these requirements were not effective in preventing improper and potentially fraudulent registrations from receiving nonexpedited assistance payments. Our estimate likely understates the total amount of improper and potentially fraudulent payments because we did not test our samples for all potential reasons why a disaster assistance payment could be fraudulent or improper. For example, our testing criteria did not include reviewing whether registrants had insurance policies that covered hurricane damages, which may have made them ineligible for IHP payments. We also did not test whether FEMA inspectors accurately assessed the damage to each sampled damaged property, or whether the registrants were displaced from their homes, an eligibility factor for rental assistance. During the course of our work, we found that these problems affected some of our sampled payments and, therefore, these payments may be improper or potentially fraudulent. However, because the problems did not relate to identity and address information, they passed our testing criteria. For example, an individual in our statistical sample provided a valid SSN and lived in a declared disaster area. However, the individual informed GAO that he did not incur any hurricane-related damage. Despite this fact, the individual received $2,000 in expedited assistance. We did not test whether registrants received duplicate benefits from other FEMA programs, such as free hotel lodging and trailers, which would have resulted in FEMA paying duplicate housing benefits to the same registrant. Later in this testimony, we provide examples where registrants received from FEMA free hotel rooms in addition to rental assistance. Finally, our estimate would include payments FEMA has identified for potential recoupment. Given the considerable amount of potentially fraudulent and improper payments identified in our statistical sample, it is not surprising that FEMA continued to provide rental assistance payments to GAO investigators based on bogus registrations. In one instance, rental assistance was made even after a FEMA inspector was unable to find the damaged property. Similarly, our sample testing and data mining work also identified additional examples of payments made on the basis of bogus information. In our previous testimony, we reported that we were able to obtain $2,000 expedited assistance checks from FEMA using falsified identities, bogus property addresses, and fabricated disaster stories. FEMA has continued to provide us with additional disaster-related assistance payments even after FEMA received indications from various sources that our registrations may be bogus. GAO has not cashed these checks and plans to return the checks to the Department of Treasury upon the conclusion of our work.