To address the concerns raised in our  February 13, 2006, testimony, we recommend that DHS and FEMA do the  following:  Establish an identity verification process for Individuals and  Households Program (IHP) registrants applying via both the Internet  and telephone, to provide reasonable assurance that disaster assistance  payments are made only to qualified individuals. Within this process  establish detailed criteria for registration and provide clear  instructions to registrants on the identification information required,  create a field within the registration that asks registrants to provide  their name exactly as it appears on their Social Security Card in order  to prevent name and Social Security Number (SSN) mismatches,  fully field test the identity verification process prior to   ensure that call center employees give real-time feedback to  registrants on whether their identities have been validated, and   establish a process that uses alternative means of identity  verification to expeditiously handle legitimate applicants that are  rejected by identity verification controls. Such  duplicate payments include  the payments made to IHP recipients who improperly received the  $2,000 debit cards and an additional $2,000 EA check or Electronic  Funds Transfer (EFT) and  the thousands of duplicate EA payments made to the same IHP  registration number. The primary findings of our work relate  to weak or nonexistent controls that leave the government vulnerable to  substantial fraud and abuse in the IHP. However, we continue to believe that accepting registrations for  individuals using invalid identity and damaged property information  subjects the federal government to a high risk of fraud and abuse beyond  EA payments. FEMA and DHS further noted that we made several references to isolated  incidents where debit cards were used for purchases that did not appear to  be for disaster needs, and FEMA questioned whether highlighting those  examples was appropriate. We also clearly stated that  over 60 percent of debit card transactions were used to obtain cash and  could not be tracked further to identify the final use of the IHP funds. Testimony on FEMA’s Control Weaknesses over Expedited Assistance for Victims of Hurricanes Katrina and Rita

	Highlights

A  result of wdespred congressinaanpubinterein  the federl respnse to hrranKtrina anRi, GAO cocted an aut of the Iua and Household Prom (IHP) under Comtroller Geerl of the United Ste tory authory. However, the manuarocess used to revew thee registrnsot revet EA and other payme from ing issued. Thousan of registranisused SSN, i.., used SSN  tht were ever issued or elonged to deceased or other inuas. For exale, or visi to over 200 of the casaged  roert in Texas and Louisiana howed tht least 80 of theroert  were gus—inclingant lot anxisteapartmes. were in eed of helter. of the $5. FEMA Did Not Validate Identity of Registrants Who Applied for Assistance via Telephone

FEMA lemeted dffererocedre whe rocessingisaster  registrns subtted via the Iteret and telehoe clls. Data Mining Indicates Potential Fraud and Abuse Beyond Our Case Studies

The cas we deed and reorted re ot isolted insance of  oteial frauanabus.
Why GAO Did This Study

In the wake of Hurricanes Katrina and Rita, the Federal Emergency Management Agency (FEMA) faced the challenge of providing assistance quickly while having sufficient controls to provide assurance that benefits were paid only to those eligible under the Individuals and Households Program (IHP). On February 13, 2006, GAO testified on the initial results of its ongoing work related to whether (1) controls are in place and operating effectively to limit assistance to qualified applicants, (2) indications exist of fraud and abuse in the application for and receipt of assistance payments, and (3) controls are in place and operating effectively over debit cards to prevent duplicate payments and improper usage.

What GAO Found

GAO identified significant flaws in the process for registering disaster victims that leave the federal government vulnerable to fraud and abuse of expedited assistance (EA) payments. For Internet applications, limited automated controls were in place to verify a registrant's identity. However, there was no independent verification of the identity of those who applied for disaster assistance via the telephone. GAO demonstrated the vulnerability inherent in the call-in applications by using falsified identities, bogus addresses, and fabricated disaster stories to register for IHP. FEMA's automated system frequently identified potentially fraudulent registrations, such as multiple registrations with identical social security numbers (SSN) but different addresses. However, the manual process used to review these flagged applications did not prevent EA and other payments from being issued. Other control weaknesses include the lack of any validation of damaged property addresses for both Internet and telephone registrations. Given these weak or nonexistent controls, it is not surprising that GAO's data mining and investigations showed substantial potential for fraud and abuse of EA. Thousands of registrants misused IHP by applying for assistance using SSNs that were never issued or belonged to deceased or other individuals. GAO's case study investigations of several hundred registrations also indicate the use of bogus damaged property addresses. Visits to over 200 of these damaged properties in Texas and Louisiana showed that at least 80 of these addresses were bogus--including vacant lots and nonexistent apartments. FEMA also made duplicate EA payments to about 5,000 of the nearly 11,000 debit card recipients--once through the distribution of debit cards and again by check or electronic funds transfer. In addition, while debit cards were used predominantly to obtain cash, food, clothing, and personal necessities, a small number were used for adult entertainment, bail bond services, and weapons purchase, which do not appear to be items or services required to satisfy disaster-related needs.