	FEMA’s Controls to Prevent Potentially Fraudulent Payments Were Not Effective

We found weak or nonexistent controls in the process that FEMA used to  review disaster registrations and approve assistance payments that leave  the federal government vulnerable to fraud and abuse. In the critical  aftermath of hurricanes Katrina and Rita, FEMA moved swiftly to  distribute expedited assistance payments to allow disaster victims to  mitigate and overcome the effects of the disasters. The lack of identity verification for  telephone registrations and any address validation exposed the  government to fraud and abuse of the IHP program. Although the identity verification process appeared to have worked for  most Internet registrations, it did not identify a small number of  registrations with invalid SSNs. For registrants who registered only via  telephone, or registrants who called FEMA subsequent to being denied on  the Internet, FEMA did not have controls in place to verify that the SSN  had been issued, that the SSN matched with the name, that the SSN did  not belong to a deceased individual, or whether the registrants had been  rejected on prior Internet registrations. For both  portals, we tested FEMA’s controls by providing falsified identities and  bogus addresses. Potentially Fraudulent Activities Resulting from Weak or Nonexistent FEMA IHP Controls

With limited or nonexistent validation of registrants’ identities and the  reported damaged addresses, it is not surprising that our data mining and  investigations found substantial indicators of potential fraud and abuse  related to false or duplicate information submitted on disaster  registrations. Case Study Examples Show That Control Weaknesses Have Been Exploited

Our audits and investigations of 20 case studies demonstrate that the weak  or nonexistent controls over the registration and payment processes have  opened the door to improper payments and individuals seeking to obtain  IHP payments through fraudulent means. Some were vacant lots, others turned out to be bogus apartment  buildings and units. In addition,  some individuals in the cases cited below submitted additional  registrations but had not received payments as of mid December 2005. However, our physical inspection of these addresses revealed  that 10 of the addresses were bogus addresses. We also found that the automated edits established in NEMIS identified  these registrations as potential duplicates. The  weaknesses identified through data mining include ineffective controls to  detect (1) SSNs that were never issued or belonged to deceased or other  individuals, (2) SSNs used more than once, and (3) other duplicate  information. Controls over Debit Cards Were Ineffective in Preventing Duplicate Payments and Improper Use

In the days following hurricane Katrina, FEMA experimented with the use  of debit cards to expedite payments of $2,000 to about 11,000 disaster  victims at three Texas shelters who, according to FEMA, had difficulties  accessing their bank accounts. Thousands of Debit Card Recipients Received Multiple Expedited Assistance Payments

Based on a comparison of FEMA’s IHP payments and the list of debit card  recipients, we found that over 5,000 of the 11,000 debit card recipients  received more than one $2,000 expedited assistance payment because they  received a debit card and another form of payment (check or EFT). We found that in isolated instances, debit cards were  used for adult entertainment, to purchase weapons, and for purchases at a  massage parlor that had been previously raided by local police for  prostitution. The  majority of the remaining transactions was associated with purchases of  food, clothing, and personal necessities. In this regard, FEMA regulation  provides that IHP assistance be used for housing-related needs and items  or services that are essential to a registrant’s ability to overcome disaster  related hardship. To determine whether indications existed of fraud and abuse in expedited  assistance and other disbursements, we provided FEMA data to the Social  Security Administration (SSA) to verify against their records of valid social  security numbers (SSNs).
Why GAO Did This Study

As a result of widespread congressional and public interest in the federal response to hurricanes Katrina and Rita, GAO conducted an audit of the Individuals and Households Program (IHP) under Comptroller General of the United States statutory authority. Hurricanes Katrina and Rita destroyed homes and displaced millions of individuals. In the wake of these natural disasters, FEMA faced the challenge of providing assistance quickly and with minimal "red tape," while having sufficient controls to provide assurance that benefits were paid only to eligible individuals and households. In response to this challenge, FEMA provided $2,000 in IHP payments to affected households via its Expedited Assistance (EA) program. Victims who received EA may qualify for up to $26,200 in IHP assistance. As of mid-December 2005, IHP payments totaled about $5.4 billion, with $2.3 billion provided in the form of EA. These payments were made via checks, electronic fund transfers, and a small number of debit cards. GAO's testimony will provide the results to date related to whether (1) controls are in place and operating effectively to limit EA to qualified applicants, (2) indications exist of fraud and abuse in the application for and receipt of EA and other payments, and (3) controls are in place and operating effectively over debit cards to prevent duplicate EA payments and improper usage.

What GAO Found

We identified significant flaws in the process for registering disaster victims that leave the federal government vulnerable to fraud and abuse of EA payments. For Internet applications, limited automated controls were in place to verify a registrant's identity. However, we found no independent verification of the identity of registrants who registered for disaster assistance over the telephone. To demonstrate the vulnerability inherent in the call-in applications, we used falsified identities, bogus addresses, and fabricated disaster stories to register for IHP. We also found that FEMA's automated system frequently identified potentially fraudulent registrations, such as multiple registrations with identical social security numbers (SSN) but different addresses. However, the manual process used to review these registrations did not prevent EA and other payments from being issued. Other control weaknesses include the lack of any validation of damaged property addresses for both Internet and telephone registrations. Given the weak or non existent controls, it is not surprising that our data mining and investigations to date show the potential for substantial fraud and abuse of EA. Thousands of registrants misused SSNs, i.e., used SSNs that were never issued or belonged to deceased or other individuals. Our case study investigations of several hundred registrations also indicate significant misuse of SSNs and the use of bogus damaged property addresses. For example, our visits to over 200 of the case study damaged properties in Texas and Louisiana showed that at least 80 of these properties were bogus--including vacant lots and nonexistent apartments. We found that FEMA also made duplicate EA payments to about 5,000 of the nearly 11,000 debit card recipients--once through the distribution of debit cards and again by check or electronic funds transfer. We found that while debit cards were used predominantly to obtain cash, food, clothing, and personal necessities, a small number were used for adult entertainment, bail bond services and weapons purchase, which do not appear to be items or services that are essential to satisfy disaster related essential needs.