Criminals unlawfully obtain funds allocated for economic relief by forging documentation or misrepresenting eligibility, thereby generating illicit capital at the outset. Such schemes often rely on fabricated business downturn claims or false operational data. The main goal is acquiring newly generated illicit proceeds from relief payouts under false pretenses. Adversaries commonly exploit large-scale disbursement volumes and oversight gaps by submitting falsified applications, including stolen or synthetic identities and forged supporting records. In some cases, they claim multiple forms of aid for the same business or inflate payroll data beyond actual headcounts. Once received, relief funds are rapidly layered through personal or third-party accounts, structured into smaller sums, or commingled with legitimate deposits to complicate detection. Criminals may also deploy shell companies or nominee-controlled accounts, obscuring beneficial ownership and enabling further laundering of fraudulently obtained relief payouts across multiple jurisdictions.
Economic Relief Fraud
Fraud With Economic Relief Measures
Tactics
Criminals exploit economic relief programs under false pretenses, such as using forged documentation or inflated payroll data, to secure newly generated illicit proceeds. This directly aligns with their core objective of obtaining illicit funds through fraudulent claims.
Risks
This technique primarily exploits falsified or misrepresented customer and business credentials to obtain economic relief funds. Criminals submit forged documentation, synthetic identities, or exaggerated payroll/financial data, undermining standard due diligence on the true nature of applicants and beneficiaries.
Criminals move fraudulently obtained relief proceeds across multiple or offshore jurisdictions with weak disclosure requirements. This cross-border layering complicates investigations and impedes authorities' ability to track and recover illicit funds.
Indicators
Supporting documents for relief applications (e.g., tax returns, financial statements) show discrepancies when compared with official filings or prior KYC records.
Multiple relief applications submitted under the same beneficial owner but registered under different business names or addresses, each claiming similar operational downturns.
Recently formed or reactivated businesses applying for large relief funds without any historical operating revenue to justify the claimed financial downturn.
Relief funds disbursed into an account are rapidly transferred to personal or unrelated third-party accounts, lacking any legitimate business purpose.
Applicant repeatedly alters financial documentation or business details during the claim process to meet varying eligibility requirements.
Relief applications cite payroll or employee headcounts far exceeding official payroll records, with no valid evidence of an actual workforce.
Data Sources
- Contains official tax returns, financial statements, business registrations, and related filings.
- Allows cross-verification of claimed operating losses or payroll data used in relief applications.
- Helps detect inflated or inconsistent financials that deviate from historical filings, indicating potential fraud or misrepresentations.
- Provide comprehensive records of financial transactions, covering dates, amounts, parties, and counterparties.
- Enable detection of rapid layering or structuring of disbursed relief funds into personal or third-party accounts lacking legitimate business purposes.
- Support tracing of illicit proceeds across accounts or geographies, revealing suspicious fund flows.
- Contains ownership details, account types, balances, and transaction histories.
- Facilitates identification of newly opened or underutilized accounts used to receive relief funds, followed by swift outflows to unrelated parties.
- Supports analysis of account inflows versus legitimate business activity, uncovering anomalies indicative of fraud or money laundering.
- Authenticates and validates official identification documents and business records.
- Detects forged, tampered, or inconsistent documentation used in relief applications.
- Ensures the integrity of supporting documents, revealing potential identity theft or misrepresented financial statements.
- Contains official HR or payroll data confirming employee identities, roles, and workforce size.
- Validates or refutes exaggerated payroll or headcount claims made to justify inflated relief amounts.
- Helps detect nonexistent employees or erroneous workforce records used to secure larger disbursements.
- Provides insight into a business’s commercial activities, revenue streams, and operating expenses.
- Allows verification of actual operational history or downturn claims against the relief application’s stated figures.
- Identifies discrepancies where a business’s claimed losses or scale of operations do not match observed commercial activity, indicating potential fraud.
- Contains records of known or suspected fraudulent activities, identity theft cases, and scam patterns from industry sources and shared alerts.
- Directly supports the detection of repeat fraudsters or stolen IDs used to apply for relief, enabling proactive identification of potential scams.
- Provides verified customer and business identity details, prior KYC data, beneficial ownership information, and historical business or personal data.
- Helps detect discrepancies or repeated changes in identity or business details across relief applications, indicating potential fraud or misrepresentation.
- Facilitates cross-checking newly submitted application data against historically verified information.
- Provides official registration details, beneficial ownership structures, directors, and historical changes.
- Allows identification of overlapping beneficial owners across multiple relief claims, shell companies, or newly formed entities lacking legitimate operations.
- Supports verification of ownership details to detect front or nominee arrangements used to secure fraudulent relief payouts.
Mitigations
For relief applicants flagged as higher risk (e.g., inconsistent financial statements, inflated payroll data), conduct deeper investigations into tax returns, employee rosters, and business operations. Cross-verify submitted financial data with revenue or labor authorities and examine any prior regulatory filings to uncover fraudulent claims or forged documentation.
Perform thorough identity and business verification on relief fund applicants by cross-checking registration records, validating beneficial ownership, and confirming actual operational history. Specifically, verify newly formed or reactivated businesses claiming large downturns, ensuring that claimed employee rosters and historical activity align with official filings or registries. This helps expose forged or synthetic identities and prevents fraudulent relief claims at onboarding.
Implement targeted monitoring triggers for relief fund deposits to identify abrupt transfers to personal or unrelated third-party accounts without a plausible business purpose. Investigate structuring patterns, such as splitting transfers into smaller sums, and layering activities across multiple accounts or jurisdictions, which commonly indicate the rapid displacement of fraudulently obtained relief proceeds.
Check business ownership and stated operational downturns against publicly accessible government registers, social media, and industry databases. Detect mismatches in reported workforce numbers or operational status by triangulating applicant claims with external evidence, identifying forged or exaggerated claims for relief funds.
Continuously review and reassess businesses that receive repeated relief disbursements, monitoring any updated payroll figures, financials, or operational details. Investigate unexplained amendments in supporting documentation or abrupt expansions in claimed workforce to identify evolving fraud schemes seeking additional relief under false pretenses.
Instruments
- Criminals fraudulently obtain relief funds and deposit them into personal or business bank accounts set up with falsified or synthetic credentials.
- They then layer these funds by splitting them into smaller transfers or commingling them with legitimate deposits, making it harder for financial institutions to spot illicit origins.
- By using multiple accounts—often under shell entities or nominees—fraudsters create a network of transactions that obscures the ultimate beneficiary and frustrates straightforward detection efforts.
Service & Products
- Fraudsters establish accounts under fabricated or shell businesses to receive fraudulent relief payments.
- Funds are then commingled with any legitimate deposits or diverted into additional accounts, complicating transaction tracing.
- Individuals falsely claim personal economic relief and deposit funds directly into their own checking accounts.
- They subsequently split the funds into smaller transfers or move them to third-party accounts to obscure their origin and evade detection.
- Once initial relief funds are obtained, criminals transfer them offshore to jurisdictions with limited disclosure requirements.
- This cross-border layering impedes authorities’ ability to trace and recover the fraudulently acquired funds.
- Large sums of fraudulently obtained relief funds are rapidly moved between accounts or across borders.
- Multiple intermediate transfers create complex money trails, complicating oversight and detection.
- Used to set up shell companies or complex corporate structures that falsely qualify for relief programs.
- Nominee directors and opaque beneficial ownership arrangements disguise true control, enabling repeated or fraudulent applications for relief funds.
Actors
They orchestrate fraudulent relief claims by submitting forged or falsified documentation to obtain illicit funds from economic relief programs. Once received, they move or layer these proceeds through various accounts, complicating financial institutions' ability to identify legitimate transactions and detect fraud.
They create or alter supporting records, such as tax returns or payroll statements, to misrepresent eligibility for economic relief. These falsified documents enable fraudulent claims that financial institutions process, undermining normal verification procedures.
Criminals establish or use these entities to:
- Apply for relief funds under false pretenses, often lacking legitimate operations.
- Commingle fraudulent proceeds with minimal legitimate activity, obscuring transaction origins for financial institutions.
They provide a façade of business legitimacy, complicating due diligence checks.
They hold accounts or corporate positions on behalf of the true beneficiaries, concealing control over relief funds. This arrangement allows for multiple or repeated applications and transfers without raising immediate suspicion, frustrating financial institutions' ability to identify the ultimate owners.
They exploit relief programs by:
- Inflating payroll figures or operational expenses to claim higher relief amounts.
- Submitting multiple applications for the same entity or related entities, diverting funds into business accounts.
These practices disguise the true financial situation of the business and expose financial institutions to fraudulent transactions.
They receive or transfer relief funds on behalf of others, often using personal accounts to layer and move illicit proceeds. By conducting multiple smaller transactions or forwarding sums to additional accounts, they hinder financial institutions' ability to detect the ultimate beneficiaries.
References
APG (Asia/Pacific Group on Money Laundering). (2021, July). APG Yearly Typologies Report 2021. Asia/Pacific Group on Money Laundering. https://apgml.org/documents/default.aspx
Alma K., Krishnan S., Mangels C., Wang M.L. (2020, May). COVID-19-related money laundering and terrorist financing risks and policy responses. FATF. https://www.fatf-gafi.org/en/publications/Fatfgeneral/Covid-19-ml-tf.html
FinCEN (Financial Crimes Enforcement Network). (2021). Advisory on COVID-19 health insurance- and health care-related fraud (FIN-2021-A001). FinCEN. https://www.fincen.gov/coronavirus
Department of the Treasury. (2022, February). National Money Laundering Risk Assessment. Department of the Treasury.https://home.treasury.gov/system/files/136/2022-National-Terrorist-Financing-Risk-Assessment.pdf