Unemployment Insurance Fraud

Fraudulent exploitation of unemployment benefit systems whereby criminals or collusive insiders file false claims, fabricate personal details, or otherwise misrepresent eligibility. As a result, they receive government disbursements that become newly acquired illicit proceeds, disguised as standard financial aid. Without close scrutiny, these payouts may bypass typical AML controls if treated solely as routine government transactions. Criminals may rely on fictitious employer-employee relationships, inflating or inventing wage records to qualify for higher benefits, or collude so that employees receive unemployment insurance while continuing to collect unreported wages. Insider misconduct has also been documented, with state employees manipulating claims or disbursement details for improper approvals. In some schemes, stolen or synthetic identities enable fraudulent claims across multiple jurisdictions, further complicating detection. Additionally, money mule networks sometimes funnel these disbursements through multiple accounts, obscuring the origin of the funds and amplifying laundering risks.

[
Code
T0144.008
]
[
Name
Unemployment Insurance Fraud
]
[
Version
1.0
]
[
Parent Technique
]
[
Risk
Customer Risk, Product Risk
]
[
Created
2025-03-12
]
[
Modified
2025-04-02
]

Insider Abuse in Benefit Claims

Tactics

Criminals file fraudulent unemployment claims, often using stolen or fabricated identities, to generate newly disbursed government funds as illicit proceeds. This activity directly aligns with acquiring illicit capital through a predicate fraud offense.

Risks

RS0001
|
Customer Risk
|

Criminals file unemployment claims under stolen or fabricated identities (or collude with complicit insiders) to generate illicit disbursements. Financial institutions receiving these funds face compromised customer due diligence, as the eligibility and identity data behind the transactions are falsified. This is the primary vulnerability exploited by the technique.

RS0002
|
Product Risk
|

Criminals exploit government-issued prepaid cards and easily accessible personal checking accounts to receive and layer fraudulent unemployment disbursements. The minimal verification requirements of prepaid or stored-value products allow quick, anonymous access to proceeds, making it difficult for financial institutions to detect the illegitimate source of funds.

Indicators

IND00748
|

Multiple unemployment benefit payments from different states or agencies deposited into the same account within a short timeframe, despite no employment history in those jurisdictions.

IND00749
|

Sudden surge in government disbursements labeled as unemployment benefits to an account with no prior payroll or unemployment-related transaction history.

IND00750
|

Customer repeatedly requests changes in disbursement methods or banking details for unemployment benefits without reasonable explanation, especially across multiple state programs.

IND01968
|

Frequent unemployment benefit credits to newly opened accounts that show no typical income patterns or prior financial activity.

IND01969
|

Account holder provides inconsistent or incomplete personal details when receiving unemployment benefit payments, conflicting with official identification records.

IND01970
|

Several individuals sharing the same residential address or contact information each receive separate unemployment benefit deposits from different government agencies.

IND01971
|

Noticeable spike in unemployment claim disbursements originating from a jurisdiction flagged for benefit fraud, coinciding with unusual deposit activity across multiple recipient accounts.

IND01972
|

Concurrent receipt of unemployment benefits and ongoing wage deposits from an employer into the same account without any documented partial unemployment arrangement.

Data Sources

Captures changes in account settings, payment methods, and linked beneficiaries for unemployment claim disbursements, helping to detect frequent reconfigurations or suspicious alterations indicative of potential fraud or unauthorized access.

Identifies high-risk states or regions known for unemployment benefit fraud, focusing monitoring efforts on claims or government disbursements originating from flagged jurisdictions and correlating unusual deposit volumes with known fraud hotspots.

Detailed records of financial transactions capture unemployment benefit deposits, enabling the detection of unusual patterns such as multiple benefit payments from different jurisdictions to the same account, concurrent wage and benefit deposits, or sudden spikes in government credits. This data is critical for identifying potentially fraudulent claims.

Cross-references addresses, phone numbers, and identity attributes against public or official databases to detect anomalies, such as multiple claimants using a single address, and inconsistencies that suggest potential collusion or synthetic identity usage.

Authenticates official identification documents used for unemployment benefit claims by identifying forgeries, tampering, or synthetic identities. This is achieved by comparing document data with authoritative sources and verifying security features.

DS0033
|
|
  • Consolidates information on identity theft, payment card fraud, and scam patterns.
  • Supports the detection of stolen or synthetic IDs used in fraudulent unemployment claims by cross-referencing known fraudulent identities.
  • Shares industry alerts on emerging unemployment fraud schemes, facilitating early identification of suspicious claims or accounts.
  • Contains job postings, candidate applications, and employment details from recruitment platforms.
  • Helps detect fictitious employer-employee relationships or inflated wage records used to justify higher unemployment benefits.
  • Cross-referencing claimants’ stated employment histories with actual recruitment records can expose potential fraud.

Holds verified identity, employment, and personal information. Cross-referencing these details with claimed unemployment eligibility helps detect discrepancies such as mismatched work history, questionable residential addresses, or incomplete personal details, which may indicate stolen or synthetic identities.

Mitigations

Require documentary proof (e.g., prior wage statements, termination letters) from customers receiving unemployment benefits and cross-verify these records against official or publicly available data sources. This ensures the claimant’s eligibility aligns with their stated unemployment status and reduces the risk of disbursements based on stolen or fabricated identities.

Establish targeted monitoring rules to detect multiple unemployment disbursements from diverse state agencies, simultaneous wage deposits from an employer, or frequent updates to payout accounts. For instance, automatically flag an account receiving multiple benefit deposits from different states within short timeframes to expose fraudulent or dual claims.

Validate claimants' asserted unemployment status by comparing reported employer data with external public records, business registries, or online platforms. This helps confirm whether individuals truly left their jobs or if purported employers actually exist, thereby uncovering fictitious employer-employee relationships that fuel fraudulent claims.

Implement temporary holds or account access limits when customers receive atypical or repeated unemployment benefit deposits from multiple sources without clear justification. This measure prevents the rapid movement of potentially fraudulent funds and provides time to verify legitimate eligibility before releasing them.

Provide confidential channels (e.g., hotlines or secure portals) enabling employees to promptly report suspected collusion with state agencies or customers attempting to manipulate unemployment claims. Timely staff reporting allows the institution to investigate and contain insider cooperation or repeated fraud attempts.

Instruments

  • Fraudsters direct fraudulent unemployment deposits into personal checking accounts opened under falsified credentials.
  • Because these benefit payments appear to originate from a legitimate government source, they often face minimal investigation by financial institutions.
  • Multiple accounts further distribute and layer the funds, complicating transaction tracing and reducing the likelihood of detection.
  • Government agencies frequently load unemployment benefits onto prepaid cards, which require minimal personal verification.
  • Criminals exploit this ease of access by acquiring multiple cards under fabricated identities or through money mule networks.
  • These cards allow near-instant cash withdrawals or transfers, effectively scattering the funds and hampering traditional financial tracking methods.

Service & Products

  • Criminals or collusive employers may falsify or inflate wage records to qualify for larger unemployment insurance payouts.
  • Misstated employment histories and earnings data help mask ineligibility, boosting fraudulent benefit claims.
  • Many government agencies disburse unemployment benefits onto prepaid cards, allowing quick access to funds with minimal upfront verification.
  • Criminals can obtain multiple cards under fabricated identities, enabling easy cash withdrawal and layering across various jurisdictions.
  • Fraudsters open or use existing personal checking accounts—often under stolen or synthetic identities—to receive fraudulent benefit deposits.
  • Money mule networks then funnel these disbursements through multiple personal accounts, swiftly obscuring the origin of the illicit funds.

Actors

Collusive employers or shell entities fabricate wage data and employment records to:

  • Inflate reported earnings for fraudulent claimants, qualifying them for higher unemployment payouts.
  • Provide fictitious employer-employee relationships, masking the illegitimacy of benefit claims.

These actions mislead financial institutions that rely on employer data to validate payroll and benefit transactions.

Illicit operators file or coordinate fraudulent unemployment claims, manipulating eligibility details or using stolen identities to receive illicit government disbursements. These deposits appear as legitimate benefit payments and can circumvent financial institution scrutiny.

AT0076
|
|

Money mules receive or transfer fraudulent unemployment benefits on behalf of third parties through:

  • Multiple personal accounts that quickly disperse incoming disbursements, obscuring the original source.
  • Voluntary or unaware participation, adding extra layers of complexity for financial institutions monitoring suspicious activity.

Complicit state employees manipulate unemployment claims or payout systems by:

  • Approving fraudulent submissions or inflating benefit amounts without proper verification.
  • Overlooking inconsistencies in eligibility data or failing to flag suspicious claims.

This abuse enables criminals to funnel illicit funds into accounts while financial institutions presume the government source is legitimate.

References

  1. FinCEN (Financial Crimes Enforcement Network). (2020, October 13). Advisory on unemployment insurance fraud during the Coronavirus Disease 2019 (COVID-19) pandemic (FIN-2020-A007). FinCEN. https://www.fincen.gov/coronavirus

  2. FinCEN (Financial Crimes Enforcement Network). (2020, July 7). Advisory on imposter scams and money mule schemes related to Coronavirus Disease 2019 (COVID-19) (FIN-2020-A003). FinCEN. https://www.fincen.gov/sites/default/files/advisory/2020-07-07/Advisory_%20Imposter_and_Money_Mule_COVID_19_508_FINAL.pdf

  3. Financial Crimes Enforcement Network (FinCEN). (2020). Advisory on Unemployment Insurance Fraud During the Coronavirus Disease 2019 (COVID-19) Pandemic (FIN-2020-A007). FinCEN. https://www.fincen.gov/coronavirus