State sees cyber ID theft rise along with unemployment claims

The Oregon State Capitol building in Salem. (The Enterprise/File)

The Oregon Employment Department experienced a tenfold increase in identity theft issues in 2020 as new jobless claims poured in during the pandemic, mirroring a spike in claims that took place across the country.

Cyberthieves capitalized on the huge volume of unemployment claims filed during the early months of the pandemic to submit fraudulent benefits applications. Washington lost upwards of $200 million during the pandemic; California’s losses top $11 billion.

But unlike several other states, Oregon won’t say how much money was lost to fraud.

The employment department rejected a public records request submitted in December, citing a broad statutory exemption from the records most state agencies must disclose. The department also refused an accompanying request seeking records explaining how it reached the decision not to disclose information on fraud.

The employment department maintains that thieves are watching news coverage and social networking groups for clues as to how individual states are fighting fraudulent activity.

Acting director David Gerstenfeld said that putting a dollar figure to the state’s losses, even for a full year, could trigger a wave of attempted theft that could drain the state’s unemployment insurance trust fund and slow payments to legitimately unemployed Oregonians.

 “We’ve seen a couple other states get hit with incredibly large, sudden waves of claims. We certainly want to avoid that,” Gerstenfeld said.

Pressed by The Oregonian/OregonLive, the department acknowledged the sharp spike in attempted identity theft from around 900 cases in 2019 to more than 9,000 last year. Gerstenfeld said the rate of overpayments – money paid to claimants who don’t deserve it – increased from 10% in 2019 to at least 14% in 2020.

 “We think that probably understates the scale of the issue,” Gerstenfeld said. Many of those overpayments were genuine mistakes, by claimants or the employment department, but some share of them were fraud.

Still, Gerstenfeld said Oregon believes its fraud losses are considerably smaller, on a per capita basis, than the huge losses in California and Washington. He said those states were unlucky in that they were hit early in the pandemic and that Oregon has learned from problems elsewhere.

Arizona, California, Massachusetts, Michigan, Ohio, Rhode Island, Washington and Wisconsin have all disclosed estimated fraud losses during the pandemic. Oregon and a few other states, among them Tennessee and West Virginia, have said they will not.

Michele Evermore, researcher and policy analyst at the National Employment Law Project, said the states have legitimate concerns about disclosing information thieves could use.

 “If these fraudsters are looking around state to state, and they see a state with a particularly high number, they’re going to say: ‘Oh, this is going to be an easier one to hack,’” Evermore said. She said thieves’ tactics are constantly evolving and they’re looking for any advantage.

Still, Evermore said, “The public needs to know what’s going on, too. It’s just hard to figure out how to balance all that.”

The employment department is in the process of adding staff as part of an expanded fraud-detection effort, though Gerstenfeld said that wasn’t triggered by any recent increase in claims.

Oregon has paid nearly $8 billion in jobless benefits in the 11 months since the pandemic began last March, more each month than it typically pays in an entire year. An unprecedented 750,000 people have received some class of unemployment benefit during that time.

Oregon has severely lagged other states in promptly paying jobless claims and implementing new jobless benefits programs during the pandemic.

It was the very last state to pay “waiting week” benefits last year for the first week workers are out of a job; an analysis by The Oregonian/OregonLive found the department was among the slowest at paying regular benefits, too.

The state’s repeated failings last year result, in large measure, from the obsolete technology Oregon relies on to pay jobless benefits. The system dates to the 1990s and, amid dysfunctional culture in the employment department, repeatedly delayed upgrades despite receiving $86 million in federal funds to pay for a modernization in 2009 (the state still has most of that money.)

One element of Oregon’s old-fashioned systems may be working against fraudsters. Oregon often pays initial benefits by a check through the mail, rather than electronically.

That means thieves must either collect checks from the mailbox of an identity theft victim, or wait for subsequent weeks’ payments to come online. By that time, the identity theft victim or the employment department may have caught on to the scam.

Gerstenfeld declined to say how much of a factor that may be in limiting Oregon’s fraud losses.

Without figures on the state’s actual fraud losses, it’s impossible to know for sure whether Oregon has indeed performed better at preventing fraud than it has at paying benefits. Lawmakers are divided over the department’s refusal to say how much it has lost.

 “California and Washington have been forthcoming with some of their issues. I don’t know why we can’t,” said Sen. Betsy Johnson, D-Scappoose, co-chair of the Legislature’s joint Committee on Ways and Means. “Being transparent about the deficiencies is not going to incentivize fraud. The fraud already exists.”

Rep. David Gomberg, a Democrat representing parts of the Oregon coast, repeatedly raised the issue of unemployment fraud at legislative hearings this month. But he said he is sympathetic to the employment department’s position, and intends to seek a confidential briefing to obtain more information.

 “I am frustrated but understand their explanation,” Gomberg said. “Again, I would like to know more but not if it results in costs to the fund or more fraud.”

Fraud victim?

Some people who haven’t filed jobless claims have received benefits checks or tax forms from the employment department indicating they were paid unemployment benefits during 2020. Those may be the result of identity theft.

Additionally, the Oregon Employment Department warns that fraudsters are impersonating the department or the U.S. Department of Labor over the phone or on social media.

The employment department says it will never ask for PIN verification numbers over the phone, and warns people about emails coming from – or directing people to – fraudulent websites. The employment department says its communication comes from a .gov internet address, typically Oregon.gov.

The employment department has a new form for people and employers to report suspected identity theft in jobless claims. Alternately, the department is taking calls on suspected fraud at 877-668-3204.