How hackers are stealing hundreds of millions of dollars from Washington’s unemployment system

How hackers are stealing hundreds of millions of dollars from Washington’s unemployment system
Washington Employment Security Department on the computer

Dawn Gately’s hair salon in Port Townsend has been shut down for months. When she applied for unemployment benefits, she received an all too familiar response.

“Someone else had used my social security number and it also showed a strange email address,” says Dawn.

Dawn is one of a growing number of victims of "impostor fraud" through the Employment Security Department, which administers unemployment benefits.

Content Continues Below

ESD would not give precise figures, but now admits tens of thousands of fraudulent accounts have been created, and hundreds of millions of dollars have been paid out to impostors through May 21. Those numbers are for Washington alone, and may rise as more individuals and businesses come forward to report fraud.

Federal investigators appear to be focusing on a cybercrime conglomerate in Nigeria. Armen Najarian, Chief Identity Officer with Silicon Valley-based internet security company Agari, has been tracking them, too.

“They’re very good at what they do and they’ve been doing it for a long time,” says Armen.

Agari has connected more than 140 of the first 700 fraudulent unemployment claims in our state to a Nigerian cybercrime group named Scattered Canary.

“They’re diversified. They have a number of lines of businesses. One is business email compromise, where they might impersonate a CEO reaching a CFO asking for an urgent wire transfer,” says Armen. “They’re involved in real estate fraud scams where they are diverting a payment or mortgage transfer.”

Armen says the group has found a way to have a single scammer obtain, and then use, hundreds of Gmail accounts to fraudulently apply for unemployment benefits using stolen social security numbers and other personal information. He adds that the Washington Employment Security Department’s rush to pay applicants may have made things easier for the thieves.

“The law of unintended consequences, right? What was intended to be a pro-citizen policy has perhaps been exploited because maybe there wasn’t [sic] the in-depth verification checks that have existed if it wasn’t more locked down,” says Armen.

The Commissioner of the Employment Security Department says additional measures recently put in place have blocked "hundreds of millions" in additional fraudulent claims, but would not explain how she got that number.

Mike Hamilton, with the Seattle-based internet security company CI Security, has also been following the Scattered Canary developments. He believes American authorities may have to consider new incentives for countries known to harbor cyber-criminals, to prevent those groups from attacking american targets.

“If we treat our logical borders like we treat our physical borders. and say you can’t control all the crime in your country that’s sucking money out of my country – great! We’re going to cut off legitimate business at the border router and we’re going to let your business community howl at you until you clean up your problem,” says Mike.

And that could help cyber crime victims like Dawn get the benefits they desperately need.

“It’s hard because I’ve gone through a lot of money on my own when I could have been receiving unemployment,” says Dawn. “A lot of savings for my retirement, so I’m going to be working when I’m 80.”

You can check out our previous reporting for a checklist to see if you’ve been victimized, report the fraud, and protect your identity.

UPDATE: Washington’s Employment Security Department says the Department of Justice is leading the fraud investigation. Here is a statement their Seattle office sent us after our story ran:

“In any fraud investigation and prosecution, our focus is on finding and securing the proceeds of crime, so that we can return them to their rightful owner. This investigation is no different.   A team of federal law enforcement agents is working hard to identify, and recover funds from, accounts that have been used in this fraud.  Last week, a diligent financial institution, with which agents were working, was able to prevent $120 million from being distributed to criminals.  Agents are assisting in recovering millions of additional dollars, with assistance from scores of other banks and credit unions.  I commend the Social Security Administration Office of the Inspector General, the Secret Service, the FBI, and the Department of Labor Office of the Inspector General for their quick and urgent work to reclaim these funds and other criminal proceeds that we are working to identify.”

See the rest of our reporting on Washington’s unemployment crisis: