Early last month, a Rhode Island bank received a loan application for $ 144,050 under the Paycheck Protection Program, the massive federal effort to help small businesses hit by the coronavirus crisis.

The application claimed to be on behalf of the owners of Remington House, a restaurant on Post Road in Warwick, RI. It listed 18 employees and an average monthly payroll of $ 46,000.

But when a bank official walked past the building, there were indications the restaurant had been closed before the pandemic. There were dumpsters on the property and notices to stop work were posted on the door and windows.

The once popular restaurant had been closed since November 2018, according to federal prosecutors, who this week charged two men with conspiracy to commit bank fraud.

This is the first criminal prosecution for fraud related to the paycheck program. Industry officials warn it won’t be the last – by far. Indeed, individuals who are working with banks to tackle misconduct in the $ 660 billion program – including former California banking commissioner Walter Mix – estimate fraud rates could reach 10 to 12 percent.

These estimates, which are based on initial reviews of loan records at dozens of banks, are roughly consistent with what happened after other disasters. In the aftermath of Hurricane Rita and Hurricane Katrina, a government audit found that about 16% of applicants for federal disaster assistance were using invalid information. If 10% of P3 funding went to fraudsters, taxpayers would be swindled out of tens of billions of dollars.

“History shows that when government relief programs are put in place quickly in response to a disaster, fraud is quite common,” said Derek Cohen, a former federal prosecutor who now represents white-collar defendants at Goodwin Procter .

In early April, the Small Business Administration said lenders would be exempt from liability if borrowers failed to meet paycheck program criteria.

But bankers are still worried about being hooked eventually, at least under certain circumstances. They are grappling with a wide range of questions about what steps they should take to both prevent fraud and protect themselves from liability, even though they are under pressure to approve emergency loans quickly.

“This program provides many opportunities for lenders to deal with the consequences of the way they manage these loans,” said Vivian Merker, partner at consultancy firm Oliver Wyman.

Risks increased in the second round

Bankers have worried about the potential for fraud since the program was created in early April.

Brad Kessel, CEO of the independent $ 3.6 billion-asset bank in Grand Rapids, Michigan, warned earlier last month of potential crooks posing as small business owners to get their hands on on the money.

“There’s going to be a lot of frauds,” Kessel said at the time. “We see some of our employees getting all kinds of emails.”

But in the early days of the program, the banks were largely focused on getting funds as quickly as possible. Almost 5,000 lenders worked – often around the clock – to obtain the approval of nearly 1.7 million loans during this initial phase, which ended on April 16.

Since then, the PPP has nearly doubled in size, with $ 310 billion added to the original allocation of $ 349 billion. Government officials have also started to put more emphasis on fraud deterrence in the program.

Deputy Attorney General Brian Benczkowski told the Wall Street Journal earlier this week that prosecutors conduct a broad fraud investigation and that they closely examine the conduct of banks, in addition to the actions of borrowers.

Treasury Secretary Steven Mnuchin and SBA Administrator Jovita Carranza have pledged to review all PPP loans of $ 2 million or more.

Also in recent weeks, many banks have started accepting applications from new small business customers, making them more vulnerable to fraud.

Existing small business customers are generally viewed as more secure because bankers have already met rules that require them to know these customers. Often times, they met the owner of the business in person and shook hands with him.

“The risk of first-round fraud probably wasn’t that big because everyone was picking their customers,” said Adam Jiwan, president and CEO of Spring Labs, a Los Angeles-based tech company that offers tools to flush out the fraud. “The likelihood of phase two fraud is high as banks go beyond their existing relationships.”

The relatively late addition of online lenders to the program may also have increased the risk of fraud, as these companies are less likely than traditional banks to have a personal relationship with their customers. On the other hand, online lenders can have relatively sophisticated risk management procedures.

“Anytime you have a situation where you have a lot of money that needs to come out quickly in a purely digital environment, the conditions for fraud are hot,” Jiwan said.

Stacking of loans is a threat

The coronavirus relief law, which was enacted in late March as the economic damage from the pandemic spread rapidly, addressed the possibility of fraud. The law requires the SBA to register loans using a tax identification number in order to prevent the same borrower from obtaining more than one loan, a problem known as stacking loans.

Once a loan has been submitted, the SBA’s E-Tran system returns a unique application number to the lender which is supposed to eliminate most of the risk of duplicate applications.

But questions are now emerging about the SBA’s system for verifying taxpayer identification numbers. Jiwan said that even though E-Tran captures the basic forms of loan stacking, fraudsters can easily manipulate the system.

Small businesses often have multiple taxpayer IDs and multiple levels of ownership or limited liability companies within the same operating company. Additionally, scammers are notorious for their “TIN spoofing,” that is, creating multiple identifiers and applications.

“There was an assumption that E-Tran was actually doing a thorough review of the stacking of loans,” Jiwan said. “What we encountered was that everything moved so quickly and there were so many misunderstandings that it was difficult to implement secure information sharing in real time. “

SBA representatives did not respond to a request for comment.

The Office of the Comptroller of the Currency held a listening session on April 20 with bankers on PPP fraud. People who attended and spoke on condition of anonymity said confusion remained over a multitude of issues, including fraud checks and payroll verification.

During the session, several attendees raised concerns about the potential for synthetic identity fraud, which may involve combining real and fictitious information to create a credible identity, according to a meeting summary released on Thursday. . Participants also indicated that relying solely on one taxpayer identification number increases the risk of fraud, since different taxpayer identification numbers could be used to obtain multiple loans for the same small business.

Banks lack clarity on loan cancellation

Under the paycheck program rules, small businesses can receive low interest loans for two and a half times the amount of their monthly payroll obligations. Loans are fully repayable if at least 75% of the proceeds are spent on staff costs.

No loans have been canceled yet, but the time is approaching when borrowers will need to submit more detailed documents to their banks in order to prove that they have spent the funds in a way that qualifies them for cancellation.

The ability to cancel a loan is a big part of why the program has proven so popular with small businesses from coast to coast. But it could also cause many legitimate small business owners to inflate their labor costs.

Bankers fear the government will ultimately not forgive many loans, forcing lenders who have come under pressure to quickly approve applications to keep the loans on their books.

The ex-regulator Mix, who is managing director and leader of financial services at Berkeley Research Group, said he could predict that the SBA would act like an insurance company and deny many loan forgiveness requests.

In that scenario, the banks would be stuck with a 1% loan on their books for two years, he said. If banks are forced to hold onto many low-yielding loans, they should not be exposed to credit losses, since the PPP includes a government guarantee.

Yet bankers are confused by the guidance the SBA has provided on their responsibilities.

An SBA document said lenders are expected to perform a “good faith review” within a reasonable time of borrower’s calculations and supporting documentation for average monthly salary costs. But he also said that “lenders can trust the statements of borrowers”.

Identity thieves lick their chops

Another potential way to commit fraud in the program is identity theft. In this scenario, a criminal poses as a real small business owner. This type of fraud can be committed on a large scale, using stolen identity data.

“There are plenty of opportunities for criminal networks to go down the list and impersonate companies,” said Steven Minsky, CEO of LogicManager, a provider of risk management software. “You can just cut and paste, fill and repeat. “

He said criminals likely identify and target the banks that exercise the worst controls. “When they find one that’s weak, they funnel as many loans as possible through that program,” Minsky said.

The alleged Rhode Island fraud scheme involved identity theft, prosecutors said, but not on a large scale. A man by the name of David Staveley is said to have posed as his own brother to apply for P3 funds. Staveley had a criminal history which would have disqualified him from the program.

It is unclear exactly how much of the detective work was done by the bank that received the request, the $ 1.7 billion in BankNewport’s assets, and how much was done by law enforcement officials. .

Police in Berlin, Massachusetts received a tip about Staveley. But the Bank of Rhode Island also conducted a car tour of the restaurant’s property on April 17, which found it in poor condition, according to an FBI affidavit in the case. The loan funds were not disbursed.

Banks that similarly approve and fund fraudulent loan applications can potentially be financially responsible if any of their employees were involved in the program, industry officials have said.

Jon Prior contributed to this story.