What is PPP fraud? How it works and how to avoid it

The Paycheck Protection Program (PPP) was a key COVID-19 financial relief initiative backed by the U.S. government that aimed to prevent layoffs during the pandemic. Yet, with a staggering $800-billion loan budget disbursed between April 2020 and May 2021, it also attracted all kinds of fraudsters who couldn’t pass up the opportunity to get forgivable multi-million-dollar loans, even as they were breaking the law doing so.

This guide to PPP loan fraud looks back at how PPP loans worked, defines the meaning of PPP fraud and the role of identity theft in it, and provides actionable recommendations on how to keep yourself safe from financial fraud.

PPP loans explained

The Paycheck Protection Program (PPP) was a COVID-19 financial relief program designed to help keep small business workers employed during the pandemic. It was implemented in April 2020 by the U.S. Small Business Administration (SBA) under the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) and ended on May 31, 2021.

The program provided government-backed loans to cover costs such as payroll, rent, utilities, and mortgages that were forgivable under certain circumstances, essentially turning them into grants. The loans were issued by private lenders, such as banks and financial companies, but guaranteed by SBA.

PPP targeted small businesses and self-employed people to offset the financial disruption caused by the pandemic. Eligible businesses included:

• Businesses with 500 or fewer employees
• Self-employed individuals and independent contractors
• Nonprofits, veterans organizations, and tribal businesses 

Eligible businesses could apply through participating lenders, with loan amounts largely depending on monthly payroll costs but not exceeding $10 million per loan. The essential condition of PPP loans was that if at least 60% of the loan covered payroll costs and employee levels were retained, the loan could be forgiven. In this way, the PPP program aimed to stabilize employment and prevent mass layoffs in uncertain times.

At the same time, SBA also offered some other relief programs—the COVID-19 Economic Injury Disaster Loan (EIDL) program and the EIDL grant program. Collectively, the SBA disbursed over $400 billion in EIDL loans and $800 billion in PPP loans.

What is PPP fraud?

It’s not surprising that such a large-scale financial relief campaign dispensing forgivable loans attracted fraudsters not only from the U.S. but also from abroad. According to the report by the SBA and the Office of Inspector General (OIG), the SBA might have disbursed as much as $64 billion in potentially fraudulent PPP loans.

What’s the PPP fraud meaning? PPP fraud occurred when individuals or business entities intentionally deceived the government to qualify for PPP loans by filing applications with false or misleading information, using stolen or fake identities, or spending the money in ways that were not legally allowed.

In one case cited in the report above, a group of eight fraudsters submitted over 150 applications and obtained more than $18 million in PPP and COVID-19 EIDL loans, which they then spent on luxury homes, jewelry, furnishings, and designer handbags.

PPP fraud ranges from organized criminal schemes (intentional fraud) and identity theft to PPP loan misuse (which doesn’t always involve criminal intent but still violates program rules). Identity theft, in particular, has been a persistent problem in PPP fraud cases. Criminals often submitted fake PPP applications using stolen Social Security numbers, Employer Identification Numbers (EINs), and other personal data, obtaining PPP loans in the name of unsuspecting individuals who are now struggling with financial and bureaucratic consequences even years after the program ended.

Even today, long after the pandemic relief efforts wrapped up, audits and investigations continue. In one recent example, a co-founder of a lending service company was sentenced to 10 years in prison and ordered to pay $66 million in restitution for fraudulently obtaining $65 million in PPP loans.

How PPP fraud scams work

Many PPP scams unfolded in similar ways, exploiting weaknesses in the PPP administration. In the early days of the program, fraudulent applications could be approved because of the sheer number of submissions, limited early verification, and a lot of self-reported information that couldn’t be vetted by the SBA in that limited timeframe.

Some of the tactics used in PPP fraud included: 

• Fake or inflated business information, including employee counts and payroll figures.
• Multiple applications submitted through different lenders, as systems were not yet synchronized and it was possible to obtain multiple loans before duplicate applications were flagged.
• Using stolen personal and business information, including personally identifiable details such as full names and SSNs, to submit fraudulent applications in victims’ names. In most cases, people only learned about their identities being exploited in PPP loan scams after they were approached by the IRS, law enforcement, or lending institutions.

These tactics proved successful (until exposed) as the Paycheck Protection Program was designed to move money quickly during an economic emergency. Bad actors relied on gaps in applicant verification rather than technical loopholes before stronger controls and cross-checks were implemented.

Can someone use your identity for PPP fraud?

Yes, identity theft is common in PPP fraud cases. This is what enabled many fraudulent PPP applications to pass as legitimate by using real people’s and businesses’ identifying details.

In another case cited in the SBA and OIG report, two brothers used multiple fabricated identities as well as personally identifiable information stolen from 20 people to submit false applications for over $1 million in PPP loans and unemployment benefits.

Commonly exploited personal data stolen from unsuspecting people included full names, addresses, dates of birth, SSNs, EINs, business names, and registration details. Many of these details are available publicly through people-search websites and business registries. Other records might have been acquired through data breaches, the dark web, or social engineering scams. In addition, data brokers legally compile and sell personal and business profiles. Scammers could mix and match this information to create fraudulent PPP applications.

Victims of PPP loan scams whose identities were stolen still feel the repercussions today. If you suspect your identity was used to obtain a fraudulent PPP loan, the Federal Trade Commission recommends the following steps:

• Report your identity theft at IdentityTheft.gov to get a report and a personal recovery plan.
• Report the identity theft to the SBA. If you have questions regarding PPP loan identity theft, contact the SBA at [email protected]. 
• If you know the lender that issued the fraudulent PPP loan in your name, contact the lender as well, asking them to release you from the loan and remove it from your credit files based on the fraud evidence.

Examples of PPP loan fraud

Years after the Paycheck Protection Program ended, investigations into PPP loan fraud are still ongoing. The SBA works together with the Office of Inspector General, the U.S. Secret Service, federal agencies, and financial organizations to identify and persecute PPP offenders. This has resulted in $399 million in seized or forfeited assets and $509 million in restitution orders, in addition to prison sentences.

The specially assigned COVID-19 Fraud Enforcement Task Force also reported that it brought criminal charges against more than 3,500 defendants for losses exceeding $2 billion, with $1.4 billion already seized or forfeited as of April 2024.

Some of the recent headlines about PPP fraud prosecutions include:

• Major criminal schemes, such as an Illinois man who was sentenced to six years in prison and ordered to pay $23 million in restitution for orchestrating a $55 million fraud scheme including PPP and other loans.
• A Kansas City woman pleaded guilty to wire fraud, identity theft, and money laundering related to obtaining $500,000 in fraudulent PPP loans, in addition to her leading role in a $3,000,000 counterfeit U.S. Treasury check scheme, and was sentenced to 11 years in prison.
• A Detroit-based CPA pleaded guilty to defrauding lenders of over $14 million in PPP loans during the pandemic and now faces up to 30 years in prison.
• Among celebrities, Lil Wayne and Chris Brown are being questioned for their alleged misuse of millions of dollars in COVID-19 PPP relief funds on luxury items and partying.

How to spot PPP fraud

PPP fraud may come to light accidentally through mail, credit checks, or government notices. In some cases, PPP scams are reported in complaints submitted to the Pandemic Oversight Hotline or through SBA’s Office of Inspector General’s whistleblower protection program.

However, as an individual who suspects their identity was exploited in fraudulent PPP loan schemes, you might notice signs before legal action starts. 

Watch out for: 

• Unexpected mail and notices from the SBA or a lending organization about a PPP loan you never applied for.
• Tax documents referencing forgiven PPP loans or loan balances you don’t recognize.
• IRS notices mentioning loan proceeds you never received.
• New loans and inquiries from lenders on your credit report or sudden changes in credit scores.
• Unfamiliar business registration, bank accounts, or financial activity linked to your identity.
• Lastly, government or law enforcement agencies questioning you about a PPP loan application you never submitted.

If something feels unfamiliar or inconsistent, it may mean someone used your identity to claim a PPP loan without your knowledge. To reclaim your identity and recover your credit score, you would need to go through the process of identity theft reporting and restoration, in addition to placing fraud alerts and credit freezes with credit bureaus.

Legal and financial consequences of PPP fraud

Although the PPP relief program ended with the pandemic, law enforcement, auditors, and courts are still handling PPP loan scam cases today. Investigations have exposed organized crime schemes, conspiracies, and questionable claims, and continue to result in imprisonment and restitution orders.

When investigators determine that a person intentionally submitted false information in their PPP loan application, charges may include wire fraud, bank fraud, and identity theft. Potential legal and financial consequences may include fines, probation or supervised release, as well as prison sentences in more serious cases.

Not all PPP-related inquiries lead to criminal charges, as these depend on factors such as intent, loan amounts, and organized activity. But even without criminal charges, borrowers suspected of PPP loan fraud or misuse may be required to:

• Repay the PPP loan partially or fully
• Pay interest, penalties, or civil fines
• Return funds that were misused

People whose identities were fraudulently used to obtain PPP loans are generally not responsible for repayment if the fraud is confirmed. However, unresolved PPP loan issues may appear on personal and business credit reports, make it harder to obtain future loans, and affect eligibility for government-backed programs. For identity theft victims, it’s important to clear these issues to avoid credit or tax complications.

How to protect yourself from PPP loan scams

Even though the Paycheck Protection Program has ended, PPP loan scams and related identity theft cases are still surfacing. Apart from PPP fraud, other scam schemes may also involve your stolen identity and harm your financial stability. 

To protect yourself from schemes similar to PPP scams:

• Limit exposure of your personal information both online and physically.
• Never share your SSN and EIN in response to unsolicited requests.
• Do not click links or download attachments from unknown senders or those whose identity you can’t verify independently.
• Monitor your credit and financial accounts regularly for suspicious or unfamiliar activity.
• Check your government and tax records periodically for anything you don’t recognize.
• Protect your online accounts with strong passwords, two-factor authentication, and timely security updates of your devices.

Keep your identity safe by limiting personal data exposure

Many scams, including identity-based ones like PPP fraud, don’t start with hacking but with easy access to personal and business information. When your name, address, phone number, employment details, and business records are available online, scammers can piece together a convincing profile to support their fraudulent loan applications and impersonation attacks.

Reducing how much of your data is available through public data brokers, people-search websites, public records, and business registries can lower the risk of:

• Identity theft
• Fraudulent loan or benefit applications
• Phishing and impersonation attempts

Onerep is a data removal and personal privacy protection service that locates and removes publicly available personal information on your behalf automatically, closely monitoring for its reappearance. This reduces your personal data exposure and gives scammers fewer opportunities to exploit your identity in schemes like PPP fraud. 

Run a free scan to see where your personal data is exposed right now.

FAQs

What happens if someone misuses a PPP loan?

PPP loan misuse may result in a fraud investigation, a requirement to repay the PPP loan partially or in full, and potential civil enforcement or criminal charges if the misuse is proven intentional.

Can PPP fraud affect your credit?

Yes, if a fraudulent PPP loan was registered under your name, it can appear on your credit report. Unresolved PPP loans and collection activity can also negatively impact your credit score.

How do you report suspected PPP fraud?

Suspected PPP fraud can be reported to the SBA Office of Inspector General (OIG) and to the Federal Trade Commission at IdentityTheft.gov specifically for identity theft cases.

Are PPP loan forgiveness programs still available?

No, the PPP loan program ended on May 31, 2021, and new forgiveness applications are generally no longer accepted. However, existing loans and past forgiveness decisions are still reviewed through audits and investigations into potential PPP fraud.