Fighting fraud at financial agencies is ‘all about prevention’ and collaboration
The Export-Import Bank’s watchdog put a notification on its website warning about individuals impersonating OIG agents. The Federal Deposit Insurance Corp. sees obituary photos used in attempts to gain access to accounts. And the Treasury Department is facing a world in which it’s easier than ever “to spin up fake identities.”
For fraud fighters in the federal government, the proliferation of artificial intelligence tools has brought myriad challenges to an already formidable field. Nevertheless, agency staffers embedded in those digital battlefields say there are some reasons for optimism in the fight.
“I think collaboration is increasing,” Eric Rivera, assistant inspector general for audits at the EXIM Bank, said during a panel discussion Thursday at ATARC and GovExec’s Fraud, Waste, & Abuse Forum. “It’s all about prevention, and I think that has gotten into the forefront of the conversation about fraud.”
As a small independent agency that loans out billions of dollars to help U.S. businesses export their goods, the EXIM Bank is an especially attractive target for scammers. On the audit side of the OIG’s house, Rivera is aware of that target and focused largely on working with investigators and helping to set up controls to prevent fraud “on the front end.”
“It’s not necessarily that fraud has changed; it’s more like it has gotten more sophisticated,” Rivera said. “We assume [the fraudster] is always a few steps ahead, right? So how can we get ahead of them, right?”
At the FDIC, Hussain Jabalpurwala is always on high alert for forged identities and documents — including some that come with pictures of dead people — in the rush to recover money held in banks that shut down.
Collaboration, largely through data-sharing, with agency partners helps stem that tide, but there are two things Jabalpurwala said should be kept in mind: Leadership needs to make sure efforts aren’t redundant, and data has to be portable for sharing agreements to actually work.
“Once [the data is] shared, [agency leaders need to make sure] it’s used in the right way,” said Jabalpurwala, who previously served as chief of the Department of Homeland Security’s biometrics and identity branch. And there should be “alerts or dashboards set up where not only the leadership [has access] but also people at the lower level can see that, OK, this is where it’s happening, this is where I need to focus.”
Justin Marsico, executive director of financial integrity at Treasury’s Bureau of the Fiscal Service, echoed Jabalpurwala’s comments on data-sharing agreements as “the most meaningful form of collaboration” agencies can have.
The Treasury Department, for example, has a partnership with the Social Security Administration aimed at combatting third-party account takeovers. When SSA is monitoring an account in which bank information is changed, the agency will send an API call to Treasury, and the department will let SSA know if it looks like a legitimate bank account.
“And that little API, in and of itself, has stopped tens of millions of dollars in fraud, but also loss of lifeline payments to Social Security recipients,” Marisco said.
Data-sharing isn’t always so easy, however. Marisco said the Privacy Act almost seems “designed” or “optimized to make data-sharing in the fraud community difficult or burdensome.” There are several steps that need to be taken before agencies share data in order to comply with the law, which was passed in 1974 to guarantee the protection of Americans’ personally identifiable information.
Several agencies have been sued during the second Trump administration for alleged Privacy Act violations, mostly centered around the so-called Department of Government Efficiency. Marsico said expertise on Privacy Act compliance “needs to be shared more broadly” so agencies can take the proper steps to leverage data-sharing opportunities.
While there’s room for improvement on that collaborative effort, Marsico has led another push to spur information-sharing that’s been an unmitigated success. Treasury’s Do Not Pay system is a collection of data sources that contains information about the risk of possible awardees.
When an agency or a state has questions about whether to sign off on a payment, they can call Treasury’s API or send a file with all the relevant information. The department will then assess those entities and flag those that appear to have a higher risk of fraud.
Last year, just 4% of government programs had “fully signed up to use Do Not Pay,” Marsico said, but an initiative with the Office of Management and Budget this year aimed to get that number to 100%. As of this month, participation is up to 99%, according to Treasury.
“I think the fact that anti-fraud prevention is a priority in Washington,” Marsico said, and “the fact that the Treasury secretary is talking about Do Not Pay in interviews with national media, that helps to set the stage for all of the partners that we have across the government in agencies to know that this is important work that needs to be done. They need to prioritize it.”
