A new Government Accountability Office (GAO) report finds that the Small Business Administration (SBA) failed to fully heed recommendations from its Office of Inspector General (OIG) when distributing COVID-19 relief loans, which contributed to billions of dollars lost to fraudulent payments.
The agency’s fraud detection technology partially relied on machine learning (ML) tools that may have failed to catch complex fraud schemes, GAO said. And despite legal requirements to do so, SBA never publicly reported its use of ML tech – considered by GAO to be a subset of AI technology – the watchdog said in its March 24 report.
During the pandemic, the Federal government offered small businesses Paycheck Protection Program (PPP) loans to keep employees on payrolls and provided businesses Economic Injury Disaster Loans (EIDL) for financial relief.
GAO said that while reviewing PPP and EIDL applications, SBA followed a four-step anti-fraud process but failed to act on the SBA’s OIG recommendations to review all flagged loans. The end result was over $200 billion in potentially fraudulent payments – nearly 17 percent of total funds disbursed.
That number compares with $191 billion in fraudulent unemployment insurance (UI) payments distributed during the pandemic, of which only a fraction has been recovered despite congressional efforts to push for more.
SBA’s fraud detection involved automated screening with some manual checks, AI-driven data analysis, manual reviews of flagged applications, and referrals of huge numbers of results to the agency’s OIG.
But the agency’s ML tool used to review PPP loan applications focused on prioritizing loans for human review based on existing flags rather than identifying new suspicious patterns – thus limiting SBA’s ability to catch complex fraud schemes, GAO said. Despite an executive order from the first Trump administration requiring AI use case disclosures, SBA did not include its ML tool in the agency’s AI use case inventory.
“The AI reporting requirements were aimed to ensure AI use awareness across the government and ensure that agencies did not use AI irresponsibly,” said GAO. “Despite SBA’s prior statements on the use of AI via press release statements, SBA officials told us during this review that they have never had any AI use cases.”
“As of December 2024, SBA had not reported an inventory of its AI use cases, including usage of machine learning for the PPP and did not post this information on its website when machine learning was in use,” GAO continued.
GAO noted that SBA officials claimed the agency’s ML tool was not AI-related, even though Federal statutes define ML as a subset of AI.
The four-step fraud detection process was rolled out gradually and wasn’t fully in place until more than half of program funds had already been distributed, “limiting its impact in preventing fraud,” according to GAO.
SBA’s referral process to the OIG faced challenges after the automated screening process suffered from a lack of access to accurate and quality data.
“In its work, GAO identified a weakness in SBA’s process for referring cases of likely fraud to its OIG – that is, step four of its four-step process,” said GAO, noting that SBA submitted nearly three million referrals to its OIG.
“SBA OIG officials told GAO that of these referrals, about two million were not actionable because they did not contain enough data elements to allow for further investigation or had quality issues, such as duplicates or incorrect information,” GAO said.
“Without an effective referral process, the SBA OIG is not able to fully investigate instances of likely fraud and make follow-on referrals to, for example, the Department of Justice for prosecution, as necessary,” GAO continued.
Data-sharing roadblocks further hampered fraud oversight, with legal restrictions blocking SBA’s access to data from the Internal Revenue Service, Social Security Administration, and National Directory of New Hires. Weak internal controls failed to flag fraudulent documentation, while missing internet weblogs prevented tracking duplicate applications from the same IP addresses, GAO said.
GAO recommended that SBA work with its OIG to develop a plan for referring potential or likely fraud for its EIDL program, and SBA agreed with that recommendation.
Efforts to regain money lost to pandemic-era fraudsters have spanned over several years and congressional hearings, with Reps. Pete Sessions, R-Texas, and Kweisi Mfume, D-Md., saying that they plan to soon introduce legislation to improve improper and fraudulent payment oversight.