Darknet Sellers Advertise Methods for Exploiting U.S. Unemployment Benefits
Summary
DarkOwl reported criminals selling state-specific guides and using stolen identities or hijacked claimant accounts to divert pandemic unemployment benefits, while states strengthened identity checks and fraudsters advertised bypasses.
Key points
- DarkOwl observed unemployment-fraud guides offered for $200–$300 and PUA offers mentioning states covering more than 75% of the U.S.; the article cautions that advertised states are not necessarily all affected.
- Reported fraud methods included taking over existing claimant accounts and using stolen personal information to submit new claims, including with identities of deceased people.
- The article says fraud methods circulated on darknet marketplaces, Telegram, and social media; claims that identity-verification checks could be bypassed were attributed to fraud-group chatter.
- A U.S. Department of Labor inspector general report cited in the article linked more than 91,000 deceased people’s Social Security numbers to $58.7 million in unemployment claims in 2020.
- The article describes Maryland and Washington unemployment-system data exposures, including a Washington file-transfer vulnerability attributed to a third-party provider.
- States were adding identity checks. The article reported that Colorado flagged more than 1 million claims for fraud, about 90% of its PUA claims, with $7 billion in potential fraudulent payouts.
Article Details
- Event Type
- Pandemic-related unemployment-benefit fraud and exposure of claimant data
- Impact
- DarkOwl reported fraudsters selling state-specific guides for filing false unemployment claims and taking over claimant accounts. A U.S. Department of Labor report cited in the article said claims involving more than 91,000 deceased persons’ Social Security numbers accounted for $58.7 million in unemployment insurance claims in 2020. Washington state reported that a file-transfer-service vulnerability exposed data from over one million residents who filed claims in 2020; Maryland had reported a breach potentially affecting over 78,000 claimants. Colorado had flagged over one million claims for fraud—about 90% of its PUA claims—with $7 billion in potential fraudulent payouts.
MITRE ATT&CK
Threat Actors
Vendors
AccellionThe critical vulnerability discovered was later reported to be associated with a third-party service provider, specifically Accellion’s File Transfer Application (FTA).ID.ME(active or on hold) verify their identity with their “Program Identity Hold” system with their partner ID.me to help mitigate fraudulent claim activity by evaluating 50 different potential triggers.
Products
Accellion FTAThe critical vulnerability discovered was later reported to be associated with a third-party service provider, specifically Accellion’s File Transfer Application (FTA).ID.me(active or on hold) verify their identity with their “Program Identity Hold” system with their partner ID.me to help mitigate fraudulent claim activity by evaluating 50 different potential triggers.