• A new report estimates overall fraud in the Covid-19 Paycheck Protection Program and Economic Injury Disaster Loan program and grants could reach $84 billion.
• CNBC found victims who had their identities stolen for gain under the EIDL and PPP last year.
• The Small Business Administration says in recent months, new enhanced checks have been put in place to intensify system validations used to mitigate the occurrence of fraud in both programs.

Korena Keys' small business was hard hit when the pandemic first took hold last year.

Her digital media firm, KeyMedia Solutions in Sioux Falls, South Dakota, saw its sales plummet 60% in May from the previous year. She was able to secure a loan from the Small Business Administration's Paycheck Protection Program for $115,000 to keep workers employed until things stabilized.

So when Keys received paperwork from the SBA in January that there was an additional $150,000 loan taken out in her business's name under the Economic Injury Disaster Loan program, she thought it might be a mistake.

"We'd made a conscious decision not to apply for any other assistance," Keys said. "We thought those funds need to be left for businesses that weren't faring as well."

Although she says she did not receive the funds, the loan is very real, and payments of nearly $800 a month are set to begin in November. The loan was approved, Keys said, even though the application had inaccurate details about her business, including a wrong phone number, email address and financials.

"The shock of it really turned to frustration and anger," Keys said, adding that several other businesses in her community had similar stories of identity theft in these aid programs. 

She has filed claims with the SBA's Office of Inspector General and its fraud department, but she hasn't been cleared of responsibility yet, although she's hopeful things will be resolved before the loan comes due. Hours have been spent, detracting from her business, trying to clear the loan.

"It's definitely caused some sleepless nights," she said. "Until it's in writing, I am always worried. It's just going to hang over me until its finalized."

Getting aid out the door

As the U.S. government and SBA rushed to get loans out the door for businesses ravaged by the pandemic last year, criminals exploited these aid programs, in some cases stealing identities of business owners to use that information to fraudulently obtain loans for gain. A recent analysis from SBA's OIG projects fraud within the Covid-19 small business programs could reach $84 billion.

In all, the U.S. government has allocated more than $1 trillion in Main Street aid via the Paycheck Protection Program and the Economic Injury Disaster Loan program. The PPP allows small businesses to borrow loans that may be forgiven if the borrower uses the majority of the capital on payroll, while the Covid-19 EIDL program allows borrowers to access loans based on temporary losses of revenue due to the pandemic. There was also an advance grant available under the EIDL.

Reviews of both programs by the OIG warned of the potential for criminal exploitation due to the fast-moving nature of the rollout and unprecedented demand for aid, and a recent memo from the House Select Subcommittee on Coronavirus Crisis lays out how widespread it might be. As much as $79 billion in potentially fraudulent EIDL loans and advances were made and up to $4.6 billion in potentially fraudulent PPP loans were made, the memo said.

There have been 1.34 million EIDL loans and grants sent from the SBA to the OIG, including nearly 750,000 referrals for suspected identity theft and more than 585,000 referrals for other potentially fraudulent activity. There have been nearly 150,000 hotline calls to the SBA OIG about tips and complaints regarding potential fraud — that is a 19,500% increase over prior years, the memo said.

The Department of Justice has collected $626 million in funds seized or forfeited as a result of civil and criminal investigations of the EIDL and PPP, the subcommittee analysis from March said. The group's report points its finger at the Trump administration for its refusal to "implement basic controls" in earlier iterations of the aid programs last year.

In a statement to CNBC, the SBA said the Biden administration takes its responsibility seriously to safeguard taxpayer dollars and prevent fraud, waste and abuse in federal programs.

"In recent months, new enhanced checks have been put in place to intensify system validations used to mitigate the occurrence of fraud in the Economic Injury Disaster Loan and Paycheck Protection programs," it said. "In instances of suspected fraud, SBA coordinates closely with the Office of Inspector General, Justice Department and other law enforcement agencies to share information and support criminal investigations."

"While the agency does not comment on individual borrowers, the lessons learned from these coordinated efforts with federal partners help to inform and strengthen internal controls," it added.

'Ridiculously easy' for criminals

Some victims of fraud under the program last year don't even have small businesses.

Max Hebert is a Marine Corps Reserve veteran and is currently in the National Guard. He also fulfills grocery deliveries for Walmart. Last summer, he received a notice in the mail at home in Eau Claire, Wisconsin, after being deployed in Ukraine with the National Guard. The letter had his name misspelled as "Max Herbert," notifying him that an EIDL had been taken out in his name for $45,000 — more money than he makes in a year.

Hebert, who has a state-registered LLC from over a decade ago that he never wound up using for a business, says he called the SBA and spoke to a customer service representative, who let him know the account would be flagged. He also went to IdentityTheft.gov to file a report that his identity had been stolen and has reached out to the SBA OIG as well.

"When I talked to the SBA agent on the phone, he confirmed they had my Social Security number, they had my address, they had enough information about me in order to fill out all this paperwork," Hebert said, adding that he was caught in many phone loops trying to get to the right person to report the crime.

Hebert said he also sought advice on Reddit from other victims. After filling the report some five months ago, he recently followed up with the SBA and was told his loan was on hold and flagged as potentially fraudulent — progress, but no resolution.

But Hebert has received a letter saying he will need to start making loan payments of $220 a month beginning in July.

"There's not a good way that I am going to be paying that," he said. "I am concerned about what that's going to do if I don't get it resolved. For example, by next tax season, are they going to try to seize my tax return? Are they going to garnish my paycheck if I don't resolve the situation in time?"

Richard Clarke, a police detective in Lauderhill, Florida, told CNBC his department recently arrested 32-year-old Xavier Taylor. While responding to a call, officers realized Taylor had a warrant out for his arrest from August for allegedly scheming to defraud the SBA by stealing a business owner's identity.

The warrant said Taylor was able to access $81,100 via the PPP. He's accused of taking a business owner's information, applying for the loan and transferring the owner's mailing address to his own. Through his lawyer, Taylor declined to comment, but he has pleaded not guilty to multiple felony fraud charges. 

"It does seem ridiculously easy. Based on my experience, a lot of people, especially since Covid and the PPP loans, have taken advantage of lapses in the system to benefit personally from applying for loans — either deceptively or using other persons' information," Clarke said. "My hope is that there will be due diligence in certifying, checking, qualifying persons to be recipients of these business loans."

Back in Wisconsin, Hebert said he's confident his situation will be resolved, although it might take time and work. But beyond his worries about his personal information being compromised, he is simply disappointed the program was used in this way.

"The biggest thing to me is that in a time when all Americans are struggling, that someone would take advantage and do all of these dishonest things to try to take money that does need to go to small businesses that are really struggling right now," he said.