Between April 3 and May 6, 2020, the Paycheck Protection Program (PPP) released $525.8 billion in loans, “an amount representing more than 20 times the largest year in SBA’s history in just 33 days.” But that speed comes at a cost. In July, lending institutions reported nearly seven times the average monthly number of suspicious activities to the Treasury Department’s Financial Crimes Enforcement Network (FinCEN). Overall, the number of fraud reports in 2020 is 530 percent higher than it was in 2019.

Year	# of frauds reported	% increase
2015	1263
2016	1442	14%
2017	1593	10%
2018	1921	21%
2019	2082	8%
2020	11,032 (through November)	530%

Source: the Treasury Department’s Financial Crimes Enforcement Network (FinCEN)

The House of Representatives’ Select Subcommittee on the Coronavirus also recently determined that “a lack of oversight and accountability from the Treasury Department and Small Business Administration (SBA) may have led to billions of dollars being diverted to fraud, waste, and abuse, rather than reaching small businesses truly in need.” Additionally, it found that 99.4 percent of PPP loans were left with little or no oversight given Treasury’s and SBA’s commitment to audit only PPP loans in excess of $2 million.

Based on the small sample of cases brought by the Justice Department to date, which represent about $175 million in alleged fraud, up to 5 percent of PPP loans raise red flags. At the same time, some lenders appear to be having more fraud cases than others. In an effort to distribute the money faster, on April 14, SBA has allowed web-based companies into the program. These include financial technology companies (fintechs) that provide myriad financial services powered by technology, such as BlueVine Capital and Kabbage, as well as banks and nonbank lenders that work with such companies, including Cross River Bank, Celtic Bank, and Ready Capital. While fintechs processed  just 15 percent of PPP loans overall, they are associated with 75 percent of the PPP loans that the Department of Justice has connected with fraud.

Similarly, a recent McClatchy investigation found that 20 percent of 75 suspect loans had been approved by fintech company Kabbage. Kabbage, which was struggling at the beginning of the pandemic and had to furlough its employees, surpassed megabanks to become the second-largest PPP lender by application volume, ultimately approving more than $3 billion in PPP loans and taking in an estimated $145 million in fees. Over 75 percent of all Kabbage applications were processed without human intervention or manual review with a median time of four hours from applying to approval.

A fintech partner of Cross River Bank, the 12th largest PPP lender by total dollars loaned, reported that “in the first five hours of accepting applications, [it] processed over $800 million of loan requests.” Clients of Cross River Bank were also disproportionately charged with PPP fraud.

Paypal and its lending partner WebBank processed and funded PPP loans in less than 48 hours, sometimes less than 24 hours. In contrast, just to meet anti-money-laundering legal requirements, it takes banks about three to five days of work.

“Zero human interaction is more troubling,” says Gary Kalman, director of Transparency International’s U.S. office. “For a new company or one you don’t know, I would think you’d at least want to do a quick Google search.” In many cases, a simple Google, state records, or SAM.gov search would have revealed an applicant’s business didn’t exist, was dormant, or was excluded from doing business with the government.

According to an analysis of the 56 first PPP fraud cases by the Project on Government Oversight (POGO), nearly half of those approved fraudulent loans involved seven fintechs and banks working closely with fintech companies. The top two lenders who approved most of the allegedly fraudulent PPP loans in the POGO’s sample are Cross River Bank and Celtic Bank Corporation. The Justice Department has brought charges against at least 82 individuals that obtained $113 million in PPP loans. The alleged fraudsters used the loans to purchase Lamborghinis, go to strip clubs, take gambling trips to Las Vegas, invest in a cryptocurrency, make risky stock market bets, purchase a 40-foot yacht and a $1 million rowhouse in Washington, DC, and make other expenditures not allowed by law.

Even though so many allegedly fraudulent loans were processed by fintech companies, they might get legal immunity from any accountability for fraud. Thanks to fintechs’ lobbying effort, as long as they relied on the information loan applicants submitted, fintechs will not be held accountable under the recently introduced Paycheck Protection Small Business Forgiveness Act. That bill has amassed bipartisan support from at least 32 Senators and 137 Representatives.

PPP’s design and lack of sufficient safeguards made it vulnerable to fraud. As SBA is working to address oversight weaknesses in the system in response to GAO’s report, it should introduce more stringent requirements and additional controls for loans processed by fintechs. It might even consider excluding fintechs from PPP altogether.