Financial institutions can help their communities by keeping EIP fraud top of mind and using a risk-based approach when monitoring transaction accounts for suspicious activity. There are several red flags that should be incorporated into an institution’s processes and procedures as part of their COVID-19 related FinCrime monitoring program.

Fraudulent, altered, counterfeit, or stolen EIP checks, Automated Clearing House (ACH) deposits, and prepaid debit cards.

• An account holder attempts to deposit one or more checks that appear to be issued by the U.S. Treasury but are fraudulent or counterfeit checks. When questioned, the customer may disclose that he or she:
  • was sent a partial payment, and needed to verify his or her PII or financial information before receiving the full EIP; or
  • received the check purportedly from a current or former employer with instructions that the check was the customer’s “stimulus payment” and that he or she was to buy prepaid cards and send them to another individual.
• An existing account receives multiple EIP-related deposits for individuals other than the account holder(s). The individuals named on the checks reside outside the geographic region of the account holder.
• An existing account receives an excessive number of EIPs via U.S. Treasury check or deposits related to a prepaid debit card linked to the same address (e.g., an account receiving more checks than expected relative to the customer’s profile and financial institution’s customer due diligence).
• A customer opens a new account with an EIP check or debit card, and the name of the potential account holder is different from that of the depositor or the payee of EIP.
• The EIP check is deposited, or the debit card’s funds are transferred into dormant accounts with little or no prior activity.

Theft of multiple EIPs

• Individual accounts opened after the U.S. government announced the EIP program, receive U.S. Treasury checks or direct deposits from the U.S. Treasury that could indicate multiple EIPs, and for individuals other than the account holder.
• The account holder is a child under age 17 at the end of the taxable year, but the account received numerous EIPs.
• Rapid transfers of multiple EIPs into one account could indicate that bad actors are consolidating the payments. The funds may be:
  • Quickly withdrawn via large cash withdrawals or serial ATM withdrawals;
  • Used to purchase convertible virtual currencies;
  • Transferred out of the account via a money services business such as cryptocurrency exchanges and peer-to-peer mobile payment systems, or wire transfers to other accounts;
  • Used for large purchases at merchants that offer cash back as an option or transferred onto prepaid debit or gift cards.
• Deposits of one or more EIP U.S. Treasury checks or electronic deposits made into an account held by a retail business or a personal account of a business owner or employee, and the account holder is not the payee/endorser.
• The same IP address is used to transfer funds from several EIP debit cards to a bank account, especially if that IP address is located outside of the United States or associated with a business.

Other frauds and thefts occurring in an account receiving EIPs.

• An account receives numerous deposits or electronic funds transfers (EFTs) that indicate the payments are linked to EIPs, and unemployment insurance payments from one or more states in names that do not match the account holder(s).
• An account with several EIP deposits also receives numerous tax refunds from federal and state governments for individuals other than the account holder(s).
• Deposits of one or more EIP checks or electronic deposits are made into a nursing home or assisted living facility’s business account, and those payments have not been returned to the resident.