What’s Working: How ID.me navigates face masks and social engineering to battle Colorado unemployment fraud

The staggering five-plus-hours wait to complete the last step for receiving unemployment benefits has been whittled down by 60% after the company tasked with verifying user identities ramped up staffing. Two hours, though, is still a long time to wait on the phone or on a computer for your turn to talk to a human. 

But those waiting are in the minority, according to the Colorado Department of Labor and Employment and ID.me, the McLean, Virginia, firm hired by CDLE to verify the identity of every person on unemployment.

About 85% complete the process in five to 15 minutes — and no ID.me staff is needed. Those who have their documents in order but must wait for a human — called a “trusted referee” — “have a success rate of 98%,” said Jessica Hudgins Smith, press secretary for the state’s Division of Unemployment Insurance.

“We strongly believe ID.me is doing what we need it to do,” Smith added. “Our trusted and federally certified technology partner utilizes threat-intel monitoring tactics and detected criminal activity targeting states that do not require ID.me verification. … This alone reveals that ID.me is successfully helping identify and prevent fraudulent activity within Colorado’s unemployment program.”

Despite the ongoing unemployment fraud, Colorado’s job situation continues to improve with new data showing fewer Coloradans remain on unemployment. But there are still a lot of people collecting a check. As of April 24, there were 196,607 requests for jobless pay. Since some are for individuals requesting multiple weeks, CDLE estimated there are 163,895 Coloradans on unemployment, down about 3,000 people from the prior week.

Last month’s requirement for everyone on unemployment to verify their identities created a logjam for the 15% who couldn’t complete the process without human intervention. But I’m hearing that the long waits are subsiding and people are getting paid.

Melinda Jordan spent months trying to get her ID verified by calling support and filing tickets with ID.me. She was finally verified Tuesday and learned what the holdup was: Someone had filed a fraudulent claim using her ex-spouse’s identity and address, resulting in her own benefits getting stuck.

“Perhaps integrity along with Karma and a ton of pushing was the recipe for success. (On May 4) I was finally cleared and able to file claims — hallelujah!” she emailed, adding that eight weeks of benefits arrived at her bank two days later. “And I just got an interview set for Monday — hopefully I’m on a roll now!”

KEEP IN MIND: Even if you pass ID.me, the state has nearly 60 fraud alerts that may prevent an account from being paid. And there are still people who have not been paid yet. 

But when it comes to verifying identities, ID.me officials agreed to share what they’re seeing.

“This is the largest cybersecurity threat as it pertains to fraud in our nation’s history,” said Pete Eskew, ID.me’s senior vice president of public sector. “The best evidence that we see (that ID.me is working) is that they are not attacking ID.me as often as they are attacking states that do not have ID.me.” 

Getting through ID.me

Like most identity-verification services, ID.me mainly relies on a person’s credit report, which lists past addresses, phone numbers and bank accounts. There can be mistakes. I’ve heard from a handful of people who went back and fixed their credit reports and then were verified successfully by ID.me. 

But if you don’t have a credit record, ID.me’s mantra is “No identity left behind,” which is why those people must show their face and other proof of their identity via a computer webcam or phone camera.

For those who don’t have a computer or phone access, ID.me hopes to announce in June a partnership with a local retailer so people can do in-person interviews.

What trips people up are the following common issues shared with me by CDLE, ID.me and actual users: 

• Gather up necessary documents before starting. Those can include an unexpired driver’s license, state ID or passport. Secondary documents include a Social Security card, birth certificate or health insurance card. Here’s a list.
• Original documents only. Photocopies aren’t allowed.
• Turn on the lights to take clear photos of documents. 
• Increase your phone camera’s brightness when taking a selfie so that you, too, are well lit.
• There are nine steps. Many people stop after the selfie (Step 6). Finish all the steps.
• Yes, you must enter your Social Security number (Step 7).
• You must give permission to ID.me to share your verified identity with CDLE (Step 9).
• You can use a smartphone, but it’s best to end the process on a computer. 

If you don’t pass the self-service part of ID.me, expect a wait to talk to a trusted referee. The company has hired 100 more employees in recent weeks to handle this. And with the larger customers such as California mostly done, the new states joining the program have smaller populations, so, hopefully, they create less of a backlog.

But expect to set aside time to complete this video call with ID.me staff. The company provides an estimated wait time, but if it’s going to be more than five hours, the company just says “more than 5 hours.” 

Tips for waiting: 

• Use a computer (not a phone) and keep it charged.
• Refresh your screen periodically to make sure you didn’t lose connection.
• If you step away, make sure to disable any power-saving settings.
• The “Save and Return Later” doesn’t save your spot in line; it just saves your information.
• The queue depends on how many people are waiting. If you wait during late-night or early-morning hours, you may not have to wait as long. It’s open 24/7.
• One reader who abandoned the five-plus-hour wait for a video confirmation said she just restarted the process from a different location and was confirmed within minutes. 
• A Twitter user complained to ID.me’s Twitter account about the long wait, and ID.me’s social staff responded. She certified for benefits and was paid within the week.
• When you finally are verified through a trusted referee, return to CDLE’s site and add your ID.me credentials when prompted. See ID.me’s Colorado page for more tips.

If you didn’t pass but you’re not a fraudster, here are other issues that trip up people:

• Uploaded documents are unreadable.
• Your utility bill is more than 60 days old.
• Your driver’s license is expired. (Colorado offers online renewals even for expired licenses of no more than one year.)
• Your name doesn’t match (e.g, maiden vs. married name).
• Your address recently changed.
• You have a locked or frozen credit report, erroneous information on your credit report, or typos.
• You didn’t take a selfie when prompted.
• You’ve already verified yourself. 

If you’re waiting on verification confirmation, CDLE has added a status update for all users of MyUI+. Check your dashboard for a “yes” or “no” on the new line that says “Id.Me Verified.” 

ID.me’s impact on fraud

No need to remind the unemployed why it has become more difficult for some to get paid their jobless benefits. As we reported last month, fraudsters using stolen IDs have made off with $19.4 million in Colorado’s unemployment payments in the past year.

But for everyone else reading this — including countless Coloradans whose personal data was used illegally to file for unemployment — the federal government required states this year to add anti-fraud technology if they wanted to distribute some of the billions in federal pandemic aid. Colorado hired ID.me in January and rolled out the technology to all unemployed claimants in April.

As of Thursday, a mere 206,549 people in Colorado have been verified successfully by ID.me. That’s more than the number of Coloradans still on unemployment. But it also includes folks who are back at work but are still owed money, Smith said. 

ID.me says it has verified 4.2 million individuals nationwide.

Of course, fraud continues, even on video calls. There have been cases of people trying to cover or disguise their faces to get past ID.me’s face-matching technology. 

Like this guy pictured on the right, who wore a tight-fitting face mask in a video interview and on whom the trained ID.me staff cried foul. 

“People are showing up to video calls wearing a mask. Sometimes it’s unsophisticated,  sometimes it is more sophisticated where they’re trying to come across as a legitimate applicant. But they won’t pass our check,” said ID.me’s Eskew.

In other cases, fraudsters are using social engineering to con real people to register with ID.me. Once the victim completes the identity verification, the state unemployment agency typically releases the hold on the suspicious account and the fraudster gets paid. (For that reason, Colorado has told victims of unemployment fraud to not use ID.me.)

“(Fraudsters) are going after (the) more vulnerable population with prize-money scams or job scams or romance scams. Frankly, they’re impersonating another individual to have the legitimate individual give over their credential,” Eskew said. “We’ve had legitimate men and women come to us on our video chat line and … and they’ll say, ‘No, I’m here for the prize money’ or ‘I was told to come to this website to get a job.’”

If you have applied, ID.me now —  as an additional security check — sends a text message to those who have completed the verification process.

ID.me is constantly changing its process to thwart criminals, just as fraudsters move on when something doesn’t work anymore. The company’s cybersecurity team watches the dark web too. After Colorado announced it would begin requiring ID.me’s verification technology, ID.me found chatter on the dark web to avoid Colorado because it was using ID.me.

That probably explains why, as of Thursday, only 12.1% of the 1.7 million people that CDLE asked to verify themselves have successfully done so. 

ID.me scares them, apparently. 

“They might poke around and see how far they can get, but they are quickly recognizing that they have to have control of so much evidence (that) if you are not legit, you’re not likely going to have that, nor do you want to … put your face on camera that we can then share with law enforcement,” Eskew said. “It points to people that are committing fraud that no longer want to work with Colorado in this case because they use ID.me. They might go to another state.”

ID.me will soon add four states, bringing the number of state unemployment agencies to 26, which will cover 70% of the U.S. population. 

The large network helps ID.me find patterns, including where criminals are coming from. “It’s from countries that we would have all picked out right away: China, Russia and Nigeria,” Eskew said. 

And it means that ID.me has access to a lot of data — and duplicate data. It can connect a fraudster filing for benefits in different states. The sessions are recorded and analyzed. ID.me says it can tell if someone is being coached, if someone is reading a script or if the voice is not coming from the person on screen. (All have happened.) 

“To be honest, it’s pretty easy to spot somebody that is legitimately trying to get help,” Eskew said. 

People without a credit record, which includes a lot of younger workers, won’t pass on their own. But an ID.me staffer can use logic to figure out why a person may not have a credit report but has all the needed documents to prove who they are.   

“There’s a logical reason for it, and logic is constantly being violated by a lot of these fraudsters,” he said. 

So far, it’s still worthwhile for international and domestic villains to find new ways to cash in on U.S. unemployment relief. While the number of jobless Coloradans has declined in recent months, Colorado still paid $82 million last week — and approximately $2.28 billion so far in 2021. But ID.me, too, continues to invest in new ways to thwart criminals.

“Our job is to increase the cost (for criminals) and make it not worth their time and energy, because it’s just too difficult to bypass ID.me,” Eskew said. “We can share the information with law enforcement and make sure our states are protected.”

Skip a job interview, lose benefits

During the pandemic, which we are technically still in, work-search requirements were dropped. Then they were reinstated. Now, if you don’t show up for a scheduled job interview, exam or first day of work, you could lose your unemployment benefits.

It’s a new emergency rule that is in effect as of this week. It also disqualifies people who provide false or incorrect information during an interview that would result in the interviewer’s belief that the applicant is unqualified for the job. 

“Anecdotally, we have heard from employers and our partners in other states that candidates are scheduling interviews and then not showing up just to fulfill their work-search requirements,” said CDLE’s Smith. “We’ve also heard candidates are giving incorrect contact information to hiring managers, so they have no way of getting in touch with the candidate to offer them a job — allowing the candidate to avoid reporting a job refusal.”

CDLE asks employers to report no-shows and job refusals through this online form.

The state is also auditing a claimant’s work-search activity, so that could result in becoming disqualified from benefits — and an overpayment notice. The rule is not posted on CDLE’s site, but the agency shared the wording of it here.

Got an overpayment?

CDLE continues to see issues with some people who now owe the state money. But those who get that shocking overpayment often say they don’t know why this is happening. 

In the case of two readers who were on State Extended Benefits in November but, as CDLE recommended, moved to Pandemic Unemployment Assistance in December, their December overpayments “will likely be written off,” Smith said. 

“We are seeing some issues with overpayments appearing on weeks when a claimant switched from one program to another, but this impacts a small population of claimants,” she said. “As we’ve mentioned in the past, the majority of overpayments that are not due to the fault of the claimant — and resulted from late processing and/or adjudication — will be written off.”

But in another reader’s case, it was deemed a legitimate overpayment.  

“We will be attempting to recover overpayments we know were due to fraudulent activity with penalties and interest,” she said. 

UPDATE: If you spot a questionable overpayment on your account, CDLE officials say you need to call 303-536-5615, tell them you have an overpayment and asked to be transferred to overpayments to get it resolved. If this proves impossible, fill out the form below to get my attention.

→ Share your unemployment or jobs story with me by filling out this online form. And for those of you who already have, I’ve responded, although I haven’t heard back from everyone. 

Other work bits

→ Montana to stop federal unemployment pay. Due to a shortage of workers, Montana’s governor is ending federal unemployment benefits. That includes people on extended benefits, Pandemic Unemployment Assistance and even the weekly $300 bonus for everyone. Not everyone is happy about that, obviously. UPDATE: South Carolina appears to be following suit as its governor asked its workforce department to terminate federal benefits by June 30.

→ Antarctica still needs seasonal workers. I dove into what it takes to qualify for this seasonal gig, which hires for the austral summer of October to February. If you’re interested, they’re still looking for carpenters, electricians and other support staff. Read all about it: Why Antarctica relies on Centennial to find plumbers, electricians and other seasonal staff.

→ SBA’s Paycheck Protection Program is out of money. But other Small Business Administration programs are still available, including the Economic Injury Disaster Loan, the Restaurant Revitalization Fund and the Shuttered Venues Operators Grant.

→ Colorado’s CLIMBER Loan is the state’s new program to help small businesses recover from COVID-19. Short for Colorado Loans to Increase Mainstreet Business Economic Recovery, CLIMBER provides low-interest loans between $30,000 to $500,000. There are caveats, but the goal is to support business recovery so only businesses around before Feb. 29, 2020 are eligible. Housed in the State Treasurer’s Office, the program has several participating lenders. >> DETAILS

---

Thanks for getting through this longer-than-usual column. I hope readers continue to find it useful and helpful. Reach out with feedback and please share it with everyone you know who should be reading it. Support local news and meet you all back here next week. ~ tamara

This column has been updated since it was originally published. Updates are noted in the text.