Data matching flags suspicious unemployment claims

A secure, cloud-based platform is helping states check the legitimacy of unemployment insurance (UI) claims.

The Integrity Data Hub (IDH), built by the National Association of State Workforce Agencies (NASWA), has prevented about $243 million in improper payments as of February 2021, the latest complete numbers available. In a single week in early April, the hub received 1.5 million UI claims from 31 states and flagged 15,600 suspicious Social Security numbers, 13,000 email addresses, 18,000 mailing addresses and 26,000 bank accounts.

“What that means is that at some point in the last year essentially, one state has uploaded that email address or that bank account information and said, ‘This is associated with a suspicious claim,’” said Randy Gillespie, vice president of integrity at NASWA and director of the UI Integrity Center, a joint federal and state initiative funded by the Labor Department. The hub has been cross-matching 1.5 million to 3 million claims per week for the past several months, he said.

The hub is free for states to use, and participation shot up in the past year, Gillespie said, along with the rise in UI claims. About a dozen states used it before the pandemic, but since then, all but one have signed a participation agreement, and 32 are consistent users.

That’s because one of IDH’s main functions is multistate cross-matching of claims.

“As claims are filed in states, we receive and store the data for those claims. Then as claims come in from other states, we simply cross-match all the data from each state’s claims to each other,” Gillespie said. “What happens is if the same Social Security number, or other data, is being used on a claim in more than one state, which should cause suspicion, each state is notified.”

Other data elements that trigger a flag are bank account and phone numbers as well as IP, email and mailing addresses. For instance, IDH will flag claims filed using a foreign IP address.

States can connect to the system in one of three ways: via an application programming interface (API), secure file transfer protocol or uploading claims data through the hub’s user interface. Each state identifies users who are approved to access the system, and the center this month added multifactor authentication for logins.

“Unemployment insurance systems across the country vary widely in their technological advancement, and so the data hub was designed with three separate communication channels to allow easier access to all states, regardless of their technology,” Gillespie said. For states using the API, when a claimant logs into the state’s system, it automatically calls the hub to perform an identity verification and gets results in real time, for example.

IDH is built on an Amazon Web Services-based microservice architecture for flexibility and scalability, and it uses AWS Kinesis with AWS Firehouse, Kinesis Data Analytics and Lambda for auditing, aggregation and reporting.

The center partners with a third-party vendor to handle real-time identity verification, including scores indicating confidence, and it is working to stand up a bank account validation service with Early Warning, a financial technology company.

“One of the key things that we say here is that we’re not sharing one state’s data with another,” Gillespie said. “We receive each state’s data and return it back to them with information on which other states also have those data points and which data elements got flagged by which cross-match.  The returned file also includes an ID verification score for each claimant with up to five reasons that drive that score.”

When a state sends a claim, IDH assigns it a unique ID. If, say, the Social Security number matches one used in claims from two other states, the hub flags the claim and alerts the states to the match.

“There’s a functionality that’s been extremely useful during the pandemic that we call fraud alerting, which is simply a secure messaging platform,” Gillespie said.

When a state identifies a fraudulent scheme or claim, information that would be useful for investigators goes into the fraud-alerting platform, and then every user gets an email about the alert.

“All the approved data hub users across the country are enrolled in fraud alerting,” Gillespie said. “It’s allowing secure, real-time collaboration among fraud investigators.”

NASWA stood up the UI Integrity Center in 2014 to develop resources and tools for states to reduce improper unemployment payments and fraud. In 2017, it set up the Suspicious Actor Repository, which lets participating states upload data as they discovered suspicious activity. That became the Integrity Data Hub in 2018 as functions increased.

Gillespie said the hub has the potential for expansion at the federal level. “We have had multiple conversations over the last several years with the Social Security Administration, with the [Internal Revenue Service], with [the Federal Emergency Management Agency], with other federal benefit programs,” he said. “We believe that the data hub is a model that other federal programs could either participate in or mirror.”