Hurricanes Gustav and Ike Disaster Assistance

FEMA Strengthened Its Fraud Prevention Controls, but Customer Service Needs Improvement Gao ID: GAO-09-671 June 19, 2009

GAO's previous work on Hurricanes Katrina and Rita identified fraud, waste, and abuse resulting from a lack of fraud-prevention controls within the Federal Emergency Management Agency's (FEMA) assistance programs. For example, FEMA did not verify the identities or addresses of individuals applying for aid under its Individuals and Households Program (IHP). FEMA also did not verify the eligibility of individuals seeking shelter in FEMA-paid-for hotels and made duplicate payments to individuals who applied multiple times. GAO made numerous recommendations designed to improve these controls. To follow up on this work, GAO conducted undercover tests of the IHP process during the response to Hurricanes Gustav and Ike. This report discusses (1) whether FEMA's controls have improved since Katrina and Rita and (2) issues GAO identified related to the customer service that FEMA provided. GAO submitted bogus applications for disaster assistance, met with FEMA officials, and contacted actual disaster victims to determine their experiences applying for aid.

FEMA has significantly improved its fraud prevention controls over disaster assistance. For example, FEMA now conducts identity and address verification on all applications and requires inspections prior to approving rental assistance. In addition, FEMA requires individuals in need of housing assistance to provide valid registration numbers before checking into FEMA-paid-for hotels. FEMA has also taken steps to flag and cancel duplicate registrations for the same disaster. These improvements made it more difficult for GAO to penetrate IHP controls for Hurricanes Gustav and Ike--only 1 of 10 fraudulent applications submitted by GAO received cash payments. However, GAO found flaws in FEMA's controls that still leave the government vulnerable to fraud, waste, and abuse. GAO's undercover tests show that a persistent fraudster can bypass many of these controls by submitting fabricated documents to prove identity or address and, as a result, obtain housing assistance. GAO also received duplicate payments for bogus hotel expenses. In addition, FEMA failed to properly inspect a bogus address GAO used to apply for assistance, ultimately sending GAO multiple checks for thousands of dollars in rental assistance. GAO observed several problems with FEMA's customer service, which made it difficult for many real victims to apply for assistance or obtain shelter in a timely fashion. For example, one of GAO's investigators called nine times over the course of 3 days--several times being put on hold for 20 minutes----before being connected to an operator. Other investigators received incorrect information about the application process. Actual disaster victims confirmed these problems. One applicant reported having to call FEMA at 4 a.m. in order to reach an operator. FEMA cited several factors that contributed to this poor service, including a higher-than-expected call volume and an inability to meet projected call center staffing needs because a contractor failed to provide adequate staffing. Despite these issues, FEMA told GAO that it has made few changes in preparation for the 2009 hurricane season.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone:

GAO-09-671, Hurricanes Gustav and Ike Disaster Assistance: FEMA Strengthened Its Fraud Prevention Controls, but Customer Service Needs Improvement This is the accessible text file for GAO report number GAO-09-671 entitled 'Hurricanes Gustav And Ike Disaster Assistance: FEMA Strengthened Its Fraud Prevention Controls, but Customer Service Needs Improvement' which was released on June 19, 2009. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Committees: United States Government Accountability Office: GAO: June 2009: Hurricanes Gustav And Ike Disaster Assistance: FEMA Strengthened Its Fraud Prevention Controls, but Customer Service Needs Improvement: GAO-09-671: GAO Highlights: Highlights of GAO-09-671, a report to congressional committees. Why GAO Did This Study: GAO‘s previous work on Hurricanes Katrina and Rita identified fraud, waste, and abuse resulting from a lack of fraud-prevention controls within the Federal Emergency Management Agency‘s (FEMA) assistance programs. For example, FEMA did not verify the identities or addresses of individuals applying for aid under its Individuals and Households Program (IHP). FEMA also did not verify the eligibility of individuals seeking shelter in FEMA-paid-for hotels and made duplicate payments to individuals who applied multiple times. GAO made numerous recommendations designed to improve these controls. To follow up on this work, GAO conducted undercover tests of the IHP process during the response to Hurricanes Gustav and Ike. This report discusses (1) whether FEMA‘s controls have improved since Katrina and Rita and (2) issues GAO identified related to the customer service that FEMA provided. GAO submitted bogus applications for disaster assistance, met with FEMA officials, and contacted actual disaster victims to determine their experiences applying for aid. What GAO Found: FEMA has significantly improved its fraud prevention controls over disaster assistance. For example, FEMA now conducts identity and address verification on all applications and requires inspections prior to approving rental assistance. In addition, FEMA requires individuals in need of housing assistance to provide valid registration numbers before checking into FEMA-paid-for hotels. FEMA has also taken steps to flag and cancel duplicate registrations for the same disaster. These improvements made it more difficult for GAO to penetrate IHP controls for Hurricanes Gustav and Ike”only 1 of 10 fraudulent applications submitted by GAO received cash payments. However, GAO found flaws in FEMA‘s controls that still leave the government vulnerable to fraud, waste, and abuse. GAO‘s undercover tests show that a persistent fraudster can bypass many of these controls by submitting fabricated documents to prove identity or address and, as a result, obtain housing assistance. GAO also received duplicate payments for bogus hotel expenses. In addition, FEMA failed to properly inspect a bogus address GAO used to apply for assistance, ultimately sending GAO multiple checks for thousands of dollars in rental assistance. One of these checks is shown below. Figure: Rental Assistance Check Obtained as a Result of Undercover Application: [Refer to PDF for image: copy of check] Source: GAO. [End of figure] GAO observed several problems with FEMA‘s customer service, which made it difficult for many real victims to apply for assistance or obtain shelter in a timely fashion. For example, one of GAO‘s investigators called nine times over the course of 3 days”several times being put on hold for 20 minutes”--before being connected to an operator. Other investigators received incorrect information about the application process. Actual disaster victims confirmed these problems. One applicant reported having to call FEMA at 4 a.m. in order to reach an operator. FEMA cited several factors that contributed to this poor service, including a higher-than-expected call volume and an inability to meet projected call center staffing needs because a contractor failed to provide adequate staffing. Despite these issues, FEMA told GAO that it has made few changes in preparation for the 2009 hurricane season. What GAO Recommends: GAO recommends that FEMA establish random checks to assess documents submitted to support IHP applications and assess customer service findings to make improvements for future hurricane seasons. FEMA concurred and agreed to implement these recommendations. View [hyperlink, http://www.gao.gov/products/GAO-09-671] for key components. For more information, contact Gregory Kutz at (202) 512- 6722 or kutzg@gao.gov. [End of section] Contents: Letter: Background: FEMA Has Significantly Improved Fraud Prevention Controls over Disaster Assistance, but Weaknesses Still Exist: Some Disaster Victims Had Difficulty Registering for Assistance: Conclusions: Recommendations for Executive Action: Agency Comments: Appendix I: Comments from the Department of Homeland Security: Table: Table 1: Customer-Service Problems Described by Disaster Victims: Figure: Figure 1: Rental Assistance Check Obtained from Undercover Application: Abbreviations: FEMA: Federal Emergency Management Agency: GSA General Services Administration: IHP Individuals and Households Program: IRS Internal Revenue Service: SSN Social Security Number: [End of section] United States Government Accountability Office: Washington, DC 20548: June 19, 2009: Congressional Committees: In several previous reports and hearings related to Hurricanes Katrina and Rita, we found that significant control weaknesses in the Federal Emergency Management Agency's (FEMA) disaster assistance programs left the government vulnerable to fraud, waste, and abuse.[Footnote 1] Specifically, we found that FEMA's weak or nonexistent fraud prevention controls over cash assistance provided to disaster victims resulted in an estimated $1 billion in potentially fraudulent payments. Our work showed that these payments occurred mainly because FEMA did not consistently validate the identity of applicants who registered for assistance, inspect or confirm the physical existence of damaged addresses, and confirm whether potential aid recipients actually owned or occupied a damaged residence at the time of the disaster. FEMA also made thousands of dollars in duplicate payments to registrants who improperly claimed the same damaged addresses. In addition, we identified fraud and abuse related to the temporary housing assistance FEMA provided to individuals displaced by the disaster. For example, we found that FEMA allowed individuals to stay in FEMA-paid-for hotels even though they were already receiving rental housing or were ineligible for disaster assistance. This report provides a limited assessment of the controls FEMA had in place for disaster assistance during the response to Hurricanes Gustav and Ike. Specifically, we discuss (1) whether certain aspects of FEMA's fraud prevention controls have improved since Hurricanes Katrina and Rita and (2) issues we identified related to the customer service provided to disaster applicants. To perform this work, we submitted 10 applications for disaster assistance through the Internet and by telephone using falsified identities, bogus addresses, and fictitious disaster stories. It is important to note that we did not use the identities or addresses of real people to submit these applications. We created counterfeit documents where applicable using publicly available materials. We also attempted to check in to FEMA-paid-for hotels posing as disaster victims. In addition, we interviewed FEMA officials, reviewed FEMA's policies and procedures, and reviewed our undercover applications with FEMA at the close of our investigation. We documented breakdowns in customer service by analyzing FEMA's response to our applications. We also obtained a database from FEMA containing the contact information for 1,000 individuals who successfully registered for disaster assistance; we called dozens of these individuals in an attempt to interview them concerning their experiences with FEMA. We conducted our investigative work from September 2008 through April 2009 under the statutory authority given the Comptroller General of the United States to initiate such work and in accordance with standards prescribed by the Council of Inspectors General for Integrity and Efficiency. Background: Hurricanes Katrina and Rita caused catastrophic destruction to the Gulf Coast region, with an estimated combined total of $160 billion in damage. Estimates indicate that Hurricanes Gustav and Ike also caused billions of dollars in damage along the Gulf Coast region. FEMA assists disaster victims in part through its Individuals and Households Program (IHP), a component of the federal disaster-response efforts established under the Robert T. Stafford Disaster Relief and Emergency Assistance Act.[Footnote 2] FEMA determines whether individuals or households meet eligibility requirements for IHP assistance after they apply for registration either online or over the telephone. Applicants must submit identification information, including name, Social Security Number (SSN), and date of birth. Applicants must also provide a legitimate address affected by the hurricane; FEMA guidelines specify that eligibility for housing assistance is predicated on the registrant being displaced from his or her primary residence. IHP assistance can include temporary housing, home repair and personal property replacement, and other necessary expenses related to a disaster. For Hurricanes Katrina and Rita, FEMA also activated expedited assistance to provide immediate cash--in the form of $2,000 payments--to eligible disaster victims to help with emergency needs for food, shelter, clothing, and personal necessities. Activating expedited assistance allowed FEMA to provide aid to disaster victims without requiring proof of property damage or other losses. FEMA did not activate expedited assistance for Hurricanes Gustav and Ike, although it did offer limited fast-track payments for individuals with critical needs as a result of Hurricane Gustav.[Footnote 3] As of March 2009, FEMA states that it has distributed approximately $665 million in IHP assistance to victims of Hurricanes Gustav and Ike, as compared to almost $8 billion for Hurricanes Katrina and Rita. This amount includes rental assistance, lodging, repairs, replacement, and other needs assistance. FEMA Has Significantly Improved Fraud Prevention Controls over Disaster Assistance, but Weaknesses Still Exist: Since Hurricanes Katrina and Rita, FEMA has improved its controls over identity and address verification and inspections, housing assistance in FEMA-paid-for hotels, and duplicate registrations. Improvements in these three key areas have reduced FEMA's risk of making payments based on fraudulent disaster assistance registrations. For example, for Hurricanes Ike and Gustav, FEMA conducted identity and address verification on all applications and required inspections prior to approving rental assistance. In addition, FEMA required individuals in need of housing assistance to provide valid registration numbers before checking into FEMA-paid-for hotels. FEMA has also taken steps to flag duplicate registrations submitted for the same disaster. Although these improvements are significant, our work shows that an identity thief or a persistent fraudster with basic counterfeiting skills could still obtain rental or hotel assistance by exploiting existing weaknesses in the registration and approval processes. In particular, we were able to bypass verification controls by submitting more sophisticated bogus identities and by providing FEMA with fictitious documentation to validate our registration information. For one of our registrations, these weaknesses allowed us to obtain thousands of dollars in rental assistance, approval for transitional housing, and duplicate reimbursements for fictitious hotel expenses. We were successful on this application not only because we submitted fictitious documentation, but also because FEMA's inspector failed to properly inspect our bogus damaged address. For other applications, falsified supporting documentation allowed us to obtain approval for transitional housing, and in one case we subsequently checked into two different hotels. Finally, we found that FEMA was unable to prevent duplicate registrations submitted for more than one disaster. Identity and Address Verification and Inspections: The following information describes (1) the control weaknesses related to identity and address verification and inspections that we identified during our work on Hurricanes Katrina and Rita, (2) the improvements we found as a result of our undercover tests during Hurricanes Gustav and Ike, and (3) flaws that still exist in the identity and address verification and inspection processes. Weaknesses in Address and Identity Verification and Inspections Identified after Hurricanes Katrina and Rita: As we reported previously, we found significant flaws in the process that FEMA used to approve individuals for disaster assistance payments after Hurricanes Katrina and Rita. For example, although FEMA subjected Internet applications to an identification verification process, it did not use this verification process for phone applications. Specifically, for Internet applications, a FEMA contractor used credit and other information to confirm that (1) the applicant's SSN matched with an SSN in public records and (2) that the SSN did not belong to a deceased individual. Applicants who were rejected through the Internet were advised to apply over the phone. However, phone applications were exempt from any identity verification. In addition, prior to providing assistance payments, FEMA did not use public records or inspections to verify the physical location of damaged addresses, nor did it confirm that applicants actually occupied a damaged address at the time of the disasters. As a result of these weaknesses, we were able to receive disaster assistance by using fictitious names and nonexistent addresses. For example, for one of our Hurricane Katrina applications, we used an empty lot in Louisiana as our damaged address. Although this damaged property address was clearly bogus, FEMA notified us that an inspector had confirmed that the property was damaged and subsequently sent us thousands of dollars in rental assistance. Through data mining, we identified cases where other applicants received assistance by using SSNs belonging to deceased individuals and by using storefronts, post office boxes, cemeteries, and nonexistent apartments as damaged addresses. Other cases we identified involved applicants that claimed to live at valid damaged addresses, even though they were actually incarcerated or living in states not affected by the Hurricanes. Improvements Identified during the Response to Hurricanes Gustav and Ike: FEMA made several improvements to the verification and inspection processes. For example, FEMA told us that the same identity- verification process is now automatically performed when an applicant applies through the Internet and over the phone. In addition, both Internet and phone applications are now subject to automatic address and occupancy verification. Address verification includes checks to confirm that an address is deliverable; is not a post office box or a business address; and is not a "high-risk," address such as a tattoo parlor, or a pawn shop. Occupancy/ownership verification confirms that an applicant occupies or owns the property through a check of property records. Applicants who register over the telephone and fail any of these verification tests still receive registration numbers, but FEMA requests additional documentation prior to any payments being made. According to FEMA, applicants can verify their identities by submitting tax forms, marriage licenses, or government-issued identification. Address and occupancy can be verified by submitting documents such as drivers' licenses, utility bills, and property-tax records. An applicant can fax the supporting documentation to FEMA or wait and provide them to an inspector. FEMA also told us that even if an applicant passed both identity and address verification, an inspector must meet with an applicant to further verify occupancy and to confirm that a property was damaged in order to be eligible for rental assistance. Our undercover applications for Hurricanes Gustav and Ike confirm these improvements, as described in the following examples: * Five of our 10 applications initially failed identity verification. For these 5 applications, we used falsified identification information similar to what we used for Hurricanes Katrina and Rita. Specifically, for these applications, we used either completely fabricated names and SSNs, or names with valid dates of birth and SSNs but without any credit history, such as credit card or bank activity. We could not successfully register some identities by using the Internet and were instructed to apply by phone.[Footnote 4] At the end of the phone application process, FEMA call center operators provided us with registration numbers but also told us that there were "verification errors" associated with our registrations. Although the operators told us that inspectors would be contacting us to schedule an inspection of our property, we were instructed to provide additional documentation to validate our identities. * All 10 of our applications initially failed address and occupancy verification. For all 10, we used fabricated address information, including street addresses that did not exist and the addresses of local municipal buildings. When we later reviewed our applications with FEMA, we found that all 10 were flagged as having errors, in part because the addresses we used were not deliverable or because the names we used did not match property records associated with the addresses. * The inspection process prevented us from receiving rental assistance for 9 of our 10 applications. Specifically, the 9 addresses we selected for these applications were either not private residences or they were not actually damaged by the hurricanes. Therefore, although FEMA inspectors left messages requesting that we schedule inspections, we did not meet with them. For example, for 1 of our applications we used the address of a Texas elementary school in an area affected by Hurricane Ike. Prior to scheduling an inspection, the inspector called us from the school requesting clarification as to where we resided. We discontinued the application as a result of this call. Continued Weaknesses in Address and Identity Verification and Inspections: We were able to circumvent FEMA's initial controls by using valid identities with credit histories and by submitting fabricated identification and address information. For one of our registrations, these weaknesses, coupled with FEMA's failure to correctly inspect our fictitious address, allowed us to obtain rental assistance and duplicate reimbursements for fictitious hotel expenses. * Six of our 10 applications passed identity-verification controls on the first try through the Internet and over the phone, in part because we simulated the actions of an identity thief by using identities with legitimate dates of birth, SSNs, and credit histories.[Footnote 5] Because some of these identities were valid, FEMA appropriately did not find any verification errors. However, FEMA also did not identify the fact that one of the identities with a credit history showed that we lived outside the areas affected by the hurricanes. For 1 of our applications, we used a name and SSN that were linked to credit records in Virginia, with no record of activity in Texas or the surrounding area. In this way, a fraudster could steal an identity from anyone in the country and use it to pass FEMA's identity tests. * Five of our 10 applications eventually passed either identity or address verification or both because FEMA accepted fabricated supporting documents we submitted as legitimate. For example, for 1 of the applications, we registered by phone using a completely fake name, date of birth, and "999-XX-XXXX" as our SSN. FEMA requested that we provide additional documentation to prove our identity, so we faxed in a bogus college transcript. When we subsequently reviewed our applications with FEMA, we found that this bogus transcript was deemed sufficient proof of identification. Similarly, we were able to submit fabricated tax forms and utility bills to prove address and occupancy. When we asked FEMA officials about the process for handling supporting documentation, they told us they do not take any steps to verify the documents. The officials said that they only check to see whether the document appears to be tampered with. If it does, FEMA case workers or contractors will verify the document by calling any phone numbers listed on the document or performing Internet research. If the document appears to be valid, then no additional checks are performed. According to FEMA, our fabricated documents did not appear to be tampered with and therefore were immediately accepted as legitimate. * One of our applications received thousands of dollars in rental assistance because FEMA accepted our fabricated supporting documents and because FEMA approved the application without the inspector correctly inspecting the property or meeting with us in person. This application was also approved for a free hotel room and received duplicate payments for previously incurred hotel expenses. For this application, we used a name with a valid date of birth and SSN, but without any credit history. For our damaged address, we used a nonexistent street number on a real street in an area of Texas affected by Hurricane Ike. In response to FEMA's request for identity verification, we submitted an IRS form 1099, which can easily be found on the Internet, claiming that we worked for a bogus landscaping company on a nonexistent street. We also submitted a fabricated utility bill to verify our occupancy. A FEMA inspector attempted to contact us to schedule a date for an inspection, but we never set up a meeting. Ultimately, we were notified that we were eligible for rental assistance and housing assistance in a FEMA-paid-for hotel. However, because the approved dates for obtaining a hotel room were about to expire, we subsequently asked FEMA to reimburse us for previously incurred hotel expenses. As proof of our stay in the hotel, we submitted a bogus bill we created by changing the name and address on a letterhead from a hotel in the Washington, D.C., area. In total, we received just over $6,600 in assistance from FEMA for this application, including $4,465 for rental assistance and $2,197 for hotel-expense reimbursements. The $2,197 in hotel-expense reimbursements we received included duplicate reimbursements for our hotel expenses: one check for $1,098.50 from FEMA and another check in the same amount from FEMA's hotel contractor. Figure 1 depicts one of the rental assistance checks. Figure 1: Rental Assistance Check Obtained from Undercover Application: [Refer to PDF for image: copy of check] Source: GAO. [End of figure] In reviewing this application with FEMA officials, we asked why we received rental assistance without an inspection. FEMA told us that the inspector had performed an inspection and noted that the entire street where our fictitious address was supposed to be was destroyed. Although FEMA initially blocked us from receiving assistance because we were not present during the inspection, the case worker chose to override this decision because the case worker believed that the destruction of the entire street indicated that we had an immediate need for assistance. FEMA officials emphasized that the case worker should not have taken this action and we should not have received rental assistance. Finally, with regard to the duplicate payments we received for hotel expenses, FEMA told us that we may have received these payments because of a breakdown in the reimbursement process. Specifically, both FEMA and its lodging contractor made payments for expenses incurred at hotels by approved disaster applicants. FEMA typically sends a list of payments it has already made to the contractor. Using a manual process, the contractor reviews this list to determine what payments need to be made. With regard to the duplicate payment we received, the FEMA officials we spoke with speculated that the contractor simply missed the payment by FEMA during its review. After we brought this issue to their attention, FEMA officials told us that they were already conducting a review of the process to determine if the duplicate payment problem was widespread. As a result of this review, FEMA found that the lodging contractor made four additional duplicate payments. FEMA has flagged these payments for recoupment. Housing Assistance in FEMA-Paid-for Hotels: The following information describes (1) the control weaknesses related to FEMA's hotel housing program that we identified during our work on Hurricanes Katrina and Rita, (2) the improvements we found as a result of our undercover tests during Hurricanes Gustav and Ike, and (3) flaws that still exist in the hotel-assistance approval process. Weaknesses in the Hotel-Assistance Approval Process Identified after Hurricanes Katrina and Rita: Following Hurricane Katrina, FEMA provided displaced individuals with free hotel accommodations. However, FEMA did not require the hotels to collect registration information (such as FEMA registration numbers or SSNs) on individuals staying in the free rooms. Without this information, FEMA was not able to ensure that only valid disaster victims were receiving free hotel accommodations. As a result, we found that individuals stayed in free hotel rooms even though they were not eligible to receive any type of disaster assistance because they had never lived in residences damaged by the hurricanes. Improvements Identified during the Response to Hurricanes Gustav and Ike: According to FEMA, it strengthened controls over hotel assistance by requiring applicants seeking free lodging to (1) obtain a registration number from FEMA and (2) pass both identity and address verification. Once registrants received approval to check in to a hotel, they had to provide the hotel with a valid registration number, picture ID, and the last four digits of an SSN so that the hotel could check this information against a database maintained by FEMA's hotel contractor. Our undercover work confirmed that these controls were effective. For example, without applying for assistance and obtaining registration numbers, our investigators tried seven times to obtain hotel rooms just by claiming that they were victims of Hurricane Ike and showing bogus Texas drivers' licenses. They were denied rooms every time. In addition, when we tried to obtain hotel rooms with FEMA registration numbers that had not passed the identity and address- verification process, we were again denied rooms. Continued Weaknesses in the Hotel Assistance Approval Process: Despite the improvements we identified, we were still approved for hotel assistance on 4 of our 10 applications after we obtained registration numbers and passed identity and address verification using bogus supporting documentation. For one of these applications, we still received approval for transitional housing even though FEMA noted that the utility bill we submitted to prove our address was illegible. Ultimately, we checked into two different hotels using one of our bogus identities.[Footnote 6] Duplicate Registrations: The following information describes (1) the control weaknesses related to duplicate payments and registrations we identified during our work on Hurricanes Katrina and Rita, (2) the improvements we found as a result of our undercover tests during Hurricanes Gustav and Ike, and (3) flaws that still exist in the process FEMA uses to detect duplicate registrations. Weaknesses in Detecting Duplicate Registrations Identified after Hurricanes Katrina and Rita: FEMA did not detect duplicate registrations or prevent duplicate payments after Hurricanes Katrina and Rita. We identified instances where FEMA made more than one payment to the same household that shared the same last name and damaged and current addresses. FEMA also made millions of dollars in duplicate payments to thousands of individuals who submitted claims for damages to the same primary residences for both Hurricanes Katrina and Rita. FEMA officials explained that victims of both disasters are allowed only one set of IHP payments for the same damaged address and therefore only entitled to payments based on a single registration. Improvements Identified during the Response to Hurricanes Gustav and Ike: Improved data checks enabled FEMA to successfully prevent us from applying twice for Hurricane Gustav using the same identity. For example, we used the same damaged and current address information for two of our applications. When we subsequently reviewed our applications with FEMA officials, we saw that one of the applications had been flagged as being a duplicate and was about to be canceled. Continued Weaknesses in Detecting Duplicate Registrations: Although FEMA's controls prevented us from submitting duplicate information for the same disaster, FEMA did not detect that we submitted duplicate information for different disasters. Specifically, we were able to submit applications with the same name, SSN, and date of birth for both Hurricanes Gustav and Ike. Ultimately, we received approval for transitional housing for this identity for Hurricane Ike, even though we had previously used the same identity with a different address to apply for assistance for Hurricane Gustav. Using the same address for two disasters in different states should have been an indicator of possible fraud. If the controls FEMA uses for duplicate registrations within a disaster would have been applied to duplicate registrations across disasters, our registration would have been flagged immediately. Some Disaster Victims Had Difficulty Registering for Assistance: We observed several deficiencies in the customer service FEMA provided to disaster victims. Specifically, had we been real disaster victims without Internet access, we would probably have been unable to obtain assistance in the immediate aftermath of the hurricanes. We also called actual disaster victims, many of whom told us that they experienced similar problems. According to FEMA, these problems occurred in part because the initial call center staffing model it developed for the 2008 hurricane season was overwhelmed by members of the media and high- level government officials encouraging the public to contact FEMA. However, data we received from FEMA show that these call centers were actually staffed well below FEMA's own estimates of peak staffing needs following the hurricanes. FEMA told us that this staffing deficiency was caused, in part, by difficulties associated with one of its contractors, but also stated that it had not planned to staff call centers up to levels necessary to handle peak call-volume needs. Despite problems we noted with FEMA's customer service following the hurricanes, it intends to rely on the same operational plan for the 2009 hurricane season. Difficulties Experienced by Undercover GAO Applicants and Real Disaster Victims: Although we encountered little or no difficulty when applying for assistance over the Internet, we observed several problems with FEMA's customer service when we made applications by phone. The following examples describe some of the problems we encountered: * Busy phone lines and long wait times. We could not immediately get through to the call centers when applying by phone. For one of our Hurricane Ike applications, an investigator had to call nine times over the course of 3 days before being able to speak to a call center staff member. During these calls, the investigator either got a recording saying "all agents are busy; try later" or was put on hold for 15 to 20 minutes before hanging up. On another Hurricane Ike application, the investigator called five times over the course of three days before getting through to a call center, experiencing similar busy messages and wait times. On a Hurricane Gustav application, the investigator had to call after 1:00 a.m. in order to speak with an operator. We identified similar problems when calling FEMA's help line to check on the status of our applications. For example, one investigator called the help line 13 times over the course of 8 days but never got through to an operator. * Incorrect information. Call center staff did not always give us accurate information. For example, although some of our fictitious applicants were told that inspectors would call to schedule inspections even though the applicant did not know the extent of damage to his property, one of our investigators was told he would not be scheduled for an inspection unless he provided a more precise account of his property damages. For another application, we had to fax supporting documentation in multiple times because we were initially given an incorrect fax number. * Delayed notification for hotel assistance. For two of our registrations that were approved for temporary housing, FEMA did not notify us in a timely manner, which prevented us from obtaining a hotel room. In an effort to understand the experiences of actual disaster victims, we contacted registrants chosen from a database provided by FEMA. About half of the individuals we spoke with told us that they did not experience any problems with FEMA's application process; the other half confirmed that they encountered delays in getting through to FEMA operators, problems scheduling inspections, and difficulties obtaining hotel rooms once they had been approved. FEMA permits registration for assistance over the Internet, but power outages may have forced many victims to seek assistance over the telephone. Table 1 highlights 10 of our conversations with disaster victims. Table 1: Customer-Service Problems Described by Disaster Victims: Call: 1; Hurricane: Ike; Application type: Internet; Details: * Registrant was unable to check into a FEMA-sponsored hotel in the affected area because there were no vacancies. Call: 2; Hurricane: Ike; Application type: Internet; Details: * Registrant was repeatedly "kicked off" the FEMA Web page when trying to register for disaster assistance; * Registrant was unable to check into a FEMA-sponsored hotel in the affected area because there were no vacancies. Call: 3; Hurricane: Ike; Application type: Internet; Details: * Registrant could only get through to speak to a FEMA helpline operator by placing calls between 2:00 a.m. and 4:00 a.m. Call: 4; Hurricane: Gustav; Application type: Phone; Details: * Registrant called FEMA over a dozen times before getting through to an operator to register for disaster assistance; * Registrant faxed FEMA documents to verify occupancy and receipts for reimbursement on five or six different occasions; * Each time the registrant called to confirm receipt of the faxed documents, a FEMA helpline operator would say the documents had not been received and would need to be refaxed; * Because of the many difficulties when trying to call or fax FEMA for assistance, the registrant stopped seeking disaster assistance from FEMA. Call: 5; Hurricane: Ike; Application type: Phone; Details: * Registrant called FEMA around six or eight times before getting through to an operator to register for disaster assistance; * Registrant was put on hold several times: once waiting 30 minutes before the FEMA operator returned to the line; * FEMA inspectors failed to show up to their appointment with registrant on five different occasions; * In order to finally get the property inspected, the registrant waited for over 2 hours at a local FEMA office to get an inspector to come out and inspect the damaged home. Call: 6; Hurricane: Gustav; Application type: Internet/phone; Details: * Registrant called FEMA six or seven times before getting through to an operator to register for disaster assistance; * Registrant said when she checks her status online, FEMA's system states she is approved for disaster assistance; however, telephone operators stated that the application was still being processed. Call: 7; Hurricane: Ike; Application type: Internet/phone; Details: * Registrant called FEMA several times before being able to register for disaster assistance; * Although FEMA scheduled an inspection of the registrant's property, an inspection never took place because the inspector did not show for the inspection appointment. Call: 8; Hurricane: Ike; Application type: Phone; Details: * Registrant called FEMA multiple times throughout the day for 2 weeks before getting through to an operator to register for disaster assistance; * Registrant said FEMA operators were never able to tell him if his home was located in a disaster area. Call: 9; Hurricane: Gustav and Ike; Application type: Phone; Details: * Registrant was placed on hold for 20 minutes before a FEMA operator returned to the line; * Registrant said FEMA operators were not able to answer her questions about the registration process and IHP. Call: 10; Hurricane: Ike; Application type: Internet; Details: * Registrant could only get through to FEMA when she called at 4:00 a.m. * FEMA said a home inspection would occur within 2 weeks. However, she waited 6 weeks for the inspector to perform a home inspection; * Registrant received conflicting information about the registration process from FEMA operators. Specifically, one operator stated she needed to register with the Small Business Administration before she could register with FEMA. Another operator told the registrant that FEMA and the Small Business Administration were the same entity. Source: GAO. [End of table] FEMA's Staffing Models and Call Center Operational Plan: FEMA cited several factors that contributed to poor customer service in the aftermath of Hurricanes Ike and Gustav: a higher-than-expected call volume, unmet staffing needs, contractor failure, and problems with its automatic call system. FEMA told us that although it intends to use a different contractor for the 2009 hurricane season, the agency will make no other changes to its call center operational plan. Higher-than-Expected Call Volume: FEMA told us that they received what they described as an overwhelming number of calls, especially from individuals that may not have otherwise asked for assistance, because the media and high-level government officials strongly encouraged the public to contact FEMA. For example, FEMA estimated that it would receive approximately 530,291 calls requesting assistance for Hurricanes Gustav and Ike, but it actually received a total of 1,195,213 calls--125 percent more than expected. FEMA officials also stated that many individuals who called FEMA had unrealistic expectations as a result of the widespread coverage of hurricane Katrina. In particular, many applicants called because they expected to receive an immediate $2,000 expedited assistance payment. Projected Call Center Needs Unmet: Data provided by FEMA show that FEMA fell short of its anticipated peak staffing needs. According to FEMA, call centers are typically staffed with a baseline number of personnel before a disaster takes place. To determine staffing, FEMA primarily relies on historical models, and the type and the size of a disaster. If FEMA determines that additional staff are needed after a disaster occurs, it relies on an interagency agreement with the Internal Revenue Service (IRS) and on contractors. According to FEMA, its four call centers[Footnote 7] were staffed with a baseline of 684 staff before Hurricanes Gustav and Ike hit. In preparation for Hurricane Gustav, FEMA determined that peak staffing levels at the call centers could be as high as 6,300 staff by September 4, 2008, 3 days after the hurricane would make landfall. However, FEMA data show that actual staffing levels were just below 1,100. In addition, FEMA determined that peak staffing levels at the call centers could be nearly 11,000 staff by September 15 in order to handle calls for both Hurricanes Ike and Gustav. However, once Hurricane Ike made landfall on September 13, FEMA data show there were only 1,378 personnel staffed at the call centers-- 75 percent below staffing estimates for that day. When asked about the significant difference between staff on hand and anticipated staffing requirements, FEMA officials stated staffing to meet short-term peaks is inefficient as it would require substantial resources to hire and train staff to peak levels, only to release them shortly thereafter due to decreased call volume. Contractor Failures: FEMA said that one contractor was not able to supply a sufficient number of staff in a short period of time, resulting in a lack of staff available at call centers. Specifically, FEMA told us that it entered into a temporary service contract awarded through the General Services Administration (GSA) to augment its call center staff. This contract limited the proposals to only those companies on the GSA schedule that were small businesses--businesses that FEMA believes were not equipped to handle its staffing issues. FEMA said that by the time it learned that only small businesses were under consideration, it could not afford to consider alternative routes. In addition, FEMA said that one of the small businesses it chose to work with indicated that it intended to team up with a large national staffing services company with greater resources, which initially gave FEMA confidence that the contractor could meet its staffing needs. However, FEMA said that it took over 2 weeks for the contractor to supply the numbers of temporary workers required to address the large call volume. In addition, as a change after Hurricane Katrina, call center operators had to undergo security screening prior to being able to work at the call centers. Before Katrina, operators could start work while the security check was in progress. FEMA said that this heightened security check prevented the contractor from providing additional staff in a timely fashion. FEMA officials told us they will not be using the same contractor for the upcoming hurricane season. Automatic Call System Issues: With regard to the issues we identified related to obtaining timely hotel approval, FEMA officials said that they received a large number of requests for free lodging. As a result, they established (1) a separate fax line to accept verification documentation and (2) an auto-dial system to inform people they were approved to check into a hotel. However, according to FEMA, there were problems with the auto-dial system, and therefore some individuals were not promptly informed that they were eligible for housing assistance. Conclusions: This investigation shows that FEMA has made significant progress in addressing the challenge of providing urgent disaster relief to individuals and communities in need of assistance, while simultaneously safeguarding its programs from fraud and abuse. By improving controls over IHP, FEMA has taken steps to provide reasonable assurance that fraud and abuse in this program is minimized. Given that the current hurricane season has begun, FEMA should incorporate lessons learned from our investigation to continue to improve its fraud-prevention program and address all of the customer-service issues we identified. Recommendations for Executive Action: We recommend that the Secretary of Homeland Security direct the Administrator of FEMA to take the following two actions: * Establish random checks to assess the validity of supporting documentation submitted by applicants to verify identity and address. * Assess the customer-service findings from this investigation and make improvements for future hurricane seasons in areas such as contractor readiness. Agency Comments: In written comments on a draft of this report, the Department of Homeland Security concurred with and agreed to implement both of our recommendations. We are sending copies of this report to the Secretary of Homeland Security, the FEMA Administrator, and interested committees. In addition, the report will be available at no charge on GAO's Web site at [hyperlink, http://www.gao.gov]. If you or your staff have any questions regarding this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Signed by: Gregory D. Kutz: Managing Director, Forensic Audits and Special Investigations: List of Committees: The Honorable Joseph Lieberman: Chairman: The Honorable Susan M. Collins: Ranking Member: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Bennie G. Thompson: Chairman: The Honorable Peter T. King: Ranking Member: Committee on Homeland Security: House of Representatives: The Honorable Edolphus Towns: Chairman: The Honorable Darrell Issa: Ranking Member: Committee on Oversight and Government Reform: House of Representatives: The Honorable Mary Landrieu: Chairman: The Honorable Lindsey Graham: Ranking Member: Ad Hoc Subcommittee on Disaster Recovery: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Thomas Carper: Chairman: Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable Henry Cuellar: Chairman: The Honorable Mike Rogers: Ranking Member: Subcommittee on Emergency Communications, Preparedness, and Response: Committee on Homeland Security: House of Representatives: [End of section] Appendix I: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Washington, DC 20528: June 11, 2009: Mr. Gregory Kutz: Managing Director: Forensic Audits and Special Investigations: U.S. Government Accountability Office: 441 G Street, N.W. Washington, D.C. 20548-001: Dear Mr. Kutz: Thank you for the opportunity to review the U.S. Government Accountability Office's (GAO's) draft report; Hurricanes Gustav and Ike Disaster Assistance: FEMA Strengthened its Fraud Prevention Controls, but Customer Service Needs Improvement (GAO-09-671). We appreciate that the report concludes FEMA has made significant progress in addressing the challenge of providing urgent disaster relief to individuals and communities in need of assistance, while simultaneously safeguarding its programs from fraud and abuse. We concur with the report's two recommendations. We will: (1) establish random checks to assess the validity of supporting documentation submitted by applicants to verify identity and address; and (2) assess the customer service findings from this investigation to implement improvements for the current and future hurricane seasons. Thank you for your contributions to strengthening a program which delivers emergency financial benefits to thousands of disaster victims each year. If there are any questions, please contact Michael Wetklow in the Office of the Chief Financial Officer, at (202) 447-5196. Sincerely, Signed by: Peggy Sherry: Acting DHS Chief Financial Officer: [End of section] Footnotes: [1] GAO, Expedited Assistance for Victims of Hurricanes Katrina and Rita: FEMA's Control Weaknesses Exposed the Government to Significant Fraud and Abuse, [hyperlink, http://www.gao.gov/products/GAO-06-403T] (Washington, D.C.: Feb. 13, 2006); Hurricanes Katrina and Rita Disaster Relief: Improper and Potentially Fraudulent Individual Assistance Payments Estimated to Be Between $600 Million and $1.4 Billion, [hyperlink, http://www.gao.gov/products/GAO-06-844T] (Washington, D.C.: June 14, 2006); and Hurricanes Katrina and Rita Disaster Relief: Continued Findings of Fraud, Waste, and Abuse, [hyperlink, http://www.gao.gov/products/GAO-07-252T] (Washington, D.C.: Dec. 6, 2006). [2] 42 U.S.C. �� 5121-5207. [3] According to FEMA, it implemented the Critical Needs Assistance (CNA) program to distribute $500 assistance checks to individuals who were in need of basic necessities, such as food, water, and shelter, after Hurricane Gustav. To be eligible for CNA, individuals had to apply for disaster assistance, pass identification-verification controls, verify their residence was damaged, and demonstrate the need for critical assistance. [4] In addition to the 10 applications mentioned above, we attempted to register other bogus identities through the Internet. We could not successfully register these identities due to identification- verification errors and were instructed to apply by phone. [5] It is important to note that we did not use the identities or addresses of real people to submit these applications. The identities were developed in coordination with federal agencies and credit- reporting agencies in order to simulate what an identity thief would do in a similar situation. Addresses were fictitious or nonresidential addresses. [6] However, we were unable to register for more than one room at a time. Specifically, when we tried to register for a second hotel room using this registration, the hotel checked the registration number against the database maintained by FEMA's hotel contractor and informed us that the system showed we were currently checked into another hotel. [7] The call centers, located in Texas, Maryland, Virginia, and Puerto Rico, serviced calls for both Hurricanes Gustav and Ike. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO‘s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO‘s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: