Growing evidence suggests that the self-certification vetting process created an opportunity for people to take advantage of the program’s open-door design, the report says.

The SBA’s inspector general found “tens of thousands” of companies that received PPP loans when they were ineligible, the report says. This could include corporations created after the pandemic arrived, businesses that had more than 500 employees and companies that owe the federal government money, hence are named in a do-not-pay database.

Some eligible companies may have received more than they should have.

The FBI has opened several hundred PPP-related investigations that involve almost 500 suspects and hundreds of millions of dollars, the report says. The U.S. Justice Department already has charged 73 defendants in fraud cases related to PPP.

The Treasury Department in September received 2,495 suspicious-activity reports involving business loans from banks and other depository institutions, more than the total for any year dating back to 2014, according to public data.

Many other PPP loans are falling into a gray area in which businesses received one despite seeing revenue increase during the pandemic. Prosecutors are probing some of those cases but finding it difficult to bring charges, in part because Congress set a low bar for obtaining the funds, according to law enforcement officials familiar with the matter.

Prosecutors face hurdles in proving business owners lied when they said they needed money in the pandemic’s chaotic early days—even if profits kept coming in later, officials said.

The Small Business Administration has received more than 1,000 reports that business owners are fighting fraudulent Economic Injury Disaster Loan (EIDL) applications taken out in their name based on information that hackers pulled from PPP applications. The hackers have obtained information through other avenues as well.

A few of the firm’s clients who have been scammed realized it only after receiving a document by mail from the Small Business Administration informing them of a revised repayment schedule that the businesses did not request. Some business owners also have learned their information was stolen after performing new lien searches with lenders.

KCoe advises companies to take these steps to detect fraud.

Stay Alert. Pay close attention to your mail, emails, and lender communications. If anything seems suspicious, or you receive an official notice regarding EIDL and you did not apply for it, report it immediately.

Notify Lenders. Inform your lender (whether you participated in the EIDL program or not) so that they are aware of potentially fraudulent loans. Should the lender identify liens that shouldn’t have been filed, the owner will need to report the fraudulent loan to the SBA.

Be Proactive. Closely monitor personal credit reports. Put a hold/freeze on your credit to help monitor any authorized activity.

Report Immediately. With the uptick in fraudulent activity, it’s important to report your case immediately to SBA to start an investigation and address the business fraud. Contact the SBA Customer Service Center  at (800) 659-2955.