The Name on the Loan

The case

The loan was for $290,795. According to a federal indictment filed in Oregon in September 2026, the person whose name was on it “never owned a business, did not maintain an e-mail address, and did not regularly use a computer.” That person had help with paperwork. Prosecutors say the helper was their caregiver, who “handled” their finances and “prepared” their taxes, and who used their identity to apply for pandemic money.

It is one of the pandemic loan cases the U.S. Justice Department announced on 14 September 2026. The department said its summer surge involved more than 160 criminal defendants and about $245 million in intended loss — the amount the schemes aimed at, not the amount proven taken. The same week, the Small Business Administration said it had suspended 870,000 borrowers and would send final 30-day demand letters.

This article reads the papers behind that announcement: a 9-page indictment from Oregon, court records from Missouri, Texas and Iowa, and the reports in which the SBA’s own inspector general and the Government Accountability Office describe how a name could be enough to get money out of the programs. They show three ways a name ends up on a pandemic loan — invented, stolen, or lent — and what someone whose name was used can do now.

None of the charges described here has been proven in court unless we say a defendant pleaded guilty or was convicted. As the Justice Department says, an indictment is merely an allegation and all defendants are presumed innocent until proven guilty. No defendant or victim is named, and neither is the real company in Texas that appears in one of the cases.

Can someone take out a PPP loan in your name?

According to the Oregon indictment, yes — and the paperwork did not need the person whose name was on it. Here is what it describes, in order.

First, a disaster loan that was turned down

On or about 11 February 2021, the indictment says, the caregiver used the person’s identity to apply to the SBA for an Economic Injury Disaster Loan, or EIDL, in their name and the name of a business they supposedly owned alone. Prosecutors say it was related to about eight other EIDL applications she submitted. It sought about $150,000, and the indictment records the result: it “was declined by the SBA.”

So one door stayed shut. The next one did not.

Then, a Paycheck Protection Program loan

The Paycheck Protection Program, or PPP, lent money to small businesses to keep paying workers. To qualify, a business had to be operating on 15 February 2020, as the SBA inspector general’s 2023 report notes. The disaster loans had an earlier date, 31 January 2020.

On 19 March 2021, the indictment says, a final PPP application went in, in the same person’s name and the name of a different company. It said the company was established on 1 January 2020 — about six weeks before the deadline, by our count — that it had 15 employees, and that its average monthly payroll was $116,318. Prosecutors call all of that false.

The indictment lists what was attached: federal tax forms the prosecutors say were false, “fictitious bank account statements”, and a copy of the person’s real Oregon Identity Card. It adds one more detail that matters for anyone who looks after someone else’s paperwork: the application had been started two weeks earlier, prosecutors say, with an e-mail address made from the person’s first initial and last name — an address for someone who, the same document says, did not keep one.

A fake business, built on a real person’s identity. According to the indictment, the lender and the SBA “approved the application.”

The money landed — and left the same day

“On April 1, 2021, the SBA wired $290,795” to a bank account in the person’s name, which the indictment says the caregiver controlled. The same day, prosecutors say, she “wrote three consecutive checks to divert $273,930.38.” She is charged with two counts of wire fraud. The Justice Department said on 14 September 2026 that she “is believed to have fled the country and remains an international fugitive subject to an INTERPOL Red Notice.”

In the indictment, the person in whose name all of this happened appears only as initials, a name on a bank account, and a copy of an ID card.

How does a name end up on a pandemic loan?

The Oregon case is one of three patterns in these papers. The name can be invented, stolen, or lent.

Invented: nineteen businesses, and one that was real

In the same September announcement, the Justice Department said a man in Missouri was indicted for applications “claiming to own dozens of businesses that were operating before the COVID-19 pandemic.” The SBA inspector general’s account of the same indictment is more exact: 29 PPP and EIDL applications involving 19 purported businesses. (Nineteen is not “dozens”; the indictment itself is not freely available online, so we give both and say who said each.)

The Justice Department says that in every instance but one, the businesses were not in operation by the 15 February 2020 deadline, and that the claims about “ownership, employees, gross revenue, and business operations were entirely fabricated.” The inspector general says the indictment alleges he sought about $55,931,875 and obtained about $820,000 in PPP funds. The release does not say what happened to the rest of the requests.

The one business on the list that existed was, in the Justice Department’s words, a Texas company that “allegedly had no knowledge” of him. Its name was on his applications. According to the indictment, it had no idea.

According to the court’s minute sheet, the indictment was unsealed on 12 August 2026 after his arrest, he pleaded not guilty, and he was released on bond. Nothing in this case has been proven.

Stolen: someone close enough to have the paperwork

The Oregon case is the stolen kind, and the Justice Department’s list has a second one. In Texas, it says, a woman who worked for a state agency made false statements on disaster loan applications, “including using her daughter’s identity without her daughter’s knowledge or permission, falsely claiming to have 50 employees, and falsely claiming lost rental income.” She pleaded guilty to wire fraud and money laundering, and a federal judge accepted the plea on 19 August 2026.

Two cases, the same detail. In neither did the name come from a hacker. It came from someone close enough to have the documents: a caregiver, a parent.

The inspector general’s 2023 report describes the other end of the scale — two brothers who, they admitted, “used the personal identifying information of more than 20 people” along with fake identities to apply for COVID-19 loans.

Lent: the plant

The third pattern does not involve theft at all. In northern Iowa, prosecutors say, the names were handed over by the people they belonged to.

According to the U.S. Attorney’s office there, more than a hundred people each falsely claimed to be self-employed and to have earned about $100,000 in gross income in 2019. “In truth, each participant actually worked elsewhere, most of them at the same northern Iowa meatpacking plant.” The Justice Department says the group filed about 470 PPP applications in the names of more than 100 people, seeking more than $4.5 million; about $2.4 million was paid out.

The government’s sentencing memorandum against one participant lays out the chain. At the top, two organizers. Under them, “six high-level ‘bundlers’ or ‘facilitators’”, who recruited people, collected their personal information “including photographs of drivers’ licenses”, and passed it up. A separate charging document says the applications were filed “in exchange for a fee” and backed by “a fictitious Schedule C” for 2019 — a made-up tax form for a business that did not exist.

Then the money came back up. After the loans arrived, the memorandum says, the recruiter “requested and collected the fees for the loans from the applicants.” The charging document says co-schemers “demanded a portion of the PPP moneys,” and the memorandum says this recruiter passed fees on to the two organizers. The workers paid to have their own names put on fraudulent applications.

One of the six recruiters went to trial. He had pleaded not guilty; a jury convicted him, and in December 2025 he was sentenced to 48 months in prison and ordered to pay $212,293 in restitution. The two organizers, the U.S. Attorney’s office said in September 2026, are fugitives, believed to have left the country.

The template

Iowa is small next to some of what the inspector general found. Its 2023 report describes one investigation that grew from three suspects into “a sprawling conspiracy involving over 1,300 non-existent businesses and up to $140 million in potential fraud.” In that network, the report says, applications “often featured identical employee numbers and average monthly payroll figures.” Different businesses, the same numbers.

The same report describes a telemarketing case: two scammers, convicted, who took people’s personal information “in exchange for a fee” and “promised to file an application for an agricultural grant; instead, the defendants filed fraudulent COVID-19 EIDL applications” — more than 400 of them. Not everyone who handed over a name knew what it would be used for. That case began with information from a financial institution.

Why did the SBA approve loans for businesses that didn’t exist?

Because, for most of the money, the checks came after the payment. That is how the inspector general and the GAO describe it.

Speed first. “SBA executed over 14 years’ worth of lending within 14 days,” the 2023 report says. To move that fast, the rules allowed the agency “to reduce or eliminate key internal controls and rely on self-certification of eligibility to expedite aid.” The applicant vouched for the applicant.

The missing check. The report’s “biggest concern” was the quick delivery of money without first establishing controls “such as verifying that the business did indeed exist before the onset of the pandemic.” For one emergency grant, applicants self-certified how many employees they had, and “this number was not vetted by SBA.” The inspector general calls the result a “pay and chase environment”: pay first, chase later.

The lenders. Private lenders processed PPP applications, and the report says “certain lenders added to the fraud risks by prioritizing quickness and potential profit over a thorough review of applicant eligibility.” It describes one lender — unnamed — that went “from 200 loans per year to almost 500,000 loans per year during the pandemic — without a substantial increase in staff or security measures.”

The timing. The Government Accountability Office measured how much was out the door before the SBA’s full antifraud process was in place: about 55% of the eventual COVID-19 EIDL money had been disbursed, and about 66% of the PPP had been approved. For the PPP, the GAO says, expanded automated screening and human review arrived in January 2021.

The Oregon application came in March 2021 — after that. A company established six weeks before the deadline, with fifteen employees the indictment calls invented, still went through. The checks that existed by then did not catch a name that belonged to someone who had never run a business.

Where the money goes

The papers follow the money only part of the way, but where they do, the shape is the same: the loan stays with the name, and money moves to the people running the scheme.

• Oregon: $290,795 in, and $273,930.38 out by three checks on the same day, to accounts the indictment says the caregiver controlled. The account was in the victim’s name.
• Iowa: the loans were paid to the workers whose names were on them, and the fees moved up the chain — to the recruiters, and from them to the organizers.
• Missouri: about $820,000 of about $55.9 million sought, according to the inspector general’s account of the indictment.
• Elsewhere: the inspector general describes a nationwide scheme in which two defendants who pleaded guilty helped others obtain over $15 million in loans “in exchange for 25 percent of the total loan proceeds.”

The inspector general’s 2021 review found one more sign of where money was being sent: in 29,435 disbursed disaster loans, worth $1.7 billion, among the applications tied to identity theft complaints, the bank account number had been changed after the application to another one used for the payment — what the report calls “an additional indicator of potential fraud.”

How much PPP and EIDL money was fraud?

Nobody gives one number, and the honest answer is a range with names attached.

The SBA disbursed about $1.2 trillion in COVID-19 EIDL and PPP funds. In 2023 its inspector general estimated over $200 billion in “potentially fraudulent” loans and grants — at least 17 percent — split as more than $136 billion in EIDL and $64 billion in PPP. The SBA disputed that and published its own estimate: about $36 billion in “likely” fraud. The GAO, which reports both estimates, found in 2023 3.7 million of 13.4 million recipients with fraud indicators, and adds that “the presence of such fraud indicators is not proof of fraud.”

By May 2023, the inspector general said, its work had led to 1,011 indictments, 803 arrests and 529 convictions. And in its 2025 follow-up, it reported that 15 of the 39 recommendations still open had not been carried out by the end of 2024.

What is Operation No Doze?

It is the name the Justice Department, the SBA and its inspector general gave to the 2026 push. On 14 September 2026 the SBA also announced two things it keeps apart: the suspensions, and the letters it will send under Operation No Doze.

The suspensions. The SBA said it had suspended 870,000 U.S. borrowers connected to an estimated $39 billion in suspected fraudulent PPP and EIDL activity. Suspended borrowers, it says, are barred from future SBA small-business and disaster loans. A suspension is an administrative step over suspected fraud. It is not a conviction.

The letters. “In a separate enforcement action,” the SBA says, under Operation No Doze it “will send final 30-day demand letters to suspected fraudulent PPP and COVID EIDL borrowers, starting with approximately 8,000 in Kansas and Missouri.” The letters demand repayment of debt tied to “the flagged loans.” For borrowers who do not pay in 30 days, the SBA lists what can follow: enforcement under the Administrative False Claims Act, with liability up to double the government’s damages; referral to the Justice Department; transfer to the Treasury for collection, with added interest and “collection fees of up to 28 percent”; and offsets against “tax refunds, contractor and vendor payments, federal salaries, and Social Security and other benefit payments.” The SBA says it had already referred more than 560,000 suspected fraudulent borrowers, tied to $22 billion, to the Treasury.

The clock. Two laws signed on 5 August 2022 — Public Law 117-165 for COVID-19 EIDL and Public Law 117-166 for the PPP — give the government 10 years from the offense to bring a case against a borrower who engaged in fraud. The inspector general put it this way: “the passage of time does not diminish our commitment to accountability.”

What the announcement does not say. The SBA’s release says nothing about what happens when the name on a flagged loan belongs to someone like the person in Oregon, who never applied. That is not a reason to panic. It is a reason to know the identity theft process before a letter arrives.

How do you find out if a loan was taken out in your name?

By mail, for many. The inspector general’s 2021 review of identity theft in the COVID-19 disaster loan program put it plainly: “Many of the complainants are shocked to receive an SBA loan statement, which is one way they find out about the fraudulent loans.”

Others never get that statement. “Potentially more victims are still unaware of these loans because the fraudsters used fake addresses,” the review says, and by January 2021 an SBA official estimated the agency had received over 150,000 returned loan statements because of incorrect or fraudulent addresses.

By then the SBA had referred 846,611 COVID-19 EIDL applications to the inspector general — applications tied to an identity theft complaint plus related ones sharing the same e-mail address, phone number or physical address. At the time of that review, the inspector general found, the SBA had no process to protect victims’ credit, stop billing them or release liens on their assets. The SBA answered that it approved a letter and identity theft declaration on 2 February 2021, for disaster loans.

How to spot it

A loan statement, letter or collection notice for an SBA loan you never applied for. Counter-test: look at the name of the business and the loan number on it. If you never ran that business, that piece of mail is the signal the inspector general describes — not junk to throw away.

A business in your name that you never started. Counter-test: in the Oregon case the application named a company “established” six weeks before the deadline. If any document shows you as owner of a company you have never heard of, treat it as identity theft.

An e-mail account in your name that you never opened — especially for someone whose paperwork another person handles. Counter-test: the Oregon indictment says the application was started with an e-mail address built from the victim’s initial and last name, for someone who did not keep one.

Someone offering to fill out a government application for you, for a fee or a cut. Counter-test: in Iowa and in the telemarketing case, that offer is how names ended up on fraudulent applications. Whatever they promise, the name on that application is yours, not theirs.

A helper who has all of the paperwork and none of the oversight. Counter-test: in both stolen-identity cases here, the name came from someone close — a caregiver, a parent. If you manage a parent’s paperwork, or someone manages yours, a second person reading the mail is protection, not distrust.

What to do if it already happened

Do not ignore the letter. The SBA’s 2021 letter to victims warns that while it reviews an identity theft claim, “you may still receive monthly statements by mail” and suggests keeping them.

Send the SBA three documents. According to the SBA’s report fraud or identity theft page, if someone used your information to get SBA funding without your permission, you must submit: a copy of your photo ID (driver’s license, state ID or U.S. passport); an Identity Theft Report, filed at IdentityTheft.gov or with your local police; and the SBA Declaration of Identity Theft, Form 3513.

Sign the form by hand. The form asks how you became aware that your identity was used, and has you confirm that you did not request the loan or use any of its money. “Electronic signatures will not be accepted.” It can also be filed on behalf of a minor child, a person who has died, or someone who is incapacitated.

Send it to the right place. The SBA lists its loan portal, or e-mail: IDTheftRecords@sba.gov for disaster loans, including COVID-19 EIDL, and PPPidtheftinquiries@sba.gov for PPP loans. Type sba.gov into the address bar yourself; do not reply to a link in a message.

Protect your credit. The same SBA letter points victims to IdentityTheft.gov for “a free, one-year fraud alert”, free credit reports, and a free extended fraud alert or credit freeze.

Know what the review is for. That letter says the SBA’s review is “for the sole purpose of releasing the loan debt only”, and that its disaster office will not give information about any criminal investigation. In 2021 the inspector general wrote that when the SBA cancels a loan, “the billing statements, payment demands, delinquency notices, and collection actions are stopped.”

Report fraud you see. The same SBA page sends reports of suspected fraud in SBA programs to the inspector general’s hotline. If someone calls claiming to be from a federal agency and demanding payment, our piece on whether the scam caller is reading from a script explains how official-sounding calls are built.

How to not be next

The lesson is not about 2020. It is about where your name lives. In these papers, nobody had to break into anything: a caregiver handled the finances and the taxes, a parent had a daughter’s details, a recruiter collected photos of driver’s licenses, and a rule that asked applicants to vouch for themselves did the rest.

A name was enough, and nobody had to prove it was theirs. The protection is the same in all three cases: know who has your documents, read the mail that carries your name, and never let anyone file a government application for you in exchange for a fee.

Everything here comes from the public record: the Justice Department’s and the SBA’s announcements of September 2026, court documents from Oregon, Missouri, Texas and Iowa, the SBA inspector general’s reports of 2021, 2023 and 2025, a GAO report and two federal laws. No defendant or victim is named, and charges that have not ended in a plea or verdict are allegations. The next film follows the money further — our article on how scam networks hide money is the place to start, and who else is claiming the seized money shows what happens when the government tries to give it back.