The emergency ended before the accounting did
The Paycheck Protection Program was designed to move money faster than a conventional small-business loan. Its fraud legacy has moved on a different clock: investigations, disputed estimates, forgiveness reviews and collection efforts continue years after lending stopped. The difficulty is not simply measuring a large problem. It is distinguishing evidence that money was at risk from evidence that fraud occurred, and separating both from money actually recovered.
That distinction remains current. On September 14, 2026, the Small Business Administration announced suspensions of 870,000 borrowers associated with an estimated $39 billion in suspected fraudulent PPP and COVID Economic Injury Disaster Loan activity. This is an agency announcement about suspected activity across two programs. It is not a finding that $39 billion of PPP money was stolen, nor does suspension establish a criminal conviction. [12]
Why ordinary lending rules were set aside
Treasury's March 31, 2020 launch announcement presented the program as a rapid public-private response to collapsing business activity. Loans would carry a 100% SBA guarantee, with no collateral or personal guarantees, and could be forgiven when used for eligible payroll and operating expenses. The announcement anticipated an April 3 opening and possible same-day approvals. Those were original launch terms; Congress and administrators subsequently changed important program rules. [1]
The economic logic was emergency continuity. A business facing an abrupt revenue interruption could lose employees before a conventional credit review finished. Forgivable support also differed from asking an already stressed employer to assume ordinary long-term debt. The design shifted emphasis toward eligibility, payroll and permitted uses rather than the usual lender judgment about repayment from future cash flow. That shift explains the program's vulnerability without excusing deception.
Access was a separate problem. GAO's September 2021 review found that businesses with 10–499 employees received 42% of first-phase loans although they represented 4% of small businesses. Later changes admitted additional lenders, clarified self-employed eligibility and targeted underserved businesses. Lending to the smallest businesses increased, though it remained disproportionately low. These findings complicate the idea that stricter screening alone defined success: the program also had to reach firms that the initial distribution system missed. [2]
Reliance was permitted; responsibility remained
PPP divided duties among borrowers, lenders and SBA. Borrowers supplied certifications and records; lenders processed applications; SBA guaranteed eligible loans and administered government payment obligations. Treasury and SBA's FAQ 1 placed accurate payroll calculations with the borrower while expecting lenders to review calculations and supporting documents in good faith within a reasonable time. Lenders could rely on specified borrower representations, but identified errors or material gaps in substantiation called for resolution. [3]
This was lighter-touch underwriting, not an instruction to disregard contradictory information. It also created an attribution problem after losses appeared. A fraudulent borrower does not automatically prove that a lender violated its obligations. Conversely, a government guarantee does not establish that every lender action complied with the program. The relevant question is what each participant was required to do under the rules then applicable, and what the evidence shows it actually did.
The timing of safeguards mattered. GAO's June 2020 oversight identified the risk created by reliance on self-certifications. Subsequent updates to that recommendation record say automated screenings covered 2020 PPP loans in August and early September 2020, while screening before lender approval began in January 2021. A control added after payment can identify a problem, but it cannot prevent that original payment. [4]
The headline estimates measure different things
SBA's inspector general estimated in June 2023 that more than $200 billion in combined COVID EIDL and PPP disbursements was potentially fraudulent. The report separated that amount into more than $136 billion for COVID EIDL and $64 billion for PPP. Its PPP estimate represented approximately 8% of disbursed PPP funds. Attributing the entire $200 billion to PPP is wrong. Describing the PPP component as a court-established theft total is also wrong. [5]
The inspector general used investigative work, earlier oversight and data analysis to identify potential fraud. SBA disputed the approach. In its own June 27, 2023 report, the agency estimated about $36 billion in likely fraud across its pandemic relief programs after additional review, including projections for unresolved files. For PPP specifically, SBA projected that 223,000 loans totaling $7.4 billion would have been referred to the inspector general when its review was complete. These were agency estimates and referral projections, not adjudicated losses. [5][6]
The difference cannot be resolved by averaging the two headline numbers. A broad warning signal and a narrower reviewed population answer different questions. Screening may flag legitimate loans; a more restrictive process may miss fraud. Neither the presence nor the removal of an administrative flag supplies the same evidence as a completed investigation. The size of the disagreement is itself consequential: program management and independent oversight did not offer a single reconciled measure of the eventual loss.
Forgiveness did not close every question
Forgiveness was part of PPP's purpose, not inherently a suspicious outcome. Treasury and SBA released the forgiveness application in May 2020 to implement relief for qualifying uses, including payroll. A legitimate borrower could receive a loan, satisfy the conditions and owe nothing further. Looking at a public record showing forgiveness and treating that status as proof of wrongdoing reverses the program's design. [15]
The opposite inference is no safer. SBA and Treasury's July 2021 FAQ 39 said loans of any size could be reviewed before or after SBA paid forgiveness to the lender. Forgiveness therefore was not a certificate that no later eligibility or fraud issue could arise. An approved benefit, an eligibility determination and a criminal adjudication are different events, reached through different processes. [8]
GAO's March 2025 examination found weaknesses in PPP screening, analytics and human-led review. Its account described unresolved concerns about documentation, validation checks and oversight of contractor reviews. SBA's four-stage approach combined screening, data analytics, human review and referral to the inspector general; GAO found that controls within the process were not uniformly effective. The analytical implication is straightforward: counting cleared files does not by itself demonstrate that the underlying concerns were resolved adequately. [7]
A lender case illustrates the limits of a settlement number
In May 2024, DOJ announced a civil resolution with Kabbage, then winding down as KServicing Wind Down Corp., concerning alleged false PPP forgiveness, guarantee and processing-fee claims. The government alleged inflated loan calculations and inadequate fraud controls. The company acknowledged specified calculation errors in the settlement, while DOJ stated that the resolved claims were allegations and there had been no determination of liability. This was not a criminal conviction. [9]
The financial terms are equally important. DOJ said the government would receive an allowed general unsecured bankruptcy claim of up to $120 million, with ultimate recovery dependent on assets available for unsecured creditors. The resolution also provided credit for $12.5 million previously returned to SBA. Calling the headline claim $120 million of cash recovered would misstate the announcement. Adding the credited prior return as entirely new recovery would risk counting the same money twice. [9]
A criminal judgment answers a narrower, stronger question
DOJ reported on August 21, 2025 that Meelad Dezfooli received more than 15 years in prison after a September 2024 jury conviction involving bank fraud and money laundering. According to the release, he fraudulently obtained more than $11 million in PPP funds. Unlike a screening flag or an indictment, the reported verdict establishes that a jury found the charged offenses proved in that case. This account describes the dated conviction and sentencing record, not a representation that all appellate proceedings have ended. [10]
DOJ also reported restitution of about $11.79 million, forfeiture of about $11.23 million and forfeiture of identified property. These orders should not be added together and presented as a cash recovery total. Restitution is an obligation to compensate; forfeiture concerns criminal proceeds or property; collection determines what is actually realized. Distinct legal remedies can relate to the same underlying funds, and an order alone does not establish payment. [10]
Recovery statistics need a program and a date
DOJ's April 9, 2024 task-force announcement reported more than 3,500 defendants charged and over $1.4 billion seized or forfeited in stolen COVID relief funds. It covered multiple pandemic programs. It did not say that all defendants had been convicted, that every seized dollar had completed final disposition, or that the total belonged entirely to PPP. This is a dated enforcement snapshot, not an October 2026 cumulative PPP recovery balance. [11]
The September 2026 SBA release likewise said more than 560,000 suspected fraudulent pandemic borrowers tied to $22 billion in loans had previously been referred to Treasury for collection. A referral begins or advances a collection process; it is not receipt of $22 billion. The release's separate figures for suspensions, suspected loan amounts and referrals cannot safely be added into a larger fraud or recovery total without loan-level reconciliation. [12]
Even a carefully labeled aggregate remains incomplete if the underlying categories overlap. The same loan can appear in an agency flag, an inspector-general referral, a prosecutor's case and a later forfeiture announcement. Enforcement announcements illuminate progress, but they are not automatically independent entries in a financial ledger. Net taxpayer loss requires consistent treatment of disbursements, recoveries and unresolved amounts, rather than a sum of press-release headlines.
The long tail is a control problem as well as a legal one
Congress extended the enforcement horizon through the PPP and Bank Fraud Enforcement Harmonization Act, signed August 5, 2022. For covered first- and second-draw borrower fraud, it provides that criminal charges or civil enforcement actions must be filed within ten years after the offense. That longer window helps explain why the end of emergency lending did not end the enforcement story; the applicable deadline still depends on the offense and circumstances. [13]
Collection weaknesses can remain even when fraud receives attention. GAO's November 2024 overpayments report found that SBA's reviews emphasized fraud and eligibility without adequately identifying all overpayments. Its recommendation page, reviewed for this article, continued to list relevant SBA recommendations as open: February 2026 status notes said SBA had not supplied updated information on certain collection-control recommendations. These are dated implementation observations, not proof that nothing changed afterward. [14]
PPP leaves two conclusions that can coexist. Fast emergency support addressed a genuine economic threat, and controls were inadequate in consequential ways. Yet precision remains essential to accountability. Potential fraud is not confirmed loss; a charge is not a conviction; forgiveness proves neither innocence nor guilt; and a demand, judgment or seizure is not automatically cash returned. The public record through October 4, 2026 supports an enduring oversight failure and continuing enforcement work. It does not support one simple, uncontested figure for how much PPP fraud ultimately cost.
Sources
- Treasury: original PPP launch announcement, March 31, 2020Official releaseBack to text: ↑
- GAO-21-601: access and lending changes, September 21, 2021Official sourceBack to text: ↑
- SBA/Treasury: PPP FAQs, May 9, 2024 version, questions 1 and 39Official source · PDFBack to text: ↑
- GAO-20-625: initial controls and subsequent recommendation updatesOfficial sourceBack to text: ↑
- SBA OIG Report 23-09: COVID-19 EIDL and PPP fraud landscape, June 27, 2023Official source · PDFBack to text: ↑1↑2
- SBA: Protecting the Integrity of the Pandemic Relief Programs, June 27, 2023Official source · PDFBack to text: ↑
- GAO-25-107267: fraud screening and referral controls, March 24, 2025Official sourceBack to text: ↑
- SBA/Treasury: PPP FAQs, July 29, 2021 version, question 39Official source · PDFBack to text: ↑
- DOJ: Kabbage civil resolution, May 13, 2024Official sourceBack to text: ↑1↑2
- DOJ: Meelad Dezfooli sentencing, August 21, 2025Official sourceBack to text: ↑1↑2
- DOJ: COVID-19 Fraud Enforcement Task Force report announcement, April 9, 2024Official releaseBack to text: ↑
- SBA: nationwide borrower suspensions announcement, September 14, 2026Official sourceBack to text: ↑1↑2
- Public Law 117-166: PPP and Bank Fraud Enforcement Harmonization Act, August 5, 2022Official source · PDFBack to text: ↑
- GAO-25-106199: identifying and recovering overpayments, November 13, 2024, with 2026 recommendation updatesOfficial sourceBack to text: ↑
- Treasury: PPP loan forgiveness application announcement, May 15, 2020Official releaseBack to text: ↑