EBT theft in California has cost taxpayers tens of millions

In May 2019, police entered a 12th-floor room at a Residence Inn near the Los Angeles International Airport and found various tools for credit card theft and duffel bags holding more than $930,000 in cash.

The room had been rented by Jawuan Gibson, who eventually pled guilty in Sacramento County Superior Court to grand theft and identity theft. 

The case caught the attention of the California Department of Social Services. Gibson had been accused of sending mass text message scams to trick cash aid recipients into giving away their Electronic Benefits Transfer card information. He then stole their money, withdrawing the cash from duplicated cards.

At the time, the amount reported stolen from EBT users was in the tens of thousands of dollars a month — a small fraction of the millions the department sent out in cash assistance each month that year to more than 350,000 poor families. When recipients were victimized, they could generally get the money back, albeit with some delay. 

But officials feared the case indicated more theft was coming. So in early 2020, the department came up with a plan to hire investigators specifically focused on EBT theft. 

Separately, a group of county welfare fraud investigators said they asked the social services department to add security chips to EBT cards, a layer of fraud protection commercial bank customers had already been enjoying on debit and credit cards for years.

The state did neither. 

The COVID-19 pandemic hit, and with it would come an influx of public aid and a tsunami of benefits theft that hit recipients of everything from stimulus checks to unemployment aid. The state, facing a potential economic downturn, in the spring of 2020 abandoned a $565,000 plan to bolster EBT theft investigations, according to Social Services’ public budget documents. 

By the time the Department of Social Services quietly resurrected the plan two years later in April 2022, California was losing nearly $2 million a month to EBT thieves, according to figures released by the department. Now thieves were also stealing food stamps, a benefit used by nearly three million California households, and purchasing expensive items like pallets of energy drinks to resell.

Both cash and food benefits are largely federally funded, but California must pay out of its own funds to reimburse theft victims. 

The delayed plan raises questions about whether the state missed an opportunity to stem the theft. The Department of Social Services said it responded appropriately with some security measures to the Sacramento County case, but that it only prevented scams, while theft skyrocketed thanks to fraudsters’ use of hidden devices to steal card numbers, known as skimming.

Between July 2021 and this March, taxpayers paid $87 million for this theft. Throughout the current fiscal year that began in July, the department is expecting to pay $178 million, according to budget documents. 

In 2019 and 2020, lawmakers introduced a bill requiring social services to examine weaknesses in the EBT system for online transactions and come up with solutions. Both years the bill died in the Assembly Appropriations Committee via the suspense file process by which lawmakers kill numerous bills in one hearing without explanation. 

When Gov. Gavin Newsom’s administration committed this year to making California the first state to use EBT cards with chips, public benefits were being stolen to the tune of $10 million a month. 

Chip cards, which payments industry experts say could significantly cut the thefts, would allow recipients to use EBT cards without being as vulnerable to their card numbers being stolen. The state has earmarked $50 million for the upgrades. The soonest those upgrades will go into effect is May 2024, at least six months from now. 

Few policies in place to protect theft victims

Guadalupe Rosales found herself in a panic on a recent Saturday morning. 

It was the second of the month, the day California typically deposits cash assistance onto the El Monte single mother’s EBT card. Rosales checked her account in preparation for a trip to the ATM. But the money, all $1,300, was gone, withdrawn by someone else at an ATM in another city. 

Rosales relies on CalWorks, the state’s cash assistance program for poor families, to support her three children as they get back on their feet after experiencing domestic violence. 

It was the second time Rosales’ benefits had been stolen. She had bills to pay and a car to fill up to take the kids to school. Her oldest son had senior portraits to take, and she could barely afford tickets to his football games. 

Worse yet, it was Labor Day Weekend. By the time the Los Angeles County welfare office opened the following Tuesday for her to request a reimbursement, rent and utilities were past due. She’s since gotten the money replaced, but not before paying a slew of late fees and borrowing money.

“I feel like I’m in more debt than I was,” she said. 

California initially appeared to be at the forefront of protecting public benefits recipients.

In 2013, the state began reimbursing welfare recipients who have their benefits stolen electronically. In 2020 it was the first state to extend reimbursements for victims of food stamp theft even if they didn’t lose their EBT card. 

That’s the case for most EBT theft, investigators say. Victims are either scammed into giving away their card numbers, or the numbers are stolen through a method called skimming, which involves installing a hidden device at checkout counters, ATMs or gas pumps to record the card numbers of those who swipe the magnetic stripes. 

In December 2018, the welfare fraud investigators association’s legislative and policy chairman Glenn Allen said the group met with Social Services leaders and asked the state to add security chips to EBT cards, but were told that would be “too expensive.”

“We told them, ‘You need to chip the cards now,’” Allen said.

Meeting notes provided by the association say the group’s then-president Guy Christian told officials including then-director Will Lightbourne that the cards needed security upgrades. Among the issues they discussed, according to the association’s notes: the department’s concern about growing “cloning/skimming of cards” and “the lack of sophistication such as ‘chipped’ cards.”

California Department of Social Services spokesperson Jason Montiel declined to comment on the meeting. He said chips were not considered prior to 2023 because earlier waves of EBT theft were primarily theft from scams, such as the one in the Sacramento County case. Skimming targeting EBT cards, he said, “did not fully emerge until fall of 2021.”

In the summer of 2019, the Department of Social Services gave a presentation at a national conference about the rising concern of EBT theft. It cited two cases — one in Sonoma County and the Gibson case, which was cracked by Sacramento County welfare fraud investigators and the Department of Justice, who teamed up to find patterns in the victims’ accounts and watch ATMs where withdrawals were being made. 

A copy of the presentation, obtained by CalMatters, spells out what the department saw as the problem: Numerous state and federal policies designed to curb fraud in the welfare system were all directed at either the government or public benefits recipients. There weren’t enough policies to prevent “third-party fraud,” in which the recipients are the victims.

“The theft of benefits by those outside the system has not been a significant part of the welfare fraud prevention framework,” the presentation said. 

The department recommended adding three-digit card verification value codes to EBT cards, strengthening the EBT call center’s security and limiting when PINs can be changed. 

The following January, the department proposed spending $565,000 to hire four investigators to examine EBT theft statewide.

“These occurrences involving EBT theft could be mitigated using data analytics and may have been identified earlier if (the California Department of Social Services) had the staff dedicated to monitoring suspicious EBT transactions,” the proposal said. “Due to the lack of investigative resources statewide, including county, state and federal investigators, there is an operational need for California to employ its own investigators to prevent, identify, and help recover these significant losses of public assistance funds.”

In an emailed response to questions from CalMatters, Montiel said the social services department dropped the plan a few months later because of a projected revenue shortfall due to the pandemic, which prompted departments statewide to cut budget requests.

But the department did not resubmit the plan later that year when it proposed other new spending, or the following year when revenues came in higher than expected — even as it issued more benefits to recipients’ cards thanks to pandemic federal aid. Montiel did not answer why. 

The investigative unit was proposed again in April 2022 and approved by the Legislature. Montiel said the team was created in March 2023, hiring a supervisor, two officers and an investigator. It’s currently “providing intelligence and support to local, state, and federal investigation teams and is assisting with detecting and deterring theft,” he wrote.

Gerry Bonilla, division chief of program compliance at the Los Angeles County Department of Public Social Services, said an earlier statewide effort could have helped counties.

Bonilla’s welfare fraud investigative staff primarily handle cases involving recipients getting benefits for which they’re ineligible, which he said “is not very widespread.” They investigate 800 to 900 of these cases a month, “most of which come back negative,” and look into them by parsing through each client’s income statements and other paperwork. 

By contrast, Bonilla said anywhere from 4,000 to 10,000 Los Angeles County residents now claim their benefits were stolen each month. In recent arrests, police point to organized crime groups with international ties.

“It would have certainly been helpful to have a team deployed to that,” Bonilla said. “Our investigators are not equipped to handle that type of investigation.”

Other investigators said they haven’t seen the department take a major role in theft prevention, despite many cases that cross county lines. 

Heather Tallent, a board member of the California Welfare Fraud Investigators Association and supervisor of the welfare fraud division in the Ventura County District Attorney’s Office, said she receives historical data from the state of ATMs where cards are cashed out, but less help with live surveillance of suspicious transactions.

“From what I can see, there’s no proactive investigative response to skimming,” Tallent said. “I haven’t seen it. And it’s not necessarily a criticism, it may be a resource issue for (social services).”

Not everyone believes social services departments should beef up their law enforcement arms. The term “welfare fraud” is fraught among advocates for the poor, evoking 1990s-era stereotypes about people cheating to get public assistance that many anti-poverty organizations blame for burdensome bureaucratic hurdles for people to get aid and unnecessary scrutiny on recipients. 

Earlier this year, advocates supported the state dropping a requirement for EBT theft victims to file a police report in order to get their benefits reimbursed, which welfare fraud investigators said was a bad idea. 

Upgrades at least six months away

With a more generous social safety net than most states, California has been particularly hard-hit in the EBT theft wave. 

Thieves who had initially targeted the simple debit cards of state stimulus check recipients moved on to the similarly vulnerable EBT cards, said David Babcock, a senior investigator on the L.A. County District Attorney’s Cyber Investigation Response Team. 

“Some of these crews that were deploying these skimming techniques started to recognize that the only cards they’re gonna get successfully skimmed are cards without chip technology because people still have to swipe those cards,” Babcock said, calling EBT cards “the last cards without chip technology” in the state.

The social services department has been slow to release more detailed and up-to-date monthly tallies of the theft in response to public records requests from CalMatters, saying in September that it would not produce the data until December.

“These are the most vulnerable people in our community,” Bonilla said. “It’s really just mushroomed.”

In October, the county board of supervisors approved creating its own investigative unit in the D.A.’s office just to focus on this type of theft. 

Chip card upgrades are more than six months away at the earliest. 

In the meantime, the Department of Social Services said it will launch a mobile app this fall, ebtEDGE, that would allow cardholders to freeze their cards or block online or out-of-state transactions.

Until the chip cards arrive, local departments have shifted staff to process a flood of reimbursement requests while recipients try to remain vigilant, changing their PINs and checking their accounts. The state this year has also budgeted more than $30 million in administrative funding for counties to process reimbursements.

Federal rules also in play

In June 2022, the department added the three-digit CVV codes, which Montiel said cut scamming theft by 90%. It was no match against skimming, and overall benefits theft has only skyrocketed since then.

Chips have been developed since the 1990s and were common in Europe before being widely adopted in the U.S. eight years ago. That’s when the card companies Mastercard and Visa set a deadline for American banks to issue chip cards and merchants to accept them, or bear the liability for theft and fraud. 

Though credit card fraud still happens, Jason Bohrer, executive director of the payments industry group Secure Technology Alliance, said it’s largely done by getting access to users’ accounts online through methods far more sophisticated than skimming. Adding chips to credit cards in the U.S. has nearly eliminated fraud that takes advantage of users’ physical cards, he said. 

Other California departments have already taken the security measure. In 2021 the Employment Development Department said it would start rolling out chip cards for unemployment benefits recipients. 

But no state yet puts chips on their EBT cards. Payments experts say it’s always been a cost-benefits consideration.

“Until the cost of the fraud outweighs the cost of issuance, there’s not a lot of incentive to make the transition,” said Tracy Kitten, director of fraud and security at the financial security firm Javelin Strategy & Research.

Federal regulations direct states to use a payments industry standard that limits the delivery of food benefits to cards with magnetic stripes only, Montiel said. The U.S. Department of Agriculture and California are working to modify the restrictions to allow for chip and tap cards, both departments said.

There are also back-end technological upgrades needed before chip cards are rolled out, because EBT transactions run through different systems than commercial banks. 

“Incorporating chip cards requires significant changes to the underlying infrastructure on which the EBT system is built,” Montiel wrote. “Without these underlying, back-end technological upgrades, a transaction using a chip/tap EBT card would fail.”

In one other response to the theft wave, California fell behind.

A year ago, Congress passed a spending bill to reimburse states for paying recipients back up to two months of stolen food benefits. California pays theft victims back, but only for one month.

California in October became the last state in the country to get its reimbursement plan approved by the USDA. Other states had been approved as early as February. The federally-paid plan goes into effect in California in December. Neither federal nor state agency would explain what caused the delay. 

It’s frustrated recipients like Marshall Epstein who have been victims of theft multiple months. Epstein, a Los Angeles resident, said he had $1,400 worth of food assistance funds on his EBT card when it was skimmed earlier this year. After filing a report he only got about $200 back. 

He scans the news frequently, waiting to find out when he’ll get a card with a security chip.

“I’m not looking for extra money, just to get my benefits back,” he said.