2 On Your Side: Latest EDD Scam Targeting Out-Of-State Residents Via Text

LOS ANGELES (CBSLA) — Carolyn thought it was her lucky day when she got a series of text messages that said she had been selected to receive money from EDD, California's Employment Development Department.

"I filled out my name and social security number," she said. "And asked how much I was getting a month, and I put that in."

Carolyn is already receiving unemployment payments in her home state of Nevada, which is why she didn't question communication about additional payments — even if it was allegedly coming from a different state.

"But then when they sent me another text message...asking me for my driver's license and a selfie, that's when I got suspicious," she said.

The thieves were likely trying to use Carolyn's image and identity to get around EDD's identity verification system, ID.me.

When asked whether she was concerned about the information she did give to the scammers, she said, "I was scared, and I still am."

Despite living in Nevada, Carolyn has a Seattle area code for her cell phone number. Just like a man named Dave who contacted CBS2's Kristine Lazar after receiving a series of text messages this week from someone claiming to be a lottery winner.

"And they wanted to send 500 people $10,000 dollars," Dave said.

So Dave sent a photo of his driver's license and a selfie.

"The thought was there all along that this may be a scam," he said. "But, I mean, I had hoped. I am struggling right now."

But then the scammer told Dave something that set off alarm bells.

"I was going to get a text from a different site, and I was supposed to ignore that," he said.

That text was from a legitimate source. It was ID.me asking Dave if he had logged into EDD. That's when Dave knew he had been had.

In a statement, ID.me CEO Blake Hall said:

"These individuals are victims of a scam known as social engineering, an attack where a criminal tricks an individual into handing over their personal information and taking a selfie under false pretenses like getting a job or winning prize money. This is not a technical attack. The real owner of the identity was verified. But, they were fooled.

The "N" response in the text message also clearly shows that ID.me's anti-fraud controls are working. Similar to how a bank will notify an individual of suspicious activity on their credit card, ID.me notifies people when their identity is used at a government agency. These texts pierce the scam to alert the owner of their identity of how it was actually used. In this case, ID.me quickly blocked this scam and reported the fraud to CA EDD after the individual reported unauthorized use. Nationwide, ID.me receives more than 200 SMS N responses each day and automatically suspends the associated accounts while alerting involved government agencies.

Social engineering is a disturbing form of fraud because the attacker preys upon a human's inherent willingness to trust another person. These attackers will often prey upon vulnerable populations like lonely people who believe they have found a romantic interest online. By following the federal guidelines for identity verification, NIST 800-63-3 Identity Assurance Level 2, and adding authorized use notifications, ID.me has prevented tens of billions of dollars of unemployment benefits fraud across the country."

As for EDD, the department released a statement that said:

"There have been aggressive scammers at work through this historic pandemic. The EDD has been sharing warnings on our website, news release, social media and other outreach and education efforts."

EDD also said people can get more information about avoiding scams on the department's Help Fight Fraud webpage. The department has also released a fact sheet titled "What You Should Know About Unemployment Scammers" to help people protect themselves against those who attempt to impersonate EDD and ID.me.