Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND SecureFlow — Bypassing ID.me Identity Verification
- MITRE ATLAS case study AML.CS0017
- New Jersey Man Indicted in Fraud Scheme to Steal California Unemployment Insurance Benefits (justice.gov)
- The Many Jobs and Wigs of Eric Jaklitchs Fraud Scheme (frankonfraud.com)
- ID.me gathers lots of data besides face scans, including locations. Scammers still have found a way around it. (washingtonpost.com)
- CA EDD Unemployment Insurance & ID.me (help.id.me)
- California EDD - How do I verify my identity for California EDD Unemployment Insurance? (help.id.me)
- New Jersey Man Sentenced to 6.75 Years in Prison for Schemes to Steal California Unemployment Insurance Benefits and Economic Injury Disaster Loans (justice.gov)
- How ID.me uses machine vision and AI to extract content and verify the authenticity of ID documents (network.id.me)
An individual filed at least 180 false unemployment claims in the state of California from October 2020 to December 2021 by bypassing ID.me's automated identity verification system. Dozens of fraudulent claims were approved and the individual received at least $3.4 million in payments.
The individual collected several real identities and obtained fake driver licenses using the stolen personal details and photos of himself wearing wigs. Next, he created accounts on ID.me and went through their identity verification process. The process validates personal details and verifies the user is who they claim by matching a photo of an ID to a selfie. The individual was able to verify stolen identities by wearing the same wig in his submitted selfie.
The individual then filed fraudulent unemployment claims with the California Employment Development Department (EDD) under the ID.me verified identities. Due to flaws in ID.me's identity verification process at the time, the forged licenses were accepted by the system. Once approved, the individual had payments sent to various addresses he could access and withdrew the money via ATMs. The individual was able to withdraw at least $3.4 million in unemployment benefits. EDD and ID.me eventually identified the fraudulent activity and reported it to federal authorities.
In May 2023, the individual was sentenced to 6 years and 9 months in prison for wire fraud and aggravated identify theft in relation to this and another fraud case.
ASSESSED SYSTEM
ID.me's automated remote identity-verification service as relied on by the California Employment Development Department (EDD) for unemployment-insurance claimants between October 2020 and December 2021: the applicant enters personal information, uploads a photo of a driver's licence, and submits a selfie; the system extracts content from the ID photo, validates the document's authenticity using a combination of AI and proprietary methods, and uses facial recognition to match the ID photo to the selfie. A passing verification let the claim proceed in EDD's application pipeline.
OUT OF SCOPE
The fraudster's forged driver's licences, wigs, and stolen identity data (attacker inputs and tooling); EDD's own claim adjudication, payment, and mailing-address processes, which approved dozens of claims after verification; the separate fraud case covered by the same sentencing; and ID.me's verification service as it stands after the incident, which the record does not describe.
Architecture: Traditional ML / Classifier (decision tree Q6) — The decision tree resolves at Q6 by elimination. Q1 = NO and Q2 = NO: no agents, planner, task state, or tool invocation; the service returns a verification outcome to the relying agency. Q3 = NO: no model-invoked function or connector is described. Q4 = NO: the record describes no inference-time retrieval layer. Q5 = NO: the service extracts and validates document content and matches faces; it generates no open-ended content. What remains is a bounded document-authenticity and face-matching pipeline with deterministic workflow logic, the Q6 class. Tier 2: Tier 2 Consumer: members of the public use the service directly to prove their identity, and exploitation lets an attacker assume specific individuals' identities, the defining Tier 2 criterion. The at least USD 3.4 million benefit loss occurred in the relying agency's payment process and is carried by the corroborated Cp rather than by raising the tier.
Documented attack or failure path
- The individual collected stolen identities, including names, dates of birth, and Social Security numbers, and obtained fake driver's licences combining those details with photos of himself wearing wigs.
- He created ID.me accounts and completed its identity-verification flow for EDD, entering personal information, uploading a forged licence, and submitting a selfie wearing the same wig.
- ID.me's document verification accepted the forged licences and its face-match step matched the selfie to the licence photo, so stolen identities were verified and the claims proceeded in the application pipeline.
- Dozens of at least 180 fraudulent unemployment claims filed between October 2020 and December 2021 were approved.
- Payments were sent to addresses he could access and withdrawn at ATMs, totalling at least USD 3.4 million, before EDD and ID.me identified the activity and reported it to federal authorities.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Not every attempt succeeded: dozens of at least 180 fraudulent claims were approved. The record does not state at which stage the remaining claims stopped, so no score credit is assigned to ID.me's verification step for this.
- EDD and ID.me eventually identified the fraudulent activity and reported it to federal authorities, leading to the individual's sentencing in May 2023. This is after-the-fact detection, recorded as an ACI monitoring observation rather than as a preventive control.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.08–0.76 (midpoint 0.42), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.32 | The 0.25 anchor: purpose-built controls existed — automated document-authenticity validation followed by ID-to-selfie face matching — but they failed against a common, low-cost forgery-plus-disguise technique that the attacker could repeat across many identities. The 0.50 anchor requires resistance to common attacks with an attack success rate below 50%; the record publishes no rate for the verification step itself (the dozens-of-180 approval figure includes EDD's downstream processing), so 0.50 is not established. Not 0.00, because authenticity validation and face matching were operating and forced the attacker to manufacture consistent forged documents and disguised selfies rather than submit arbitrary images. | ID.me's verification accepted forged driver's licences carrying stolen identity details and the fraudster's own disguised photo: its document-authenticity validation (AI plus proprietary methods) did not reject them, and its face-match step paired the wig-wearing selfie with the matching wig-wearing licence photo. The same low-cost technique was repeated across at least 180 claims, of which dozens were ultimately approved.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: declared with an architecture rationale in the workpaper: Cn-5, Cn-6; NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.25 | Human-on-the-loop anchor. The record describes ID.me's verification as automated: a passing result released the claim into EDD's pipeline with no per-case human identity review evidenced. The service executes no payments itself, which keeps it below 0.75; its unreviewed decision gates a consequential benefit workflow, which places it above the 0.25 human-gated anchor. |
| AsAttack Surface Exposure | 0.50w 0.35 | The 0.50 anchor: internet-facing to external, unauthenticated applicants who submit their own document images and selfies, with automated validation on those inputs. No RAG, web-scraping, multi-agent, or MCP surface is described. |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph with DGC at least 0.90 is public, so the specification's worst-case default applies. It is corroborated by the observed path from a passed verification through claim approval to at least USD 3.4 million in benefit payments sent to addresses the attacker controlled.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.20 | The defeated controls are learned document-authenticity and face-matching judgments. Closing the path requires improved or retrained authenticity detection and a stronger binding between the document and the claimed identity, whose effectiveness must be re-evaluated. The record describes no remediation, so a deterministic or infrastructure-only fix is not evidenced. Not 0.75, because acceptance of forged documents is a detection-quality gap rather than an inherent model property. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | At the 0.25 anchor. The vendor (ID.me) and the deployment owner (California EDD) are identified, and the vendor's published method description documents the verification components (content extraction, AI-assisted authenticity validation, ID-to-selfie face matching). No model identity, configuration, AIBOM, or evaluation artefact is public, so nothing above the 0.25 anchor is met. |
| Ec — Public evaluation coverage | 0.03 | coverage 0.05 (1 of 22 applicable sub-metrics) × independence 0.80 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2020-10-01; age 2208 days on the workpaper reference date. Components: T_calendar 0.00 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. Evidence age is measured from the MITRE ATLAS incident date 2020-10-01 (month granularity; the start of the fraudulent claims) to the 2026-10-18 evidence reference date, 2181 days, so the calendar term dominates. agentic = false and baw = false: a bounded verification pipeline with no runtime tool reprovisioning, model-writable memory, online learning, or self-modifying configuration is described. C_monitor 0.65: detection came only after a sustained campaign of at least 180 claims between October 2020 and December 2021. C_event 0.65: the moderate row is applied for an exploited weakness; the record attributes acceptance to flaws in the process 'at the time' but documents no specific change event. C_evidence 0.85: no remediation of the verification step is documented in the record. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.00 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.6 midpoint, interval 1.2–5.9; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-D-005.001 | AI System Log Generation & CollectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0017-idme-identity-verification-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0017-idme-identity-verification-bypass), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-2. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
WHAT THIS CASE TEACHES
Identity-verification fraud is scored on the document-authenticity and face-match controls that were defeated, not on the downstream payout: a low-cost forgery-and-disguise technique places Ro-1 at 0.25, and a vendor-reported evidence base lowers Independence to 0.80 in the diagnostic ACI without changing the scenario ERS.
Sources: AIDEFEND SecureFlow — Bypassing ID.me Identity Verification · MITRE ATLAS case study AML.CS0017 · New Jersey Man Indicted in Fraud Scheme to Steal California Unemployment Insurance Benefits (justice.gov) · The Many Jobs and Wigs of Eric Jaklitchs Fraud Scheme (frankonfraud.com) · ID.me gathers lots of data besides face scans, including locations. Scammers still have found a way around it. (washingtonpost.com) · CA EDD Unemployment Insurance & ID.me (help.id.me) · California EDD - How do I verify my identity for California EDD Unemployment Insurance? (help.id.me) · New Jersey Man Sentenced to 6.75 Years in Prison for Schemes to Steal California Unemployment Insurance Benefits and Economic Injury Disaster Loans (justice.gov) · How ID.me uses machine vision and AI to extract content and verify the authenticity of ID documents (network.id.me)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0017 (incident) |
|---|---|
| Target | California Employment Development Department |
| Actor | One individual |
| Reporter | ID.me internal investigation |
| Primary evidence date | 2020-10-01 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Predictive ML / computer vision |
| Risk impact | Model evasion / bypass, Credential and identity theft, Financial fraud abuse |
| Affected components | ID.me document verification system, ID-to-selfie face matching model, identity-document content extraction (OCR/AI), California EDD unemployment claims process |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Submit Forged Identity Documents for VerificationThe individual applied for unemployment assistance with the California Employment Development Department using forged identities, interacting with ID.me's identity verification system in the process. The system extracts content from a photo of an ID, validates the authenticity of the ID using a combination of AI and proprietary methods, then performs facial recognition to match the ID photo to a selfie. [7] (https://network.id.me/wp-content/uploads/Document-Verification-Use-Machine-Vision-and-AI-to-Extract-Content-and-Verify-the-Authenticity-1.pdf) The individual identified that the California Employment Development Department relied on a third party service, ID.me, to verify individuals' identities. The ID.me website outlines the steps to verify an identity, including entering personal information, uploading a driver license, and submitting a selfie photo. | AML.TA0000 AML.T0047 |
| 2 | Defeat Selfie-to-ID Face Match with DisguiseThe individual collected stolen identities, including names, dates of birth, and Social Security numbers and used them along with a photo of himself wearing wigs to acquire fake driver's licenses. The individual uploaded forged IDs along with a selfie. The ID.me document verification system matched the selfie to the ID photo, allowing some fraudulent claims to proceed in the application pipeline. | AML.TA0004 AML.T0015 |
| 3 | Collect Fraudulent Unemployment PaymentsDozens out of at least 180 fraudulent claims were ultimately approved and the individual received at least $3.4 million in unemployment assistance. | AML.TA0011 AML.T0048.000 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0017-idme-identity-verification-bypass; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0017 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).