The contractor with the company laptop knew which holds to remove

Denise opened the envelope on a Tuesday in late January because the return address said State of Maryland and she had learned, after a year of layoffs and reopenings and layoffs again, that you do not let mail from the state sit.

She was fifty-four. She had cleaned rooms at a hotel near BWI for eleven years before the pandemic emptied the lobby. She had filed for unemployment in April of 2020, like everyone else on her floor of the housekeeping staff, and she had received what she was owed, and then she had gone back to work when the hotel called her back, and then she had been laid off again, and then back, and by the time the envelope arrived on her kitchen table she thought she was done with the Maryland Department of Labor.

The envelope was a 1099-G. A tax form. It said the State of Maryland had paid her benefits in 2021 and 2022. The number on it was wrong. The number on it was big.

She had not filed a claim in 2021. She had not filed a claim in 2022. She had been working the second-shift housekeeping rotation at a different hotel by then, off the books some weeks, on the books most. She read the form three times. The radiator in the kitchen clicked the way it always clicked in January.

Somebody had collected unemployment in her name. Somebody had used her social security number to tell the State of Maryland she was out of work, and the State of Maryland had believed it, and the money had gone somewhere that was not her.

She did not know yet that the door to her file had been opened from the inside.

I.

The CARES Act was the largest emergency expansion of unemployment benefits in American history. Congress passed it in March of 2020. It did two things that mattered for what happened next. It made gig workers and self-employed people eligible for unemployment for the first time, through a program called Pandemic Unemployment Assistance. And it added a federal supplement on top of state benefits, six hundred dollars a week at first, three hundred later.

States had to build the plumbing for all of it in weeks. Maryland's system, like most states', was old. The fraud filters were old. The verification was old. The staffing was thin. Applications surged from a normal week of a few thousand to a normal week of hundreds of thousands. To keep benefits flowing to people who actually needed them, many states waived work search requirements and loosened identity checks.

That is the environment. A flood of money. A system built for a trickle. Locks that had not been changed in years, propped open with a brick because the line outside was around the block.

The U.S. Government Accountability Office later estimated that between $100 billion and $135 billion in unemployment benefits paid during the pandemic were fraudulent. That is somewhere between eleven and fifteen percent of every dollar paid out. Some outside estimates run as high as $400 billion.

Read that slowly. The low end of the official estimate is one hundred billion dollars.

The Maryland ring took $3.5 million of it.

II.

The federal indictment, and the guilty pleas and sentencings that followed, lay out the shape of the conspiracy.

From May 2021 to June 2022, Terry Chen, of Prince George's County, and five named co-conspirators filed fraudulent claims with the Maryland Department of Labor using stolen identities. Real names. Real social security numbers. Real birthdates. The kind of information that sits in data breach dumps that anyone with a Telegram account and a few hundred dollars can buy.

The claims were approved. The benefits were loaded onto debit cards and into accounts that the conspirators controlled. The money came out at ATMs, moved through bank accounts, bought goods, became cash.

This is the standard architecture of a pandemic unemployment ring. It ran in every state. It is not the part of this case that is interesting.

The interesting part is Kiara Smith.

Smith was twenty-eight years old. She worked at a company that contracted with the Maryland Department of Labor to provide professional support services. According to the federal record, those services included fraud detection. She had a company-issued laptop. With that laptop, she could open the MD-DOL system and look at claims. She could see which ones the automated filters had flagged. She could approve them. She could remove the fraud holds. She could certify weeks for benefits so that the money kept flowing.

She did all of those things. The federal court found, and her sentence reflects, that she used her access to alter and approve fraudulent claims, remove fraud holds on claims the system had already flagged as suspicious, and certify benefit weeks for her co-conspirators.

She was the valve. The system had filters. The filters worked. The filters caught some of the claims the ring submitted. And then someone on the inside opened the valve and let the flagged claims through anyway.

Smith was sentenced to forty-two months.

III.

Picture what this looks like from the chair Denise is sitting in.

Denise's identity is purchased in a data dump. Her name goes into a claim. The claim hits the MD-DOL system. The system flags it. Maybe the address does not match. Maybe the IP address is wrong. Maybe the bank account routing the benefits does not look right. The flag goes into a queue.

Smith sees the flag on her laptop. Smith clears the flag. The money goes out.

Denise does not know any of this is happening. Denise is working second shift. Denise gets her own pay stubs. Denise does not think to check whether someone else has filed for unemployment in her name, because why would she.

Two years later the 1099-G arrives. Denise calls the number on the form. She is on hold for an hour. She talks to someone who tells her to file a report. She files the report. She gets a letter saying it is under review. She gets a notice from the IRS asking why she did not pay tax on the benefits she received. She did not receive them. She has to prove it. She has to send copies of her pay stubs from the hotel. She has to explain, to a person at a federal agency, that the money on the form did not arrive in her account, did not pay her rent, did not buy her groceries, did not exist in her life except as a number on a piece of paper that says she owes tax on it.

She is not a defendant. She is not a co-conspirator. She is collateral.

That is what identity theft inside a federal benefits program looks like from the inside of the kitchen.

IV.

On May 21, 2026, Judge Deborah L. Boardman sentenced Terry Chen to seventy-two months in federal prison. Three years of supervised release. One million dollars in restitution. One million dollars in criminal forfeiture.

The other sentences in the case, from the same courtroom, from the same judge:

Lawrence Nathanial Harris, 180 months. Fifteen years.

Ahmed Hussain, 102 months.

Kiara Smith, 42 months.

Zakria Hussain, 36 months.

Bryan Nushawn Ruffin, 27 months.

The spread tells you something about how federal sentencing reads culpability in a conspiracy. The longest sentences go to the people the court found most central to the scheme. Smith, the insider with the laptop, did not get the longest sentence. She got more than the two co-conspirators who appear to have played smaller roles, and less than the two the court appears to have viewed as central organizers.

U.S. Attorney Kelly O. Hayes for the District of Maryland framed the prosecution as part of the federal Task Force to Eliminate Fraud. The DOJ's COVID-19 Fraud Enforcement Task Force, established in May 2021, has charged nearly 600 defendants in cases involving more than $600 million across 56 federal districts.

In May of 2026, the U.S. Department of Labor's Office of Inspector General sent a directive to financial institutions. Freeze the funds in prepaid debit card accounts linked to fraudulent pandemic UI claims. Hold them through the end of the year. Do not let them escheat to states under unclaimed property laws, because once they escheat the federal government's ability to claw them back gets significantly harder.

That directive is the shape of the cleanup. Years after the fraud. Money still sitting on debit cards that were never used up. Federal investigators trying to grab it before it disappears into state coffers under a different legal name.

V.

There is a pattern here, and it is older than the pandemic.

Any time the government sets up a large benefits program quickly, the fraud follows. PPP loans. EIDL grants. Pandemic unemployment. The Restaurant Revitalization Fund. The pattern is consistent. The system is built fast. The verification is loose. The money is moving. Outside actors test the locks. Insiders, sometimes, open the doors.

The insider piece is the part that should not be overlooked. The Maryland case is not unusual in that respect. Across the country, pandemic fraud prosecutions have repeatedly named contractors, temporary employees, and in some cases full-time state workers who used their access to clear claims, approve payments, or provide information to outside conspirators.

That is the part the headline number does not capture. The $3.5 million figure says how much was taken. It does not say how. The how is that someone with a badge and a laptop sat at a desk and turned off the alarm that was telling her the house was being robbed.

VI.

Denise eventually got the IRS thing cleared up. It took her a year and a half. She had to file an identity theft affidavit. She had to put a fraud alert on her credit. She had to write letters. She kept a folder for it in the top drawer of the desk in her kitchen. The folder grew thick.

She still has the folder. She has not thrown it out, because she does not trust that the thing is fully done.

She has never met Terry Chen. She has never met Kiara Smith. She does not know if her name was one of the claims Smith cleared from the fraud hold queue, or one of the claims that sailed through on its own. She probably never will know.

The federal record will say the case is closed.

The folder in the kitchen says something else.

The fraud was not that someone stole her identity. Identities get stolen every day. The fraud was that the system designed to catch the theft was unlocked from the inside, by someone whose job it was to lock it.

That is what the six years are for.