New research reveals how domestic and international fraud rings exploited disaster aid programs following Kerr County floods

As federal policymakers explore faster, more decentralized approaches to disaster relief, new research from Socure reveals that these programs are deeply vulnerable to fraud, and that bad actors possess the scale and sophistication to exploit existing weaknesses, as well as those introduced by proposed reforms.

Socure, the AI-first platform for global identity and risk decisioning, today released new research uncovering how organized domestic and international fraud rings rapidly mobilized to exploit victims and relief programs following the catastrophic July 2025 floods in Central Texas.

The report, titled “Exploiting Disaster: Identity Fraud Spikes After Texas Floods,” provides an in-depth look at how criminal networks, including those with ties to China, Morocco, and other countries, weaponized pre-built “identity farms” and proxy networks to target disaster assistance funds intended for survivors.

As disaster relief programs increasingly prioritize speed through faster approvals, consolidated payouts, and broader state-level administration, these findings underscore the growing need for identity certainty and proactive fraud controls across the entire disaster-aid ecosystem, including federal agencies, state governments, financial institutions, and payment platforms.

“This research shows that fraudsters don't wait for recovery efforts to begin—they activate immediately,” said Mike Cook, Head of Fraud Insights at Socure. “Sophisticated fraud rings lie in wait with pre-built fake identities, ready to exploit moments of crisis – waiting for an early weather report, for example – ready to hit. As a former Texas flood survivor myself, I hope this research helps agencies and organizations better protect relief funds when speed and accuracy matter most.”

Socure’s analysis examined activity before and after the July 4 Kerr County floods and identified a repeatable, fast-moving fraud playbook:

• Fraudsters were ready to launch campaigns in lockstep with news coverage. Attacks surged within hours of the floods and again immediately after Federal Emergency Management Agency (FEMA) and Small Business Administration (SBA) relief announcements, demonstrating how criminals time attacks around public communications.
• Disaster relief programs were top targets. Nearly 29% of observed fraud attempts aimed to steal government assistance, followed by money-movement and credit card attacks.
• Local actors struck first; global networks scaled fast. Domestic fraud dominated early, but international attacks rose within days, including activity traced to OFAC-sanctioned regions.
• China-linked identity farms drove scale. Approximately 30% of international fraud originated from long-running Chinese identity farms generating synthetic and stolen identities for years.
• Residents faced elevated risk. Post-flood, Kerr County residents were 3.5× more likely to be targeted for identity fraud than before the disaster.

Within 72 hours of the floods, fraudulent applications for government aid began to spike, illustrating how quickly criminal networks exploit accelerated relief programs.

“These fraud surges offer a clear view into the broader scam economy,” said Rivka Gewirtz Little, Chief Growth Officer at Socure. “When fraud syndicates go after disaster aid, they deliberately strike across sectors—establishing money movement and financial services accounts to build scam infrastructure, then hit giving services to capture relief funds. We need a view of identity that spans the entire ecosystem. Our identity graph provides government agencies and financial institutions with the real-time intelligence required to stop fraud at scale and ensure aid reaches the people who truly need it.”

As large-scale disasters become more frequent and relief efforts prioritize speed, organizations across the public and private sectors face mounting pressure to modernize fraud defenses. Fraud activity now moves at the pace of the news cycle, requiring real-time data collaboration, AI-powered identity verification, and cross-sector threat intelligence sharing.

Socure’s findings highlight the importance of strengthening identity infrastructure across disaster relief, financial services, and money-movement platforms—so survivors are not forced to battle fraud while rebuilding their lives.

The report is available for download here.

About Socure

Socure is the leading platform for digital identity verification, compliance and fraud prevention solutions, trusted by the largest enterprises and government agencies to build trust and mitigate risk. Leveraging AI and machine learning, Socure’s industry-leading platform achieves the highest accuracy, automation, and capture rates in the industry.

Serving more than 3,000 customers and 190+ countries across financial services, government, gaming, healthcare, telecom, and e-commerce, Socure’s customer base includes 18 of the top 20 banks, four of the Mag 7, the largest HR payroll and workforce providers, the largest sportsbook and prediction market operators, 74 organizations across the public sector, and more than 600 fintechs.

Leading organizations trust Socure to deliver certainty in identity across onboarding, authentication, payments, account changes, and regulatory compliance. Learn more at www.socure.com.

View source version on businesswire.com: https://www.businesswire.com/news/home/20251215046737/en/