COLUMBUS, Ohio (AP) — With the floodgates set to open on another round of unemployment aid, states are being hammered with a new wave of fraud as they scramble to update security systems and block scammers who already have siphoned billions of dollars from pandemic-related jobless programs.

The fraud is fleecing taxpayers, delaying legitimate payments and turning thousands of Americans into unwitting identity theft victims. Many states have failed to adequately safeguard their systems, and a review by The Associated Press finds that some will not even publicly acknowledge the extent of the problem.

The massive sham springs from prior identity theft from banks, credit rating agencies, health care systems and retailers. Fraud perpetrators, sometimes in China, Nigeria or Russia, buy stolen personal identifying information on the dark web and use it to flood state unemployment systems with bogus claims.

The U.S. Justice Department is investigating unemployment fraud by “transnational criminal organizations, sophisticated domestic actors, and individuals across the United States,” said Joshua Stueve, a spokesman for the department’s criminal division.

The Labor Department inspector general’s office estimates that more than $63 billion has been paid out improperly through fraud or errors — roughly 10% of the total amount paid under coronavirus pandemic-related unemployment programs since March.

“We’re all learning that there is an epidemic of fraud,” said U.S. Rep. Kevin Brady of Texas, the ranking Republican on the House’s powerful Ways and Means Committee. Brady said the $63 billion estimate “is larger than the entire budget of the Department of Homeland Security.”

“These are frightening levels of fraud,” he said.

California has been the biggest target, with an estimated $11 billion in fraudulent payments and an additional $19 billion in suspect accounts. Colorado has paid out nearly as much to scammers — an estimated $6.5 billion — as it has to people who filed legitimate unemployment claims.

Other estimates, according to AP reporting across the states, range from several hundred thousand dollars in smaller states such as Alaska and Wyoming to hundreds of millions in more populous states such as Massachusetts and Ohio.

The nationwide fraud has fed on twin vulnerabilities: a flood of jobless benefit applications since the pandemic began that has overwhelmed state unemployment agencies and antiquated benefit systems that are easy prey for crafty and persistent criminals.

In Ohio, weekly first-time unemployment claims have ranged from 17,000 to more than 40,000 during the pandemic. But since late last month, those claims have topped more than 140,000 some weeks, with many of them believed to be fraudulent. The state has paid at least $330 million in fraudulent pandemic unemployment benefit claims.

Trying to catch so many bogus claims delays payouts to Ohioans who are legitimately in need of help. In the Columbus suburb of Upper Arlington, Cynthia Sbertoli was receiving $228 a week after she was laid off in March from her job with a nonprofit that runs high school student exchange programs.

Her benefits were put on hold in January after she informed the state that someone had tried to use her identity in a scam to claim benefits. She thought the problem was resolved but has yet to see a renewal of her benefit checks, which she and her husband use to help pay for a son’s vision and auditory therapy.

“It’s just not a good way to take care of people,” said Sbertoli, 49.

In Indiana, Kentucky and Maryland, officials have said that for certain weeks in the new year at least two-thirds of the claims they received were classified as suspicious due to problems verifying identities. It’s not the first brush with serious fraud for Maryland. In July, officials said they’d discovered a massive criminal enterprise that had stolen more than $500 million in unemployment benefits.

Among states that have been hardest hit are those participating in the Pandemic Unemployment Assistance program adopted by Congress last year. It has been a lifeline for out-of-work freelancers and gig workers who normally don’t qualify for unemployment insurance, but it’s also been a boon for criminals who use stolen identities to make claims. Nearly 800,000 of the 1.4 million claims Ohio has received through this program have been tagged for potential fraud.

Scams have been so widespread that the U.S. Department of Justice is setting aside money to hire more prosecutors. In New York alone, the Department of Labor says it has referred “hundreds of thousands of fraud cases” to federal prosecutors. The state says it has blocked $5.5 billion in fraudulent claims, while New Jersey says it’s prevented $2.5 billion from flowing into the hands of criminals.

Despite those efforts, a government watchdog agency says not enough states are taking the necessary steps to prevent fraud.

In its memo this past week, the U.S. Department of Labor’s Office of Inspector General said that by the end of last year, 22 of the 54 state and territorial workforce agencies were still not following its repeated recommendation to join a data exchange run by the National Association of State Workforce Agencies.

That system is designed to check Social Security numbers used in claims to see if they are being used in multiple states, or are linked to dead people or other scam methods. The office said it had found $5.4 billion in fraudulent payments from March through October.

The biggest chunk of that, $3.5 billion, came through claims that used the same Social Security numbers in multiple states. One number was used on claims in 40 states. Twenty-nine of the states paid those claims, totaling more than $220,000.

“The Department needs to take immediate action and increase its efforts to ensure (states) implement effective controls to mitigate fraud in these high risk areas,” the inspector general warned Labor officials.

The people whose identities are used to claim improper benefits often don’t find out until they receive their tax statements.

Andrew Heidtke received a letter in September from the Wisconsin Department of Workforce Development notifying him that unemployment claims he never applied for were being processed.

“I had no idea what was happening,” said Heidtke, who works as an administrative assistant for an engineering lobbying organization. “I kind of just thought it was spam at first.”

Another victim was 99-year-old Harry Hollingsworth of Strongsville, Ohio. The retired elevator car factory worker received a form in late January showing he had received $3,156 in benefits. Hollingsworth died recently, and his son, Jim Hollingsworth, said the bogus claim created a big hassle.

“It looks like the state, they dropped the ball on this completely,” he said.

In its own survey of state governments, the AP found that many are not publicly disclosing the level of fraud. Some officials expressed concern that providing any information, no matter how general, could provide criminals an opening to exploit their systems further.

President Joe Biden’s administration is pledging to cut down on unemployment fraud even as it tries to extend benefits through September. As part of previous legislation, the administration is sending states $200 million to fight it.

That would be welcome in Virginia, where House Minority Leader Todd Gilbert, a Republican, said the Legislature’s watchdog agency should investigate how the state allowed $40 million in bogus payments through prison inmate-related scams.

“How many desperate people, laid off through no fault of their own, could have been helped with that money?” he asked. “It’s maddening.”