LOUISVILLE, Ky. (WDRB) -- Desperate to stop "rampant" fraud, Kentucky Gov. Andy Beshear is shutting down the state's unemployment insurance system for four days starting at midnight.
When the system reopens the morning of Tuesday, April 13, all unemployment claimants will have to re-register using an 8-digit PIN they will receive in the mail late this week or early next week, officials said at Beshear's briefing Thursday.
"I hate that we have to do it, but there is no other option other than to let people's money get stolen," Beshear said.
Letters containing the new PIN numbers will be mailed tomorrow and officials hope that claimants will receive them in time to reregister their accounts on Tuesday or shortly thereafter, said Amy Cubbage, Beshear's general counsel.
The move comes less than a week after the state suspended claimants' ability to change their direct deposit information and began paying many by paper check instead of electronic deposits.
Beshear and Cubbage said a fraudster or group of fraudsters, likely using robots, were able to get into about 300,000 unemployment accounts and to reset their four-digit PINs.
"Someone went in and reset the PINs, and then later went in with the reset PINs and tried to redirect bank and bank account information," Cubbage said.
Many Kentuckians use unsophisticated PINs like "1234," making large-scale attempts to access accounts by guessing PINs successful, Cubbage said.
She said the state doesn't have nearly 300,000 active unemployment claims, so many of the accounts accessed are no longer receiving deposits, but she could not be more precise.
Kentucky received more than 1.8 million unemployment claims from March 2020 through January 2021 filed by about 744,000 unique individuals, according to statistics provided by Beshear's Labor Cabinet.
Beshear said it's not yet clear how many bank accounts were changed or how much money was redirected improperly.
"Just the fact that it's happening at this scale means we got to stop it," Beshear said. "...We've got to make sure that this type of attack, where they basically run through every possible four-digit PIN for these clients, that they can no longer do that."
Starting Tuesday, the unemployment website will require two-factor authentication to verify claimants' email addresses and 12-character passwords that contain a mix of letters and numbers, Cubbage said.
It's nearly impossible to reach Kentucky unemployment officials by phone or email. Claimants who need help must schedule phone or office appointments. So what happens if people don't receive the letter with the new PIN number?
"We know that mailing a PIN is going to be a hardship for people. We know that the postal service has sometimes issues of getting things out timely," Cubbage said. "That's why we're making every effort to generate those letters tomorrow, so that hopefully everyone will have them in their boxes either with by the time it's reopened or within a day or two after. We are exploring alternative resources for people if they don't get those PINs in a timely manner to be able to reach out to (the unemployment office), and get help with those PIN resets."
Cubbage did not elaborate on those "alternative resources" but said updates will be posted to kcc.ky.gov.
While the public won't be able to access the system during the four-day shutdown, it will still be active on the back end and claims will be still be processed, Cubbage said.
People who are unable to file or request payments during the four-day window will be held harmless through backdating, she said, though no details were offered about how that will work.
