{
 "slug": "accessible-payment-authorization",
 "topic_id": "TOPIC-192",
 "cluster": "Government Benefits, Procurement & Public Sector Identity",
 "tier": "Tier A",
 "title": "Benefit payment redirection: the cheapest attack on a state program",
 "summary": "Benefit payment destinations are changed in self-service portals authenticated by knowledge factors. The beneficiary discovers the diversion when the payment does not arrive, and the population affected is the least able to absorb it.",
 "lede": "Every control proposed for public benefits runs into the same constraint, and most proposals ignore it: the people you are protecting are the people your control will exclude if you get it wrong. That constraint has to come first, not in a paragraph at the end.",
 "date": "2025-11-16",
 "category": "Compliance",
 "author_id": "solene-beaumont-adjei",
 "tags": [
  "public benefits",
  "payment diversion",
  "digital exclusion",
  "state programs",
  "accessibility",
  "program integrity"
 ],
 "image_title": "Accessible Payment Authorization",
 "schema": "Article",
 "key_takeaways": [
  "GAO reported in August 2026 on significant fraud risks across the twenty largest state-administered federal programs.",
  "Benefit systems were designed for accessibility and low friction, correctly. Payment destination was modelled as a profile attribute, which was the error.",
  "The coverage model comes first: what share of the caseload can satisfy each option? A control that excludes eligible people has failed, whatever its fraud numbers."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Start with who is affected"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "The attack and the population, in tension",
   "caption": "The wrong control excludes claimants. The right one touches a rare event.",
   "nodes": [
    {
     "label": "Claimant enrolled",
     "note": "eligibility established"
    },
    {
     "label": "Deposit destination set",
     "note": "a profile field",
     "bad": true
    },
    {
     "label": "Destination changed",
     "note": "self-service",
     "bad": true
    },
    {
     "label": "Benefits redirected",
     "note": "discovered at the next cycle",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "A state benefits caseload is not a general population sample. It skews toward people with unstable housing, limited or shared device access, intermittent connectivity, disabilities, limited English proficiency, and no banking relationship."
  },
  {
   "type": "p",
   "html": "Every one of those characteristics is a reason someone qualifies for the benefit. They are not edge cases; they are the distribution."
  },
  {
   "type": "p",
   "html": "So the first artefact of any control design here is not a threat model. It is a coverage model."
  },
  {
   "type": "h2",
   "text": "The coverage model"
  },
  {
   "type": "table",
   "caption": "Illustrative structure. Populate with your own caseload data — general population device statistics will overstate reach substantially.",
   "head": [
    "Authorisation option",
    "Caseload reach",
    "Excluded without an alternative"
   ],
   "rows": [
    [
     "Device-bound credential on a personal smartphone",
     "[measure]",
     "No smartphone; shared device; no data plan"
    ],
    [
     "Credential on a shared or borrowed device",
     "[measure]",
     "Household coercion risk"
    ],
    [
     "In-person at a county office",
     "[measure]",
     "Transport, hours, disability, work schedule"
    ],
    [
     "Telephone with knowledge verification",
     "[measure]",
     "Hearing impairment; language; the knowledge is also known to the fraudster"
    ],
    [
     "Mailed confirmation with delay",
     "[measure]",
     "Unstable address; the address may be what changed"
    ]
   ]
  },
  {
   "type": "p",
   "html": "No single row reaches everyone. That is the finding, and it means the design is necessarily a combination with a funded assisted path rather than a single mechanism."
  },
  {
   "type": "h2",
   "text": "Setting the exclusion budget"
  },
  {
   "type": "p",
   "html": "Decide, explicitly and in advance, what share of the caseload a control may delay or exclude before it should not ship."
  },
  {
   "type": "p",
   "html": "Then do the arithmetic honestly. A control reaching ninety-six percent of a two million person caseload leaves eighty thousand people needing an assisted path. If the assisted path is a county office with a six-week appointment backlog, the control has excluded eighty thousand entitled people and the fraud reduction does not offset that."
  },
  {
   "type": "blockquote",
   "text": "An unstated exclusion rate is still an exclusion rate. Publishing it is what makes the decision reviewable."
  },
  {
   "type": "h2",
   "text": "What the federal record says about the risk"
  },
  {
   "type": "p",
   "html": "GAO reported in August 2026 on significant fraud risks in the twenty largest state-administered federal programs, following earlier 2026 work on improper payments and fraud risk management. Large-scale benefits fraud in recent years has established that these programmes are targeted systematically rather than opportunistically."
  },
  {
   "type": "p",
   "html": "None of that reporting quantifies payment-destination diversion separately, and this article does not estimate it. What is clear is that the payment destination is the cheapest field to attack and the least protected."
  },
  {
   "type": "h2",
   "text": "A design that respects the constraint"
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">Tier by value.</strong> A monthly benefit of a few hundred dollars and a lump-sum disbursement of several thousand do not warrant the same friction.",
    "<strong style=\"font-weight:600\">Enrol opportunistically.</strong> Offer credential enrolment at every existing touchpoint — application, recertification, office visit — rather than as a campaign.",
    "<strong style=\"font-weight:600\">Never gate access to the benefit.</strong> The control applies to changing the destination, never to receiving the payment.",
    "<strong style=\"font-weight:600\">Dual notification with delay.</strong> Notify the old and the new destination and the address of record, and hold the change. This costs nothing and reaches everyone.",
    "<strong style=\"font-weight:600\">Fund the assisted path properly.</strong> If the fallback is understaffed, the control has excluded people by operational design."
   ]
  },
  {
   "type": "p",
   "html": "Item four deserves emphasis because it is the cheapest intervention in this entire series and the most universally applicable. It requires no enrolment, no credential and no technology procurement."
  },
  {
   "type": "h2",
   "text": "The state's own incentive"
  },
  {
   "type": "p",
   "html": "States frequently replace diverted benefits, because the alternative is a family without food assistance for a month and a caseworker escalation. That means the loss is already being absorbed by the state in practice."
  },
  {
   "type": "p",
   "html": "Framed that way, prevention is a budget question rather than a program integrity question, and it tends to get further with a legislature."
  },
  {
   "type": "h2",
   "text": "Designing for the actual population"
  },
  {
   "type": "table",
   "caption": "Control options against accessibility cost",
   "head": [
    "Control",
    "Security value",
    "Accessibility cost"
   ],
   "rows": [
    [
     "Document upload at every login",
     "Low",
     "<strong style=\"font-weight:600\">Very high</strong>"
    ],
    [
     "Smartphone app requirement",
     "Moderate",
     "<strong style=\"font-weight:600\">High — excludes by device</strong>"
    ],
    [
     "Knowledge questions",
     "Low — answers are in breach data",
     "Moderate — excludes the unbanked and recently moved"
    ],
    [
     "<strong style=\"font-weight:600\">Gate the destination change only</strong>",
     "<strong style=\"font-weight:600\">High</strong>",
     "<strong style=\"font-weight:600\">Low — a rare event</strong>"
    ],
    [
     "In-person for total credential loss",
     "High",
     "Low if rare, high if default"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Any added step reduces access.”</strong> Which is why it belongs on a change most claimants make rarely or never, rather than on the claim itself. Frequency is the variable that decides accessibility cost."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Some claimants have no device at all.”</strong> Then the in-person path is theirs, and it must be genuinely staffed. A fallback that exists on paper but not in practice is exclusion with extra steps."
  }
 ],
 "faq": [
  {
   "q": "Why lead with exclusion rather than fraud?",
   "a": "Because in this population exclusion causes immediate hardship and fraud causes delayed loss, and controls designed without a coverage model routinely produce more of the first than they prevent of the second."
  },
  {
   "q": "What is the single cheapest improvement?",
   "a": "Dual notification with a hold period on destination changes. No enrolment, no technology, reaches the entire caseload."
  },
  {
   "q": "Should the exclusion budget be published?",
   "a": "Internally at minimum, and to oversight bodies where a program is under review. An unpublished budget is still a budget."
  },
  {
   "q": "Does a credential requirement risk denying benefits?",
   "a": "Only if it gates receipt rather than destination changes. It must never gate receipt, and any design that does should be rejected."
  },
  {
   "q": "Does adding a control reduce access?",
   "a": "It depends entirely on frequency. On the claim itself, yes. On a destination change most claimants make rarely, the cost is minimal."
  },
  {
   "q": "What about claimants with no device?",
   "a": "An in-person path, genuinely staffed. A fallback that exists only on paper is exclusion with extra steps."
  },
  {
   "q": "Why not knowledge questions?",
   "a": "The answers are in breach compilations, and they exclude the recently moved and the thinly documented — poor on both axes."
  }
 ],
 "sources": [
  {
   "t": "U.S. Government Accountability Office reports",
   "u": "https://www.gao.gov/reports-testimonies"
  },
  {
   "t": "GAO-26-109100, July 2026 — managing fraud risks in federally funded programs",
   "u": "https://www.gao.gov/products/gao-26-109100"
  },
  {
   "t": "U.S. Department of Labor — unemployment insurance program integrity",
   "u": "https://www.dol.gov/agencies/eta/ui"
  },
  {
   "t": "Published accessibility and digital inclusion guidance for public benefit systems."
  },
  {
   "t": "PaymentAccuracy.gov — federal improper payment data",
   "u": "https://www.paymentaccuracy.gov/"
  },
  {
   "t": "GAO-15-593SP — A Framework for Managing Fraud Risks in Federal Programs",
   "u": "https://www.gao.gov/products/gao-15-593sp"
  }
 ],
 "related": [
  {
   "slug": "payment-integrity-control-map",
   "title": "$186 billion in improper payments",
   "category": "Compliance"
  },
  {
   "slug": "consumer-identity-budget",
   "title": "The consumer identity budget",
   "category": "Definitional"
  },
  {
   "slug": "tiered-emergency-authorization",
   "title": "Emergency and disaster assistance",
   "category": "Comparison"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Accessible%20Payment%20Authorization/1500_900/blog.jpg",
 "wordcount": 919,
 "url": "/blog/accessible-payment-authorization.html",
 "reading_time": "4 min read",
 "seo_title": "Benefit payment redirection in state programs",
 "meta_description": "Benefit payment destinations are changed in self-service portals authenticated by knowledge factors.",
 "hub": {
  "slug": "topics/public-sector-identity",
  "title": "Public sector identity"
 },
 "answer": "By putting the friction on the change, not on the person. Benefit redirection works by editing a deposit destination in a portal. A control that demands smartphones or documents at every interaction excludes exactly the population the programme exists to serve; a control that gates the destination change does not.",
 "answer_q": "How do you protect benefit payments without excluding recipients?",
 "glossary": [
  {
   "term": "Benefit redirection",
   "def": "Changing the deposit destination on a legitimate claim so payments go to an attacker."
  },
  {
   "term": "Digital exclusion",
   "def": "Loss of access caused by a control's device, connectivity or documentation requirements."
  },
  {
   "term": "Frequency-weighted friction",
   "def": "Placing authentication cost on rare, high-consequence events rather than on routine ones."
  }
 ],
 "checklist": {
  "title": "A control that does not exclude",
  "id": "design",
  "desc": "Four rules.",
  "steps": [
   {
    "name": "Gate the change, never the claim.",
    "text": "Claims are frequent; destination changes are rare."
   },
   {
    "name": "Offer more than one credential type.",
    "text": "A phone, a hardware key, or an in-person path."
   },
   {
    "name": "Staff the in-person path properly.",
    "text": "An unstaffed fallback is exclusion."
   },
   {
    "name": "Notify on the old channel.",
    "text": "So a redirect is visible to the real claimant."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising official to the exact release, award or disbursement being authorised, and produces a receipt an inspector general, an auditor or another agency can verify without access to the issuing system.",
  "href": "../docs.html",
  "label": "See authorisation receipts"
 }
}