In 2020 and 2021, the federal government disbursed roughly $800 billion through the Paycheck Protection Program to 11.5 million borrowers. The program moved faster than any federal spending program in modern history — applications were approved in days, sometimes hours, and lenders faced enormous pressure to process paperwork without the usual diligence. Then, starting in October 2020, a second wave began: forgiveness applications. Every borrower seeking to turn their loan into a grant had to sign sworn certifications about how they spent the money.
Some of those certifications were accurate. Many were not. The Small Business Administration's own Inspector General has estimated that roughly $200 billion of PPP funds went to fraud or improper use. The Department of Justice and the COVID-19 Fraud Enforcement Task Force have been working through that backlog ever since — and every single case they've resolved, large or small, started with someone, somewhere, noticing a discrepancy between what the paperwork said and what actually happened.
If you worked for a business that got a PPP loan — especially if you were laid off while the money was supposedly funding payroll — this guide is for you. It explains what the paperwork required, what kinds of discrepancies matter legally, and what the law provides when an ordinary person steps forward. It is not legal advice. It is a reader's guide to a public record.
One loan, two separate frauds.
Most people think of a PPP loan as a single transaction: a business applied, the government sent money, and later the loan was forgiven. Legally, that's not quite right. Every step of a PPP loan generated its own paperwork, its own certifications, and its own potential liability under federal law.
The False Claims Act, 31 U.S.C. § 3729, makes it a civil violation to knowingly present a false or fraudulent claim for payment to the government. In the PPP context, the Department of Justice has pursued two distinct theories:
The application fraud
When a borrower applied for a PPP loan, they certified — under penalty of perjury — that they were eligible, that the economic uncertainty made the loan necessary, that they had the number of employees they claimed, and that the payroll figures they submitted were accurate. If any of those certifications was false, the loan itself was obtained by fraud.
The forgiveness fraud
Separately, when the borrower later applied to have the loan forgiven (usually between October 2020 and 2023), they signed a second set of certifications: that the money was actually spent on the categories the law allowed (payroll, rent, utilities, a few limited others), that at least 60% went to payroll, that employees and wages were maintained at required levels, and that the documentation was accurate. If those certifications were false, the forgiveness was obtained by fraud — separately from any application-stage fraud.
This matters for several reasons. Each false submission is a separate false claim with its own legal consequences. The evidence for the two frauds is different — application fraud turns on what the borrower intended and knew at the time of application; forgiveness fraud turns on what actually happened with the money. And the statutes of limitations run from different dates, which means that even where the loan application might be approaching the edge of the limitations window, the forgiveness fraud is typically well within it.
The strongest cases often involve both frauds together: a business that inflated its payroll to get a larger loan, then falsely certified how it spent the money to get the whole thing forgiven. But a case can be built on forgiveness fraud alone, and for many former employees that's the stronger story — because you saw what actually happened to the money.
What the forgiveness paperwork actually required.
Three forms were used for forgiveness, depending on the size of the loan. For the vast majority of businesses, the forms were Form 3508S (for loans of $150,000 or less), Form 3508EZ (for certain simplified cases), and Form 3508 (for everyone else). All three required the same essential certifications, worded slightly differently.
Here's what the person signing actually swore to, in plain English:
The dollar amount forgiven equals what was actually spent on eligible expenses.
The borrower certified that the amount they requested to be forgiven was actually spent on payroll, rent, utilities, mortgage interest, and a handful of other enumerated categories during the covered period. If the money was spent on something else — a boat, a renovation, personal use by the owner, a distribution to investors — and the certification said otherwise, that's a false certification.
At least 60% of the loan went to payroll costs.
The 60% threshold was a hard requirement. If a business received a $400,000 loan but only $180,000 actually went to payroll — while the forgiveness application claimed $240,000 went to payroll — the certification is false. The remaining 40% could go only to specifically listed non-payroll expenses, not to anything else.
The number of employees and their wages were maintained.
Full-time equivalent (FTE) employee counts had to be maintained at pre-pandemic levels — or the forgiveness amount was proportionally reduced. Wages could not be cut by more than 25% for any individual employee earning under $100,000. Businesses that laid off employees or cut wages and still claimed full forgiveness had to explain it — usually through a "safe harbor" carveout — and the explanation had to be true.
The supporting documents are accurate and will be retained.
Every borrower certified that the payroll records, tax forms, and other supporting documents they submitted (or would retain for audit) were accurate. They also certified they would keep those records for six years after the forgiveness date. False supporting documents — fabricated payroll records, inflated tax filings, fake employees — are additional false statements on top of the core certification.
The information provided is true and correct in all material respects.
The catch-all certification. Every form required a sworn, under-penalty-of-perjury statement that everything on the form was accurate. This is what DOJ typically uses as the anchor for a False Claims Act theory — because it covers every factual misrepresentation anywhere on the application.
When someone at your former employer signed one of those forms, they swore to all five of those things. If any of them wasn't true — and the person knew it wasn't true, or was deliberately ignorant of whether it was true — there may be a false claim. And former employees, the people who were physically there during the covered period, are often the only ones who can say with confidence what was actually happening.
Seven patterns that signal something wrong.
These are the patterns that come up most often in PPP forgiveness fraud cases. They are not, by themselves, proof of anything — a loan that shows one of these patterns might be entirely legitimate, with an innocent explanation. But they are the things that make experienced investigators look twice. If you recognize more than one of these from your own time at a business, it's worth talking to a lawyer.
The reported payroll is dramatically higher than what you know was paid.
A restaurant that claimed $340,000 in payroll during a three-month covered period — but that you know paid its staff weekly, had ten employees, and averaged $14 an hour. The math doesn't work. Either someone was making six figures, or the payroll was inflated on paper.
This is the single most common discrepancy. Employers inflated payroll to justify a larger loan amount and to ensure the 60% payroll threshold was met on forgiveness. Former employees — especially bookkeepers, office managers, and people who handled schedules — are often the only people who can authoritatively state what payroll actually ran.
The number of employees reported doesn't match what you saw.
A small office that reported 28 full-time-equivalent employees on its forgiveness application, when you know the place had a dozen people on a busy day. Ghost employees are one of the more common PPP fraud patterns — either people who never existed, people who had already left the company, or family members of the owner who were technically on the books but never worked.
Occasionally a business's FTE count legitimately looks high because of part-time staff being converted to full-time equivalents for reporting purposes. But significant gaps between reported FTE and what an ordinary employee observed are a common flag.
You were laid off or had hours cut — but the loan was fully forgiven.
PPP forgiveness required that FTE counts and wage levels be maintained. If they weren't, the forgiveness amount was supposed to be reduced proportionally. Businesses that cut staff or hours and still received 100% forgiveness either qualified for a narrow safe-harbor exception — or they falsely certified that employment levels had been maintained.
If you were furloughed, had your hours cut significantly, or were let go during the covered period, and the business's forgiveness application still claimed full FTE maintenance, the discrepancy is worth scrutiny.
The money obviously went to something other than payroll.
New trucks. A renovated owner's office. A pool at the owner's house. A family vacation. A luxury car purchase in the same month the loan hit. Employees often see exactly where the money went — because they see what suddenly appeared at work, and they see what the owner was bragging about at the bar.
The forgiveness application required that funds be spent on specific enumerated categories. Anything that went somewhere else — even if the business otherwise had enough legitimate expenses to cover the forgiveness amount — is worth looking at carefully.
The business wasn't really operating during the covered period.
Some businesses received PPP loans while essentially shuttered — the owner hadn't reopened, the staff was gone, and the loan sat in an account. When it came time to apply for forgiveness, those businesses had a choice: admit the money hadn't been spent on payroll (because there was no payroll) and pay it back, or fabricate the spending and certify otherwise.
Former employees who returned briefly to wind things down, or who knew the business closed, are uniquely positioned to know whether the business was actually paying payroll during the covered period.
Multiple related entities each got loans.
A restaurant owner with three locations — each separately incorporated — who got three separate loans. A property management company and its affiliated holding companies, each getting a loan. Under PPP rules, affiliated entities were supposed to be aggregated for eligibility purposes, with loan-size caps applying to the affiliated group, not to each entity separately.
Sophisticated borrowers sometimes structured around these rules by creating separate entities that claimed independence they didn't have. The forgiveness applications then each certified, separately, that the entity was eligible — when in fact it was part of a larger affiliated group that would have hit the caps.
You were paid in cash, but the forgiveness claimed W-2 wages.
PPP forgiveness covered payroll — formally documented wages subject to federal employment taxes. Cash payments made off the books don't count as PPP-eligible payroll. Some businesses inverted this: they claimed cash employees as W-2 wages on their forgiveness application, using fabricated payroll records to support the claim.
If you were paid cash during the covered period and later saw a W-2 with figures that didn't match what you actually received, or if you never received any W-2 despite being listed as a payroll employee, those are straightforward documentation problems.
Recognize one or more of these at your old employer?
Our employer lookup tool lets you search the public SBA record. See what your former employer reported — and whether it matches what you remember.
Search the public recordHow the False Claims Act works for ordinary employees.
The False Claims Act is one of the oldest federal statutes still in active use. Congress enacted it during the Civil War, in 1863, after Union Army procurement officers discovered that contractors were systematically cheating the government on supplies — selling lame horses, sand mixed into gunpowder, uniforms that fell apart. The statute gave private citizens the right to file suit on behalf of the government against those who had defrauded it, and entitled those citizens to a share of whatever the government recovered. It still works that way today.
The person who brings the suit is called a "relator." The suit itself is called a "qui tam" action, from a Latin phrase meaning "he who sues on behalf of the King as well as for himself." The structure is specifically designed for the situation you might be in: you saw something wrong, the government doesn't know about it, and you have a practical way to bring the information forward.
What makes a good qui tam case
In rough order of importance:
- Specific facts. A good case names specific false statements, specific documents, specific patterns. "My employer was generally shady" doesn't work. "The forgiveness application claimed $340,000 in payroll during the covered period; based on what I know about who worked there and how much they were paid, actual payroll was closer to $140,000" is the kind of specific factual narrative the government can investigate.
- A knowledgeable relator. Courts and DOJ give weight to relators whose position put them close to the facts. A bookkeeper, an office manager, a payroll administrator, an accountant, a former CFO — these are the roles that see the paperwork. Former rank-and-file employees can also bring cases, especially on the "what actually happened to the money" theory.
- Non-public information. The FCA has a "public disclosure bar" — a case that's based only on information already in the public record can be barred. This doesn't mean you can't use public SBA data; it means your case needs to include something not already publicly known. Your firsthand observations of how the business actually operated during the covered period are, by definition, non-public.
- First in line. The "first-to-file" bar means only the first relator to file on a given scheme can be a relator. (More on this below.)
What a case looks like, procedurally
A qui tam case doesn't start with a press release. It starts with a confidential filing in federal court, under seal — meaning the case is not publicly visible for at least 60 days, usually much longer. During the seal period, the Department of Justice investigates. The defendant typically doesn't know the case exists. The relator may be asked to meet with DOJ attorneys and investigators, provide documents (only those they have lawful access to), and explain what they know.
At the end of the investigation, DOJ decides whether to "intervene" in the case — take it over and prosecute it — or "decline" and let the relator's own lawyers continue on their own. Intervention is a strong signal of a meritorious case and usually leads to substantial recoveries. Declination is not fatal; many successful cases have proceeded after DOJ declined to intervene.
What the relator receives
Under 31 U.S.C. § 3730(d), a successful relator receives a share of whatever the government recovers. The share is:
- 15% to 25% in cases where the government intervened
- 25% to 30% in cases where the government declined and the relator proceeded alone
The exact percentage within each range is set based on the relator's contribution to the prosecution, the significance of the information, and other factors. The relator's share comes out of the government's recovery — it does not reduce what the government collects from the defendant; it's a portion of it that goes to the person who made the case possible.
These numbers are ranges, not promises. They are set by statute and by the facts of each case. No one can tell you in advance what a specific case will recover or what a specific relator's share will be. But the statute, as written, creates the structure: the government recovers what was stolen, and the person who made the recovery possible receives a share.
Protection from retaliation
Federal law — specifically 31 U.S.C. § 3730(h) — prohibits employers from firing, demoting, threatening, harassing, or otherwise retaliating against employees for acts "in furtherance of" a False Claims Act case, including internal reporting and investigation. If an employer retaliates, the employee can recover reinstatement, double back pay, special damages, and attorney fees. Louisiana's parallel statute at La. R.S. 46:440.3 provides similar protection for state Medicaid cases.
In practice, most PPP relators file after they've already left the company — either because they were laid off during the covered period, or because they moved on later. Retaliation protection still matters: a former employer cannot retaliate against you in forms like blackballing you to future employers, filing groundless counterclaims, or publicly attacking you.
Why timing is everything: the first-to-file rule.
The False Claims Act rewards the first relator to file on a given scheme. It does not reward the tenth. It does not reward the person who thought about it for a year and then called a lawyer.
Under 31 U.S.C. § 3730(b)(5), once a qui tam action has been filed alleging a particular fraud, no other person may file a related action based on the same underlying facts. The second-in-line relator is barred — even if their case is factually stronger, even if they would have brought more information, even if the first case was dismissed.
The practical effect for PPP fraud cases is significant. Tens of thousands of lawyers and investigators are actively reviewing PPP data right now. Former employees from businesses with suspicious loans are comparing notes on social media, in group chats, and over beers. Accountants who prepared PPP forgiveness applications they later regretted are reaching out to attorneys. Every day, more qui tam cases are being filed on PPP fraud.
This is the real urgency, and it is more urgent than any statute-of-limitations countdown. If you saw PPP forgiveness fraud at a specific business, the question is not whether you have time to file. You have time. The question is whether someone else — another former employee, a former contractor, a vendor, a bookkeeper — is going to file first.
This is also why the decision to call a lawyer is not the same as the decision to file a case. A confidential consultation with counsel creates privilege, gets you on a timeline, and preserves your options. It does not commit you to anything. It does not publicly disclose your identity. It does, however, start the clock on your claim before someone else's clock finishes.
What to do if you suspect fraud.
If you've read this far and you recognize your former employer in the patterns above, here's the short version of what to do:
1. Write down what you remember.
Before memories fade, write down what you saw. Names of people who worked there. Approximate hours you worked. Approximate pay. Significant purchases or events you remember. The timeframe matters: the "covered period" for PPP was either eight or twenty-four weeks after the loan disbursed, depending on when the loan was issued. Focus on what you saw during that window. Keep the document somewhere private — a personal email account, a cloud storage folder, a physical notebook at home.
2. Search the public record.
The SBA publishes detailed data on every PPP loan. You can look up your former employer and see the reported loan amount, forgiveness amount, payroll allocation, jobs reported, and forgiveness date. We've built a tool that makes this easy to search. Pandemic Oversight (pandemicoversight.gov) and ProPublica also maintain versions of this database. Compare what the paperwork says to what you remember.
3. Call a lawyer, confidentially.
A first call to a qui tam attorney is confidential and free. You do not need to bring documents. You do not need to have made up your mind about filing. You need to describe what you saw and let the lawyer tell you whether there's a case worth pursuing. Most lawyers will know within thirty minutes whether the facts support a claim.
4. Do not discuss it with coworkers.
The first-to-file rule means that if a coworker you tell decides to file first, you're barred. Discussing it on social media, in group chats, or even in personal conversation can create evidence of "public disclosure" that weakens your case. Keep it between you and a lawyer.
5. Do not contact the employer.
Do not send the employer an angry email. Do not confront the owner. Do not threaten anything. Every one of those actions creates a record that can be used against you later — and tips off the employer in a way that can blow up a qui tam case before it's filed. If you want to do something about what you saw, silence is the strategy.
What not to do.
Equally important: don't do any of these.
- Don't take documents from your current or former employer's systems that you don't already have lawful access to. Even if you believe the documents would support a case, removing them may create legal problems that complicate the case. Your firsthand knowledge, plus the public SBA data, is usually enough to start.
- Don't post on social media about what you saw. Posts on Facebook, Reddit, TikTok, or anywhere else can create "public disclosure" issues that affect whether you qualify as a relator. Private conversations with a lawyer under the attorney-client privilege don't; public posts do.
- Don't delay indefinitely. The first-to-file rule doesn't wait. Neither does the "original source" requirement, which can be affected by public disclosures made after you saw the fraud but before you filed.
- Don't pay anyone upfront. Qui tam cases are handled on contingency — the lawyer is paid only if there's a recovery. If someone is asking for money upfront to file a PPP whistleblower case, walk away.
- Don't assume the case is too small. Small PPP fraud cases have been successfully prosecuted for loans as small as $20,000. The federal penalty structure — treble damages plus per-claim penalties — makes even small fraud worth pursuing.
- Don't assume it's too late. The FCA has a six-year statute of limitations running from the date of the violation, extended under some circumstances to up to ten years. For most forgiveness-fraud cases, the clock started when the forgiveness application was filed — often 2021, 2022, or 2023 — and has years left to run.
A final word about the larger picture.
Congress built the False Claims Act because it understood something about how government fraud actually works: the people who see it first are rarely the people with the power to do something about it on their own. It's the bookkeeper. The junior accountant. The laid-off restaurant manager. The nurse. The billing clerk. The person whose desk sat next to the person who committed the fraud, who saw the paperwork and wondered.
For a century and a half, that statute has been working exactly as designed. Since 1986, when Congress strengthened it, whistleblowers have brought more than $85 billion back to the federal Treasury — funds stolen through contractor fraud, healthcare fraud, banking fraud, and now pandemic fraud. Every one of those dollars came from someone deciding that what they'd seen was worth saying.
If you're weighing this because you remember something specific — a figure that didn't make sense, a conversation you overheard, a pattern you noticed and couldn't explain — the statute exists for you. The process is built to protect you. The reward is set by Congress. And the hardest part, genuinely, is the first phone call.
Ready to talk about what you saw?
Confidential intake. No fee unless we recover. An initial conversation is free and does not commit you to anything.
Start a confidential intakeSources and further reading
- 31 U.S.C. §§ 3729–3733 (federal False Claims Act)
- 31 U.S.C. § 3730(b)(5) (first-to-file bar)
- 31 U.S.C. § 3730(d) (relator share provisions)
- 31 U.S.C. § 3730(h) (anti-retaliation)
- 31 U.S.C. § 3731(b) (statute of limitations)
- SBA Form 3508, 3508EZ, 3508S (PPP forgiveness applications)
- SBA Office of Inspector General, "COVID-19 Pandemic EIDL and PPP Loan Fraud Landscape" (June 2023)
- U.S. Department of Justice, Fraud Section Annual Statistical Report (latest available)
- SBA Public PPP Loan Data (data.sba.gov/dataset/ppp-foia)
- Pandemic Response Accountability Committee (pandemicoversight.gov)
- ProPublica, "Tracking PPP Loans" (projects.propublica.org/coronavirus/bailouts/)
Attorney advertising. This article is for educational purposes only and does not create an attorney-client relationship or constitute legal advice. Reading this article does not create any relationship with The Whistleblower Project. Every case is different and results depend on specific facts and law. Past results do not guarantee or predict a similar outcome in any future case. The Whistleblower Project is a Louisiana-licensed law firm. For specific legal questions, consult an attorney licensed in your jurisdiction.