Penalties for PPP loan fraud stack fast. Federal prosecutors rarely charge a single offense; they combine bank fraud, wire fraud, false statements, money laundering, identity theft, and conspiracy counts drawn from the same conduct, and the maximum exposure reaches 30 years in prison per count plus fines up to $1 million. On the civil side, defendants face mandatory restitution for the full loss, treble damages under the False Claims Act, and forfeiture of anything bought with the money. And because bank fraud carries a 10-year statute of limitations, the government has until roughly 2030 or 2031 to bring new cases against loans issued in 2020 and 2021.
The Federal Charges Prosecutors Stack
PPP fraud is not one crime. Prosecutors pick from a menu of established federal statutes and layer them on the same defendant, because a single fraudulent application usually violates several at once.
- Bank fraud, 18 U.S.C. § 1344. Any scheme to defraud a financial institution or obtain money it holds through false pretenses. PPP loans ran through banks and credit unions, so this statute reaches virtually every case.1Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
- Wire fraud, 18 U.S.C. § 1343. Covers electronic communications used to carry out a fraud. Since applications were submitted online, wire fraud counts appear in nearly every prosecution.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
- False statements, 18 U.S.C. § 1001. Criminalizes knowingly false statements in any matter within federal jurisdiction. PPP applications were signed under penalty of perjury, so a fabricated payroll figure is enough.3Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally
- Money laundering, 18 U.S.C. § 1956. Charged when defendants move or spend fraud proceeds to conceal their source. Transfers to personal accounts, cryptocurrency wallets, or overseas accounts routinely trigger this on top of the underlying fraud.4Office of the Law Revision Counsel. 18 USC 1956 – Laundering of Monetary Instruments
- Conspiracy, 18 U.S.C. § 1349. When two or more people agree to commit bank or wire fraud, each participant faces the same maximum penalty as the underlying offense.5Office of the Law Revision Counsel. 18 USC 1349 – Attempt and Conspiracy
- Aggravated identity theft, 18 U.S.C. § 1028A. Adds a mandatory two-year prison term whenever another person’s identity was used to carry out the fraud. That two years must run consecutively to every other sentence, and probation is not available.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
A defendant who submitted a fake application using someone else’s Social Security number, received the funds electronically, and then spent the money on personal purchases can be charged under all six statutes from that one course of conduct.
Prison Time and Fines per Count
The exposure per count is severe, and it multiplies with each count charged.
- Bank fraud: up to 30 years in prison and a fine up to $1 million.1Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
- Wire fraud: normally up to 20 years, but the maximum jumps to 30 years and a $1 million fine when the offense affects a financial institution or involves a presidentially declared disaster or emergency. Both enhancements routinely apply in PPP cases.2Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
- False statements: up to 5 years.3Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally
- Money laundering: up to 20 years and a fine of up to $500,000 or twice the value of the laundered funds, whichever is greater.4Office of the Law Revision Counsel. 18 USC 1956 – Laundering of Monetary Instruments
- Aggravated identity theft: a mandatory 2 years, consecutive to all other sentences, no probation.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
- Conspiracy: the same maximum as the crime the defendant conspired to commit.5Office of the Law Revision Counsel. 18 USC 1349 – Attempt and Conspiracy
These are per-count maximums. A defendant charged with three counts of wire fraud and one count of bank fraud carries a theoretical maximum of 120 years, though actual sentences are set under the federal sentencing guidelines, which factor in the amount of loss, the number of victims, and the defendant’s role in the scheme. Real PPP sentences have ranged from a few months for small-dollar first offenders to well over a decade for ringleaders of large schemes.
Restitution, Treble Damages, and Forfeiture
Criminal sentencing is only one track. The government pursues civil recovery in parallel, and the financial consequences often dwarf the original loan.
Mandatory Restitution
Federal courts must order full restitution for the total loss caused by the fraud. A judge cannot waive it because the defendant is broke, and the obligation survives the end of a prison sentence.7Office of the Law Revision Counsel. 18 USC 2327 – Mandatory Restitution The DOJ’s Fraud Section alone has seized over $78 million in cash proceeds from fraudulent PPP funds, along with real estate and luxury items.8U.S. Department of Justice. Co-Founder of Paycheck Protection Program Lender Service Provider Sentenced to 64M COVID-19 Relief Fraud
False Claims Act Damages
The False Claims Act lets the government recover three times its damages plus a civil penalty for each false claim. The statutory range of $5,000 to $10,000 per claim is adjusted annually for inflation and currently exceeds $13,000 per claim.9Office of the Law Revision Counsel. 31 USC 3729 – False Claims Someone who submitted a fraudulent $150,000 PPP application faces $450,000 in treble damages before per-claim penalties are added.
Asset Forfeiture
Vehicles, real estate, jewelry, and bank accounts bought with fraudulent proceeds are all subject to forfeiture. A defendant can lose the asset, still owe restitution for its full value, and still owe treble damages on top of that.
How Long the Government Has to Charge You
Bank fraud and wire fraud affecting a financial institution both carry a 10-year statute of limitations.10Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses Congress reinforced that clock for PPP fraud specifically through the PPP and Bank Fraud Enforcement Harmonization Act of 2022, signed into law on August 5, 2022. Because most PPP loans were disbursed between April 2020 and May 2021, prosecutors have until roughly 2030 or 2031 to bring new charges.
This is not theoretical. As of early 2026, the SBA’s pandemic oversight page still lists new fraud charges and sentencing announcements on a near-weekly basis.11U.S. Small Business Administration. Pandemic Response Oversight The enforcement wave has not crested, and the tools investigators use have gotten significantly stronger since 2020.
Why Old Cases Are Still Being Found
The Pandemic Response Accountability Committee has compiled over one billion records from more than five dozen data sources into a graph analytics database containing 622 million nodes and 1.65 billion relationships. That’s 2.3 billion connections among tax IDs, phone numbers, IP addresses, email addresses, bank accounts, and physical addresses used in federal applications.12U.S. House of Representatives Committee on Oversight and Government Reform. Statement of Kenneth R. Dieffenbach, Executive Director, Pandemic Response Accountability Committee
PRAC runs machine learning, network analysis, and an AI-enabled “Fraud Prevention Engine” that can review roughly 20,000 applications per second. Unsupervised models spot anomalies like a shared bank account among dozens of supposedly independent applicants; supervised models flag patterns that match known fraud cases. In one project, PRAC cross-referenced PPP applicants against HUD low-income housing records and found over 40,000 borrowers who reported dramatically higher income to the SBA than to HUD, flagging more than $860 million in suspicious loans. A separate review of Social Security numbers across 67.5 million applications estimated over 1.4 million potentially stolen or invalid SSNs tied to approximately $79 billion in potentially fraudulent payments across pandemic programs.12U.S. House of Representatives Committee on Oversight and Government Reform. Statement of Kenneth R. Dieffenbach, Executive Director, Pandemic Response Accountability Committee
Those databases will persist long after the last PPP case is closed, flagging anyone whose identifiers overlap with known fraud patterns in future federal applications.
If Someone Used Your Identity for a PPP Loan
Not everyone reading about PPP penalties is a target. Thousands of PPP loans were taken out with stolen identities, and many victims discovered the fraud only when they checked their credit reports or received IRS notices about income they never earned. The Federal Trade Commission’s recovery steps are:13Federal Trade Commission. Identity Theft Steps
- File an FTC identity theft report at IdentityTheft.gov or by calling 1-877-438-4338, and save both the report and the recovery plan the site generates.
- Place a free fraud alert with any one of the three credit bureaus (Equifax, Experian, or TransUnion), then pull your reports from all three at annualcreditreport.com.
- Report the theft to the SBA at sba.gov/idtheft. For questions specifically about PPP identity theft, email PPPIDTheftInquiries@sba.gov.
- Contact the lender if you know which bank issued the fraudulent loan. Ask them to release you from the obligation and remove it from your credit file. They will likely ask for a copy of your FTC report.
Move fast. An unresolved fraudulent PPP loan can damage your credit, trigger IRS notices for unreported income, and complicate future borrowing. The SBA has a dedicated process for these cases, but the victim has to start it.