RICHMOND, Va. -- Over the past year the Virginia Employment Commission has faced a lawsuit, been the subject of a blistering government watchdog report for its dysfunction and the source of much stress for thousands of Virginians waiting for their much-needed benefits.
While the incoming governor has promised to fix the VEC, a Chesterfield man says to hurry because he says he's been waiting nine months.
“A lot of sleepless nights, a lot of stress between myself and my spouse, where she has had to work numerous hours to overtime to compensate for the income that I have lost,” said Derrick Baker.
Baker has spent much of the last year trying to get his claim with the Virginia Employment Commission straightened out.
Before the IT worker was laid off last April, he got a notice out of the blue from the VEC that someone using his name had filed a claim.
So weeks later, when he actually needed to file with the VEC, he ran into a roadblock.
“They had a fraudulent claim [in my name] in March,” said Baker. “I filed a legit claim in April and it's linked together, which it should not be. So I had to go through the process of proving who I am by sending in documents, pretty much all the way up to a DNA sample, and everything else that needs to be linked to it.”
After countless calls that went nowhere, he thought he had finally proved his identity. But his six weeks of benefits never arrived.
“So I got a letter saying that my claim was legitimate, and everything was fine, and we're good to go,” Baker said. “And then shortly after that, maybe about a month or two, something came from one of the judges, saying that I did not supply documentation to validate who I was in time. When it's clearly in my records.”
So Baker had to file an appeal which now, three months later, still has not been resolved.
He has even sent emails to VEC Commissioner Ellen Marie Hess and Gov. Northam’s “Workforce Development” Director Megan Healy.
They did not respond.
It got worse when the VEC shut down for its much-delayed upgrade in November when the same fraudster somehow got back into his account.
“I'm waiting to have my appeal heard, but the person who has fraudulently taken over my account has access to and can see everything, on the portal after the upgrade,” said Baker. “I reported that. So they gave me a new PIN number. But they then told me, ‘We don't use pin numbers anymore. We use phone numbers.’ I'm like, why would you use a phone number when you gave me a document stating that I have to supply the PIN number in order for me to get any type of assistance?”
For Baker who has been working with computer systems for more than 20 years, the experience revealed the VEC's greatest vulnerability: how it verifies users. He says the new and improved VEC system is still woefully inadequate.
“We're talking about a three-decade-old problem, and you're still using a three-decade-old verification system, you know, asking me the security questions,” Baker said. “What was your high school mascot? What was your mother's maiden name? Instead of going with the two-factor verification which everybody uses now? VEC is not using it.”
As he waits on getting the benefits that put a hole in his finances nine months ago, Baker says the hacker and the VEC have both done lasting damage.
“I equate it to buying a house: you renovate it, you upgrade it and everything,” said Baker. “But you forget the one thing: you don't change the locks, so everyone else who had access to the house, still has access to your house. And that's what the VEC needs to do. Just because you upgraded it, made it look pretty, your verification process still needs to be reworked.”
VEC spokesperson Joyce Fogg said by email that while she could not comment on individual cases someone would contact Baker.
Sure enough, the morning our story aired, he got a call from the VEC saying his appeal is being processed.
As for a two-factor or multi-factor authentication, Stephanie Benson, a spokesperson for the Virginia Information Technologies Agency told CBS6 it is in place for state agencies but that a user would have to set it up themselves.
Baker says it was never offered by the VEC on its site.
