Over the last three years, thieves plundered billions of dollars in federal COVID-19 relief aid intended to combat the worst pandemic in a century and to stabilize an economy in free fall.

Here are some key takeaways from an Associated Press analysis of what may have been stolen or wasted.

How much was stolen?

An Associated Press analysis found that fraudsters potentially stole more than $280 billion in COVID-19 relief funding; another $123 billion was wasted or misspent. Combined, the loss represents a jarring 10% of the $4.2 trillion the U.S. government has so far disbursed in COVID-relief aid.

That number is certain to grow as investigators dig deeper into thousands of potential schemes.

There are myriad reasons for the staggering loss. Investigators and outside experts say the government, in seeking to quickly spend trillions in relief aid, conducted too little oversight during the pandemic’s early stages and instituted too few restrictions on applicants. In short, they say, the grift was just way too easy.

“Here was this sort of endless pot of money that anyone could access,” said Dan Fruchter, chief of the fraud and white-collar crime unit at the U.S. Attorney’s office in the Eastern District of Washington. “Folks kind of fooled themselves into thinking that it was a socially acceptable thing to do, even though it wasn’t legal.”

The U.S. government has charged more than 2,230 defendants with pandemic-related fraud crimes and is conducting thousands of investigations.

The pilfering was wide but not always as deep as the eye-catching headlines about cases involving many millions of dollars. But all of the theft, big and small, illustrate an epidemic of scams and swindles at a time America was grappling with overrun hospitals, school closures and shuttered businesses. Since the pandemic began in early 2020, more than 1.13 million people in the U.S. have died from COVID-19, according to the Centers for Disease Control and Prevention.

Where did scam artists get the money?

Before leaving office, former President Donald Trump approved emergency aid measures totaling $3.2 trillion, according to figures from the Pandemic Response Accountability Committee. President Joe Biden’s 2021 American Rescue Plan authorized the spending of another $1.9 trillion. About a fifth of the $5.2 trillion has yet to be fully paid out, according to the committee’s most recent accounting.

Never has so much federal emergency aid been injected into the U.S. economy so quickly. “The largest rescue package in American history,” U.S. Comptroller General Gene Dodaro told Congress.

What agencies were hit the hardest?

The health crisis thrust the Small Business Administration, an agency that typically gets little attention, into an unprecedented role. In the seven decades before the pandemic struck, for example, the SBA had doled out $67 billion in disaster loans.

When the pandemic struck, the agency was assigned to manage two massive relief efforts –the COVID-19 Economic Injury Disaster Loan and Paycheck Protection programs, which would swell to more than a trillion dollars. SBA’s workforce had to get money out the door, fast, to help struggling businesses and their employees. COVID-19 pushed SBA’s pace from a walk into an Olympic sprint. Between March 2020 and the end of July 2020, the agency granted 3.2 million COVID-19 economic injury disaster loans totaling $169 billion, according to an SBA inspector general’s report, while at the same time implementing the huge new Paycheck Protection Program.

In the haste, guardrails to protect federal money were dropped. Prospective borrowers were allowed to “self-certify” that their loan applications were true. The CARES Act also barred SBA from looking at tax return transcripts that could have weeded out shady or undeserving applicants, a decision eventually reversed at the end of 2020.

“If you open up the bank window and say, give me your application and just promise me you really are who you say you are, you attract a lot of fraudsters and that’s what happened here,” said Michael Horowitz, the U.S. Justice Department inspector general who chairs the federal Pandemic Response Accountability Committee.

What could the U.S. government have done better to combat fraud?

Horowitz criticized the government’s failure early on to use the “Do Not Pay” Treasury Department database, designed to keep government money from going to debarred contractors, fugitives, felons or people convicted of tax fraud. Those reviews, he said, could have been done quickly.

“It’s a false narrative that has been set out, that there are only two choices,” Horowitz said. “One choice is, get the money out right away. And that the only other choice was to spend weeks and months trying to figure out who was entitled to it.”

In less than a few days, a week at most, Horowitz said, SBA might have discovered thousands of ineligible applicants.

“24 hours? 48 hours? Would that really have upended the program?” Horowitz said. “I don’t think it would have. And it was data sitting there. It didn’t get checked.”

Who is to blame?

On politically divided Capitol Hill, lawmakers have not put the pandemic behind them and are engaged in a fierce debate over the success of the relief spending and who’s to blame for the theft.

Too much government money, Republicans argue, breeds fraud, waste and inflation. Democrats have countered that all the financial muscle from Washington saved lives, businesses and jobs.

Republicans and Democrats did, however, did find common ground last year on bills to year to give the federal government more time to catch fraudsters. Biden in August signed legislation to increase the statute of limitations from five to 10 years on crimes involving the two major programs managed by the SBA.

The extra time will help federal prosecutors untangle pandemic fraud cases, which often involve identity theft and crooks overseas. But there’s no guarantee they’ll catch everyone who jumped at the chance for an easy payday. They’re busy, too, with crimes unrelated to pandemic relief funds.

Gene Sperling, the White House American Rescue Plan coordinator, said any future crisis that requires government intervention doesn’t have to be a choice between helping people in need and stopping fraudsters.

“The prevention strategy going forward is that in a crisis, you can focus on fast delivery to people in desperate situations without feeling that you can only get that speed by taking down common sense anti-fraud guardrails,” he said.