Womply gave government investigators data on roughly 1.5 million PPP loan applications.

Who received Womply’s data

From 2021 to 2024 Womply answered legal process from at least 48 federal, state, and local agencies investigating PPP fraud, in more than 370 separate productions of court-admissible records.

What each production contained

A typical subpoena response was a complete, self-authenticating package, built so prosecutors could put it straight into evidence:

• The legal process: the subpoena, CID, or warrant.
• Summary of search results for the named targets.
• IP-address history tied to the applications.
• Application data export: the 40+ fields below.
• Application documents & uploads applicants submitted.
• Communications records.
• Sworn Certification of Records: court-admissible business records.

Application-data fields produced (40+ per record)

Each application record carried more than forty fields across five categories, far more than a typical loan file:

More data than most lenders collected

Because Womply was a technology platform rather than a lender, it captured far more than a standard loan file. Alongside the loan paperwork it held each applicant’s identity-verification inquiries, the IP addresses and countries seen at sign-up, device and timestamp histories, and every document uploaded — the 40+ fields above. Most lenders never collected data at that depth.

That granularity is what made fraud visible. A single application can look clean on its own; organized rings only stand out across thousands of records: shared IP addresses, reused identities, common devices. It is how Womply flagged its first coordinated fraud ring, identified 13,798 loans tied to compromised identities, and could hand investigators data structured to map fraud across the program.

That same depth is what made the records hold up in court. Federal prosecutors in more than ten districts introduced Womply’s records as certified business records, authenticated alongside the SBA and major banks, with no defense challenging their reliability, and in one trial the login and upload logs disproved a defendant’s sworn testimony that he “didn’t fill out anything.”