“DOGE” Access to Treasury Payment Systems Raises Serious Risks

On January 31, reports began emerging from the Treasury Department that senior civil servants were resisting requests from the “Department of Government Efficiency” (DOGE) concerning access to the payment systems the Bureau of the Fiscal Service (BFS) operates.^[2] In the days since, officials affiliated with DOGE have been granted certain access to BFS systems, although press reports have varied on the exact nature of this access.^[3]

DOGE head Elon Musk — who is reportedly “fixated on the Treasury system as a key to cutting federal spending”^[4] — has since tweeted about DOGE’s intention to stop certain payments as well as his view that civil servants at BFS are criminally enabling fraudulent payments, which must be addressed.^[5] The New York Times has reported that “Trump administration appointees and allies of Elon Musk” requested that career officials use the BFS payment systems to freeze federal payments, prior to political appointees gaining access.^[6] For the first time in decades, the Secretary of the Treasury has delegated the responsibilities of overseeing these payment systems to a political official rather than a nonpartisan career civil servant with long expertise and experience in these matters, even while that political official maintains his role as a private company CEO.^[7]

DOGE access to or control over BFS systems raises serious concerns, including the risk that payments will be illegally stopped based on Musk’s own or the Trump Administration’s political or policy preferences; the possibility of severe cybersecurity and privacy breaches; and the potential that payments could be inadvertently delayed to millions of individuals, including retirees and veterans, to organizations and businesses providing public services on behalf of the federal government, as well as to states, localities, territories, and tribal nations for providing services like Medicaid and transportation.

This primer explains what the Bureau of the Fiscal Service does, how it has traditionally been managed by career civil servants, and the risks posed by tampering with the system. While this report is focused on the Treasury payment systems, DOGE personnel are also seeking and gaining access to other sensitive government systems, including the federal student aid system, which has confidential information about student borrowers (some of whom are long out of school).^[8] There have been similar reports of DOGE personnel accessing health agency payment and contracting systems as well as systems for major programs like Medicaid and Medicare.^[9] Many of the same concerns raised by access to the Treasury systems hold for those systems as well.

What does the Bureau of the Fiscal Service do?

The Bureau of the Fiscal Service operates the “plumbing” that both collects information from government agencies about the people, entities, and governments to which funds should be disbursed and then makes those payments. The vast majority of payments that flow in and out of the federal government go through the Treasury payment systems. BFS manages an average daily cash flow of roughly $200 billion, securely disbursed nearly 1.3 billion payments totaling $5.4 trillion in fiscal year 2023, and centrally disburses nearly 88 percent of all federal payments.^[10]

These payments operate through several different systems. For example, the Automated Standard Application for Payments (known as ASAP.gov) makes grant funding available to be securely drawn down by state and local governments, educational and financial institutions, vendors and contractors, for-profit and nonprofit organizations, and tribal organizations. Federal agencies enroll recipient entities, authorize payments to them, and manage their accounts, allowing these entities to request payments from pre-authorized accounts. BFS also operates the Payment Automation Manager (or PAM), which is used to make over a billion payments annually, including tax refunds and benefit payments like Social Security.

While these systems differ, they generally operate through the following process:

• A federal agency will develop, certify, and send a “payment file” to BFS through the Secure Payment System (SPS) with instructions on who is to be paid, when, and how much.^[11]
• That payment file will typically include the necessary information to complete a payment — for example, the recipient’s banking information, as well as sensitive identifying information like Social Security numbers.^[12]
• Payment files are checked against a series of pre-approved data sets as part of the Do Not Pay program.^[13] These data sets check whether the intended payee is deceased (the “death master file”), delinquent on federal debts, or debarred from receiving payments or doing business with the federal government — for example, because they are blocked foreign nationals on the Office of Foreign Assets Control’s list. To the extent issues are flagged, the agency that initiated the payment file must be the one to adjudicate them and determine whether a payment is proper.
• BFS processes the payment by sending the money electronically into the designated account or sending a paper check.^[14] Under 31 U.S.C. 3325, Treasury issues the payment once it has been properly certified. As one federal court explained in 1990, “[t]he disbursing officials [at Treasury] do not review the vouchers to determine the legality or propriety of the underlying claims but, rather, the Regional Financial Centers examine the vouchers to determine if they are in the proper format, have been duly certified and are correctly computed.”^[15] Indeed, except as to checking the correctness of computations on a voucher — and potentially redirecting some portion of a recipient’s payment toward a delinquent federal debt that they owed — disbursing officials at Treasury are “held accountable for” ensuring that any funds certified by the relevant agency are paid out to the payee.^[16]

As this process makes clear, BFS staff do not independently make determinations of eligibility for payments (a responsibility performed by agencies with respect to the specific laws and regulations governing their programs), but instead ensure that requested payments are successfully and securely processed. BFS career officials execute an important but operational role: as noted above, if the payment information BFS receives from an agency is certified in its proper form, then BFS makes the payment. It is the so-called “certifying officer” at an agency — the one who sends over the payment — who “is responsible for . . . the legality of a proposed payment under the appropriation or fund involved,” including adjudicating any payment flags that are raised by cross-checks with Do Not Pay databases.^[17] BFS has no authority to directly alter requested payment amounts unless it is to “offset” (i.e., redirect a portion of a payment toward) a known government debt, an authority provided in the Debt Collection Improvement Act of 1996.^[18]

Access to or control over the BFS systems could have implications for both entitlement programs, like Social Security and Medicare, and programs funded annually through the appropriations process (called “discretionary” programs) — whether implemented via direct federal payments to individuals; through payments to states, territories, or tribal or local governments; or through payments to private nonprofits or businesses. In each of these cases, BFS is responsible for ensuring that funds accurately reach the intended federal recipients. To give three examples:

• In the case of entitlement programs where money goes directly from the federal government to a recipient’s bank account, like Social Security benefits or veterans’ disability compensation, BFS processes a payment file that is developed by the Social Security Administration or the Department of Veterans Affairs and then deposits funds into an individual’s account or sends them a check.
• In the case of a program where the program is administered by a state, territory, or tribal nation, like Medicaid (administered by the Department of Health and Human Services) or WIC (the Department of Agriculture’s Special Supplemental Nutrition Program for Women, Infants, and Children), BFS processes a payment file to make funding available to the administering government, which then provides services or benefits to individuals. In some cases, this funding is provided up front; in others, it is provided on a reimbursable basis.
• In the case of Pell Grants, where funds are provided to private (for-profit or nonprofit) universities, BFS processes a payment file from the Department of Education that enumerates how much the provider was due to be reimbursed or the university was due to cover Pell Grant recipients at the institution.

Who has access to BFS systems and what do they do?

For decades, BFS (and its immediate predecessor, the Financial Management Service) has been staffed by nonpartisan career employees led by a nonpartisan career official, reporting to a career official (the fiscal assistant secretary).^[19] Only a small number of career staff at BFS have served in the delegated role of disbursing officials within the Treasury Department. BFS maintains strict access controls and separation of duties protocols, and individuals with access to BFS systems are subjected to extensive monitoring and oversight. Each employee undergoes a thorough security screening and is given extensive training on the proper management and operation of the payment systems and the handling of sensitive data. This arrangement has protected the integrity of these federal payment systems and processes, ensuring insulation from political pressures or policy interests and focusing BFS’s mission on reliability, accuracy, timeliness, operational efficiency, and privacy protections.

What are the risks entailed by DOGE access to BFS systems?

The integrity of federal payment systems is critically important to the individuals, businesses, organizations, governments, and financial institutions that trust their information will be protected in the system and that legally owed payments will be reliably received without any threat of interference. There are at least four major risks created by breaking the long-standing precedent that has prevented non-career officials from accessing or interfering in BFS payment systems.

1) DOGE access would provide a centralized avenue for the illegal withholding of payments or benefits to a wide range of recipients. The Trump Administration has already indicated through its first-week executive orders and actions taken by the Office of Management and Budget, or OMB (such as the now-rescinded OMB memo M-25-13) that it will seek to compel agencies to block payments to legally entitled recipients for political or policy reasons, which would amount to illegal impoundment.^[20] Already, multiple courts have ordered these actions stopped.^[21] Further, Musk has made clear his intention to use BFS payments to cut federal spending, including his charge to DOGE staff to maximize the amount of daily spending cuts.^[22]

Access to or control of the BFS payment systems would potentially allow empowered political officials to bypass the guardrails of career civil servant stewardship in federal agencies and at BFS and centralize efforts to illegally block payments — either in conjunction with, or apart from, any steps agencies would take. For example, individuals with access to the BFS payment system could potentially (and illegally):

• Block, or threaten to block, payment to a Social Security recipient.
• Block, or threaten to block, specific program payments or federal payments en masse to a recipient state or local government based on a dispute over a policy issue (e.g., if a state is accused of not fully cooperating with the Trump Administration or acceding to its desires on issues like immigration or LGBTQ rights).
• Block, or threaten to block, payments — potentially across multiple agencies’ programs — to specific nonprofits or businesses that the Trump Administration views as non-compliant with their policy preferences, or perhaps are competitors to someone well connected to the Administration.

In response to retired Lt. General Michael Flynn posting a list of institutions with “Lutheran” in their name that receive federal funding (both service providers and universities), Elon Musk tweeted on February 2 that “the DOGE team is rapidly shutting down these illegal payments.”^[23] This is just one example of how a blanket payment stop could be placed on institutions that are eligible recipients of funding and have been approved by the relevant agency.

Even if the Trump Administration took no action, just the perceived ability to block payments in this manner could coerce individuals or entities into complying with Administration preferences that are not enshrined in law, issuing statements supportive of the Administration, or making other concessions to prevent the disruption of federal funds to which they are entitled. In short, it could become a tool to bully those with whom the President or Elon Musk disagree.

2) DOGE access puts sensitive data — including taxpayer information protected by Section 6103 of the Internal Revenue Code, Social Security numbers, and bank account information — in the hands of individuals who shouldn’t have access to it. Payment files that are at the heart of the BFS payment systems include highly sensitive information, which could include recipients’ Social Security numbers (regardless of the kinds of payment they are receiving) and addresses as well as their bank account information. Unauthorized individuals who receive access to the system would also have access to this information, for example:

• direct deposit information and other sensitive identifying information for tens of millions of Social Security recipients;
• bank account information for nonprofit and for-profit providers of government services through Medicare; and
• potentially sensitive personal or business information from private firms that do business as government contractors.

The risk that such information could be inappropriately viewed by political appointees who were not thoroughly vetted for access to sensitive information and lack the training needed to protect the data could reduce participation in government programs or reduce competition to provide government services. Businesses securing government contracts should not have to weigh the risk that sensitive information will be inappropriately viewed by political appointees who might have close relationships with competitors — or, in the case of special government employees like those at DOGE, still have financial interests in those competitors themselves.

One of the DOGE-affiliated officials named by Treasury as having access to the BFS payments systems — Tom Krause — is serving as a temporary “special government employee” while reportedly retaining his role as CEO of a software firm.^[24] On February 7, it was reported that Krause would be moved into the role of fiscal assistant secretary overseeing BFS, despite that role having been filled by nonpartisan career civil servants for decades.^[25] Similarly, Elon Musk has been leading DOGE efforts while seeming to actively run his several companies (and do business with the federal government), creating the possibility of extensive conflicts of interest.

Unauthorized access to data in the BFS system, whether intentional or unintentional, could violate the Privacy Act, which restricts the ability of an agency to share personal information with anyone outside the agency (including with officials of other agencies, absent consent from the individual or a statutory exception). Given that BFS also handles taxpayer information — including taxpayers’ identities and addresses and their refund claims — unauthorized viewing or disclosure would potentially violate Section 6103 of the Internal Revenue Code, which protects taxpayer confidentiality and comes with both criminal and civil penalties.^[26]

3) DOGE access creates operational security risks that could leave the system and sensitive information vulnerable to exploitation by external actors. Absent appropriate protocols, poor cybersecurity — and personnel security — practices pose significant operational risks for fraud, theft, or espionage.^[27] Providing full access to the BFS payment systems to unaccountable or inexperienced actors like DOGE appointees could accidentally expose a “roadmap” for thieves and fraudsters looking to penetrate the system, or for foreign intelligence services seeking to build out their understanding of who is receiving funds, in what amounts, and for what purposes — or as a useful tool of a cyberattack that would throw the federal government into chaos. The cybersecurity risks could stem from DOGE personnel using unauthorized systems to copy or analyze sensitive data or exposing — even if unintentionally — protected information about how the system works. DOGE appears to have pushed career civil servants to grant inappropriate access to political appointees without experience in these systems and little oversight or restraint, which could override existing protections in ways that dramatically increase those risks.

These payment systems are considered part of the national financial critical infrastructure and are subjected to heightened controls and protections; for example, they must rigorously adhere to National Institute of Standards and Technology security and safety standards to protect the systems from external threats and cyberattacks.^[28] The payment systems must be rigorously maintained and kept up to date. Any system changes, no matter how small, must be performed by trained and authorized personnel, carefully controlled and monitored, and deployed only following thorough testing. The payment systems are designed to adhere to a “zero trust cybersecurity standard,” in which systems access is limited to the minimum needed for any particular function and constant verification and authentication are required to grant such access.^[29] Granting inappropriate access to political actors who may not closely adhere to these existing safeguards is an unaffordable risk.

4) Even absent a cybersecurity event, providing DOGE with access to these sensitive systems creates the risk of “breaking” the system in ways that could inadvertently delay or stop payments like Social Security from arriving on time. BFS disburses 1.3 billion payments a year and reports making 100 percent of payments on time.^[30] Any efforts to interfere with the system, even in a limited way, run the risk of creating broader problems that could delay payments or damage the perceived reliability of federal payments. The system is designed to process payments at volume, and attempts to target individual recipients at this stage of the process — as opposed to at the agency level, before the payment file is sent — could delay a much larger set of payments like monthly Social Security benefits. Markets, financial institutions, organizations and states providing services, and individuals all rely on government funds being disbursed on time, so the payment systems cannot afford even brief unscheduled disruptions.

Does providing DOGE officials with “read-only access” remove these risks?

Recent communications from Treasury leadership have suggested that DOGE-affiliated officials are being provided with “read-only access,” although that term has not been clearly defined.^[31] Read-only access would still threaten individuals’ privacy, compromise national security, and provide information that could support a broad and inappropriate use of the improper payments law to initiate illegal impoundment.

In addition, it is important to note that there was no commitment from Treasury Secretary Bessent to ensure that individuals with read-only access would not direct personnel with current read-and-write access to stop payments through BFS. Instead, as described above, contravening decades of nonpartisan career civil servants serving as fiscal assistant secretary and overseeing BFS, Secretary Bessent has delegated those responsibilities to political appointee Tom Krause.^[32] This followed reporting in the New York Times that Krause had advocated for career staff to hold one agency’s certified payments even after being informed by the then-fiscal assistant secretary that he did not believe Treasury had the legal authority to stop such payments.^[33]

Treasury’s payment systems have long been managed by non-political technical experts for a reason — our government relies on trust from all parties, including the general public, that they will provide funds, on time and securely, to those who government agencies determine are meant to receive them under the law. This is why five former Treasury secretaries wrote recently that any hint that congressionally authorized payments could be selectively suspended by Treasury comes at a cost to the credibility of the United States and would be “a breach of trust and ultimately, a form of default.”^[34] The approach signaled by DOGE leadership risks destroying that trust, whether by creating an opportunity for political actors to unilaterally block payments to those who are legally entitled to receive them, compromising the privacy and security of sensitive information for millions of Americans, or inadvertently destabilizing the payment system.