If you receive a prepaid card in the mail that you didn’t order, contact the company to cancel that card—and double check with the state unemployment office to make sure no claims have been made in your name.

Cybersecurity experts estimate that scammers from Nigeria could already have bilked millions of dollars from Massachusetts’ state unemployment system using stolen identities.

The Secret Service issued a warning that the so-called Scattered Canary cybercriminal group has been making unemployment claims in real people’s names and diverting the money to a prepaid card that the scammers register to the person’s name.

Crane Hassold, senior director of threat research at the cybersecurity firm Agari, says the scammers often have the government deposit the money into an account linked to a Green Dot card.

“They’re sending the money to prepaid cards—a card you can get at any Walmart, that has a bank account associated with it,” he explains. “And they route the payment to the bank account attached to those prepaid cards, which are then laundered through additional accounts after that.”

If you receive a prepaid card in the mail that you didn’t order, contact the company to cancel that card—and double check with the state unemployment office to make sure no claims have been made in your name.

Hassold says often people don’t hear about the scam until their company’s human resources department gets a notice that a claim has been filed. Or people find out when they try to apply for benefits.

“If the individual is actually unemployed or has recently become unemployed and they apply for unemployment benefits, and one of these scammers has already filed in their name, then they’ll get rejected,” he explains.

Hassold says the scammers are taking advantage of the fact that states, in an effort to get people relief checks as fast as possible, may be pushing money out the door without doing the proper vetting. He says often, the state will only discover the fraud after at least one payment has gone out. So far, nine states are known to have been hit by the scam.