To dramatize the problem, GAO provided lawmakers with a copy of a $2,358 U.S. Treasury check for rental assistance that an undercover agent got using a bogus address. The money was paid even after FEMA learned from its inspector that the undercover applicant did not live at the address.

"This is an assault on the American taxpayer," said Rep. Michael McCaul, R-Texas, chairman of the subcommittee that will conduct the hearing. "Prosecutors from the federal level down should be looking at prosecuting these crimes and putting the criminals who committed them in jail for a long time."

FEMA spokesman Aaron Walker said Tuesday that the agency, already criticized for a poor response to Katrina, makes its highest priority during a disaster "to get help quickly to those in desperate need of our assistance."

"Even as we put victims first, we take very seriously our responsibility to be outstanding stewards of taxpayer dollars, and we are careful to make sure that funds are distributed appropriately," he said.

FEMA said it has identified more than 1,500 cases of potential fraud after Katrina and Rita and has referred those cases to the Homeland Security inspector general. The agency said it has identified $16.8 million in improperly awarded disaster relief money and has started efforts to collect the money.

The GAO said it was 95 percent confident that improper and potentially fraudulent payments were much higher - between $600 million and $1.4 billion.

The investigative agency said it found people lodged in hotels often were paid twice, since FEMA gave them individual rental assistance and paid hotels directly. FEMA paid California hotels $8,000 to house one individual ¡ª the same person who received three rental assistance payments for both disasters.

In another instance, FEMA paid an individual $2,358 in rental assistance, while at the same time paying about $8,000 for the same person to stay 70 nights at more than $100 per night in a Hawaii hotel.

FEMA also could not establish that 750 debit cards worth $1.5 million even went to Katrina victims, the auditors said.

Among the items purchased with the cards:

-an all-inclusive, one-week Caribbean vacation in the Punta Cana resort in the Dominican Republic.

-five season tickets to New Orleans Saints professional football games.

-adult erotica products in Houston and "Girls Gone Wild" videos in Santa Monica, Calif.

-Dom Perignon champagne and other alcoholic beverages in San Antonio.

-a divorce lawyer's services in Houston.

"Our forensic audit and investigative work showed that improper and potentially fraudulent payments occurred mainly because FEMA did not validate the identity of the registrant, the physical location of the damaged address, and ownership and occupancy of all registrants at the time of registration," GAO officials said.

FEMA paid millions of dollars to more than 1,000 registrants who used names and Social Security numbers belonging to state and federal prisoners for expedited housing assistance. The inmates were in Louisiana, Texas, Alabama, Mississippi, Georgia and Florida.

FEMA made about $5.3 million in payments to registrants who provided a post office box as their damaged residence, including one who got $2,748 for listing an Alabama post office box as the damaged property.

To demonstrate how easy it was to hoodwink FEMA, the GAO told of an individual who used 13 different Social Security numbers - including the person's own - to receive $139,000 in payments on 13 separate registrations for aid. All the payments were sent to a single address.

Likewise, another person used a damaged property address located within the grounds of Greenwood Cemetery in New Orleans to request disaster aid. Public records show no record of the registrant ever living in New Orleans.

Instead, records indicate that for the past five years, the registrant lived in West Virginia - at the address provided to FEMA, the GAO said.