I'd put it as much on the state. From the bank's perspective it's just an ACH transfer. The state knows what it's for and is arguably in a better position to detect anomalies. And the state should be doing better due diligence to verify identities and eligibility.