2026-10-07
Hawaii's Kona earthquake recovery deadline is Nov. 1. The SBA's own disaster loan paperwork still accepts your Social Security number by email.
The deadline to apply for FEMA assistance tied to Hawaii's magnitude-6.0 Kona earthquake of May 22, 2026 is Nov. 1, 2026 — and as of Oct. 6, 2026, FEMA's own disaster page for DR-4936-HI shows 219 Individual Assistance applications already approved for $1,047,994.65 in housing assistance and $751,596.45 in other needs assistance, against a federal cap of $44,800 in each category (effective for disasters declared on or after Oct. 1, 2025). Since a March 22, 2024 rule change, FEMA no longer requires survivors to first apply for — and be denied or only partially approved for — an SBA disaster loan just to get full access to that assistance, a genuine privacy and paperwork improvement. But anyone whose real losses run past that $44,800 cap, which a magnitude-6.0 earthquake routinely does, still ends up filling out SBA's own home disaster loan application — and that's where the Social Security number goes back into play. Here's what encrypting that paperwork before you send it actually fixes, and the one scam-shaped case, which FEMA itself is actively warning survivors about this year, where it fixes nothing at all.
What FEMA's own numbers show, three weeks before the deadline
President Trump's major disaster declaration for the Kona earthquake made Hawaii County eligible for federal Individual Assistance, with KITV reporting the quake itself hit magnitude 6.0 and FEMA formally declaring the disaster Sept. 1, 2026. FEMA's own live tracking page puts registration at hundreds of approved households and climbing, with the application window closing Nov. 1, 2026 — and it isn't the only 2026 disaster still inside an active registration period. Iowa's DR-4942-IA (severe storms and flooding) and Indiana's August 2026 storm-and-tornado declaration both carry their own open Individual Assistance windows the same autumn, so the paperwork pattern below isn't specific to one island.
Why FEMA's own portal isn't actually where the sensitive paperwork gets heavy
FEMA's own application channels for Individual Assistance are relatively contained: a DisasterAssistance.gov account, the FEMA mobile app, or a phone call to 800-621-3362. There's no "email us your documents" option in that base application — and since FEMA's own page on the SBA relationship confirms, for disasters declared before March 22, 2024, survivors referred to SBA had to complete an SBA disaster loan application just to stay eligible for Personal Property and Transportation Assistance. The 2024 rule change ended that for every disaster declared since, including this one — FEMA's stated goal, per the agency's own language, was to "increase equity by simplifying processes, removing barriers to entry." That's a real improvement, and it means fewer survivors are funneled into SBA paperwork than five years ago. It doesn't mean nobody is. FEMA's own per-category cap — $44,800 for housing, $44,800 for other needs — isn't close to what it costs to make an earthquake-damaged house safe, sanitary, and functional again, so anyone with a real loss above that line still has a practical reason, not a bureaucratic requirement, to apply to SBA for the larger low-interest financing. That's a voluntary step now instead of a mandatory one — but it's still where the heavier paperwork starts.
What SBA's own loan application actually asks for — and how it tells you to send it back
SBA's home disaster loan package routinely includes an IRS Form 4506-T tax transcript authorization, which the IRS's own form requires your Social Security number to complete, an SBA Form 413 Personal Financial Statement listing your bank accounts and other assets, and your homeowner's insurance settlement letter, since SBA can't duplicate what insurance already covers. For this exact disaster, SBA's live contact for Hawaii survivors is listed as disastercustomerservice@sba.gov, alongside phone support and the MySBA Loan Portal. SBA's own published submission guidance for returning a completed packet has, for years, listed four channels side by side: its online portal, fax, mail — and plainly emailing the scanned documents as attachments. That isn't a phishing trick or a leaked address. It's the agency's own printed instructions, reproduced the same way across its application guides since at least 2020, right next to a contact page that still lists DCS@sba.gov today.
What encrypting that file before you email it actually fixes
NearSeal runs entirely in your browser — the 4506-T, the Form 413, the insurance settlement letter never upload anywhere to get encrypted. By default it's sealed on your own device with AES-256-GCM and a passphrase-derived key (PBKDF2-SHA256 at 220 iterations) before it goes into an email to SBA at all. That removes the plaintext copy from the two places you actually control: the file sitting in your Downloads folder or Sent mail, and the attachment as it crosses the wire into SBA's inbox. For the passphrase to do any good once the file arrives, it has to travel a separate channel from the file itself — a call to SBA's published customer-service line, not a reply in the same email thread.
The one case FEMA's own 2026 scam warnings describe that encryption can't touch
FEMA has spent this disaster season actively warning survivors about exactly this moment. A July 24, 2026 FEMA advisory for Michigan survivors, in the agency's own spokesperson's words, describes scammers posing as FEMA inspectors, demanding fees for free application help, and phishing by phone or email for exactly the personal information your disaster loan paperwork already contains — with the agency's own fix being "everything we do is free," verify any FEMA employee's photo ID and nine-digit registration number, and call FEMA's own line, 800-621-3362, if anything feels wrong. If the "loan officer" or "case manager" on the other end of that email is one of those scammers rather than the real SBA, encrypting your file before you send it changes nothing about what they do with it once they have the passphrase — you built that passphrase specifically to let them in, and encryption has nothing to say about an authorized, dishonest recipient. The actual defense here is the one FEMA is already telling survivors to use: confirm the email address actually ends in @sba.gov or @fema.dhs.gov, dial SBA's own published number (800-659-2955) yourself rather than calling back a number in an email, and never pay anyone to help you apply. Encrypting the file is for the ordinary, legitimate half of this process — getting your own documents to the real SBA — that's left over once you've confirmed who you're actually emailing.
Two more honest limits, regardless of which path you're on
NearSeal's default container keeps the original filename in a plaintext header field — bound into the authenticated data so it can't be silently swapped for something else, but still readable without the passphrase. A file named "ssn-4506t-for-sba-loan.pdf" tells anyone who intercepts it exactly what's inside before they've broken anything; rename it to something unremarkable first, or use the opt-in age-encryption.org format, which carries no filename field at all. And there is no passphrase recovery of any kind — if you forget it before Nov. 1, you don't just lose the file, you lose the time it takes to re-request a tax transcript and rebuild a personal financial statement from scratch with three weeks, or less, left on the clock.
Where NearSeal fits
FEMA's own 2024 reforms are right that the fix for over-collecting sensitive financial paperwork is structural — removing the requirement in the first place, which is exactly what happened for every disaster declared since. What that reform doesn't touch is the voluntary, legitimate second filing FEMA's own $44,800 cap still pushes real losses toward: an SBA home disaster loan application whose own instructions list email as an accepted way to send back your Social Security number, bank account details, and insurance settlement. That's the gap NearSeal closes — not a stolen identity filing a fraudulent claim in your name, and not what a genuine scammer does with a file after you've mistakenly trusted them with the passphrase, but the plaintext copy that otherwise sits in an inbox the whole way from your Downloads folder to the real SBA.