3.1 Million Visa Overstay Leads

People standing inside chain-link holding area with an officer nearby — Photo: Fishman64 / Shutterstock

The core vulnerability in America’s interior immigration enforcement is not at the border; it is the chronic gap between the millions of overstay leads generated each year and the thin slice that ever receives a knock on the door—an imbalance a recent DHS inspector general audit quantified with unusual starkness.

At a Glance

From FY2021–FY2024, ICE received 3,145,375 nonimmigrant overstay leads but pursued limited enforcement.
Roughly 104,049 leads were flagged as potential national security or public safety concerns; 496 investigations and eight arrests followed from that pool.
Among the highest-priority “Priority 1” leads, 1,769 viable cases yielded 84 investigations and two arrests.
Policy triage, data quality, and operational constraints—not a single cause—drove the gap between leads and action.

What the watchdog found, in plain terms

The Department of Homeland Security Office of Inspector General reviewed how U.S. Immigration and Customs Enforcement handled nonimmigrant visa overstay leads in fiscal years 2021 through 2024. Across that span, ICE received 3,145,375 leads—records indicating a person admitted temporarily to the United States may have remained beyond the authorized period. Of those, 104,049 were categorized as potential national security or public safety concerns. The resulting enforcement was narrow: 496 investigations opened and eight arrests from the high-risk pool; among 1,769 viable Priority 1 leads—the top tier—there were 84 investigations and two arrests.

The audit described a triage system that classified 96.7 percent of all leads as non‑priority, largely placing them outside active enforcement pipelines. The report tied the posture in part to a September 2021 enforcement guidance that told ICE to concentrate scarce resources on threats to national security, public safety, or border security—codifying a risk-ranking approach that has existed in various forms for years.

How the overstay system actually works

Overstay enforcement is a relay. U.S. Customs and Border Protection’s entry/exit systems and DHS’s Arrival and Departure Information System (ADIS) generate potential overstay records by matching admissions with departures. Those records feed ICE’s analytic units, which separate obvious mismatches or resolved cases from a subset considered “actionable”—that is, candidates for field investigation. Even then, ICE’s Counterterrorism and Criminal Exploitation Unit (CTCEU) and Enforcement and Removal Operations (ERO) apply priority criteria that elevate national security and public-safety risks ahead of routine status violators.

Two technical points matter here. First, a “lead” is not a confirmed violation. People depart without clean exit records, extend or change status lawfully, or are counted more than once as databases are updated. The inspector general’s numbers describe investigative workload, not a census of removable aliens. Second, consequences vary by law: confirmed overstays can lose visa validity and face three- or ten‑year bars on reentry after departure, distinct from arrest and removal inside the United States.

Why leads don’t translate into arrests at scale

Risk triage is the first limiter. ICE has long operated under a risk-based framework that prioritizes national security and public-safety threats over civil violators whose only issue is time overstay. The 2021 guidance emphasized that hierarchy; the audit links today’s distribution of effort to that policy choice.

Operational friction is the second. Field agents need a verified identity, a current address, and lawful access to premises or cooperation from other agencies to make contact. The inspector general cited difficulty verifying addresses and limited interagency cooperation—factors any veteran investigator would recognize as case-killers when time and personnel are constrained. Even inside the flagged high-risk universe, subjects may have departed, relocated without a paper trail, or resolved their status by the time a file surfaces to the top of a queue.

What the numbers do—and do not—prove

The audit’s tallies are unambiguous about scale and response: millions of leads, the vast majority classified non-priority, and minimal enforcement within the subset flagged as potentially serious. They support a clear conclusion that the system, as operated in FY2021–FY2024, allowed most suspected overstays to go uninvestigated, including a pool identified for potential national-security or public-safety concern.

They do not, however, convert every lead into a confirmed overstay or every flagged record into a verified threat. By DHS design, lead generation errs on the side of inclusion; confirmation requires additional checks. That distinction is not exculpatory—it describes process reality. The watchdog’s critique is not about database false positives; it is about the gulf between the filtered set of higher‑risk leads and the modest investigative and arrest outcomes.

How we got here: capacity, policy, and a persistent volume problem

America’s overstay challenge predates any one administration. Since the post‑9/11 buildout of entry/exit systems, DHS has produced annual overstay estimates and built targeting units to winnow millions of records to the riskiest subset. Congress has funded these efforts episodically, and DHS has repeatedly told lawmakers that universal follow‑up is impractical without a step‑change in staffing, data fidelity, and partner access. As a result, ICE’s mission has been defined as identifying suspected in‑country overstays, classifying priority targets, and executing enforcement actions on those who pose the greatest risk—an approach codified in formal DHS strategies and testimony.

The 2021 guidance did not invent prioritization; it narrowed it. In practice, that meant more files landing in a non‑actionable bucket, even as the total stream of leads remained large. When back-end address quality is weak and interagency support is thin, a narrow priority aperture produces exactly the pattern the inspector general documented: more flags than follow-through, even at the top of the risk hierarchy.

Implications: national security, deterrence, and credibility

Three consequences follow. First, national security risk management depends on shrinking the delta between flagged and investigated high‑risk leads. Eight arrests from more than 100,000 potential concern records is not a risk posture any security professional would defend without robust evidence that the rest were false leads or resolved by other means; the audit does not make that case.

Second, deterrence erodes when the probability of an in‑country compliance check is near zero. Overstay decisions are rational responses to incentives; if risk of contact is minimal, marginal violators become chronic ones. DHS’s own overstay reporting underscores that administrative penalties at reentry are meaningful, but they do not substitute for interior enforcement against those who stay and remain.

The new IG report on Alejandro Mayorkas's DHS is absolutely damning. Out of 3.1 million visa overstay leads, ICE arrested just eight people in four years. Even for the 1,769 so-called "Priority 1" public safety threats, ICE launched just 84 investigations and made two (2)… https://t.co/3qITnyTbww

— Blake Neff (@BlakeSNeff) October 6, 2026

What would fix the gap

Closing the enforcement delta requires more than rhetoric. The ingredients are well known to practitioners: higher-fidelity address and departure data integrated in near real time; automated de‑duplication and aging of leads to keep field queues current; expanded access to state and federal datasets that improve location certainty; and enough investigators to act on the riskiest cases quickly. Paired with a priority framework that truly reserves “non‑priority” for cases resolved by data, not by default, these steps would increase both the yield and the credibility of overstay enforcement.

Policy inevitably sets the aperture. But when an inspector general quantifies a multi‑million‑lead workload and a minuscule tail of investigations and arrests—especially inside the pool the government itself flags as higher risk—the burden of proof shifts to the system’s architects to show that their triage is calibrated to risk, not to capacity limits alone. That is the standard a serious country applies to a known vector of vulnerability.