Tackling Invoice Fraud in the NHS

This fraudulent scheme tries to divert NHS funds from legitimate suppliers by providing bank account information belonging to criminals. If requests to change bank details are not carefully verified, payments for services provided by trusted suppliers can be unknowingly paid into fraudsters’ accounts, who then launder the money.

NHS Protect, the national body that leads on tackling crime against the NHS, has alerted all NHS trusts to this type of fraud and the steps that can be taken to prevent it. Intelligence gathered and analysed by NHS Protect puts potential NHS losses from invoicing fraud at £9.8 million. NHS Protect’s intelligence bulletin process, which alerts NHS organisations to current fraud trends, led to more than half of attempts being prevented in the last financial year. Following work by law enforcement agencies, including NHS Protect, £3.6 million has been restrained and is in the process of being returned to the correct bank accounts. However, £2.8 million is believed to have been diverted and lost to criminals’ bank accounts.

NHS Protect gives advice on how trusts can prevent themselves from falling victim to this type of fraud, and what action to take if they do. Since May 2011, NHS Protect has sent three alerts to trusts through the national network of NHS Local Counter Fraud Specialists (LCFSs). There are around 300 LCFSs throughout the country who report to their local NHS organisation’s finance director. They are professionally trained and accredited by NHS Protect.

NHS Protect’s National Investigation Service (NIS) leads investigations into serious, organised and/or complex financial risks and losses including fraud, bribery and corruption.

A targeted trust speaks
The finance director of an NHS trust in England describes what happened to them and what they have learned for the future.

“In November 2011, the shared services provider who deals with our financial services received a fax, appearing to come from a construction company who had a contract with us to build a £6 million unit. We believe the criminals obtained their information from material available publicly, such as our publicised invoices over £10,000 and press releases about the new building work.

“The genuine contractor had done nothing wrong. The criminals had managed to open a bank account using the company name and somehow making it sound like an individual. They instructed our provider to change the bank details to theirs. Early in December 2011, our estates department agreed an £897K interim payment to the contractor. When this payment was released, that money went straight to the criminals’ bank account.

“On big money schemes, it is usual to send large amounts of money in several payments. The criminals just had to await the next payment to hit their account. Luckily for us, the fraud was spotted quickly. The contractor called the shared services provider on the day payment was due to ask where the money was. None of us at the trust knew that the bank details had been changed.

Getting NHS money back
“After receiving the call from the supplier, our shared services provider contacted NHS Protect, who has contacts with banks and knew exactly what to do. The money had already left the account by the time the recipient’s bank was informed. The criminals had withdrawn it straight away.

“Fortunately, the bank managed to trace some of the funds into overseas banks and £537K of the £897K was returned to us a few days later. That was thanks to NHS Protect and the bank. Even when this has happened, prompt action can get money back.

The after effects
“We lost a lot of money. We felt we had let the public down. Most of all, we were embarrassed at falling for it. This was money for patient care, stolen by criminals. The worry and anguish over it was huge. We asked ourselves a lot of questions: Why did we miss this weakness in the system? Why did the shared services provider miss things? Why was that fax trusted? But we are relieved that, thanks to NHS Protect, so much money has been recovered.

“But we have to learn from it. All of us do. The shared services provider has more than 10,000 suppliers and 17 NHS customers. It could have happened to any one of those organisations at any time. We have since adopted NHS Protect’s guidance and improved our systems.   

“I can’t stress enough times how important it is for NHS organisations to take notice of alerts sent by NHS Protect – including guidance on the best way to check and process any ‘change of bank details’ requests. It is not until it happens that you wish you’d taken notice of that alert. Don’t be the next victim.

“Never just accept a phone call, email or fax asking you to change a supplier’s payment details. Always ensure the old bank account details are provided as well. What’s the worst that could happen if you pay the old bank account? A genuine supplier won’t mind providing the relevant information in hard copy and will probably be glad that you are being careful.”

Case example
In February 2011, Romario Gordon used forged documents to divert over £250,000 from a London NHS trust to his bank account. NHS Protect was alerted and the account was frozen while investigators established it belonged to Wise Owl Cleaning Services Limited. Gordon, the only authorised signatory, confirmed that the account was his company’s and that he was sole director. The hole in the story was that the trust concerned had never awarded any contracts to Wise Owl Cleaning Services.    

Gordon spent some of the money on luxuries such as a Porsche Cayman and a holiday to the Caribbean. Following an NHS Protect investigation, he pleaded guilty to two offences of money laundering and was sentenced to 18 months’ imprisonment.

Proceeds of Crime Act (POCA)
NHS Protect used powers under the Proceeds of Crime Act 2002 to seize Gordon’s Porsche along with other assets bought with NHS money including a laptop, phones and jewellery. Over £135,000 was handed back to the trust and financial recovery on other seized items continues.

Powers under POCA allow goods and property obtained illegally to be recovered. NHS Protect employs a team of POCA-accredited financial investigators specialising in this work. This ensures maximum financial return to the NHS.

For more information
Tel: 0800 028 40 60
www.nhsbsa.nhs.uk/Protect.aspx