Another day and another depressing headline and set of statistics as to the extent of losses due to fraud and error across Covid-19 response measures.  It’s easy to get blasé when such significant numbers are being bandied about but, as the Public Accounts Committee reports, the impact on taxpayers will be felt for decades to come. 

The sheer scale of the estimated loss of £15bn is eye-watering when you consider that this represents many, many thousands of fraudulent payments.  Although efforts are being made to recover money lost in error and to fraudsters, and we have seen some modest success stories, there will be many cases where recovery will be impossible, or the costs involved will be prohibitive.

I’m expecting there to be numerous public inquiries into how this happened but for me, there is one simple message, responding quickly to an emergency or crisis should not mean overriding or ignoring basic checks or controls.  My suspicion is that many payments made to fraudsters would not have happened had simple due diligence on the recipient been undertaken. 

Too often fraudsters capitalise on urgency (real or imagined) to allow them to circumvent controls that would otherwise have cut off their opportunity.  The email from the “CEO” requesting urgent payment to a previously unknown counterparty to take advantage of a “once in a lifetime” business opportunity is probably the best-known scam in this area.

So, what can organisations do to protect themselves? My view is that checks and controls are there for a reason – if the situation is urgent, then apply those checks and controls quickly, but if something does not seem right further investigation is vital.  The quality of professional scepticism is to be much admired – as a forensic accountant it’s a term I come across (and use) frequently – encouraging your colleagues to adopt a questioning mindset when presented with the urgent request may just save you from being part of another fraud statistic.