Fraud without a breach: The emerging risk in digital Government programs

When the system works and fraud still occurs

For years, cybersecurity conversations in government have been framed around a familiar threat, the attacker trying to break in.

But some of the most interesting fraud cases emerging internationally suggest a different challenge may be taking shape and one that doesn’t involve hacking systems at all.

In these cases, the system works exactly as designed. The problem is what people do within it.

A different kind of fraud: Legitimacy without authenticity

Recent investigations in the United States into childcare subsidy programs offer one example. Authorities alleged that individuals claimed government payments for childcare services that were never delivered, using falsified enrolment records and inaccurate attendance reporting. The claims flowed through the federal program that distributes billions of dollars each year to help families access childcare services.

At first glance, nothing appeared technically compromised. Providers were registered in the system. Claims were submitted through legitimate digital portals. Payments were processed through government infrastructure exactly as designed.

The issue was not a breach, it was that the activity being claimed was not genuine.

Distributed digital ecosystems and the visibility gap

Cases like this are increasingly drawing attention because they reflect how many public services are now delivered.

Government service delivery has shifted from internally operated systems with direct oversight to multi-provider digital ecosystems where accountability is distributed across layers of contractors, managed service providers, cloud vendors, and subcontractors.

Each layer introduces credentialed users, data flows, and decision logic that sit outside the government’s direct visibility and audit reach. The fraud risks are specific, well-documented, and in several Australian cases already running into the billions.

Why scale changes the nature of risk

In Australia, for example, programs such as the NDIS rely on a broad network of providers submitting claims through digital systems. Similar models exist in childcare subsidies and Medicare provider billing.

These systems have clear benefits. They increase flexibility, expand access to services and allow governments to scale programs that would otherwise be difficult to administer centrally.

But they also change the nature of fraud risk.

Digital platforms that process invoices and service claims can be manipulated by providers who inflate volumes, fabricate deliverables, or submit duplicates. The automation that makes these platforms efficient also buries fraudulent transactions in legitimate volume.

In platform-style service systems, fraud can occur more quietly. Once a provider is registered and able to submit claims, transactions can flow automatically through legitimate processes. The system processes them exactly as intended.

The critical question becomes whether the underlying activity genuinely occurred.

The NDIS as a case study in systemic exposure

The NDIS is the most significant current example. The Australian Criminal Intelligence Commission estimates up to $6 billion may be misused within the scheme, including by organised crime syndicates.

Providers submit claims through digital portals with minimal pre-payment verification. Fraud methods include billing for services never delivered (including to participants who were incarcerated), creating fake participants with fabricated medical reports, and using 50+ separate ABNs to conceal claiming patterns. Operation Pegasus netted $5.8 million across three companies (three people jailed, police seized 8 kg of gold bullion). Operation Banksia is investigating $40 million in alleged fraud across Western Sydney and Adelaide.

The government responded with a $468.7 million integrity package in the 2024-25 budget and a 23-agency Fraud Fusion Taskforce. Over 2,100 providers now require manual review of every claim. The Commonwealth Fraud Control Framework sets the expectations, but enforcement across a distributed provider base at this scale is structurally difficult.

Why traditional controls strain at scale

This is a major reason fraud has become such a complex and expensive problem for governments globally. Managing it often requires layers of compliance, auditing and investigation that can slow down service delivery and increase administrative costs for both governments and providers The same resource constraints that drive outsourcing also leave contract oversight, security monitoring, and forensic auditing under-resourced. Governments outsource because they lack in-house technical capacity, then lack the capacity to oversee what they’ve outsourced.

The challenge is finding ways to maintain program integrity without undermining the accessibility and flexibility that these systems were designed to achieve.

Where fraud management meets cybersecurity

Increasingly, the answer lies in capabilities that sit at the intersection of fraud management and cybersecurity.

Tools such as identity assurance, transaction monitoring and behavioural analytics long used in cybercrime detection are becoming central to how governments monitor large digital service ecosystems.

Julie Gleeson, a fraud and identity specialist, says significant risk now come from providers who are inside the tent:

“The threat has shifted from breaking in to billing out. Trusted providers with legitimate access are now one of the highest-impact integrity risks in these programs, because the transactions look entirely normal on the surface. Detecting that kind of fraud takes identity assurance and behavioural analytics, not stronger perimeters.”

Designing integrity into digital programs

Rather than relying solely on traditional compliance measures, many governments are starting to rethink program design itself.

“Across the cases I have worked on, from small opportunistic schemes to coordinated syndicates moving tens of millions, the common thread is how deliberately these actors study processes to fund where they can extract value. Designing integrity into these programs means anticipating that behaviour from the start, and building identity assurance, behavioural monitoring and cross-agency data sharing in as core features rather than adding them after losses surface”, says Rita Gatt, a fraud, security and tech expert.

A major consideration is stronger identity assurance. This includes at the point providers enter the system. Ensuring that organisations registering to deliver services are genuine and remain compliant over time can significantly reduce opportunities for misuse. But it also extends to ongoing controls that manage credential misuse. Moving towards zero-trust architectures that verify identity and access on every interaction regardless of organisational affiliation, and automated access reviews that flag dormant or over-provisioned accounts across provider boundaries offer strong fraud mitigation.

Another is using data to detect anomalies earlier. Patterns such as unusual claiming behaviour, abnormal transaction volumes or providers operating outside expected service patterns can often provide early indicators that something may not be right. To be effective, this pattern detection needs to rely upon continuous transaction monitoring tuned to provider-specific patterns rather than periodic audits against aggregate thresholds.

Finally, there is increasing recognition that fraud intelligence needs to be shared across sectors. This is a systemic issue driven by our era of technical complexity and interconnectivity, married with an ever-increasing proliferation of data. Financial institutions, regulators and government agencies often see different fragments of suspicious activity. Connecting those insights can dramatically improve detection.

Beyond intrusions: Protecting trust in Digital Government

None of this suggests that large digital service ecosystems are inherently flawed. In many ways they represent a significant advance in how governments deliver support to citizens.

But the US childcare and our own NDIS investigations offer a useful reminder: as public services become more digital and more distributed, the nature of fraud risk evolves alongside them.

Protecting systems from intrusion will always remain essential.

Ensuring that the identities, providers and transactions operating within those systems reflect genuine activity may prove just as important.