Scammers drain £100m from NHS over five years

Fraudsters have stolen more than £100m from the NHS in the past five years, exploiting weaknesses in IT systems to commit crimes ranging from stealing credit card data to hacking supplier emails, The Independent can reveal.

- HOWARD MUSTOE KATE DEVLIN

The scams have cost the NHS the equivalent of funding more than 2,000 senior nurses' salaries for a year or providing over 20,000 rounds of radiotherapy for cancer patients.

Experts warned that the “inexcusable” losses, revealed as part of an Independent investigation, were ones the already overstretched health service can “ill afford”, calling for the NHS to protect itself better against fraud. In total, the cost of fraud to the NHS in England was £101m in the five years to 2023/24.

As for individual trusts within the NHS, freedom of information requests show that University Hospitals Bristol and Weston NHS Foundation Trust lost £30,615 in a 2020 bank mandate fraud. The trust declined to say more, but often in these cases criminals intercept emails and impersonate a supplier to trick staff into transferring money into fraudulent accounts, the funds from which are then moved out of the UK.

Meanwhile, Hampshire Hospitals NHS Foundation Trust lost over £10,000 in 2021/22 after its credit card details were stolen and used for online purchases. The trust stated: “The details of a trust credit card were obtained by criminals and used to make inappropriate purchases online. This was investigated by the local counter-fraud specialist and police, but could not be pursued as the companies involved were based outside the UK.

“This was also reported to the bank, but the loss was identified too late to qualify for reimbursement. Two-factor authentication has since been enabled for some purchases, depending on the type of transaction, and monthly reconciliation checks are completed.”

While consumer rules put the onus on banks to reimburse individuals up to £85,000 for fraud, these regulations do not cover organisations such as NHS trusts, which are only able to recoup losses to fraud if the money is able to be recovered.