‘Fraud costs the NHS an estimated £1.21bn a year according to recent NHS Counter Fraud Authority estimations. Fraudsters continue to exploit opportunities by coming up with several novel ways to exploit the NHS.

Tackling fraud in the NHS needs to be high on everyone’s agenda, and everyone has a role to play in eradicating incidences of fraud in order to protect our NHS resource that supports vital front line clinical services.

This role is vital in driving this agenda forward and helping build and maintain a culture of vigilance and awareness across the Trust.’

Fair Processing Notice for National Fraud Initiative 2026/27 

Purpose

The Cabinet Office conducts data matching exercises to assist in the prevention and detection of fraud. This is one of the ways in which the Minister for the Cabinet Office takes responsibility within government for public sector efficiency and reform.

Data matching involves comparing sets of data, such as the payroll or benefits records of a body, against other records held by the same or another body to see how far they match. This is done as an automated process with no decisions made as part of that process. To ensure data accuracy and reduce duplicate results, the matching process may prioritise newer datasets provided through regular automated refreshes over existing records to ensure results are based on the latest available information. The data is usually personal information. The data matching allows potentially fraudulent claims and payments to be identified.

Where a match is found it may indicate that there is an inconsistency that requires further investigation. All bodies participating in the Cabinet Office’s data matching exercises receive a report of matches that they should investigate, so as to detect instances of fraud, over- or underpayments, and other errors, to take remedial action and update their records accordingly. No assumption can be made as to whether there is fraud, error, or other explanation until an investigation is carried out. This requires human intervention and decision-making.

The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under data protection legislation or the UK GDPR.

All bodies participating in the Cabinet Office’s data matching exercises receive a report of matches that they should investigate, so as to detect instances of fraud, over- or under-payments and other errors, to take remedial action and update their records accordingly.

Legal Basis of Processing

The legal basis for processing your personal data is that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (Article 6(1)(e) UK GDPR). In this case that is improving the effectiveness and accuracy of the prevention and detection of fraud.

The National Fraud Initiative is conducted using the data matching powers bestowed on the Minister for the Cabinet Office by Part 6 of the Local Audit and Accountability Act 2014 (LAAA).

Under the LAAA Legislation

The Cabinet Office may carry out data matching exercises for the purpose of assisting in the prevention and detection of fraud.

The Cabinet Office may require certain bodies (as set out in the Act) to provide data for data matching exercises.

Bodies may participate in its data matching exercises on a voluntary basis where the Cabinet Office considers it appropriate. Where they do so, the Act states that there is no breach of confidentiality and generally removes other restrictions in providing the data to the Cabinet Office. The requirements of the data protection legislation, however, continue to apply, so data cannot be voluntarily provided if to do so would be a breach of data protection legislation. In addition, sharing of patient data on a voluntary basis is prohibited.

The Cabinet Office may disclose the results of data matching exercises where this assists in the prevention and detection of fraud, including disclosure to bodies that have provided the data and to auditors that it appoints as well as in pursuance of a duty under an enactment.

The Cabinet Office may disclose both data provided for data matching and the results of data matching to the Auditor General for Wales, the Comptroller and Auditor General for Northern Ireland, the Auditor General for Scotland, the Accounts Commission for Scotland and Audit Scotland, for the purposes of preventing and detecting fraud.

Wrongful disclosure of data obtained for the purposes of data matching by any person is a criminal offence. A person found guilty of the offence is liable on summary conviction to a fine not exceeding level 5 on the standard scale.

The Cabinet Office may charge a fee to a body participating in a data matching exercise and must set a scale of fees for bodies required to participate.

The Cabinet Office must prepare and publish a https://www.gov.uk/government/publications/code-of-data-matching-practice-for-national-fraud-initiative. All bodies conducting or participating in its data matching exercises, including the Cabinet Office itself, must have regard to the Code.

The Cabinet Office may report publicly on its data matching activities.

Special category data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. The legal basis for processing your special category personal data is:

Article 9(g) UK GDPR: processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The Cabinet Office conducts data matching exercises to assist in the prevention and detection of fraud. The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014.

The Cabinet Office’s legal basis for processing your criminal convictions data is paragraphs 6 and 10 of schedule 1​ to the Data Protection Act 2018.

Recipients

Your personal data will be shared by us as necessary for the purposes of preventing and detecting fraud with:

  • The Auditor General for Wales
  • The Comptroller and Auditor General for Northern Ireland
  • The Auditor General for Scotland
  • The Accounts Commission for Scotland
  • Audit Scotland

And with mandatory participants who include:

  • District and county councils
  • London and metropolitan boroughs
  • Unitary authorities
  • Combined authorities
  • Police authorities
  • Fire and rescue authorities
  • Pension authorities
  • NHS Trusts
  • Foundation Trusts
  • Integrated Care Boards
  • Passenger transport authorities
  • Passenger transport executives
  • Waste authorities
  • Greater London Authority and its functional bodies.

In addition, the following bodies provide data to the Cabinet Office for matching on a voluntary basis, and so may also receive your data where it appears in a match.

  • Private sector pension schemes (various)
  • Metropolitan Police – Operation Amberhill
  • Special health authorities
  • Probation authorities
  • National park authorities
  • Central government pensions schemes
  • Insurance Fraud Bureau
  • UK Central government departments
  • Social security Scotland
  • Rent Smart Wales
  • Rent Smart Northern Ireland
  • Tenancy Deposit Protection Scheme
  • Other private organisations/companies

We will share records containing personal data with HMRC. These will be matched against HMRC records and additional HMRC information appended and fed back to the NFI. The HMRC matching will seek to identify persons at the address provided and relevant income-related information. Data matching services are then provided to the NFI by the Department for Work and Pensions, and by our IT Supplier using only UK Data Centres.

The data that is matched and the reasons for matching it

For information summarising the various match types for each particular type of participating organisation and the purpose of the matching please refer to the document NFI match types per participating body. We also provide the following services:

ReCheck

ReCheck is a flexible data matching service which complements the national exercise. This service allows NFI participant bodies to re-perform existing data matching, at a time that suits them, by uploading their organisation’s datasets for internal matching.

AppCheck

NFI participants can use this service at the point of application to check against NFI data to help verify people’s identity or if they have left out relevant information that might affect their entitlement to a benefit, service, or employment.

FraudHub

Allows NFI participant bodies, who want to work together, to regularly and effectively screen their collective data in order to prevent errors in processing payments and to reduce fraud. Data supplied via the NFI FraudHub may also be used to automatically refresh other NFI services, so that the most up-to-date information available is used to improve matching accuracy.

Code of Data Matching Practice

Data matching by the Cabinet Office is subject to a code of practice.

Further Information

View more information about the Cabinet Office data matching exercises. You can also read national reports on the NFI published by the Cabinet Office.

Your Rights

You have the right to:

  • Request information about how your personal data are processed, and to request a copy of that personal data
  • Request that any inaccuracies in your personal data are rectified without delay
  • Request that any incomplete personal data are completed, including by means of a supplementary statement
  • Request that your personal data are erased if there is no longer a justification for them to be processed.
  • In certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted
  • Object to the processing of your personal data

Where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller: You have the right to object to the processing of your personal data. This right does not apply where your data is disclosed to us under a legal obligation under Paragraph 2 of Schedule 9 of the Local Audit and Accountability Act 2014.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact Details

The data controller for your personal data is the Cabinet Office. The contact details for the data controller are:

Head of the NFI

1 Horse Guards Road

London

SW1A 2HQ

Email: nfiqueries@cabinetoffice.gov.uk

The contact details for the data controller’s Data Protection Officer (DPO) are:

Stephen Jones

DPO

Cabinet Office

70 Whitehall

London

SW1A 2AS

Email: dpo@cabinetoffice.gov.uk

Mersey Care NHS Foundation Trust has nominated its inaugural Counter Fraud Champion.

The new Counter Fraud Champion is Matthew Greene- Operational Finance Director   

image.png

 

‘Fraud costs the NHS an estimated £1.3 bn a year according to recent NHS Counter Fraud Authority estimations. Fraudsters continue to exploit opportunities by coming up with several novel ways to exploit the NHS.

Tackling fraud in the NHS needs to be high on everyone’s agenda, and everyone has a role to play in eradicating incidences of fraud in order to protect our NHS resource that supports vital front line clinical services. This role is vital in driving this agenda forward and helping build and maintain a culture of vigilance and awareness across the Trust.’       

The NHS Counter Fraud Authority (NHSCFA) has for a period of time advocated for NHS organisations to nominate new Counter Fraud Champions to join the NHS counter fraud community.  It is also a core requirement promoted by the UK Government’s Counter Fraud Function, which works across all Government departments and agencies.

Since nominations to the role of NHS Counter Fraud Champions opened in December 2019, they have received over 200 nominations and appointments so far.

The role and duties of the Counter Fraud Champion include:

  • promoting awareness of fraud, bribery and corruption within the Trust.
  • understanding the threat posed by fraud, bribery, and corruption.
  • understanding best practice on counter fraud; and,
  • committing to promoting a zero-tolerance approach to fraud within the Trust.

Responsibility for investigating allegations of fraud, bribery and corruption, as well as accountability for delivering the organisation’s annual anti-fraud plan, remain firmly with the nominated Anti-Fraud Specialist.

The Counter Fraud Champion will work closely with the Anti-Fraud Specialist to ensure that the Trust remains fully committed to the maintenance of a counter-fraud, bribery and corruption culture, preventing and deterring it wherever possible, and holding to account those who are found to have committed offences, by pursuing the full range of available sanctions against them. 

For more information on how the Counter Fraud Champion and the Anti-Fraud Specialist will work together, please refer to the Anti-Fraud Specialist and Counter Fraud Champion Liaison and Joint Working Protocol.

Staff should still report any concerns of fraud, bribery and corruption to either the Anti-Fraud Specialist or the national Fraud and Corruption Reporting Line on 0800 028 40 60 (online at https://cfa.nhs.uk/reportfraud).

Mersey Care’s Anti-Fraud Specialist

Claire Smallman

0776 9304145

Claire.smallman@miaa.nhs.uk or clairesmallman@nhs.net  

 

Mersey Care Counter Fraud Champion

Matthew Greene – Operational Finance Director   

07557 498 798

matthew.greene@merseycare.nhs.uk

For more information on the role of the Counter Fraud Champion, please visit the NHSCFA website at  https://cfa.nhs.uk/fraud-prevention/NHS-counter-fraud-champion

Given the concerns raised in the recent NHSCFA Learning Report (‘Operation Falkirk’), the rise in the number of fraud referrals in relation to dual working fraud / frauds involving secondary roles / flexible working, and the most common NHS staff fraud remaining to be working whilst sick, MIAA has designed a suite of materials to assist NHS organisations in countering these fraud risks.

2026

2025

  • May 2025 - fraudsters asking to divert to Whatsapp
  • May 2025 - social media and email account hacking
  • May 2025 - extortion phishing emails
  • March 2025 - fake messages on WhatsApp

2024

2023

2022

2021

Mandate fraud occurs when someone contacts an NHS organisation with a request to change a direct debit, standing order or bank transfer mandate, by purporting to be from a genuine supplier that regular payments are made to.

If the organisation accepts the fraudulent request, the payments are then diverted into the criminal's bank account. The genuine supplier details are usually obtained from a range of sources including corrupt staff, publicly announced contracts and online logs of supplier contracts.

False exemption claims: This is when patients declare that they are exempt from paying for prescriptions when they aren't

Overseas Visitors: This is when individuals visit this country specifically to gain free treatment from the NHS which they are not entitled to receive.

Contractors and Suppliers: Includes the submission of bogus invoices and fraudulent claims by appliance contractors.

Timesheet fraud: Staff members (permanent, bank or agency) createfalse overtime claims or add hours onto their timesheets to say that they have worked whenthey actually haven't.

Working whilst sick: This is when individuals state they are unfitfor work and then work somewhere else.

Travel/expenses fraud: Staff create false mileage/ travel/expensesclaims or inflate claims in order to obtain extra money from the Trust that they are notentitled to.

Failing to declare convictions: This is when staff do not declareconvictions when obtaining employment in the NHS or fail to tell us about them if they areconvicted whilst working for the Trust.

False qualifications / professional registration: This is when peopleclaim to possess qualifications they have not obtained or state that they are members of aprofessional body when they are not

The NHS Counter Fraud Authority (NHSCFA) has for a period of time advocated for NHS organisations to nominate new Counter Fraud Champions to join the NHS counter fraud community. It is also a core requirement promoted by the UK Government’s Counter Fraud Function, which works across all Government departments and agencies.

Since nominations to the role of NHS Counter Fraud Champions opened in December 2019, they have received over 200 nominations and appointments so far.

The role and duties of the Counter Fraud Champion include:

  • promoting awareness of fraud, bribery and corruption within the Trust
  • understanding the threat posed by fraud, bribery, and corruption
  • understanding best practice on counter fraud
  • committing to promoting a zero tolerance approach to fraud within the Trust.

Responsibility for investigating allegations of fraud, bribery and corruption, as well as accountability for delivering the organisation’s annual anti fraud plan, remain firmly with the nominated anti fraud specialist.

The Counter Fraud Champion will work closely with the Anti-Fraud Specialist to ensure that the Trust remains fully committed to the maintenance of a counter fraud, bribery and corruption culture, preventing and deterring it wherever possible, and holding to account those who are found to have committed offences, by pursuing the full range of available sanctions against them.

Staff should still report any concerns of fraud, bribery and corruption to either the Anti-Fraud Specialist or the national Fraud and Corruption Reporting Line on 0800 028 40 60 or online.

On a basic level, fraud is deception carried out for personal gain, usually for money. Fraud can also involve the abuse of a position of trust. By 'NHS fraud' we mean any fraud where the NHS is the victim.

For example, imagine if you work for an NHS organisation and make false claims for travel expenses. Your role involves frequent travel by car and each month you submit a form detailing your expenses, which the organisation then pays into your account. One day you decide to start inflating your expenses, claiming for more miles than you actually travelled in order to get more money.

This is an example of fraud (specifically, fraud by false representation) as you are tricking your employer into believing you incurred higher expenses than you actually did, in order to make a financial gain.

The vast majority of those who use, work in or otherwise interact with the NHS are honest. However, the small minority who commit fraud against the NHS includes a wide range of people,from patients and members of the public to NHS staff, from contractors and suppliers to organised crime groups.

When fraudsters target the NHS and succeed, this results in a loss of resources intended for patient care. We all bear the cost when the NHS loses money to fraud.

Bribery or corruption involves offering, promising or giving a payment or benefit-in-kind in orderto influence others to use their position in an improper way to gain an advantage.

If you suspect fraud, bribery or corruption - you MUST report it.

All NHS staff have responsibility to help prevent fraud by:

  • Declaring any secondary employment/private work undertaken to your manager

  • Declaring any outside Interests which could be seen to compromise your judgment, decisions or duties

  • Declaring any potential conflicts of interest - you are required to inform the Trust if you, your spouse, partner, relative, close friend or associate has an interest that may or does conflict with the business of the Trust

  • Declaring any gifts, hospitality or sponsorship. Be alert to when a gift, hospitality, or sponsorship could be interpreted as a 'bribe'

  • Ensuring timesheets/payments/mileage claims should be checked and accurate

  • Abiding by the Trust/NHS Code of Conduct

  • Reporting all suspicions or concerns of fraud, bribery or corruption.

Everyday £250,000 is lost an hour due to fraud in the NHS - the same as the cost for a fully kitted out ambulance!

That equates to around £2billion every year lost to fraud. Help us combat fraud and put money back into patient care. 

If you suspect fraud, bribery or corruption - report it immediately here.

clairesmall.jpgClaire Smallman, Anti Fraud Specialist

Claire is the Senior Anti Fraud and Investigations Manager of MIAA anti fraud services.

Claire is responsible for the oversight of all fraud, bribery and corruption investigations for MIAA client base.

Email: clairesmallman@nhs.net or claire.smallman@miaa.nhs.uk

Tel: 07769 304 145

Counter Fraud Champion

Matthew Greene – Operational Finance Director   

Email: matthew.greene@merseycare.nhs.uk

 

Tel: 07557 498 798

Fraud is the most common crime in England and Wales, accounting for approximately 41 per cent of all crime against individuals, the UK government and police are running the "Stop! Think Fraud" campaign to combat fraud.

Fraudsters aren’t fussy. They’ll pick on anyone. Nobody is immune from fraud. The criminals behind it target people online and, in their homes, often emotionally manipulating their victims before they steal money or personal data.

But there is something we can do, by staying vigilant and always taking a moment to stop, think and check whenever we’re approached, we can help to protect ourselves and each other from fraud.

Report fraud now
Mersey Care's Director of Finance Bribery Statement
National Fraud Initiative (NFI) 2025/26
Chief Executive Officer Statement

Useful videos

Fraud in the NHS video

Working whilst off sick video

Cyber awareness video