Authors: Dr Anu Watson and Dr Cerian Griffiths
Context
The Covid-19 pandemic placed the public sector under unprecedented pressure. The urgency of the response, and the scale of spending it demanded, created fertile conditions for fraud (BBC, 2025). PPE procurement, business support schemes, and individual financial support packages were all targeted, resulting in losses of £10.9 billion, of which only £1.8 billion has been recovered. Most of that money is now beyond recovery, with the taxpayer bearing the cost (Financial Times, 2025).
At the end of 2024, Sir Tom Hayhoe was appointed as the Covid Counter Fraud Commissioner to conduct an independent review of what went wrong, what has been recovered, and what must change. The resulting report, published in December 2025, received some media coverage at the time of publication (The Guardian, 2025) but the broader public debate it deserves has been notably muted. This is somewhat surprising given the scale of public monies lost.
This SCAN blog reflects on the report’s key findings, offers some critical observations, and explores how its lessons connect directly to the work of the SCAN project, which is focused on strengthening counter fraud across the NHS in England.
Where Did Things Go Wrong?
The report examines fraud against UK government spending related to Covid-19. The report critically appraises performance and recovery of funds lost in relation to PPE procurement and schemes launched during Covid-19 to support businesses and individuals, and is underpinned by a review of evidence and engagement with relevant government departments and key stakeholders.
The report identifies four key lessons, each linked to a set of recommendations (nine in total). Together, they paint a clear picture of systemic failure.
The first and most fundamental lesson is that fraud prevention was insufficiently embedded in government thinking and practice before the pandemic struck. Fraud ultimately requires someone willing to commit it, but it also requires opportunity, and the pandemic created such opportunity in abundance. When the crisis hit and money moved fast, the controls simply were not there. There was inadequate consideration of fraud risk at the design stage of emergency schemes, limited up-front investment in recovery mechanisms, and insufficient scrutiny of decision-making.
The second lesson follows directly: robust challenge mechanisms must be built into crisis decision-making. Speed and urgency cannot justify bypassing proper scrutiny. The third lesson concerns the dangerous assumption made by decision-makers that all organisations involved in distributing public funds shared the same commitment, capacity, and capability for counter fraud. They did not. Significant variance existed across the landscape, and that unevenness had real consequences.
The fourth lesson addresses data sharing and scrutiny as the foundations of sound decision-making. The report recommends that the Public Sector Fraud Authority (PSFA) undertake dedicated work on data sharing, and that HM Treasury establish a scrutiny panel to review progress bi-annually.
For the health sector specifically, the report highlights the scale of the PPE procurement challenge. Over-purchasing, intense pace, and lack of transparency amplified fraud risk and undermined public trust. However, the Department of Health and Social Care (DHSC) ultimately responded effectively, with cross-government collaboration playing a key role. The report also points to HMRC as an example of good practice, deploying targeted methods matched to the specific features of individual schemes. While not all the report’s lessons relate directly to the health sector, the transferable learning from departments such as HMRC is nonetheless highly relevant given the scale of fraud, both Covid-19 related and otherwise, within the NHS.
What This Means for NHS Counter Fraud: Echoes in the SCAN Findings
These findings are not unique to the pandemic. The SCAN project, examining NHS and wider health sector counter fraud through policy analysis and stakeholder engagement, is uncovering a remarkably similar picture within the health sector.
The fragmentation the Commissioner identifies across government, in accountability, capacity, resourcing, and culture, mirrors what SCAN is finding within the NHS and the wider health sector. Counter fraud efforts are inconsistent across the system, with significant variation in organisational buy-in and in the practical resources available to those responsible for tackling fraud.
In particular, the third lesson of the Report around the dangerous assumption of shared capability is highly resonant with SCAN interim findings. Previous pilot research by the SCAN team found that NHS counter fraud takes place within a complex landscape of organisations and powers, creating conditions for inefficiency (Griffiths et. al. 2024).
These findings are consistent with wider work on policing fraud and economic crime, including research on harnessing private and not-for-profit sector capacity in the fight against economic crime (Goldstraw-White, et al. 2024). The pandemic did not create these systemic weaknesses, it amplified them. The challenges of fragmentation, under-resourcing, and insufficient embeddedness of fraud prevention are longstanding features of the public sector counter fraud landscape. Addressing them is not only a post-Covid imperative, it is a business-as-usual requirement.
With regard to the Report’s fourth lesson on data sharing, although progress has been made through the NHSCFA’s Project Athena in developing data analytics capability, substantial barriers to data sharing persist — directly echoing one of the report’s central concerns.
What Has Already Been Done?
The report is not solely retrospective. Several of its proposals are already being acted upon. The Covid Voluntary Repayment Scheme, the Covid Fraud Reporting Site (CFRS), and the Covid Fraud Recovery Retention Scheme, which incentivises organisations to pursue recovery, are all in place. The report takes a clear position: recovery and enforcement must continue until completion.
More structurally significant is the establishment of the PSFA in 2022, designed to strengthen counter fraud capacity across government. The PSFA is now required to produce an action plan for more joined-up cross-government working. The Public Authorities (Fraud, Error and Recovery) Bill (PAFER) introduces new investigative and recovery powers and extends the timeframe for action against Covid-19 fraud. There is also a commitment from the Chancellor of the Exchequer for a new Public Authorities Fraud Investigations and Enforcement Service to build capacity. The Commissioner further recommends that any future crisis economic schemes be tested through preparedness exercises, a logical and overdue step.
The Gap Between Recommendation and Action
The report is admirably forward-looking. It avoids finger-pointing, adopts a collaborative tone, and grounds its recommendations in practical learning. That is the right approach: lasting change in counter fraud requires buy-in across sectors, organisations, and levels of government.
However, the Commissioner himself acknowledges, with evident frustration, that the gap between recommendation and action is a familiar problem. He retains hope that this time will be different. That hope is understandable. But hope is not a framework and this is where the report ideally would have gone further to introduce some evaluation of responses to the report. There needs to be systematic, critical appraisal of whether recommendations have been implemented and whether they have produced the intended outcomes, and this receives very limited attention. One recommendation touches on scrutiny, proposing a bi-annual HM Treasury panel over two years. But monitoring progress is not the same as evaluating impact, and no clear evaluation requirement or framework is set out. This concern is not without precedent: the Health Services Safety Investigations Body (HSSIB) highlighted in 2024 the persistent problem of recommendations without follow-through action in healthcare, a pattern the Covid-19 Fraud report risks reproducing if evaluation is not built in.
The report does reference the Green Book (HM Treasury, 2026) the UK government’s guidance on appraising the costs, benefits and risks of different policy options, and recommends that HM Treasury amend it to better account for the risk of fraud and error in appraisal. However, the Magenta Book (2026), which provides central government guidance specifically on evaluating policies, programmes, and the recommendations of independent reviews, is not referenced or applied. The Magenta Book is explicit: evaluation should not be an afterthought, it should be designed in from the start. Given that a central aim of this independent review is to prevent the errors that produced £10.9 billion in losses from being repeated, this is a meaningful omission.
An accompanying evaluation framework, requiring organisations across government to critically assess delivery against their action plans, would strengthen the report’s legacy considerably. The PSFA’s forthcoming action plan on cross-government joint working is a prime example: it should include built-in evaluation with clear data collection requirements and defined success criteria. Without this, there is a genuine risk that the lessons identified here join a long list of well-articulated recommendations that generated limited sustained change.
Conclusion: Change Is Hard, But Not Impossible
The Covid-19 Fraud Commissioner’s report is a valuable and necessary piece of work. Its findings on embedding fraud prevention in systems and processes, building shared capability, enabling data sharing, and challenging decisions under pressure are not only lessons from a crisis. They are the foundations of effective counter fraud in normal times too.
For the SCAN project, the resonance is clear. The challenges the report identifies at a cross-government level are visible within the NHS and cross the wider health sector in the fragmentation of accountability, the unevenness of capacity, and the barriers to the kind of data-driven, collaborative counter fraud response that measures such as Project Athena is beginning to make possible. SCAN’s ongoing work is directly oriented towards addressing these gaps, and the Commissioner’s findings provide important external validation of why that work matters.
The question now is not whether these lessons are correct. It is whether the structures, frameworks, and political will exist to act on them. A robust evaluation requirement, perhaps drawing on the Magenta Book framework that already exists for this purpose, would be a meaningful first step in providing the public with genuine assurance that the recommendations will stick. A systematic evaluation would also contribute, alongside studies such as SCAN, to the currently very limited body of evidence on effective counter fraud in the public sector, evidence that, without such a framework, risks simply not being captured.
This project is funded by the NIHR Health and Social Care Delivery Research programme (NIHR159714). The views expressed are those of the author(s) and not necessarily those of the NIHR or the Department of Health and Social Care.
Bibliography:
Goldstraw-Wright J, Gill M, Button M (2024) Enhancing police resources in the fight against economic crime cost effectively: harnessing the potential of the private and not-for-profit sectors. Report for the Dawes Trust. Perpetuity Research and Consultancy International Ltd. https://perpetuityresearch.com/wp-content/uploads/2024/09/Enhancing-Police-Resources-Sept-2024.pdf
Griffiths, C., Doig, A., Harvey, J., Benson, K., & Lord, N. (2024). New development: From blanket coverage to patchwork quilt — rethinking organizational responses to fraud in the National Health Service in England. Public Money & Management, 44(3), 271–275. https://doi.org/10.1080/09540962.2023.2270175
HM Treasury, The Green Book (2026). https://assets.publishing.service.gov.uk/media/698dbcd17da91680ad7f4308/The_Green_Book_2026.pdf
HM Treasury, The Magenta Book. (2026) https://assets.publishing.service.gov.uk/media/5e96cab9d3bf7f412b2264b1/HMT_Magenta_Book.pdf
HSSIB. Recommendations but no action: improving the effectiveness of quality and safety recommendations in healthcare. Poole: Health Services Safety Investigations Body, 2024.
https://www.bbc.co.uk/news/articles/c075vjxyx3no
https://www.globalbankingandfinance.com/britain-economy-coronavirus-zero
https://www.theguardian.com/business/2025/dec/09/uk-fraud-prevention-covid-scams-commissioner