How a Medical Practice Found a Two-Year Vendor Payment Scheme in Its Own Books

How a Medical Practice Found a Two-Year Vendor Payment Scheme in Its Own Books

This case study is an illustrative, anonymized composite based on patterns common in small-practice forensic work. It is not a description of a specific client engagement or any real person, and no outcome described here is promised or guaranteed.

Vendor fraud in medical practice books does not look like theft. That is the entire design.

The practice in this example was a four-provider specialty group with about twenty staff. One office manager had run the business side for six years. She opened the mail, entered the bills, cut the payments, and reconciled the accounts, because that is what happens when a clinical owner delegates the finance function to the one person who seems to enjoy it.

The payments in question averaged $1,840. They went out monthly. They were coded to medical supplies, which is a real category with real volume, and they sat inside a line item the owner glanced at and considered normal.

Over twenty-six months, they totaled just over $47,000.

Why It Stayed Invisible

Nothing about it looked wrong at the level the owner was looking.

The amounts were deliberately below his mental review threshold. He questioned five-figure items. He did not question a recurring four-figure supply payment, because supply payments are recurring four-figure items.

The vendor name was plausible. Not "ACME LLC," but something that read like the medical supply distributors already in the system, differing by a word.

And the payments were consistent. Fraud that spikes gets noticed. Fraud on a schedule becomes part of the baseline, and after four or five months it stops being new information and starts being the run rate.

The Tell

It surfaced during an unrelated project. The practice was preparing for an equipment loan and someone was cleaning up the vendor master file so the financials would present properly.

Three things did not line up on one vendor. There was no contract on file. There was no Form W-9, which meant no taxpayer identification number, which meant no 1099 had ever been issued. And the remittance address matched an address in the employee records.

Any one of those is a paperwork gap. All three on the same vendor is a pattern.

That is the honest version of how these are found. Not by a monthly control catching it in real time, but by someone doing adjacent work who notices that a file is empty.

The Sequence That Followed

Order matters enormously here, and the instinct to confront someone immediately is the wrong one.

Preserve first. Before anyone was asked anything, access was documented and records were secured, including the accounting file history, bank images, and email. Changing permissions or confronting a person first is how evidence disappears and how an employment claim gets stronger.

Reconstruct the vendor master. Every vendor paid in the period was listed against three tests: does a contract exist, is there a W-9 with a valid TIN, and does the remittance address appear anywhere in the employee or payroll records. That exercise found the scheme and, incidentally, four legitimate vendors with missing W-9s that were their own compliance problem.

Quantify before acting. The full amount was calculated across the entire period, not estimated from a sample, because the number drives the insurance claim, any recovery attempt, and the tax treatment. A partial number invites a partial resolution.

Bring in counsel before anyone is confronted. Employment law, potential criminal referral, and the practice's own notification obligations are legal questions, not accounting ones. This is where the accountant's job stops.

The Controls That Would Have Caught It in Month Two

None of these require a bigger team, which is the part practice owners find surprising.

Vendor setup separated from payment. One person can enter a new vendor or approve a payment, not both. In a small office, the owner approves new vendors himself. It takes four minutes a month.

No W-9, no payment. A hard rule at onboarding, not a January chase. This scheme could not have started, because the fake vendor could not have produced one.

Owner opens the bank statement. Unopened and unforwarded, straight from the bank or the online portal with the owner's own credentials. Whoever reconciles should not be the first person to see the statement.

A new-vendor report every month. A single list of vendors added in the last thirty days, reviewed by the owner. Most months it is empty and takes ten seconds.

Address matching once a year. Compare vendor remittance addresses against the employee address file. It is a spreadsheet formula, and it is the specific test that would have flagged this one on day one.

What It Did Not Fix

The uncomfortable part, and the reason this section exists.

Recovery was partial. Employee dishonesty coverage existed but carried a limit and a deductible well below what a full loss would require, and the practice had never revisited the limit since the policy was written. Personal recovery from an individual who has spent the money is usually theoretical.

The tax treatment was not the relief the owner expected. The payments had been deducted as supply expense, so the deduction was already taken, which means there was no additional loss to claim on the amounts already run through the books. Amended returns were considered and largely produced administrative work rather than money.

The practice absorbed most of it. That is the ordinary outcome. The value of the forensic work was a defensible number, a controls environment that would not permit a repeat, and a clean file for the lender, not a check that made the practice whole.

And there was a cost that does not appear in any of those numbers. Twenty people found out that the practice's books had been open for two years, and rebuilding that took longer than rebuilding the vendor file.

Who Does This Kind of Work

The useful profile is a firm that does both sides: the monthly accounting that establishes what normal looks like, and the forensic work when normal turns out to have been wrong.

Red Bike Advisors is a Wilmington, North Carolina firm founded in 2009, now six people, listed on Sam's List as both a bookkeeper and an accountant and serving clients nationwide. Its stated services include monthly accounting and bookkeeping, tax strategy and filing, business advisory, tax resolution, and fraud and forensic investigative work, with a specific focus on small business and medical practice owners.

The practice focus is the relevant part. A firm that works with practice owners already knows the structural problem, which is that clinical owners are the most delegating owners in small business and their offices are usually one person deep on the finance side.

The limits are worth stating. The firm publishes a $500,000 revenue minimum, so it is aimed at established practices. Forensic work is expensive relative to the amounts typically recovered, and it is commissioned for the answer and the controls rather than for restitution. And no accounting firm can advise on employment or criminal matters, which is a separate professional and a separate bill.

For the preventive version of this, see 7 Internal Controls a 10-Person Business Can Actually Run, or compare firms in the Sam's List accountant directory.

Frequently Asked Questions

What is a fake vendor scheme? It is a payment fraud in which someone with access to accounts payable creates a vendor record that does not correspond to a real supplier, then approves and pays invoices to it. The payments are usually recurring, coded to an active expense account, and sized below the level at which the owner reviews individual items.

What is the fastest test for it in a small practice? Compare vendor remittance addresses and bank details against the employee and payroll address file, and flag any vendor without a signed contract or a Form W-9 on file. Both are spreadsheet exercises that take under an hour and catch the most common versions of this scheme.

Can a practice with only one administrative person separate duties? Partly, and the missing piece is usually the owner rather than another employee. The owner approving new vendors, opening the bank statement directly, and reviewing a monthly new-vendor report restores the essential separation without adding headcount. It costs a few minutes a month.

Can we deduct the loss from employee theft? It depends on whether the amounts were already deducted. Where fraudulent payments were recorded and deducted as ordinary business expense, the deduction has generally already been taken, so there may be no additional loss to claim. The treatment depends on the specific facts and the years involved, and should be reviewed with a tax professional.

---

About the author: Kimberly Green is the cofounder of Sam's List, where business owners and high earners find vetted CPAs, financial advisors, and fractional CFOs. She's met one-on-one with 400+ financial professionals and writes from the real data behind thousands of client-advisor matches. Ask her anything about finding an accountant - she's heard it all, including the questions people are afraid to ask.