Part 4: linking fraud and reform.

The fraud number that raises the biggest integrity question

Part four of a seven-part series on the 22 April NDIS reform announcement and what it is asking of providers. This version draws on the JCPAA hearing of 23 April 2026, the Fraud Fusion Taskforce conviction record to March 2026, and the financial misalignment between the reform target and the mechanisms available to deliver it. Published on the day of the 12 May 2026 federal budget.

Why this piece, now

Tonight the Treasurer will hand down the budget. The NDIS will appear in it. So will a fraud number.

The fraud number will be doing work in the budget that it cannot do on the evidence.

Three weeks ago, and only 24 hours apart, the Government hosted two pivotal NDIS architecture conversations. On 22 April 2026, at the National Press Club, Minister Butler announced a comprehensive reset of the scheme. The growth target was set at 2 per cent per year for four years, returning to 5 per cent from 2030. The reset implies approximately 160,000 existing participants losing access over the period and a further 140,000 being declined.

The next day, NDIA witnesses appeared before the JCPAA and told the detailed fraud story that Minister Butler had used, the day before, to justify the reset.

The issue is not whether fraud exists. It does. The real issue is that the Government's two stories, delivered 24 hours apart and likely to be entrenched in the budget tonight, are not lining up.

Fraud, and vulnerable people being taken advantage of, rightly gets most of us demanding action. So fraud is being used to explain a multitude of reforms, including access decisions, reassessments, tighter plan budgets and narrower interpretations of what is considered reasonable and necessary.

My concern with the current narrative is that it is a deliberate attempt to shift responsibility for the financial pressure facing the scheme onto criminals and “rorters”, rather than acknowledging the real policy choice being made and the impact it will have. Specifically:

• fewer people will qualify for the NDIS
• those who do not qualify will be referred to the current mirage of state-based foundational supports
• those who remain on the scheme will likely have more complex administration and less funding to live their ordinary lives

So why, after more than a decade of operation and hundreds of millions of dollars spent on reviews, taskforces, consultants, integrity programs and new administrative structures, do we still need to blame sustainability on the minority who do the wrong thing?

Why are we willing to spend over $700 million on fraud and integrity initiatives that, on the available evidence, have recovered only a fraction of the losses they are intended to address, yet simultaneously justify reducing supports that help people live safer, more independent and more connected lives?

Why does the policy conversation continue to focus on controlling expenditure rather than understanding what actually drives quality, value and long-term outcomes?

These are not just financial questions.

They are questions of integrity.

Because integrity is not simply about preventing theft.

Integrity is about aligning words with actions.

It is about ensuring that the evidence used to justify reform genuinely supports the conclusions being drawn.

It is about being honest with the public about what is known, what is assumed and what trade-offs are being made.

And it is about directing scarce public resources toward interventions that make a meaningful difference, rather than those that are politically useful.

If the objective were simply to save money, there are many ways to do that. But at present, the evidence suggests we are spending significant sums strengthening the appearance of control while cutting back on the very supports that have the greatest potential to create genuine and lasting impact.

That is why this is not principally a fraud story.

It is not even principally a budget story.

It is a story about whether the NDIS reform agenda is being driven by evidence and integrity, or by a narrative that is politically convenient but analytically incomplete.

The likely impact

A key reform initiative is capping growth to 2 per cent. Based on current announcements, this will start from FY 2026-27, approximately six weeks away. But the mechanisms to fairly achieve this reset target are not operational for between 12 and 20 months.

• Framework planning is currently scheduled for 1 April 2027, having been delayed twice already.
• The functional capacity assessment tool is targeted for 1 January 2028.
• The foundational supports system for adults with complex disability is not currently scoped at scale.

This means, to achieve the savings target, the NDIA can only pull at the following discretionary administrative levers:

• Slowing access decisions for new entrants.
• Tighter Section 10 interpretation under the 2024 amendments.
• Plan reductions at scheduled reassessment.
• Eligibility reassessment of current participants on the improved functional capacity pathway.
• Pricing reductions through the Annual Pricing Review.
• Discontinuation of high-cost approvals.
• Plan management type changes under the 2024 reform criteria.

These are administrative discretion, not assessment-led redesign. If 160,000 people are removed from the scheme over four years, a meaningful share of those exits will happen before the new functional capacity assessment tool exists. They will be removed under the old criteria, applied more strictly.

The underlying integrity question I have is how we can justify scheme expense savings of $60 billion to $70 billion over four years under the story of shonks and rorters. The savings number is more than four times bigger than the projected (and highly optimistic) fraud detection benefits.

The provable floor

Since the Fraud Fusion Taskforce was established in November 2022, 24 criminal NDIS fraud convictions have been secured. Twenty-three of those had been secured and referenced by the NDIA at the JCPAA hearing on 23 April 2026.

Firstly, I want to start by acknowledging that twenty-four convictions in three and a half years is an achievement. Each of those matters involves serious conduct that was investigated, charged, brought before a court, tested under criminal standards of proof, and resulted in a conviction. So long as people choose to do the wrong thing, this only needs to increase.

Across the 23 identifiable convictions, the proven court-stated loss totals approximately $10 million. The figure depends on whether the gross syndicate envelopes (Operation Pegasus $5.8 million, Operation Persei $800,000, the Deliciso network $3.8 million) are counted once or apportioned across co-offenders.

These criminals have been explicitly ordered to repay approximately $1.3 million to $1.5 million to the Australian taxpayer. They have also been cumulatively sentenced to 45 to 48 years in prison.

That is the provable floor. Three and a half years of taskforce operation, 24 convictions, approximately $10 million of proven loss, approximately $1.5 million in court-ordered restitution.

The 6 to 10 per cent that is not fraud

The figure most quoted in the public discussion is 6 to 10 per cent of NDIS payments, which translates to $2.0 billion to $3.5 billion on the 2023-24 base, reported as fraud. The JCPAA was told a tighter version, being 8.2 to 8.3 per cent, which on the 2024-25 base of $46.35 billion translates to around $3.85 billion.

But this is not just fraud. It is the agency's estimate of integrity loss. The NDIA's published methodology defines integrity loss as comprising:

• fraud
• non-compliance
• payment error

The three categories are reported as a single aggregate because the agency has stated, formally, that it cannot distinguish between them at the level of individual payments.

Anyone who has ever submitted a payment request will confirm that it is not a simple and straightforward exercise. Systems rarely align, which requires manual workarounds, which unfortunately leads to errors. Simple mistakes in a complex system are being viewed the same as underworld syndicates who are intentionally gaming the system.

So when this figure is reported as fraud in public communication, we are failing to remind the public that it is the extreme upper estimate of a category that, by the agency's own admission, the agency cannot measure.

What the 8.3 per cent does not capture

Additionally, and financially concerning, the JCPAA also heard that the leakage figure is incomplete. The NDIA stated that three categories of conduct are not yet included in calculations.

• Identity theft into the scheme, where someone's identity is stolen and used to claim.
• Falsified evidence at intake, where someone presented fabricated evidence to access the scheme and is now claiming against it.
• Organised collusion across participant, worker and provider, where everyone in the chain confirms a service was delivered when it was not.

These are the conduct types most consistent with the public framing of NDIS rorting, but they are not actually considered in the current measure. We still do not know how large they are.

This matters because 160,000 participants are to be removed from the scheme over four years, in part because of an integrity narrative built around a measure that omits the conduct the narrative most relies on.

The number is an assumption, not a measurement

The 8.3 per cent is a flat ratio applied to a growing base. It is a modelling convenience rather than a finding. None of the underlying dynamics have been tested in the public record.

To attack fraud credibly, we need to understand the foundations on which it can occur. This also changes the risk profile.

If fraud is opportunity-driven, more spending creates more likelihood of attack and the dollar value rises with the scheme. If new entrants are entering fraudulently at higher rates than existing participants, the percentage should rise. However, if fraud is concentrated in a finite group of bad actors with finite capacity, the percentage should fall as the scheme grows. We also need to factor in that, if detection is genuinely improving, the percentage should also fall.

The NDIA reports leakage as a stable percentage, which is the easiest assumption to defend but the hardest one to verify. There is no observed time series of fraud rates on a stable methodology in the public record. The 8.3 per cent cannot be proven wrong. The NDIA cannot prove it is right. That in itself is an integrity finding.

The assurance signal that does not reconcile

The Australian National Audit Office has reported on the agency's pre-payment review function. Pre-payment review covers approximately 0.4 per cent of NDIS outlays. Of the claims that are reviewed, more than 50 per cent by dollar value are cancelled.

That cancellation rate is widely cited, but it is concentrated in a risk-targeted sample, not the population. Pre-payment review is applied to claims flagged by the agency's risk-detection algorithms, which are designed to identify high-risk claims. A 50 per cent cancellation rate among high-risk claims is consistent with the algorithm working as intended. It is not evidence that 50 per cent of all NDIS claims would be cancelled if reviewed.

It has been publicised that over 2,500 ABNs have had a payment hold applied and the combined historical claims by those ABNs is over $5 billion. But this is cumulative lifetime claims, not audited fraud losses. I have personally been involved in having two payment holds lifted, and in neither case did the agency adhere to procedural fairness by advising what the specific issues were and providing an opportunity to respond.

All of this points to the agency taking action on something we know is an issue. But the data does not reconcile to a story of rampant fraud.

What the enforcement data actually shows

The Commission's enforcement record is now sufficiently large to find trends. A recent compliance enforcement export contained 2,321 enforcement actions, predominantly from 2025 (1,555 records). Activity has scaled approximately tenfold since 2023.

But action types are skewed toward administrative rather than fraud-related conduct. Compliance notices dominate at 53 per cent of all actions. Banning orders against individuals account for 29 per cent. Revocations of registration are 13 per cent. Refusals to re-register, suspensions and enforceable undertakings together account for less than 5 per cent.

The statutory grounds are equally specific. Section 73J of the NDIS Act 2013, the practice standards and audit obligation provision, is cited in 1,916 of the 2,321 records. That is 83 per cent of all enforcement actions. Section 13B of the Provider Registration and Practice Standards Rules, which deals with mid-term audit, is cited in another 434 records.

Conduct categories show a similar pattern:

• Audit failure features in 35 per cent of actions.
• Practice Standards non-compliance in 24 per cent.
• Registration failure in 22 per cent.
• Incident reporting failure in 3 per cent.
• Behaviour support failure in 1 per cent.
• Worker screening in less than 1 per cent.

By contrast:

• Restrictive practices features in only 3 per cent.
• Complaint handling in 0.2 per cent.
• Direct participant harm features in three records out of 2,321, or 0.1 per cent.

Fraud and integrity currently sits at 0.4 per cent. The reform agenda's framing of fraud as the central enforcement target is not the framing the actual enforcement data supports.

The provable floor against the projected gap

If we set the cost to identify and investigate fraud against the criminal output, the realised savings and the leakage forecast next to each other, a different image appears.

• Fraud Fusion Taskforce coordinated spend since 2022 (Taskforce creation, NDIA payment integrity workforce, NDIA fraud detection IT, Services Australia fraud investigation): approximately $426 million committed.
• Crack Down on Fraud program (separate but feeding the same Taskforce evidence base): a further $345 million, taking total integrity-related investment to approximately $771 million since 2022.
• Court-stated proven loss across all 23 convictions cited at the JCPAA: approximately $10 million across three and a half years.
• Restitution explicitly ordered: approximately $1.5 million.
• Realised CDOF savings 2024-25: $86 million in one year.
• 2022-23 detected leakage: $2 billion to $3.5 billion in one year.
• 2027-28 leakage forecast: $3.6 billion to $6 billion in one year.

This means, currently, the Taskforce-coordinated spend works out to approximately $18.5 million of program cost per conviction, or approximately $43 of program cost for every $1 of court-stated proven fraud, or approximately $284 of program cost for every $1 of restitution ordered. The proven loss across all 23 convictions is approximately 0.3 per cent of a single year of detected leakage at the lower estimate, and approximately 0.17 per cent of the 2027-28 forecast upper bound.

On the broader integrity line, the picture is more defensible. The NDIA's published $3.1 billion benefits figure across November 2022 to June 2029, set against approximately $771 million of integrity-related investment over the same window, produces a return ratio of roughly 4 to 1. Reports suggest we are currently tracking at realised savings of $200 million+ cumulative to mid-2024. This is more modest but still demonstrably positive.

This is not an argument that the convictions are unimportant. Successful prosecutions establish deterrent, validate referral pathways, and demonstrate that the taskforce can take a matter through to a sentenced outcome. They are also the part of the integrity story most legible to the public, and the part most heavily quoted in the political framing.

But criminal convictions cannot carry the weight that the reform narrative is asking them to carry. The deterrent value of 23 convictions across three and a half years, against a market of 254,000 unregistered providers and approximately 660,000 daily claims, is structurally limited.

The reform implications

When the key number in a reform narrative is overstated, the reform direction shifts in a particular way. Reforms get heavier on enforcement than the evidence justifies, and lighter on prevention than the evidence requires. Compliance burden gets distributed across the entire provider base in response to risk that is concentrated in a small number of bad actors. The regulatory model defaults to a posture of suspicion across the sector, even though the agency's own data shows it does not actually know where to target.

In the 22 April announcement, the digital payment system, the expanded mandatory registration, the quality provider shortlist, the cut to intermediary spending, and the fraud crackdown itself are all enforcement-leaning reforms. They make sense if the central problem is widespread organised fraud at 6 to 10 per cent of outlays. They make less sense if the central problem is mixed integrity loss the agency cannot disaggregate, with a provable organised-crime floor of approximately $10 million across three and a half years.

I am by no means saying that fraud should be ignored. What I am advocating for is that the reform shape be driven by an evidence base, with compliance burden calibrated against risk rather than deferred to providers.

What this asks of providers now, with the budget tonight

First, providers should engage with the integrity-loss data on its own terms, not on the framing it is being given. When the agency or the Commission cites the 6 to 10 per cent figure in regulatory communications, providers should ask, in writing or in regulator-engagement settings, what proportion of that figure the agency assesses as deliberate fraud as opposed to non-compliance or payment error. Putting that question on the record changes the dynamic of the regulator-provider conversation.

Second, providers should resist absorbing compliance burden as if the central question is fraud, when the central question, based on the evidence, is integrity loss generated principally by error and over-claiming. The control architecture for an organised-crime risk is different from the control architecture for an error-rate risk. A provider that builds error-rate controls (training, documentation discipline, payment-evidence integrity, internal audit at the population level) is responding to the actual evidence.

Third, and immediately, the budget tonight will quote a number. Read for which number it quotes and what claim it attaches to that number. If the budget quotes the upper bound of integrity loss as fraud, or attaches the conviction line to the reset target without acknowledging the order-of-magnitude gap between them, the framing is doing more work than the evidence allows. That is the moment to read carefully.

But more specifically, and tangibly, providers should understand the environment they are working within. It is a rationing program with an integrity narrative attached. The compliance burden that will flow from this Budget is calibrated to the narrative, not the underlying evidence.

That creates a difficult operating environment, where providers are being asked to prepare for two forces moving in opposite directions.

Many participants are likely to experience tighter plan budgets, narrower interpretations of what is considered reasonable and necessary, and more aggressive reassessment activity. Providers will face higher expectations around documentation, governance, internal controls and demonstrable compliance.

In simple terms, providers should expect to be paid less while being asked to prove more.

That contradiction needs to be addressed deliberately.

Assume more funding pressure is coming

If a material proportion of your participants experienced a 10 to 20 per cent reduction in plan budgets, what would happen?

If you have not modelled this scenario, you are relying on hope rather than strategy.

Conduct your own minimum viable support assessment

For participants who are likely to face reductions, determine the minimum level of support required to maintain safety and essential functioning.

This assessment should identify:

• the support elements that are clinically or operationally critical
• the foreseeable risks if those supports are reduced
• early warning indicators that the arrangement is beginning to fail
• escalation thresholds for service review or withdrawal

This becomes your evidence base if funding decisions undermine safe delivery.

Quantify the cost of safe delivery

Know your actual cost to deliver each support item. Include, at the granular level:

• direct labour
• supervision
• training
• travel
• non-billable coordination
• incident management
• clinical oversight
• compliance reporting
• insurance
• corporate overhead

If the funded amount does not cover the cost of safe and compliant delivery, document the gap. It will no longer just be a commercial inconvenience. It is a major strategic risk.

Tighten service agreement boundaries

Be explicit about:

• what services are included
• what is excluded
• assumptions underpinning safe delivery
• circumstances requiring review
• conditions under which services may be modified or ceased

Ambiguity creates risk that, as a service provider, you can no longer afford to hold.

Review your client portfolio strategically

Not every participant will remain financially viable under tighter funding conditions. Ask:

• which participants are already underfunded
• which require disproportionate non-billable effort
• which carry high clinical or regulatory exposure
• which are likely to become unsustainable if budgets are reduced

This is not about abandoning people. It is about understanding where your organisation is absorbing risk that may become untenable.

Strengthen evidence of outcomes

Where funding is challenged, providers who can clearly demonstrate the value and necessity of support will be better positioned.

Link your service delivery to measurable outcomes such as:

• reduced incidents
• improved health stability
• greater independence
• lower restrictive practice use
• enhanced community participation

The agency does not fund risk reduction. It funds participant outcomes. The stronger your evidence, the stronger your position.

Build board-level scenarios now

Boards should understand the implications of:

• 10 per cent reduction in average plan value
• increased compliance costs
• delayed NDIA decisions
• rising working capital requirements
• loss of high-margin participants
• increased risk of payment holds

Boards cannot govern what they have not modelled.

Define your non-negotiables

Be clear about the circumstances in which you will not deliver services. For example:

• funding is insufficient to deliver safely
• required clinical supports are absent
• risks exceed your organisational capability
• family expectations are inconsistent with funded supports

The next 12 months will require disciplined decisions.

The next 12 months

Over the next 12 months, the most resilient providers will not be those who simply work harder. They will be those who:

• understand their cost base
• know the minimum support required for safety
• set clear contractual boundaries
• use data to demonstrate outcomes
• withdraw where safe delivery is not possible
• communicate openly with participants, families, boards and regulators

This is the strategic challenge of the next 12 months. Providers are being asked to deliver greater assurance with fewer resources. Those who know exactly what quality costs, what risk looks like and where their boundaries sit will be best placed to navigate what comes next.

---

Next instalment: reassessment as existential threat.

Supporting Potential works with NDIS providers to build systems that deliver quality at scale. Our submission to the JCPAA Inquiry into the Administration of the NDIS consolidates 528 prior recommendations into five structural root causes and maps 42 of the other public submissions to the inquiry against them. Companion analyses (the financial story, the convictions tested) are available on request.