The deposits looked like normal business revenue. Money coming in from government health programs and insurance companies.
Nothing particularly unusual about that for a health care provider.
The withdrawals were another story.
Personal credit cards. Luxury clothing. Gambling. Payments to family members. Money sent to businesses that didn’t appear to have anything to do with health care.
In one case, a payment even went to a plastic surgeon.
Those are some of the transactions banks flagged in a recent investigation by the Financial Crimes Enforcement Network, better known as FinCEN.
And they raise an interesting question.
If the money was supposed to pay for patient care, how did it end up there?
FinCEN reviewed 5,702 reports filed by financial institutions between March 1, 2025, and February 28, 2026. Together, those reports described approximately $17.5 billion in suspicious financial activity potentially connected to health care fraud.
That doesn’t mean $17.5 billion was stolen. Banks file suspicious activity reports when they see transactions that warrant investigation. They don’t have to prove a crime occurred.
But they do have to explain what caught their attention.
And that’s where this gets interesting.
Case File: $870,000 and a Company That May Not Have Existed
One of the examples in FinCEN’s report involved an adult day care business in Minnesota.
The business received nearly $870,000 from a state agency and private insurance companies.
So far, nothing remarkable. That’s how an adult day care gets paid.
Then the bank looked at where the money went.
Some payments were described as payroll. Others went directly to the owner’s personal accounts.
And some went to a company the bank suspected might be a shell business.
Now we’ve got something to investigate.
I’d start with that last company.
Who owned it? When was it formed? Did it have employees? What was its business address?
More importantly, what did it actually do for the adult day care?
If the books showed $50,000 paid for consulting, I’d want the consulting agreement. Then the invoices. Then whatever work the consultant supposedly produced.
An invoice doesn’t prove a service was provided. Anyone can create an invoice.
I’d want to see what the business received in exchange for its money.
Next, I’d examine the payroll payments.
Who received them? Were they employees? Did they appear on payroll tax filings? Were there timesheets?
An adult day care should have staff to care for its patients. The staffing should make sense compared with the number of patients being served.
Then I’d look at the payments to the owner.
There may be perfectly legitimate explanations for those transfers. But I’d want to see whether the money was recorded as compensation, distributions, reimbursements, or something else.
The bank’s report doesn’t establish that these transactions were fraudulent.
But it gives investigators several places to start digging.
Case File: $1.4 Million in Home Health Payments
Another report described a Maryland home health business that received approximately $1.4 million from a state health agency.
Among the transactions that caught the bank’s attention were payments toward personal credit cards and living expenses.
Here’s what I’d want to know.
Was the owner simply taking money out of the business?
Or was the business paying personal expenses and recording them as legitimate operating costs?
There’s a difference.
And even if those payments were properly recorded as owner distributions, that still wouldn’t answer whether the original insurance claims were legitimate.
I’d want to work backward from the deposits.
Which claims made up that $1.4 million?
Which patients received services?
Who provided those services?
Were the caregivers actually working on the dates and times listed?
A bank can see a million dollars coming into an account. It generally can’t see whether the patients behind those payments were actually treated.
That’s where the medical records, schedules, payroll reports, and billing records become important.
If a caregiver was supposedly seeing patients at two locations at the same time, I’d be interested.
If a patient was billed for services while hospitalized somewhere else, I’d want an explanation.
And if the person submitting the claims was also the person approving the timesheets, I’d examine who, if anyone, was checking their work.
Why Were So Many Home Health Companies Involved?
Home health care businesses showed up frequently in the reports.
Treasury said they were identified as suspected fraudulent providers in 20% of the health care fraud-related reports. In a narrower portion of FinCEN’s analysis that excluded suspected Medicaid eligibility fraud in Puerto Rico, they appeared in nearly 32%.
That doesn’t mean home health companies are generally dishonest.
It does, however, make me think about how those businesses operate.
The services happen in patients’ homes, away from the company’s office.
The billing department relies heavily on documentation from employees in the field.
And the insurance company pays based on the claims submitted.
There’s an obvious question.
How does the business know the visit actually happened?
Maybe the caregiver electronically clocks in at the patient’s home. Maybe there’s a signed visit record. Maybe a supervisor periodically calls patients to confirm services.
But what if none of those checks are happening?
What if the same employee enters the visit, prepares the claim, and submits it for payment?
The opportunity to submit inaccurate claims increases when nobody independently verifies the records.
And the problem may continue for months because the money keeps coming in.
A Medical Office in a Vacant Building?
Another detail in FinCEN’s analysis caught my attention.
Some of the reportedly suspicious health care providers were registered at residential addresses, non-medical buildings, or properties that appeared closed or abandoned.
A residential address isn’t necessarily suspicious. Plenty of home health businesses operate from small administrative offices.
But I’d want to compare the address with the type of services being billed.
Suppose a company claims to operate a treatment facility, but the registered address belongs to a vacant storefront.
Where are the patients being treated?
Where are the employees working?
Does the company have another licensed location?
I’d look at the state business registration, professional licenses, provider enrollment records, and any property information available.
Maybe the company moved and never updated its paperwork.
That’s possible.
But if the address doesn’t match, the licenses don’t match, and the money is being transferred to unrelated businesses, I’d have a lot more questions.
One discrepancy may be an oversight. Several discrepancies that support the same suspicion deserve a closer investigation.
The Money Doesn’t Just Disappear
One thing I like about financial investigations is that money usually leaves a trail.
A payment comes in. It gets deposited into an account. Then it moves somewhere else.
Sometimes it moves through several accounts.
But every transfer creates another record.
FinCEN described funds moving from health care businesses to personal accounts, family members, unrelated companies, and possible shell businesses.
I’d be particularly interested in the timing.
Imagine a medical provider receives $100,000 from an insurance company on Monday.
On Tuesday, $85,000 is transferred to a consulting company.
The following week, another large insurance payment arrives, and another transfer goes to that same consultant.
Why?
Maybe the consulting company provides legitimate management services and gets paid based on collections.
Fine. Show me the contract.
What services were provided? How was the fee calculated? Who owns the consulting company?
And if the consultant is owned by the medical provider’s owner, I’d want to know why the money needed to move between two businesses.
Related-party transactions can be legitimate. But the records should explain what happened.
I’d also look for other companies receiving similar payments.
Do they share an address? A phone number? An authorized signer?
Do the transfers continue even when the provider’s patient volume decreases?
The bank statement may not give us the entire story, but it gives us names, dates, and dollar amounts to investigate.
A Reconciled Bank Account Proves Very Little About Fraud
Here’s something that gets overlooked.
A company can have perfectly reconciled bank accounts while money is being stolen.
The bank reconciliation tells you whether the transactions in the accounting records match the bank statement.
That’s useful. But it doesn’t tell you whether the transactions should have happened.
Suppose a health care company pays $25,000 to a management company.
The bookkeeper records the payment. The bank clears it. The account reconciles to the penny.
But what if the management company never performed any work?
The reconciliation won’t catch that.
Someone needs to examine the transaction itself.
I’d start by pulling the vendor file, invoice, contract, and payment approval.
Then I’d compare the invoice to the actual services.
If the invoice says “management consulting” and nothing else, I’d want more detail.
Who provided the consulting? When? What was delivered?
If the company can’t answer those questions, the issue isn’t that the bookkeeping is incorrect.
It’s that there may be no legitimate explanation for the payment.
Don’t Forget the Person Who Approved It
When reviewing suspicious transactions, I also want to know who had control over the money.
Who added the vendor?
Who entered the invoice?
Who approved the payment?
Who changed the bank account information?
And who reconciled the account afterward?
If the same person handled all five steps, that’s a problem.
Not proof of fraud, but definitely a weakness.
In a small business, one employee may wear several hats. I understand that.
But there should still be someone independently checking payments, especially transfers to owners, family members, and unfamiliar vendors.
And I’d pay attention to manual adjustments.
If someone moves expenses into another account at month-end, why?
If an insurance payment gets reversed and reposted, what happened?
If the business issues a refund to an account different from the original payment source, who approved it?
Every one of those transactions has a story.
I’d want to hear the story and compare it with the documents.
What Would I Look at First?
If I were asked to review a small health care company’s books after reading FinCEN’s report, I wouldn’t start by examining every transaction.
I’d start with the unusual ones.
Large payments to owners. Transfers to related companies. Payments to unfamiliar vendors. Personal expenses paid from the operating account.
Then I’d compare them with insurance deposits.
Are substantial amounts leaving the account shortly after government payments arrive?
Do payments to certain vendors increase whenever insurance revenue increases?
Do the financial statements show large consulting or management expenses without much supporting detail?
I’d also review provider enrollment information, business registrations, and ownership records for unfamiliar counterparties.
Once I identified a questionable transaction, I’d follow it as far as the available records allowed.
And I wouldn’t assume the first explanation was correct just because someone produced an invoice.
I’d check whether the supporting documents agreed with each other.
A contract dated after payments began, for example, would raise another question.
So would an invoice for work supposedly performed before the vendor was established.
Those are the kinds of details that can change the direction of an investigation.
So What Happened to the $17.5 Billion?
That’s not a question FinCEN’s report can completely answer.
The $17.5 billion represents reported suspicious activity, not a confirmed loss or a final accounting of stolen money.
But the report gives us a look at what financial institutions were finding.
Health care payments going into business accounts. Money moving to owners and unrelated companies. Spending that didn’t appear consistent with ordinary health care operations.
The underlying medical claims may tell one part of the story.
The bank records tell another.
And if I were investigating one of these businesses, I’d want to see whether those stories matched.
Did the patients receive the services?
Did the company get paid for those services?
And what happened to the money afterward?
The answers should be supported by records, not just explanations.
A fraudulent claim can look legitimate on paper. So can an invoice from a shell company. The problem usually starts to show when you compare the records instead of looking at each one separately.
That’s why I’d follow the money. Not because every unusual payment is fraud, but because sooner or later, the transactions have to make sense.
