Supply chain fraud: an all-business problem

On the very first episode of Fraud Matters, we’re not easing ourselves in gently. We’re looking at one of the most varied and pervasive types of fraud: supply chain fraud. From invoice fraud to labour issues to bribery and corruption, supply chain fraud comes in many guises and can be incredibly complex. But it can also be deceptively simple, and all businesses need to be aware of it. 

Through some real life examples, we explore how supply chain fraud might manifest, and how to mitigate the risks.

Guests:  

• Josie Welland, Senior Managing Associate, Sidley Austin LLP
• Arun Chauhan, Director and Founder, Tenet Law

Host: Guy Ruddle

Producer: Ed Adams

Series Lead: Mark Rowland 

Episode recorded: 20 March 2026

 A Hack Creative and First Touch production for the Business Fraud Alliance

Transcript

SPEAKER_01 0:02

Implementing prevention and trying to detect fraud in your business makes good business sense. It will make your business more stable. It will probably help your business be more profitable because you're weeding out the bad stuff.

SPEAKER_00 0:12

At the start of any relationship that you're building out, any supply chain that you're building out, one of those pieces of that puzzle should be where are the pitfalls? Where could I be exposed to risk? And actually it doesn't take that long.

SPEAKER_02 0:26

Hello and welcome to the very first episode of Fraud Matters, a brand new podcast exploring what it's like to be affected by fraud and how to make sure it doesn't happen to you and your business. I'm Guy Ruddle, and over the coming months we'll look at things like insider fraud and corporate impersonation. And we're not going to ease ourselves in gently either. We're going to start with one of the most varied and widespread types of fraud: supply chain fraud. So this is not a topic you'd want to tackle without a couple of top experts, and that's exactly who we've got in the studio with us. Let's start with Josie Welland, who is Senior Managing Associate at the global law firm Siddley Austin and a former chair of the Female Fraud Forum. Josie, welcome to the very first episode of our podcast.

SPEAKER_00 1:12

Thank you very much. It's very exciting to be here.

SPEAKER_02 1:14

What sort of clients do you do you deal with most of the time?

SPEAKER_00 1:18

So typically I now represent corporates, so those are financial institutions, technology, um, and online platforms. But over the years I've represented individuals through to SMEs and then now you're large corporates. So it's been a the full spectrum.

SPEAKER_02 1:34

You've done everything.

SPEAKER_00 1:35

I have.

SPEAKER_02 1:35

And tell me a little bit about the Female Fraud Forum.

SPEAKER_00 1:38

So the Female Fraud Forum is a non-profit organization, and the idea is to promote diversity and equality within those working in fraud. It's been a bit of a mal dominated space for a while. So our organisation is trying to bring all of the incredible women that work in that sector together in a safe space to network, collaborate, and hatch some plans.

SPEAKER_02 2:00

Fantastic. And our other top expert is Aaron Chohan, who's director and founder of Tenet Law. Aaron, welcome to the podcast. How long have you been dealing with fraud, so to speak?

SPEAKER_01 2:12

Well, thanks for having me, guy. I have been dealing with fraud for about 20 years, and uh it's uh no day is the same as any other.

SPEAKER_02 2:19

Has it changed much? Or uh I mean I mean the types of fraud or anything, or is it roughly the same thing most of the time?

SPEAKER_01 2:26

If you strip it down, it is roughly the same thing. Time and time again, it's just dressed up with different methods, different tech, different stories, but really it's about one person deceiving another person.

SPEAKER_02 2:36

Let's get into supply chain fraud. I I said at the beginning that it's one of the most varied and one of the most widespread types. What makes it so varied, do you think?

SPEAKER_00 2:46

I think it's because it can be embedded in anything. So uh the simplest way to look at supply chain fraud is fraud that sits just outside of your business but still affects you. So for small to medium-sized businesses, they depend on a range of individuals to make their business operate. So they have your suppliers, your agencies, your contractors, your distributors, and each of those relationships introduces a risk into that chain. And supply chain fraud occurs when somebody within that wider network acts dishonestly to gain financial advantage, often by exploiting gaps in oversight or procedures. So there's kind of lots of examples we can go through, but I think some of the typical ones that you might see is the supplier overcharging for goods that don't meet specification. You've got agencies overbilling for workers who never actually attend, uh, contractors who might inflate invoices or split contracts to avoid scrutiny, or your more typical third parties misrepresenting on credentials for whatever goods or products they're providing.

SPEAKER_02 3:48

I can imagine people owning or running small or medium-sized businesses listening to this, wanting to run away, right? Already. And it's, you know, it it's a little bit terrifying. Aaron, are there sort of common threads in all of the things that Josie's been talking about?

SPEAKER_01 4:04

I I think the main common thread is that certainly if you're thinking about SB businesses, you're often dealing with suppliers who are legitimate and trusted parties and people you know. And the common thread is there is a human behind that other side of that transaction who might want to be making a bit more money at your expense. And there's lots of methods to do that, and that's what it is. It's about just being on guard about those human elements that someone might deceive someone else to make a bit more money.

SPEAKER_02 4:32

So there's a danger when when you talk about things like fraud and uh other legal things, that it that it gets a bit dry and seems a bit academic, and and I think bringing it to life is it is really valuable and really important. I and I know it's hard to use absolute real examples sometimes for for legal reasons, but Josie, if if we were trying to sort of come up with the the perfect storm of of a fraud brought together from things that you cases that you that you know, what could you could you give us an idea an example?

SPEAKER_00 5:04

As if we're in Blue Peter and something I made previously. Uh so we all know about the COVID inquiry, it's ongoing at the moment, it's being talked about, uh, and the PPE scanner that came with that. So I'm gonna take a scenario which could be directly applicable to that, but it touches to all the points within the supply chain. So you have, say, a UK-based company, uh, we can be really original here and name it as Supplier Co.

SPEAKER_02 5:30

Oh, excellent. Remember that.

SPEAKER_00 5:33

Really inventive here. Uh they were awarded large government contracts during an emergency procurement process uh to supply specialist medical equipment. The contract is awarded via a fast track route with limited due diligence. The company itself sourced goods from all over, so the UK but as well as overseas uh manufacturers, often through intermediaries. The goods are delivered but later found to be non-compliant, whether that's from a technical specifications perspective or some other reason. And as a consequence of that, there are significant funds that have already been paid, but then the goods don't live up to their expectation.

SPEAKER_02 6:08

And that sounds like, and you know, I mean it it not all in one case, actually was, you know, an opportunity or a situation, you know, that things happening fast and you know, people without great experience where fraud could thrive, I suppose.

SPEAKER_00 6:24

It could, and it can uh appear anywhere within that sector. So you're kind of taking that scenario as the kind of the baseline of what could happen. You've got contract and misrepresentation. So that can happen in the tender and contract uh award process. So, for example, a manufacturer misrepresenting its capabilities or the quality of the goods that it can supply. Uh, it can also misrepresent its relationship with the intermediary who introduced you, for example. You then might have scenarios where bribery or kickbacks exist. So, again, that would equally happen at the tender and contract award stage. So, you know, your classic example is by providing incentives to the decision makers that then award that contract to that manufacturer. You then have your product substitution or quality aspects. That can happen in any degree, but obviously the scenario here would be that they don't live up to the certified requirements, or the certified requirements are falsified. They don't go through the correct test or procedures, or they say they do and they didn't. You then have uh your invoice for. So this is once we've got the contract, once the goods have been awarded, we then go down to when you start paying for those goods. So the easiest example is overbilling, overpaying. Uh so they invoice you for goods that they didn't supply, whether that's in its entirety, or more often it's a small percentage, so they might uplift it, say, by 10%.

SPEAKER_02 7:58

It's getting more and more frightening.

SPEAKER_00 8:00

That's not the intention, don't worry. We do have some solutions on the end.

SPEAKER_02 8:03

Good, because we'll come to that.

SPEAKER_00 8:04

And and then I suppose the final uh one which is kind of most aligned with uh any sort of supply chain is your labour. So inflated hours, ghost shifts is very popular, duplicate billing or even expenses fraud.

SPEAKER_02 8:18

Yeah. Ghost shifts, claiming that people have d have done a shift when they haven't and charging the client for that shift. What's the line, or is there a line, a definable line, between sharp practice and actual fraud?

SPEAKER_00 8:33

So I think we work in any business that it's areas of grey. You need to be sharp in as much that you want to get the best deal, you want to get the best price, you want to move as quickly. And so all of that incentivizes you to not do as hard as a due diligence check as a protractive process. I think for the corporates that I now represent, they're aware of their risk of liability, so they invest more time and energy into that. However, for the small and small to medium-sized businesses, that's a costly exercise, and it may well mean that they then lose out on that contract. But you can be sharp but still be aware.

SPEAKER_01 9:10

I think if you're just taking it from the fraudster's point of view, what's the difference between sharp practice and dishonesty? It's saying something that isn't true. So you're definitely lying to get that gain. And so sharp practice might be I'm bending the rules, and then this is where the areas of grey come in, aren't they, Josie? It's something you're bending the rules to the point where actually you are intentionally saying something untrue because you know you're gonna get the gain out of the back end. I'm gonna win that contract. Because I've told them actually, yeah, we've done five of these type of projects before, we've only done two. But I've told them I've done five, so they're more assured, so they're gonna give me that contract.

SPEAKER_02 9:46

And that would not be sharp practice, that would be fraud.

SPEAKER_00 9:49

Yes. If they said, however, and this is where it gets into the very grey area, we've done several of those contracts before, or we've done a handful. They're not specifying the number. So that's the grey area where you could probably arguably have a defence to saying I didn't fully lie.

SPEAKER_02 10:06

I can see why you need lawyers. So do all of these things apply to where if you get down to the SME, you know, some more medium-sized business level as well? I mean, does but what about bribery, for instance? I mean, you would would that be something that you would likely see at a smaller, at a lower level, if you like?

SPEAKER_01 10:25

Absolutely. So I think you know, whilst these the government news stories, they all they all bring the subject to life, but this can happen to the smallest one-person business to large enterprises. And you take bribery, for example, you've said, you know, could that happen in the small business? I've seen it in the small construction business, where someone who's dealing with contract management gives more contracts to a supplier because that supplier let that contract manager's son work at their business uh without anybody knowing. And that was the backhander. The backhander wasn't money, the backhander was a favourite, I'll give your son a job if you give us more work.

SPEAKER_00 10:57

But it could equally be taking you to a football game or going to an event. Hospitality is a huge area where bribery is is often rife and you don't necessarily realise.

SPEAKER_02 11:08

That's really interesting. So, I mean, you take someone for a weekend skiing or something like that. It that just doing that's not bribery in itself, is it?

SPEAKER_01 11:17

Do you does it have to be hidden for or it it's about really it's about it's about someone uh asking themselves, and you're asking yourself as a business owner, has that persuaded me to give somebody some work? Has that persuaded me? Now that has been time and time uh the way business is developed. It's through relationships, common interests, um, I can get on with somebody. But as a business owner, you've got to think about well, there are laws around this. You you can't award work for return and kickbacks and favours. And it's about your own risk appetite, it's about your own ethics, your own integrity, and saying, okay, does that feel right? Um so a lot of businesses will set a threshold. Uh, you know, large businesses will have a really careful threshold that you can't take hospitality over a certain value, you've got to declare it anyway. It's a judgment call.

SPEAKER_00 12:01

Yeah, I think you know, just elaborating a little bit more on the point that Aaron made, if there are five people that you have taken on holiday, but there's one that in return says, Oh, if you take me, I will award you this contract. Would you have taken that person but for that comment? So that's the what the business needs to do. It needs to say, Am I taking this person because I genuinely like them and I want to go skiing with them for a week? Or am I doing it because I think I'm going to get some advantage from it? And then that's where you've got to have your kind of uh step back, I think, and objectively look at it.

SPEAKER_01 12:37

And I think so. And I think it's every business needs to think about it. And it is quite pervasive, it's quite widespread in in terms of the smaller businesses because the the type of frauds we're talking about, the supply chain fraud, all these examples Josie's really explained very well. They're the ones that hide in legitimate business relationships, the ones that are trusted relationships. And you think about SMEs, a lot of their suppliers come on board not through a procurement process like a big business, but through recommendations. So you don't do those checks. You said, Well, you know, John recommended they'd be great to work with for our business. So we did. And that's where you can um fall foul.

SPEAKER_02 13:14

In the uh the COVID procurement scenario, the product quality thing or the product substitution, not you know, not delivering what you said you were going to deliver, I I would imagine that's harder to get away with in a smaller business because people are more on top of what what they're doing.

SPEAKER_01 13:31

In any business right now, I think it's fair to say people are overwhelmed and they're more than busy, and people don't have time to look back. So often the gaps, when you're looking at the bigger enterprises, the bigger businesses, they'll have a big procurement function, and then that contractor will come on board and someone else will deal with managing the contract. But they'll they'll join the dots. What happened when they're performing the contract compared to what happened when they were being procured? We knew what they said they could do, we've seen how they've done, and we can match up if there's any difference. In smaller businesses, you don't have that time, and you forget. All you think is, oh my god, it's gone wrong. How are we gonna solve it? Uh we're we're spending more on this because of some odd reasons they've told us now we've got to spend more. And no one thinks about well, actually, were they dishonest? Was someone lying to us at the outset?

SPEAKER_02 14:14

Are there obvious ones that it that that could that that that come to mind? You're sort of examples of how e it'd be quite easy to to you know not deliver what you said you were gonna deliver.

SPEAKER_01 14:24

I think I think there's some examples, I think. I mentioned construction, so I've seen uh another example is uh and it's using technology as well, um, a supplier doing development of some properties, and they were fitting out the kitchens and putting smoke alarms in each kitchen, and they took photos of the smoke alarms in one kitchen and then presented that they put them in every other kitchen, and what they'd put is empty empty units in, and they had then charged the company for them.

SPEAKER_02 14:51

That sounds like a ridiculous. I mean you're bound to get aren't you bound to get found out eventually.

SPEAKER_01 14:56

Small suppliers and then they just suddenly disappear. And it's you get situations like that. We've seen situations where um an example of a company that supplies cable ties, those little plastic cables you tie around wires, and they purposely, or the allegation was they purposely undersupplied every pack of a hundred or a thousand by one or two percent, three or four items, maybe ten items and a thousand pack. No one would ever get that, no one would ever catch them. And eventually they got caught and they were purposely undersupplying, and that margin over tens and tens of thousands of cable ties meant a tidy little extra profit. And that's the thing we're not thinking about with maybe supply chain fraud is this is coming straight off your bottom line.

SPEAKER_02 15:36

Yeah.

SPEAKER_01 15:36

You know, imagine that. Imagine you've got an extra ten thousand pounds in your business, which could go straight to profit.

SPEAKER_02 15:41

What are the signs? Are there common signs you know if if you're if you're managing or running a business, are there are there alarm bells that that are that that should be ringing if certain things are happening?

SPEAKER_00 15:54

I don't necessarily think you need to look for alarm bells because that's almost getting at it too late. You're then being reactive. And I think what we want to try and encourage everyone to do is to be a bit more proactive. And I think there's commentary that when you talk about fraud and when you try and do things the right way, actually all you're doing is putting more red tape and more barriers on SME. And having worked the full spectrum of clients, the ones with the bigger pockets naturally have more funding and more resource to do fraud prevention, but it is as important for the smaller entities. So there are some really simple things that companies can do from the outset. The first thing is you're looking to source your goods from a manufacturer overseas. Do some basic checks, right? AI is prevalent now. It's a really easy tool to enhance your Google searches, your Yahoo searches. You can also go on trust pilots or a company's house if they're UK-based manufacturers and just get a feel for who they are. Another thing that companies can do without much resource or time is if you're looking at it from the ghost shifts that I talked upon earlier, is have a site access log, right? So somebody checks in in the morning, they check out at night. You know, it's basic principles. And then at the end of the month or the quarter, however frequently you bill, check to see if the person that says they were there all day actually registered there all day. There are things that you can do on a first principle level that enables you to stop it. And and Aaron, you're nodding at me.

SPEAKER_01 17:29

Yeah, no, I'm just heated agreement. So if you think about, like, for example, we talked about um one of the examples Josie gave earlier was like exaggerated capability. You know, we've we've got we've done lots of this, we've done several of these projects before, or uh we've got these skills to do this type of work, and then you are you you say, okay, or we're of a certain size. There are those checks, which Josie's talking about absolutely right. So companies house, if you look at the accounts of a company, it'll say the number of employees they've got. Does that stack up against the type of size of project you're gonna have your supplier do? You know, it's those human checks behind the supplier.

SPEAKER_02 18:03

It seems to me that it's most likely that if you're running a business, you know, you are gonna be better at understanding your core stuff. So if you're a builder, you're gonna be better at buying bricks than you are at buying cars. When you get away from your core activity, presumably that's when it becomes easier to defraud someone.

SPEAKER_01 18:24

I I think that's spot on. So I've seen a few instances of this happen. So you'll have, for example, um, I've had a director of a manufacturing in a jewel in the jewellery trade business, and um they were operating quite a successful business, 10-12 million pounds of turnover, and they were approached about making some savings on their Royal Mail, their postal payments out, because they spent a lot of spent a lot of money on sending jewellery out in the post. Something like a quarter of a million a year they would spend. And they were approached that we can save you money with rebates from the Royal Mail if you buy this franking and post office kind of basic equipment, photocopying franking machines, and you sign up to these agreements. The director undertook the jewellery trade day and down, one of the best in it. But when it came to signing these agreements, I didn't know. And the the business was cash rich, and what he ended up signing was finance agreements to pay for this equipment at a hugely inflated price and then got suckered in to those agreements for four years and the company lost over a million pounds. Wow. And it's because they were negotiating on something, a lot of it was verbal, they didn't understand the documents, trusted what they were hearing, and it was outside of their wheelhouse, outside of what their day-to-day skills were. And so what's the learning? The learning is if you're dealing with buying something which is not the norm for your business, get someone who knows about it to help you. There's no harm in just getting some outside experience or someone who can just give you some guidance. Does this make sense?

SPEAKER_02 19:48

One thing you haven't talked about is what to do if it does happen and you do spot it. There must be a temptation to actually just say, oh yeah, well, it's embarrassing. Uh it's you know, uh I can just sort of park it and put it under experience and not really do an awful lot about it. I I'm guessing that's really not a very good idea.

SPEAKER_00 20:09

Yeah, I mean turning a blind eye is definitely not the the way to deal with things. It's very easy to attribute liability to a small to medium size uh enterprise uh for fraud. Because it comes in various different shapes and sizes and can appear anywhere within the supply chain. There's often the things, well, it wasn't me or it didn't concern me. But it can significantly impact. So the impact that it has, first of all, could be on the business itself and its operations. So it can impact cash flow, it can impact and destroy commercial relationships, and in turn, your likelihood of securing another deal, another contract down the line. The reputational harm I think is quite severe in this scenario. But from a lawyer's perspective, the the biggest concern is their liability. So as an individual, you might think, well, uh, it was the company, not me. It's very easy in the law to go after a company in and of itself, but you can what we call piercing the corporate vowels. You can go behind the company and say, Well, is the director also liable? And actually, the way our law is framed at the moment and the changes that have been made more recently, it's very easy to achieve that. So, in order to hold a company liable, all you have to show is that a senior manager was somehow involved in the criminal activity.

SPEAKER_01 21:28

When you discover this, typically, my sense or my you know experience of dealing with business owners is you have the headless chicken moment. They don't know what to do, they they haven't got a clue what to do. And sometimes they start to deal with it themselves and they're going to approach the supplier and start having it out with them on a bit of a hefty call. You know, they've got to deal with everything from business interruption, all those other consequences. Just a few things that you can think about straight away. Well, have you got a contract? So Josie's talking about the situation where the company that's done you over is not good for the money, and you can go after the directors absolutely right, you can do. But you might have some low-hanging fruit. There might be some contract terms which you can just nail them down on straight away. Um you might have some insurance in your business which covers you for this type of loss. So there are certain things to think about, but I think the key thing is working out how it's happened. Is it happening with any other supplier you've got? Does it involve anyone on the inside? And then start to take some advice about what you can do.

SPEAKER_00 22:21

Yeah, and and the scale I think is important. So I think before you even perhaps want to entertain the idea of taking a next step, assess what's already there. Get a feel for what has happened. Now, you can do that yourself. Obviously, um as lawyers, we would encourage you to engage us from an uh the outset, but I think getting the facts together to work out what is the scale, who is involved, who may be involved, and connecting those dots is a really good starting point.

SPEAKER_02 22:50

Obviously, we aren't trying to frighten people here, but if you're listening to all of this and you are, as I say, running a business or senior manager in in a business, then there's a lot to think about here. The obvious thing is prevention is better than cure, but as we've been saying, people are busy. It's easy for this to fall down the priority list. What are the what's the m fundamental, most important, not action necessarily, but way of behaving that's gonna help you, that's gonna protect you, do you think?

SPEAKER_00 23:21

Being a bit cynical.

SPEAKER_02 23:24

Oh good, we're all fine in here.

SPEAKER_00 23:27

No, I think it's taking a step back and being a bit objective. So if you have something presented to you that is too good to be true, listen to that gut instinct. Why is it too good to be true? Is it just because they themselves have been able to secure something at a good price, or is there something else behind the scenes? Take yourself away from the scenario or the immediacy of what you're dealing with and try and step back. I think that's a it's a really easy thing to do, but often it's lost in the day-to-day operations. We're all working at pace, we have lots of high pressure, there's you know, you're trying to make your business successful. So it's just having that moment to think I think it is.

SPEAKER_01 24:07

It's it's standing back and saying, Does this make sense? And do I understand why we're operating on these terms? Implementing prevention and trying to detect fraud in your business makes good business sense. It will make your business more stable, it will probably help your business be more profitable because you're weeding out the bad stuff. So having that in mind as the driver as to why you might not do it, it's not looking for what you might save, it's looking for what you might gain by putting in these changes.

SPEAKER_00 24:34

Some helpful takeaways that I often give clients is to do, and everyone will hate the word risk assessment fair enough.

SPEAKER_02 24:42

Everybody's heart sink, doesn't it?

SPEAKER_00 24:45

Including us lawyers every now and then. But actually, it's it's a really good way to just assess the pitfalls, and it works in both ways because quite often you you want to prevent the fraud that's going to harm you as a business, right? You're going to want to not suffer the cash flow issues, you're not going to want to damage your reputation, but you care less when the fraud is to your advantage, because as far as you're concerned, that makes your business more profitable. But actually, that's as much likely to attribute liability as it is in reverse. So you can get caught up in a fraud where you aren't yourself the one that has been dishonest, but you're caught up in the chain, so you get brought into it. But then equally, if there has been a fraud that you have benefited from, there is also a risk there. So I think if at the start of any relationship that you're building out or any supply chain that you're building out, whilst you're putting together the contracts, you're putting all the uh pieces in place, you're building out that puzzle, one of those pieces of that puzzle should be let me just do this risk assessment. Where are the pitfalls? Where could I be exposed to risk? And actually, it doesn't take that long. And you know, as long as we can come in, we can do that exercise for you. But you, as the operator, the director of that company, you're going to know it far better than I'm going to know it from the outset. You're going to know it like the back of your hand, you're going to live and breathe it. So you're in the best place at that point to just do an initial assessment and then come to the professionals to help you build that out if you need to, or just work with your instinct and feed off other people who know what they're talking about.

SPEAKER_01 26:18

Yeah, and I think if you just think about just some practical tools, Josie mentioned earlier about use of AI now. AI, this is not the podcast for it, but there's it's about using a secure platform. But you can just upload your supplier usage, supplier addresses, um, you can look at the spend of each of those suppliers, and you can just see if there's any and just ask AI. You'd ask the question, are there any anomalies here? You might just get some really basic information saying that supplier's been used a lot recently, and then you've got something to go up.

SPEAKER_02 26:50

Thank you both so much for for all of that. That's that's that's up and running. Our first episode of Fraud Matters is done, and you've got us there. Thank you both for being here and for bringing your wisdom. I'm sure we'll cover some of what we've talked about today again in more detail, and I'm sure we'll see both of you again in the future. But for now, thank you very much, and thank you very much for listening. Next month we'll be touching on insider fraud, one of the more devastating frauds that a business can experience, all as part of a wider conversation about culture. If you've enjoyed this podcast, be sure to subscribe on your favourite app so you never miss any of our future episodes. And please leave us a rating or review it to help us find a wider audience. For more information about frauds discussed in this podcast and how to deal with them, the Business Fraud Alliance has a stack of resources, so be sure to visit BusinessFraudAlliance.com and links to those resources will be in the show notes. As I say, thank you to Josie and Aaron for being here and thank you very much for listening. See you next time.