{
 "slug": "provider-banking-change-control",
 "topic_id": "TOPIC-185",
 "cluster": "Insurance Carriers, Health Payers & Beneficiary Identity",
 "tier": "Tier A",
 "title": "Provider payment diversion: the enrolment portal is the attack surface",
 "summary": "HHS-OIG documented schemes diverting federal and state payments intended for providers. The change is a profile edit in an enrolment portal, discovered weeks later during reconciliation.",
 "lede": "A health system's entire remittance stream from one payer can be redirected by editing a field. The provider discovers it when reconciliation fails, which is typically two payment cycles later, by which time the funds have moved on and the services have already been delivered.",
 "date": "2026-01-06",
 "category": "Vertical",
 "author_id": "solene-beaumont-adjei",
 "tags": [
  "provider enrolment",
  "EFT diversion",
  "healthcare payments",
  "program integrity",
  "revenue cycle",
  "payer operations"
 ],
 "image_title": "Provider Banking Change Control",
 "schema": "Article",
 "key_takeaways": [
  "HHS-OIG identified schemes in which fraudsters diverted federal and state payments intended for providers by taking over enrolment records.",
  "Value at risk per provider spans four orders of magnitude, from a solo practice to a health system, so the control must be value-tiered rather than uniform.",
  "Recovery rates on diverted remittances are poor, which makes prevention the only economically rational control."
 ],
 "body": [
  {
   "type": "h2",
   "text": "What the practice manager found"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "A profile edit that redirects a practice's income",
   "caption": "The control belongs to the payer. The consequence belongs to the practice.",
   "nodes": [
    {
     "label": "Enrolment portal access obtained",
     "note": "credentials or forms",
     "bad": true
    },
    {
     "label": "EFT details changed",
     "note": "a profile edit",
     "bad": true
    },
    {
     "label": "Payments continue on schedule",
     "note": "to the new account",
     "bad": true
    },
    {
     "label": "Practice notices missing remittances",
     "note": "weeks later",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "The first sign was a variance report. Expected remittance from one payer, for a two-week period, showing zero. Not reduced — zero."
  },
  {
   "type": "p",
   "html": "The billing lead assumed a clearinghouse problem and opened a ticket. Four days later the payer confirmed the payments had been made, on schedule, to an account the practice did not recognise. The enrolment record had been updated three weeks earlier through the payer portal, using credentials from a phishing campaign that had also taken the practice's email."
  },
  {
   "type": "p",
   "html": "The practice had delivered the care. The payer had paid. Neither party had done anything wrong and the money was gone."
  },
  {
   "type": "h2",
   "text": "Why the portal is where this happens"
  },
  {
   "type": "p",
   "html": "Provider enrolment portals exist to reduce payer administrative cost, and they succeeded. Providers update demographics, add locations, manage credentialing documents and — critically — set electronic funds transfer details."
  },
  {
   "type": "p",
   "html": "Identity verification occurs at initial enrolment, where the payer verifies the provider's identity, licensure and tax identification. Subsequent changes inherit the portal session, because the enrolment record is modelled as a profile."
  },
  {
   "type": "table",
   "head": [
    "Enrolment stage",
    "Verification performed",
    "Value at risk"
   ],
   "rows": [
    [
     "Initial enrolment",
     "Identity, licensure, TIN, sometimes site visit",
     "Future payment stream"
    ],
    [
     "Demographic update",
     "Session",
     "Low"
    ],
    [
     "Add location or provider",
     "Session, sometimes credentialing review",
     "Moderate"
    ],
    [
     "<strong style=\"font-weight:600\">EFT detail change</strong>",
     "<strong style=\"font-weight:600\">Session</strong>",
     "<strong style=\"font-weight:600\">Entire remittance stream</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "The federal record"
  },
  {
   "type": "p",
   "html": "HHS-OIG identified a scheme in which fraudsters diverted federal and state payments intended for providers, published in its work on Medicare and Medicaid payment risk. Enforcement activity through 2026 — including a National Health Care Fraud Takedown charging 455 defendants in June 2026 and a CMS crackdown on large-scale billing schemes announced in September 2026 — kept payment integrity at the centre of the agenda."
  },
  {
   "type": "p",
   "html": "Diversion losses are not published separately from broader health care fraud totals, so this article does not attribute a figure to it. The mechanism is documented; the aggregate is not."
  },
  {
   "type": "h2",
   "text": "Value tiering, because the population is not uniform"
  },
  {
   "type": "p",
   "html": "A solo behavioural health practice may receive a few thousand dollars per remittance cycle. A large health system may receive tens of millions. A uniform control is either too heavy for the first or too light for the second."
  },
  {
   "type": "ol",
   "items": [
    "Rank your provider population by trailing twelve-month remittance value.",
    "For the top decile, require an authorised-official signature on any EFT change, with the full account details rendered unmasked.",
    "For the middle, require the signature plus a hold with dual notification.",
    "For the smallest, retain the current process plus dual notification, which costs nothing."
   ]
  },
  {
   "type": "p",
   "html": "The top decile is typically a few hundred organisations covering most of the value. That is a tractable enrolment programme, not a population-scale one."
  },
  {
   "type": "h2",
   "text": "Who signs on the provider side"
  },
  {
   "type": "p",
   "html": "This question is worth resolving explicitly because getting it wrong recreates the problem."
  },
  {
   "type": "p",
   "html": "The signer should be the provider organisation's authorised official — the person already named in the enrolment record as authorised to act for the entity — under a delegation the organisation issues. Allowing any portal user to sign returns the control to session strength."
  },
  {
   "type": "h2",
   "text": "What the provider gets"
  },
  {
   "type": "p",
   "html": "A dual-sided receipt. The provider organisation holds independent evidence of what was requested, which is the artefact they currently lack when disputing a diversion."
  },
  {
   "type": "p",
   "html": "That matters commercially. Today a diverted provider is in a weak position with the payer: the change came through their own portal session. A signed record either shows their authorised official approved it, or shows they did not — and the second is far more useful to them than the current ambiguity."
  },
  {
   "type": "h2",
   "text": "Why the practice cannot protect itself"
  },
  {
   "type": "table",
   "caption": "Who holds which lever",
   "head": [
    "Party",
    "Lever",
    "Incentive"
   ],
   "rows": [
    [
     "Payer",
     "Controls the change process",
     "Bears no loss"
    ],
    [
     "<strong style=\"font-weight:600\">Practice</strong>",
     "<strong style=\"font-weight:600\">None — cannot gate its own record</strong>",
     "<strong style=\"font-weight:600\">Bears the loss</strong>"
    ],
    [
     "Clearinghouse",
     "Sees the remittance flow",
     "Intermediary, limited standing"
    ]
   ]
  },
  {
   "type": "p",
   "html": "This is the same misalignment as beneficiary designation, in a different industry. The practice cannot require a stronger control on its own record because the record is not theirs to configure."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Payers verify enrolment changes.”</strong> Against documents and knowledge, both obtainable. The question is whether an authorised person at the practice approved the change, which is different."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Reconciliation catches it.”</strong> At the next cycle, after several remittances. For a small practice that is a cash-flow event before it is a fraud event."
  }
 ],
 "faq": [
  {
   "q": "Is this Medicare-specific?",
   "a": "No. The same portal architecture and the same profile-field modelling exist across commercial payers, Medicaid programmes and Medicare Administrative Contractors."
  },
  {
   "q": "What about providers who will not enrol a credential?",
   "a": "Tier them. Small providers retain the current process plus dual notification; the control concentrates where value concentrates."
  },
  {
   "q": "Does CMS require this?",
   "a": "No. Provider enrolment requirements address identity and licensure verification at enrolment. Subsequent banking change authorisation is not prescribed."
  },
  {
   "q": "How quickly is diversion detected today?",
   "a": "Typically at reconciliation, which is one to two payment cycles. That interval is the exposure, and it is measurable within any provider organisation."
  },
  {
   "q": "Why can't the practice protect its own record?",
   "a": "Because the record is held and configured by the payer. The practice has no lever over the change process."
  },
  {
   "q": "What does the payer verify today?",
   "a": "Documents and knowledge, both obtainable. Not whether an authorised person at the practice approved the change."
  },
  {
   "q": "Why is reconciliation too late?",
   "a": "It catches the diversion after several remittances, which for a small practice is a cash-flow crisis before it is a fraud case."
  }
 ],
 "sources": [
  {
   "t": "FCC — protecting consumers from SIM swap and port-out fraud",
   "u": "https://www.fcc.gov/sim-swap-port-out-fraud"
  },
  {
   "t": "HHS Office of Inspector General enforcement",
   "u": "https://oig.hhs.gov/newsroom/"
  },
  {
   "t": "CMS announcements on billing scheme enforcement, 2026."
  },
  {
   "t": "CMS — Medicare provider enrollment",
   "u": "https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers"
  }
 ],
 "related": [
  {
   "slug": "rendering-attestation",
   "title": "Ghost providers and enrolment integrity",
   "category": "Vertical"
  },
  {
   "slug": "assignment-change-receipt",
   "title": "The rate confirmation that changed bank accounts",
   "category": "Vertical"
  },
  {
   "slug": "payment-integrity-control-map",
   "title": "$186 billion in improper payments",
   "category": "Compliance"
  },
  {
   "slug": "payroll-diversion-crisis-infostealer-malware-submits-unauthorized",
   "title": "Payroll diversion when the session is stolen",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Provider%20Banking%20Change%20Control/1500_900/blog.jpg",
 "wordcount": 901,
 "url": "/blog/provider-banking-change-control.html",
 "reading_time": "4 min read",
 "seo_title": "Provider payment diversion via the enrolment portal",
 "meta_description": "Schemes divert federal and state payments intended for providers. The change is a profile edit in an enrolment portal, found weeks later.",
 "hub": {
  "slug": "topics/payer-identity",
  "title": "Insurance and payer identity"
 },
 "answer": "Through a profile edit in an enrolment portal. HHS-OIG has documented schemes diverting federal and state payments intended for providers, and the mechanism is a change to the electronic funds transfer details — processed as routine paperwork and discovered weeks later during reconciliation.",
 "answer_q": "How are healthcare provider payments diverted?",
 "glossary": [
  {
   "term": "EFT enrolment",
   "def": "The process by which a provider registers the account payments are made to."
  },
  {
   "term": "Remittance advice",
   "def": "The statement accompanying payment, and frequently the first place a practice notices a diversion."
  },
  {
   "term": "Clearinghouse",
   "def": "An intermediary processing claims and remittances between providers and payers."
  }
 ],
 "checklist": {
  "title": "What a payer should require",
  "id": "payer",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Require a bound signature from a practice signatory.",
    "text": "Enrolled once, at enrolment."
   },
   {
    "name": "Render the delta.",
    "text": "Old and new account, and when it last changed."
   },
   {
    "name": "Notify the practice out of band, stating the new account.",
    "text": "Not merely that a change occurred."
   },
   {
    "name": "Hold the first remittance after a change.",
    "text": "The only realistic recovery window."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising person to the exact change or payout instruction, and produces a receipt a carrier, a beneficiary or a court can verify without calling the issuer.",
  "href": "../docs.html",
  "label": "See authorisation receipts"
 }
}