Federal Grant Payment Diversion: The Award Was Real, the Receiving Account Was Not

Federal grant payment diversion sends money awarded to a legitimate recipient into an impostor’s bank account. Fraudulent recipient account changes can redirect even a payment the real recipient requested. If you work in grant finance or payment support, you may recognize the contradiction: the system records a disbursement, but your organization never received the money.

The Department of Health and Human Services’ Office of Inspector General described exactly that mechanism in its June 2025 payment-system audit. From March 2023 through January 2024, impostors redirected funding from ten grants awarded to seven HHS recipients. The organizations had real awards. Someone else took control of where their payments went.

The Awarding Agency, the Recipient and the Payment Service

An awarding agency authorizes funding, a recipient requests money, and a payment service processes the disbursement. In this HHS example, the Program Support Center operated the Payment Management System, which recorded award authorizations, handled recipients’ payment requests and sent disbursement information back to awarding agencies. The service handled grants for HHS and other federal agencies.

The system transmitted payments through the Federal Reserve Bank or Treasury for deposit into recipients’ accounts. Payment Management Services staff handled account-change requests. Award authorization, the identity of the person requesting a change and the receiving bank account therefore answered different questions about the same money.

For someone familiar with federal grant records, this puts the destination of the payment in view. The audit described outsiders impersonating recipients whose grant funds they diverted. The recipient’s name on the award remained real while the account attached to it changed.

Federal Grant Payment Diversion and Recipient Account Changes

The impostors redirected payments by posing as grant recipients and changing banking and contact information. The audit found that they used fake recipient email addresses to request access as new users, then requested changes that included deleting valid users. The payment service had no process to confirm new users with already verified recipient personnel.

The audit described both payments requested by the impostors and payments requested by legitimate recipients that then went to the substituted accounts. A genuine request could finish the impostor’s work.

At the time, staff approving bank changes were not required to contact recipient personnel. After a change, the system sent confirmation only to the person requesting it. In these incidents, that person was the impostor.

The audit put diverted funding at over $10 million. Banks rejected over $2 million in deposits, leaving an actual loss of $7.8 million.

The Payment Record and the Missing Deposit

A grant accountant may know which award and payment request should have produced a deposit. A payment-support employee may know which account change was approved and who received its confirmation. Together, those records can connect an authorized payment to the wrong destination.

As with other government payment evidence, each record has a different job. The award identifies the intended recipient, the change history identifies the altered destination, and the disbursement record shows where the system sent the money. A recipient’s report of nonreceipt adds the contradiction that the payment status alone misses.

An affected recipient reported the first fraudulent withdrawal to the Payment Management Services Director on March 28, 2023. For an insider, the communication following such a report matters alongside the transaction: who learned that the payment was wrong, and who could act on it?

The Warning Stopped Below Leadership

The first reported withdrawal did not reach Program Support Center leadership for over nine months. The director informed the system’s security officer, who classified the activity as a non-cyber incident outside that officer’s responsibilities. The director then reported it to the inspector general, but did not inform senior leadership.

When the fraud was first reported, the impostors had withdrawn $643,733. Leadership eventually learned of the fraud on January 3, 2024, from an awarding agency. By then, nearly $7 million more had been withdrawn. The warning existed inside the organization while the money kept leaving it.

Even the system emails sent to awarding agencies and recipients in February and March 2024 left out specific incidents. They announced login changes and an identity-harvesting campaign without asking recipients to check their grant-account information for accuracy.

A later update put fraud reporting into an IT contingency plan used for service disruptions and disasters. The audit pointed out that fraud need not disrupt the service, so the plan might never be activated. A payment system can keep operating while sending money to the wrong people. That is exactly why the warning has to travel beyond the office that first receives it.

Why Payment Controls Have to Follow the Money

The inspector general’s Fall 2025 summary emphasized the same organizational failure: risk management was siloed, and fraud information did not move effectively among leadership, awarding agencies and recipients. The underlying audit found that business reviews overlooked outsiders diverting funds, while IT reviews left out risks in the payment process.

Combating Procurement Fraud in the Public Sector, published in Modern Anthology in Education, Administration, Science and Technology in 2025, examines identity theft and data manipulation in digital purchasing systems. It recommends separating responsibility for requesting, approving and paying, supported by records that make transactions traceable. Applied to a grant payment, that perspective makes the approval history useful evidence: whose identity was checked, who authorized the change and where the money went.

The HHS audit also found that staff vacancies and turnover hindered manual controls. Written procedures depended on trained people carrying them out, and oversight did not ensure that they did. For a payment-support employee, the difference between the written verification procedure and the review actually performed may be the part of the transaction only they can explain.

What Changed After the Diversion

The audit described layered verification of bank-account changes beginning in February 2024. Those checks required payment staff to verify that an authorized recipient user had requested the change before releasing the new bank information. In its response to the audit, the Program Support Center said reimbursement of affected recipients was completed in late 2024.

If you know how someone falsely claimed authority over a recipient’s account, we can assess what that means for a whistleblower case. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. We examine who made the representation, who knew about it and how it directed the payment.

When You Know Where the Payment Went

If you saw an approved account change that did not add up, or a missing-payment warning that went nowhere, speak with our whistleblower experts about the payment trail. We work beside you to connect the grant, the destination and the decisions inside the payment process, and bring in grant fraud whistleblower lawyers with the expertise your case needs. You bring the knowledge of what happened inside, and we stay with you as the case develops.