Your NHS Anti-Fraud Service is drawing attention to identity ‘imposters’ in the workplace,
where fraudsters masquerade as others (usually genuine NHS workers).

Very recently, our team was involved in the arrest of an individual on site at an NHS Trust
who was impersonating a healthcare worker. Enquiries are ongoing to establish whether the
genuine worker was complicit in the deception.

This is not the first time that we have seen this type of fraud across the region (and more
widely) and the need for police involvement because, clearly, there may be a real risk about
who the imposter actually is and whether they may be a source of potential harm to patients,
staff or visitors, let alone a fraud or theft risk.

The fraud element is, in reality, not always the primary concern when these issues arise in
the workplace.

The genuine worker may be known to the imposter, may be coerced into providing their
identity by some other means if not known to them, or there may be no known connection
between the two. The genuine worker’s identity details, and a fake ID badge in the worker’s
name, but with the imposter’s photo, is utilised.

The genuine worker has been through the necessary recruitment and vetting process, and
the fraudster is “swapped in” either at the outset, or at a later stage with the fake ID badge;
for example, when they may be moving from one health body to another, or even from one
ward or department to another within the same health body. Sometimes, the collusion is
between the genuine worker and the imposter (if they are known to each other) or by the
agency if they are involved as well.

At another NW Trust, an agency worker (who had worked over 100 shifts) was identified as
an imposter. When challenged they ran off, so the Ward Manager phoned the police (in the
middle of the night, at the weekend). The police took the imposter’s bag / phone and then
found out from the agency where the real person lived (whose name had been used) and
visited them as part of their enquiries.

As a result of this imposter being identified, staff at this organisation were reminded of the
risk to patients and themselves (as well as fraud), and that everyone should be responsible
for identifying imposters. Consequently, a few weeks later, another workplace imposter was
identified promptly and prevented from working at the Trust.

Whilst this fraud risk is not as prevalent as other NHS frauds we see, there are a rising
number of reported concerns which has prompted the release of this alert and provision of
some guidance around how this issue might be addressed.

Some steps to take to help prevent workplace imposter fraud:

• If something doesn’t seem right, don’t be afraid to speak up. Talk to your manager about your concerns as soon as possible, if you can.
• Don’t challenge anyone whom you have concerns about directly. You don’t know how they may react.
  It is everyone’s responsibility to be alert to the risk of ‘workplace imposters’ and to do what they can to protect patients, colleagues, visitors and NHS resources.
• Managers are reminded that they should always check ID for new staff on their wards / departments – particularly (but not only) if they have come via an agency.

Minimal checks should include:

• If possible, check with colleagues if the worker has come from another area of the organisation, to confirm it’s the same individual that they worked with and if they had any concerns.
• Check their identity badge to make sure it looks genuine and doesn’t feel like it’s been altered (i.e. has a different photo been attached, or has it been written over, or does it look like other badges from that agency).
• Do they actually look like their photo? Does their age look about right? Be alert to the fact that a worker’s formal name isn’t always the name which they may have on their agency ID badge, if an ID badge is even provided (i.e. for personal preference or for ease of pronouncing their name).

Enhanced checks might also include:

• Maintaining a ward register signed-off by the Nurse-in-Charge (NIC) to confirm that the ID badge name is the same as the name of the agency worker who has been booked; some organisations even maintain a photo library of agency worker badges to ensure consistency of checks.
• Some Trusts provide agency workers with CIS/Smart Cards, but to get these they have to bring photo ID (passport, driver’s license) with them to verify it is actually them. This can then be used by the NICs when checking ID on the wards.
• Some Trusts have a policy whereby all agency workers must go to the Security Office to get access cards for that shift before they can start work. They must provide photo ID (driver’s licence, passport) to obtain the access card and must carry the card/ID badge with them while on duty.
• Depending on the role the worker will be undertaking, and whether they might present any risks to patients or colleagues, don’t be afraid to not deploy the worker if you genuinely have concerns that the person is not who they claim to be.

Fraudster ‘social engineering’ works on the principle that people will be offended if they are challenged, so valid questions from responsible managers are not always asked due to that potential for embarrassment.

Ensuring that only appropriate individuals and workers have access to patients, staff and visitors is far more important than any perceived social discomfort.

Reporting Concerns / Obtaining Advice

If you have any concerns please contact your Anti-Fraud Specialist.