FinCEN Advisory FIN-2021-A001 — COVID-19 Health Insurance & Health Care Fraud (Feb. 2, 2021)

Record facts

Summary

FinCEN Advisory FIN-2021-A001, issued February 2, 2021 by the Financial Crimes Enforcement Network, alerts financial institutions to health insurance and health care frauds related to the COVID-19 pandemic. It describes fraud types targeting Medicare, Medicaid/Children's Health Insurance Program (CHIP), TRICARE and private insurers, including unnecessary services, billing schemes, kickbacks, telefraud and telehealth schemes, and fraudulently obtaining COVID-19 health care relief funds. The advisory lists financial red flag indicators grouped under headings such as potential fraudulent businesses and kickbacks and money laundering. Its case studies include an indictment of two owners of New York pharmacies charged in a $30 million health care fraud and money laundering case. It asks institutions to reference the key term FIN-2021-A001 in SAR field 2 and to select SAR field 34(g).

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

1
Introduction
The Financial Crimes Enforcement Network 
(FinCEN) is issuing this advisory to alert financial 
institutions to health insurance and health care 
frauds related to the COVID-19 pandemic.  These 
frauds target Medicare, Medicaid/Children’s 
Health Insurance Program (CHIP), and TRICARE 
as well as health care programs provided through 
the Departments of Labor and Veterans Affairs 
(collectively, “health care benefit programs”) and 
private health insurance companies.  In addition, 
the United States government has observed frauds 
in connection with COVID-19 relief funds for health 
care providers, such as those provided under the 
Paycheck Protection Program and Health Care 
Enhancement Act (PPP-HCEA).1  This advisory 
contains descriptions of COVID-19-related fraud 
involving health care benefit programs and health 
insurance, associated financial red flag indicators, 
select case studies, and information on reporting 
suspicious activity. 
This advisory is based on FinCEN’s analysis of 
COVID-19-related information obtained from Bank 
Secrecy Act (BSA) data, public reporting, and law 
enforcement partners.  Additional COVID-19-related information is located on FinCEN’s website 
at https://www.fincen.gov/coronavirus, which also contains information on how to register for 
FinCEN Updates.
1.	
See Pub. L. No. 116-139.
Advisory on COVID-19 Health Insurance-
and Health Care-Related Fraud
While FinCEN has observed a wide range of COVID-19 related fraud, this advisory 
primarily focuses on COVID-19-related fraud involving the health care industry.   
This Advisory should be shared with:
•	Chief Executive Officers
•	Chief Operating Officers
•	Chief Compliance Officers
•	Chief Risk Officers
•	AML/BSA Departments
•	Legal Departments
•	Cyber and Security Departments
•	Customer Service Agents
•	Bank Tellers
FIN-2021-A001  
February 2, 2021
SAR Filing Request:
FinCEN requests financial institutions 
reference this advisory in SAR field 
2 (Filing Institution Note to FinCEN) 
and the narrative by including the 
following key term: “FIN-2021-A001” 
and select SAR field 34g (health care 
– public or private health insurance).  
Additional guidance for filing SARs 
appears near the end of this advisory.

F I N C E N  A D V I S O R Y
2
Financial Red Flag Indicators of COVID-19 Health Insurance- and Health 
Care-Related Fraud Activity
Law enforcement and financial institutions have detected numerous instances of potential frauds 
related to health care benefit programs, health insurance, and COVID-19 health care relief funds.2   
Criminals are adapting known health insurance and health care fraud to take advantage of the 
pandemic.  The following are representative types of this illicit activity:
•	 Unnecessary services: Ordering or submitting claims for expensive tests or services that do 
not test for COVID-19, oftentimes in conjunction with COVID-19 testing, such as medically 
unnecessary and expensive respiratory testing, allergy testing, genetic testing, narcotics 
screening, or whole-body health assessments,3 or providing testing for services not usually 
rendered by the company.  
•	 Billing schemes: Billing for services not provided, or overbilling (e.g., upcoding or unbundling), 
when administering or processing COVID-19 testing and treatments.4
•	 Kickbacks: Paying service providers or purported marketing organizations an illegal kickback or 
bribe in exchange for ordering, or arranging for the ordering of, services and testing.
•	 Health care technology schemes: False and fraudulent representations about COVID-19 testing, 
treatments, or cures are used to defraud insurance carriers and to perpetrate fraud on the 
financial markets by defrauding investors.5 
•	 Telefraud and telehealth schemes: Collecting beneficiaries’ personally identifiable information (PII), 
including Medicare information.  Solicitations will often link their requests for information to 
COVID-19 treatment and prevention, such as testing or protective equipment.  Fraudsters then 
submit fraudulent claims for payment from health care benefit programs.  Fraudsters have also 
used the stolen PII to submit fraudulent telehealth services claims.6    
2.	
For information concerning frauds related to the COVID-19 vaccine, see FinCEN Notice, FIN-2020-NTC4, “FinCEN 
Asks Financial Institutions to Stay Alert to COVID-19 Vaccine-Related Scams and Cyberattacks,” (December 28, 2020).
3.	
See Department of Justice (DOJ) Press Releases, “United States Attorney’s Office Announces Charges in Fraud Cases 
Related to COVID-19,” (May 27, 2020) and “Georgia Woman Arrested for Role in Scheme to Defraud Health Care 
Benefit Programs Related to Cancer Genetic Testing and COVID-19 Testing,” (May 15, 2020). 
4.	
See DOJ Press Releases, “Two Owners of New York Pharmacies Charged in a $30 Million COVID-19 Health Care 
Fraud and Money Laundering Case,” (December 21, 2020); and “United States Attorney’s Office Announces Charges 
in Fraud Cases Related to COVID-19,” (May 27, 2020).  Upcoding occurs when a provider bills the insurance company 
for higher and more expensive levels of medical service than were actually performed.  Unbundling fraud occurs 
when a provider bills for multiple codes for a group of procedures that are covered in a single global billing code.
5.	
See DOJ Press Release, “Medical Technology Company President Charged in Scheme to Defraud Investors and Health 
Care Benefit Programs in Connection with COVID-19 Testing,” (June 9, 2020).  For additional information, including 
red flags for fraudulent COVID-19 testing, treatments, and cures, see FinCEN Advisory, FIN-2020-A002, “Advisory on 
Medical Scams Related to the Coronavirus Disease 2019 (COVID-19),” (May 18, 2020).
6.	
See HHS-OIG Fraud Alert, “COVID-19 Fraud is Rapidly Evolving,” (Last update, December 21, 2020) and
“National Telefraud Takedown Scheme” (Current as of September 2020).

F I N C E N  A D V I S O R Y
3
•	 Fraudulently obtaining COVID-19 health care relief funds: Filing false claims and applications for 
Federal relief funds,7  such as those provided under the Coronavirus Aid, Relief, and Economic 
Security (CARES) Act’s Provider Relief Fund,8 the PPP-HCEA,9 or the Economic Impact 
Disaster Loan (EIDL) program, and the claim or application has a nexus to health care benefit 
programs.10 
•	 Identity theft leading to additional fraud: Targeting beneficiaries for their PII and then using the 
stolen PII to commit COVID-19-related fraud against health care benefit programs.11   
To discern whether a health insurance fraud is COVID-19-related, financial institutions should 
assess whether the activity occurred around or after the Secretary of Health and Human Services’ 
public health emergency declaration of January 31, 2020,12 and whether the underlying purported 
service relates to COVID-19.
As no single financial red flag indicator is necessarily indicative of illicit or suspicious activity, 
financial institutions should consider all surrounding facts and circumstances before determining 
if a transaction is suspicious or otherwise indicative of potentially fraudulent activities related to 
COVID-19.  In line with a risk-based approach to compliance with the BSA, financial institutions 
also are encouraged to perform additional inquiries and investigations where appropriate.  
FinCEN identified the financial red flag indicators described below to alert financial institutions to 
fraud related to health insurance and health care, and to assist financial institutions in detecting, 
preventing, and reporting suspicious transactions related to such COVID-19-related fraud.  
Such financial red flag indicators may include: 
Additional, medically unnecessary services or billing schemes 
	After the COVID-19 public health emergency declaration, a health care service provider’s 
account receives or continues to receive:  (1) health care benefit program or health insurance 
payments well above the provider’s estimated business transactions; or (2) payments at 
7.	
See DOJ Press Releases, “Florida Man Charged with COVID Relief Fraud, Health Care Fraud and Money 
Laundering,” (July 29, 2020); “Florida Man Charged with COVID Relief Fraud and Health Care Fraud,” (July 10, 
2020); and “Ophthalmologist Previously Charged with Health Care Fraud Indicted For Defrauding SBA Program 
Intended To Help Small Businesses During COVID-19 Pandemic,” (June 24, 2020).
8.	
See U.S. Department of Health and Human Services (HHS), “CARES Act Provider Relief Fund,” (Last reviewed on 
January 21, 2021).
9.	
See Pub. L. No. 116-139.  For more information about unemployment insurance fraud, not necessarily connected to the 
health care industry, see FinCEN Advisory, FIN-2020-A007, “Advisory on Unemployment Insurance Fraud During the 
Coronavirus Disease 2019 (COVID-19) Pandemic,” (October 13, 2020).
10.	 See Pub. L. No. 116-123 and U.S. Small Business Administration, Information Notice 5000-20037, “Guidance 
Regarding Identification and Reporting of Suspicious Activity in the COVID-19 EIDL Loan Program,” (July 22, 2020).
11.	 See HHS-Office of Inspector General (OIG) Fraud Alert, “COVID-19 Fraud is Rapidly Evolving,” (Last update, 
December 21, 2020).  For more information about identity theft related to COVID-19 relief efforts, including red 
flags, see FinCEN Advisory, FIN-2020-A005, “Advisory on Cybercrime and Cyber-Enabled Crime Exploiting the 
Coronavirus Disease 2019 (COVID-19) Pandemic,” (July 30, 2020); and FinCEN Advisory, FIN-2020-A003, “Advisory 
on Imposter Scams and Money Mule Schemes Related to Coronavirus Disease 2019 (COVID-19),” (July 7, 2020).
12.	 See HHS, “Determination that a Public Health Emergency Exists,” (January 31, 2020).

F I N C E N  A D V I S O R Y
4
the same volume despite an expected diminished activity level during the public health 
emergency (e.g., a non-emergency medical transport company receiving higher than expected 
payments during stay-at-home orders).
	A health care service provider’s account receives health care benefit program or health 
insurance payments beyond the expected type or volume of service, based on staffing and 
other characteristics of the business (e.g., processing COVID-19 tests when the medical facility 
does not typically offer diagnostic services, or the facility is processing a high volume of tests 
despite only employing a few medical personnel).  
	A COVID-19-related health care service provider’s business account has unusual transaction 
activities, such as payments for personal or medically irrelevant expenses (e.g., payments to 
automobile dealers, travel agents, or retailers of luxury goods).
Potential fraudulent businesses
	Following the COVID-19 public health emergency declaration, personal or business accounts, 
especially ones that did not previously receive health care-related payments, begin receiving 
steep increases in health care benefit program or health insurance payments.
	A purported health care service provider’s account receives health care benefit program or 
health insurance payments related to COVID-19 services, and then individuals immediately 
withdraw the funds in a manner that is not typical for health care businesses (e.g., cashier’s 
checks, cash withdrawals, certain types of Automated Clearing House (ACH) transfers, or 
domestic and international wire transfers).
	After the COVID-19 public health emergency determination, a purported health care 
provider’s account does not receive small-dollar check deposits, payments from merchant fee 
servicers, or cash payments from patients that would indicate patient copayments.  This may 
indicate the absence of actual business activity.  
	A newly formed health care business account has a volume or type of payment that seems 
inconsistent with expected levels of activity for such an account.
	The physical location of a purported medical facility receiving reimbursements for COVID-19-
related health care services or relief funds is non-existent, a residential address, a commercial 
mail receiving agency address (e.g., a UPS Store address), or another non-office building 
address (e.g., a purported medical facility is listed as a laboratory, but the physical address is 
a vacant lot, car dealership, restaurant, or retail store).  
	The purported laboratory, health care service provider, or medical service personnel or their 
counterparties appear to have a minimal web presence, or one that begins around the time of 
the COVID-19 public health emergency declaration.

F I N C E N  A D V I S O R Y
5
	Following the public health emergency declaration, the physical location of a purported medical 
facility receiving payments for health care services or relief funds is far from the physical 
location of the majority of its patients or the providers purported to be practicing there, unless 
the facility is providing appropriate telehealth services (e.g., a purported medical facility located 
in a western state receives payments related to patients residing on the East Coast).
Kickbacks and money laundering
	After the COVID-19 public health emergency declaration, a health care service provider’s or 
other business account begins having overly complex, medical-related transactions involving 
multiple counterparties indicative of possible structuring, layering, kickbacks, or fraudulent 
medical claims.
	A health care service provider’s account makes frequent or unusually large payments 
recorded as advertising or marketing expenses, or makes recurring round-dollar payments 
to one or multiple individuals in a manner inconsistent with its payroll-related withdrawals.  
The payments may reference “director fees,” “consulting fees,” “marketing,” or “business 
process outsourcing.”   
	A health care service provider starts receiving payments from laboratories and health 
care services companies, but there is no financial documentation (e.g., operating expense 
payments) that the provider rendered legitimate services.  When questioned, the provider 
indicates that he or she invested in the company and the payments are dividends or payments 
for services (e.g., a laboratory pays a physician for services related to a COVID-19 laboratory 
test).  The tests, however, are not related to the physician’s specialization or do not normally 
require a physician’s involvement.  
Fraudulently obtaining COVID-19-relief funds13
	An account with no previous known association with providing health care services, receives 
an unexpected or excessive COVID-19-related payment that appears to be the CARES Act’s 
Provider Relief Fund or the PPP-HCEA payments.  Shortly after the account receives the deposit, 
an individual(s) withdraws the funds via large cash withdrawals, cashier’s checks, wires to an 
overseas account, transfers to personal accounts, or payments for non-business expenses.  
	An account previously associated with providing health care services but that has not been 
recently active or appears to be defunct, receives an unexpected or excessive COVID-19-related 
payment that appears to be the CARES Act’s Provider Relief Fund or the PPP-HCEA payments.  
	An account holder receives a substantial amount of reimbursements from health care benefit 
programs or health insurance companies for services rendered at the same time that the 
account holder receives COVID-19-related unemployment insurance payments.14
13.	 These red flag indicators pertain only to suspicious activity with a nexus to the health care industry and COVID-19.  
For non-health care industry suspicious activities related to COVID-19, please review FinCEN’s prior COVID-19 
related advisories and notices located on FinCEN’s website at https://www.fincen.gov/coronavirus.  
14.	 For more information about COVID-19-related unemployment insurance fraud, see FinCEN Advisory,
FIN-2020-A007, “Advisory on Unemployment Insurance Fraud during the Coronavirus Disease 2019 (COVID-19) 
Pandemic,” (October 13, 2020).

F I N C E N  A D V I S O R Y
6
Case Studies
Two Owners of New York Pharmacies Charged in a $30 Million COVID-19 
Health Care Fraud and Money Laundering Case15 
Federal authorities indicted two owners of several New York-area pharmacies for their alleged 
roles in a $30 million health care fraud and money laundering scheme.  The indictment alleges 
that the defendants acquired control over dozens of New York pharmacies by paying others 
to pose as the owners of the pharmacies and hiring pharmacists to pretend to be supervising 
pharmacists at the pharmacies, for the purpose of obtaining pharmacy licenses and insurance 
plan credentialing.  According to the indictment, the defendants used COVID-19 emergency 
override billing codes to submit fraudulent claims to Medicare, for which they were allegedly 
paid over $30 million for medications that never were purchased by the pharmacies, prescribed 
by physicians, or dispensed to patients.  The defendants frequently filed such claims during 
periods when pharmacies were non-operational, and used doctors’ names on prescriptions 
without their permission.  
The indictment also alleges that, with the proceeds of the fraud, the defendants engaged 
in a complex, money laundering conspiracy where they created sham pharmacy wholesale 
companies and fabricated invoices to legitimate pharmaceutical drug purchases.  In a first 
phase, the defendants conspired with an international money launderer who arranged for 
funds to be wired from the sham pharmacy wholesale companies to companies in China for 
distribution to individuals in Uzbekistan.  The defendants received cash in exchange, provided 
for by members of the Uzbekistani immigrant community to an unlicensed money transfer 
business for remittance to their relatives in Uzbekistan, minus a commission that was deducted 
by the money launderer.  In a second phase, when the amount of fraudulent proceeds exceeded 
the amount of cash available in the Uzbekistani immigrant community, the defendants directed 
the international money launderer to transfer funds back from the sham wholesale companies 
to the defendants, their relatives, or their designees, in the form of certified cashier’s checks and 
bags of cash.  The defendants used the proceeds of the scheme to purchase real estate and other 
luxury items.  
15.	 See DOJ Press Release, “Two Owners of New York Pharmacies Charged in a $30 Million COVID-19 Health Care Fraud 
and Money Laundering Case,” (December 21, 2020).

F I N C E N  A D V I S O R Y
7
Medical Technology Company President Charged in Scheme to
Defraud Investors and Health Care Benefit Programs in Connection
with COVID-19 Testing16
The president of a California-based medical technology company allegedly paid kickbacks 
and bribes to marketers and doctors to run an allergy screening test for 120 allergens on 
every patient regardless of medical necessity.  As the COVID-19 pandemic progressed and 
many patients in the United States faced difficulty obtaining access to COVID-19 testing, the 
company president sought to expand the pre-existing allergy test scheme and capitalize on a 
national emergency for financial gain by combining the COVID-19 test with the more expensive 
allergy testing which did not identify or detect COVID-19.  In addition, the company president 
allegedly made false claims to investors concerning the company’s ability to provide accurate, 
fast, reliable, and cheap COVID-19 tests.  The Fraud Section of the Criminal Division of the 
Department of Justice and the U.S. Attorney’s Office for the Northern District of California 
charged the individual in connection with his alleged participation in schemes to mislead 
investors, to manipulate the company’s stock price, and to conspire to commit health care 
fraud in connection with the submission of over $69 million in false and fraudulent claims for 
allergy and COVID-19 testing.  HHS-OIG, the U.S. Postal Inspection Service, the Federal Bureau 
of Investigation, the Veterans Affairs Office of Inspector General, and the Defense Criminal 
Investigative Service investigated the case.
Information on Reporting Suspicious Activity
Suspicious Activity Report (SAR) Filing Instructions
SAR reporting, in conjunction with effective implementation of BSA compliance requirements 
by financial institutions, is crucial to identifying and stopping health insurance and health care 
frauds, including those related to the COVID-19 pandemic.  Financial institutions should provide 
all pertinent information in the SAR.  Following these filing instructions will make it easier for 
FinCEN, law enforcement, supervisors, and other relevant government agencies to identify and 
utilize the information submitted in the SAR.17  
•	 FinCEN requests that financial institutions reference this advisory by including the key term 
“FIN-2021-A001” in SAR field 2 (Filing Institution Note to FinCEN) and the narrative portion 
of the SAR to indicate a connection between the suspicious activity being reported and the 
activities highlighted in this advisory.  
16.	 See DOJ Press Release, “Medical Technology Company President Charged in Scheme to Defraud Investors and Health 
Care Benefit Programs in Connection with COVID-19 Testing,” (June 9, 2020).
17.	 FinCEN requests that financial institutions only reference this advisory if the suspicious activity relates to the 
health care industry and COVID-19.  For non-health care industry suspicious activities related to COVID-19,
please review FinCEN’s prior COVID-19 related advisories and notices located on FinCEN’s website at
https://www.fincen.gov/coronavirus.

F I N C E N  A D V I S O R Y
8
 •	 Financial institutions also should select SAR field 34(g) (health care – public or private health 
insurance) as the associated suspicious activity type to indicate a connection between the 
suspicious activity being reported and COVID-19.  Financial institutions should include 
additional detail about the type of health care fraud (e.g., Medicare – services not provided) 
in the narrative.  
•	 FinCEN requests that financial institutions wishing to report potential health care fraud 
unrelated to COVID-19 should not include this advisory’s key term in SAR field 2 or the 
SAR’s narrative portion.  Instead, please select field 34(g) and detail the activity in the 
narrative (e.g. addiction treatment – services not provided; or pain clinic – “marketing” fees). 
•	 Please refer to FinCEN’s May 2020 Notice Related to the Coronavirus Disease 2019 
(COVID-19) which contain information regarding reporting COVID-19-related crime, and 
remind financial institutions of certain BSA obligations.
For Further Information
Financial institutions should send questions or comments regarding the contents of this advisory to 
the FinCEN Regulatory Support Section at frc@fincen.gov. 
To report suspected heath care fraud, waste, or abuse within Medicare, Medicaid, CHIP, or the 
Marketplaces, please go to the following website to determine the best resource to notify:
https://www.cms.gov/About-CMS/Components/CPI/CPIReportingFraud.
For the general public to report suspected fraud, waste, or abuse in Medicare or Medicaid call the 
HHS OIG at 1-800-HHS-TIPS (1-800-447-8477).
The mission of FinCEN is to safeguard the financial system from illicit use, 
combat money laundering and its related crimes including terrorism, and 
promote national security through the strategic use of financial authorities 
and the collection, analysis, and dissemination of financial intelligence.

File and source

File

FIN-2021-A001_Health-Care-Fraud_2021-02-02.pdf

Size

638,586 bytes

SHA-256

874438ad2960fee4c103f5975c0c883d1050a69986780f0c2fc1cb970cd4b73a

Our copy

FIN-2021-A001_Health-Care-Fraud_2021-02-02.pdf

Original

www.fincen.gov