Whistleblowers and the False Claims Act

Whistleblowers and the False Claims Act
Core statute	False Claims Act, 31 U.S.C. §§ 3729–3733
Relator share	15–25% (intervened), 25–30% (declined)
FY2025 FCA recoveries	More than $6.8 billion (record)
FY2025 qui tam filings	1,297 (record)
SEC program	Dodd-Frank § 922; 10–30% of sanctions over $1 million
ACFE tip rate	43% of occupational frauds detected by tips (2024)

A whistleblower is a person who reports suspected wrongdoing to an organization, regulator or prosecutor. In U.S. fraud enforcement, whistleblowing is both a legal status, which carries retaliation protection and sometimes a financial award, and the single most productive detection channel. The False Claims Act (FCA) lets private persons, called relators, sue on behalf of the government in qui tam actions against anyone who defrauds federal funds. Together with the SEC, CFTC, IRS, FinCEN and DOJ programs, it forms a bounty-based system that turns insiders into the principal source of evidence in many federal enforcement cases.^[1]

1 Why tips matter

The ACFE's Occupational Fraud 2024 found that 43% of cases were detected by tip, more than internal audit, management review or external audit combined; employees supplied 52% of tips, customers 21% and vendors 11%, and web-based hotlines (40%) and email (37%) were the most common channels.^[2] The share has been stable across editions of the Report to the Nations. For the examiner, this means that an anti-retaliation policy and credible follow-up are detection controls, not only legal compliance. Organizations with hotlines detected fraud faster and with lower median losses than those without (see Occupational Fraud).

2 The False Claims Act

The FCA, first enacted in 1863 to combat Civil War contractor fraud, imposes liability on any person who knowingly presents a false claim, makes a false record or statement material to a claim, conspires to do so, or knowingly conceals or avoids an obligation to pay the government (§ 3729(a)(1)). “Knowingly” includes actual knowledge, deliberate ignorance and reckless disregard; no specific intent to defraud is required. Remedies are treble damages plus a per-claim civil penalty that is adjusted annually for inflation. The Supreme Court tightened the materiality element in Universal Health Services v. Escobar (2016) and held in United States ex rel. Schutte v. SuperValu (2023) that liability turns on the defendant's actual subjective belief, not what an objectively reasonable person might have believed.

Qui tam mechanics. The relator files a complaint under seal in federal court and serves the government with a written disclosure of material evidence. The seal lasts at least 60 days and is routinely extended while DOJ and agency Offices of Inspector General investigate, often for years. DOJ then intervenes (takes over the case), declines (the relator may proceed alone) or moves to dismiss. A successful relator receives 15–25% of the recovery if the government intervenes, and 25–30% if it does not, plus attorneys' fees. The first-to-file bar, the public-disclosure bar and the original-source exception limit later or copycat relators. In United States ex rel. Zafirov v. Florida Medical Associates, a Florida district court held the qui tam mechanism unconstitutional under the Appointments Clause in 2024; on 1 September 2026 the Eleventh Circuit reversed, holding that relators are not officers of the United States and that the qui tam provisions satisfy the Appointments Clause; it remanded two further challenges (Vesting and Take Care Clauses) to the district court, so the provision stands but litigation over it continues.^[7] Readers should check its current status.

Scale. DOJ reported more than $6.8 billion in FCA settlements and judgments in fiscal year 2025, the highest annual total in the statute's history, including more than $5.3 billion (77%) from qui tam suits. Relators filed a record 1,297 new qui tam actions that year, up from 980 in FY2024, and DOJ opened 401 matters on its own. Healthcare accounted for more than $5.7 billion.^[3][4] Typical theories are upcoding and medically unnecessary services, kickbacks that render claims false (Anti-Kickback Statute), Medicare Advantage risk-adjustment, Paycheck Protection Program loan fraud, customs-duty evasion, defective pricing and small-business set-aside fraud, and, since 2021, cybersecurity non-compliance by contractors under DOJ's Civil Cyber-Fraud Initiative.

3 Other federal programs

Program	Authority	Award	Notes
SEC Whistleblower	Securities Exchange Act § 21F (Dodd-Frank § 922, 2010)	10–30% of sanctions over $1 million	FY2025: about 27,000 tips; more than $60 million awarded to 48 individuals (down from over $255 million to 47 in FY2024)[5]
CFTC Whistleblower	Commodity Exchange Act § 23	10–30% of sanctions over $1 million	Funded by Customer Protection Fund
IRS Whistleblower	26 U.S.C. § 7623(b)	15–30%, where tax, penalties and interest exceed $2 million	Form 211; see Tax Fraud and Evasion
FinCEN AML/sanctions	AML Act of 2020; 31 U.S.C. § 5323	10–30% of sanctions over $1 million	Also covers sanctions violations; see Sanctions and Export Controls
DOJ Corporate Whistleblower Awards Pilot	Criminal Division program launched 1 Aug 2024; amended 12 May 2025	Discretionary, tied to forfeitures over $1 million	Added procurement, trade/tariff/customs, sanctions and immigration-related offenses to the original priority areas (financial institutions, corruption, healthcare fraud against private insurers)[6]

The SEC rules require voluntary, original information leading to a successful enforcement action; submissions are accepted anonymously through counsel. Under Digital Realty Trust v. Somers (2018), Dodd-Frank's anti-retaliation provision protects only those who have reported to the SEC, not those who reported solely internally. The AML Act's whistleblower provisions were extended in 2022 to cover sanctions violations, and a FinCEN program awards are funded from collected penalties.

4 Retaliation protections

• FCA § 3730(h): reinstatement, two times back pay with interest, special damages and fees; three-year limitation period from the retaliatory act. Protects acts “in furtherance of” an FCA action and efforts to stop violations.
• Sarbanes-Oxley § 806 (18 U.S.C. § 1514A): protects employees of public companies, and their contractors, who report mail, wire, bank or securities fraud, or violations of SEC rules, to a supervisor, federal agency or Congress. A complaint must be filed with OSHA within 180 days; the employee may go to federal court if no final decision issues within 180 days. Remedies include reinstatement, back pay with interest and special damages. The Supreme Court in Lawson v. FMR LLC (2014) extended coverage to employees of private contractors of public companies, and in Murray v. UBS Securities (2024) held that a SOX plaintiff need not prove retaliatory intent, only that protected activity was a contributing factor.
• Dodd-Frank § 21F(h): two times back pay for SEC reporters; six-year limitations period.
• SEC Rule 21F-17: prohibits agreements, including severance and NDAs, that impede communication with the SEC. The SEC has brought repeated settled actions against firms whose confidentiality clauses lacked a carve-out for regulator reports.
• Anonymous reporting and confidentiality: most programs allow counsel-submitted anonymous tips, while the FCA seal and IRS rules protect identity until litigation.

5 Forensic evaluation of a tip or complaint

An examiner, in-house investigator or relator's counsel receives a narrative, perhaps with documents. The central task is to convert allegations into testable propositions and corroborate them with independent records before expending resources or making any accusation. The following protocol reflects common practice and professional guidance on interviewing and chain of custody.

5.1 Intake and triage

1. Record the allegation verbatim (who, what, when, which system, which contract or claim numbers) and the channel and time of receipt. Do not ask leading questions that put names into the complainant's mouth.
2. Classify against the Fraud Tree and the legal theory (false claim, kickback, revenue recognition, etc.) to determine the records that would prove or disprove it.
3. Preserve before you probe. Issue or request a legal hold on email, ERP and billing data. Take forensic images of relevant devices where authorized, and hash the files. Avoid alerting the subject: access logs may be reviewed by the subject's IT staff.
4. Score credibility without prejudging: firsthand versus secondhand knowledge, specificity, documents provided, motive (grievance, pending termination) and consistency. Motive does not negate truth, and a grievance-driven relator may still be right.

5.2 Corroboration tests

• Claims-data analysis. For healthcare allegations, extract paid claims by billing code and provider. Compare the distribution of E/M levels (99213 vs 99215) to peer-specialty benchmarks; a provider billing the top level for 80% of visits when peers average 25% is an outlier worth examining. Test for impossible days (more than 24 hours of services in a day), unbundling, duplicate claims and services after patient death.
• Contract and cost testing. For a government contractor, tie invoices to timesheets, labor-category qualifications and delivery receipts; test whether charged labor categories match the actual staff's credentials; re-perform indirect-rate allocations.
• Kickback tracing. Map payments from the vendor or manufacturer to referral sources, including speaker fees, “consulting” and grants; compare the timing and amounts against referral volumes (see Anti-Bribery Statutes). Open Payments data (CMS) is a public cross-check for payments to U.S. physicians.
• Timeline construction. Build a dated chronology from emails, calendar entries, system logs and document metadata to test the complainant's account and identify who knew what and when, which is the scienter evidence.
• Interviews in sequence. Start with neutral process witnesses and end with the subject, using the funnel approach in Interviewing. Upjohn warnings are given to employees interviewed on behalf of the company.

5.3 What each technique yields

Technique	Evidence produced	Element proved
Claims-code outlier analysis	Exhibit comparing provider vs peer distribution, with sample claim list	Falsity; supports extrapolation
Statistically valid sample (RAT-STATS) of medical records	Error rate with confidence interval, extrapolated overpayment	Falsity and damages
Email and chat review (keyword plus threading)	Communications showing awareness	Knowledge (scienter)
Payment tracing to referral sources	Flow-of-funds schedule	Remuneration, link to referrals
Metadata and log forensics	Authorship, edits, access times	Backdating, alteration

6 Worked example: sizing FCA damages

This is a hypothetical illustration. Suppose a probe sample of 100 paid claims from a population of 20,000 claims (total paid $4.0 million) shows 22 claims were upcoded, with an average overpayment of $85 per error across the sample. The point estimate of overpayment per claim is 22 × $85 / 100 = $18.70, extrapolated to 20,000 claims = $374,000. Because that is a sample, the examiner reports a confidence interval; if the standard error gives a 90% lower limit of $290,000, that conservative figure is commonly used for repayment demands. Under the FCA, single damages of $374,000 may be trebled to $1.12 million, plus per-claim penalties (for example 22 sampled false claims, or all identified false claims if separately provable, multiplied by the current penalty range), before any settlement discount for cooperation. Statistical extrapolation is accepted in many courts but is contested; the underlying methods are covered in Analytical Methods and Fraud Detection Analytics, and testimony standards in Daubert Standard.

7 Pitfalls

• A whistleblower who takes privileged documents or exceeds authorized access can create exposure for themselves and taint the evidence; counsel usually directs preservation rather than copying.
• Public-source corroboration (federal spending data, court dockets, Open Payments, SEC filings) is permissible and often decisive, but see OSINT Ethics before contacting potential witnesses.
• Many tips are wrong or incomplete. Examiners should state clearly when an allegation could not be corroborated.
• Statutes, award percentages and agency policies change; verify current text before relying on this summary.

See also: Occupational Fraud, ACFE Report to the Nations, Federal Enforcement Agencies, Tax Fraud and Evasion, Sanctions and Export Controls.

References

1. 31 U.S.C. §§ 3729–3733 (False Claims Act). law.cornell.edu
2. ACFE. Occupational Fraud 2024: A Report to the Nations. acfe.com
3. Vinson & Elkins. "DOJ's Prioritization of False Claims Act Cases Results in Settlements and Judgments Exceeding $6.8 Billion in FY 2025." velaw.com
4. Taxpayers Against Fraud. "Fiscal Year 2025 Numbers at a Glance." taf.org
5. SEC. Annual Report to Congress on the Dodd-Frank Whistleblower Program, Fiscal Year 2025. sec.gov
6. Foley & Lardner. "DOJ Criminal Division Updates Part 2: Corporate Criminal Whistleblower Awards Pilot." May 2025. foley.com
7. United States ex rel. Zafirov v. Florida Medical Associates, LLC, 11th Cir., Sept. 1, 2026 (reversing the M.D. Fla. 2024 ruling); see law-firm summaries, e.g. millerchevalier.com. Primary opinion not independently retrieved.