A procurement kickback is an arrangement in which someone with influence over purchasing receives something of value from a vendor in exchange for steering work, approving inflated invoices, or keeping competitors out. It is classified as corruption rather than theft, and that classification explains why these cases run so long. No asset goes missing. The invoice matches the purchase order, the goods arrive, the bank reconciliation clears. What the company never receives is the price it would have paid in a real competition.
Corruption appeared in 45% of the cases studied in the Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations, which examined 2,402 cases across 143 countries. The median scheme ran 12 months before detection. Caught inside six months, the median loss was $40,000. Past five years, it exceeded $1.1 million. Duration decides the number, and procurement schemes are built to last.
Three parties and a funding mechanism
Every kickback needs an insider with influence, an outside vendor willing to pay for that influence, and a way to move money from the company to the vendor and back to the insider. Remove any one and the scheme stops working.
Almost all detection work is really a search for the third element, because the funding mechanism is the only part that has to touch the company's books. The vendor has to generate the cash somewhere, and the only somewhere available is the company's own spend. It gets priced in through inflated unit rates, phantom line items, change orders, duplicate charges, unearned rebates, or a pass-through that adds margin for doing nothing. Whichever route, it leaves a trail in accounts payable.
That reconstruction is work an internal audit function is usually not scoped or resourced to do, a line we drew in more detail in when to call a forensic accountant versus your internal audit team.
How they get built
These schemes are almost never designed at the outset. They accumulate, and each stage leaves a different kind of evidence.
It starts with ordinary hospitality. Meals, tickets, a round of golf. None of it is criminal and most of it is not against policy. What it establishes is that the insider will accept things from this vendor without disclosing them. That result is the vendor's real return on a year of entertainment spend.
Then the steering begins. Specifications get written around one vendor's capabilities. Bid windows compress until only the incumbent can respond. Sole-source justifications appear with thin support. Competitors are invited but not seriously considered, which produces a bid file that looks complete and is not.
Then the money has to move, which is the stage that creates the documents.
Then both sides protect it. The insider becomes the only point of contact and resists rotation. Complaints get handled informally rather than logged. Renewals happen quietly. The insider takes little vacation, because coverage means someone else opening the file. The ACFE found 84% of perpetrators showed at least one behavioral red flag before detection, and in procurement the usual one is refusing to let anybody else own the relationship.
Complementary bidding
Competitors submit deliberately weak bids so a chosen vendor wins high. The file looks healthy because three quotes are in it. The Justice Department's Procurement Collusion Strike Force prosecutes this in publicly funded work and reported more than 200 investigations opened and more than 85 guilty pleas and convictions as of April 30, 2026. The same mechanics run in private procurement, where nobody is watching.
The shell or pass-through vendor
An entity connected to the insider is inserted into the chain. It takes the order, forwards it to the real supplier, and adds margin for handling nothing. Easy to find, rarely looked for, because the entity is registered and invoices cleanly.
Over-billing with a split
Real work delivered at an inflated rate, with a share returned. Most common wherever output is hard to measure: consulting, staffing, marketing production, maintenance, IT support. Also the hardest to quantify afterward, because proving the loss means proving what the work should have cost.
Change order abuse
The vendor wins on a competitive base bid, then recovers the margin through change orders that never face competition. Construction and capital projects are the natural home. The tell is a vendor whose jobs consistently finish well over bid while its competitors' do not.
The soft kickback
No money moves at all. A job for a family member, use of a vacation property, work done on a house, a position promised after the insider leaves. These are badly underestimated, because there is no payment to trace and they survive a first-pass financial review untouched.
Why the controls miss it
Kickbacks exploit approval authority rather than access to cash, which is why the standard separation between who holds an asset and who records it does nothing here. The ACFE found more than half of all cases involved either missing controls or an override of controls that existed. In procurement, the override is usually performed by the person the control was written to constrain.
Five gaps come up again and again. Nobody owns the vendor master file, so new vendors can be created by the same people who approve their invoices. Approval thresholds exist but nothing tests for purchase orders sized to sit underneath them. Sole-source justification forms get filed and never reviewed as a pattern. Conflict disclosure is an annual signature rather than an event tied to the procurement itself. And nobody rotates, so the same buyer owns the same vendor for years.
Rotation is unpopular and it is the most effective structural control available, because it forces a second person to open the file. The training data points the same way: organizations that trained both staff and management reported median losses of $84,000 per case against $150,000 where neither was trained. Tips remained the leading detection method at 43% of cases, most from employees.
How do you actually detect one?
By testing procurement data for patterns that competitive markets do not produce. None of this requires specialized software. It requires someone with the authority to pull the data and the independence to act on what it says.
Vendor master tests
Match vendor addresses, phone numbers, and bank details against the employee file. Flag vendors sharing an address or account with another vendor. Flag any vendor whose registration date sits within 90 days of its first purchase order. Flag vendors with no web presence, no other customers, and a P.O. box.
Spend concentration
Rank vendors by growth rather than volume. A vendor moving from $40,000 to $600,000 in 18 months with no change in scope is worth an afternoon. Then invert it and rank buyers by how much of their category spend goes to one vendor.
Threshold and split testing
Plot purchase order values as a distribution. Real procurement produces a smooth curve. A scheme running under an approval limit produces a spike immediately below it. Then look for same-vendor, same-week orders that would have crossed the line if combined.
Bid file review
Pull the losing bids, not the winning one. The Antitrust Division teaches a four-part test it calls MAPS: market, applications, patterns, suspicious behavior. In practice that means checking proposals for shared handwriting, typos, or arithmetic errors, checking whether document properties show two competing proposals were created or edited by one vendor, reviewing prior awards for rotating winners or a winner who subcontracts to the losers, and flagging any bidder that plainly could not perform the work it bid.
Change order analysis
Calculate final contract value as a percentage of awarded value, by vendor and by project manager. Rank both lists. Start where the same name sits at the top of each.
If you hold federal contracts
The Anti-Kickback Act of 1986, codified at 41 U.S.C. chapter 87, prohibits providing, soliciting, or accepting a kickback, and separately prohibits building its amount into a contract price charged up the chain. Section 8703 goes further than most compliance officers expect. A prime or subcontractor with reasonable grounds to believe a violation may have occurred must report it promptly and in writing to the inspector general of the contracting agency, the agency head where there is none, or the Attorney General. Covered primes must also maintain procedures designed to prevent and detect violations, an obligation that does not attach to prime contracts of $100,000 or less or to commercial products and services.
Section 8707 provides a fine and up to 10 years imprisonment for knowing and willful conduct. Section 8706 lets the government recover twice each kickback plus up to $10,000 per occurrence, with a six-year limitations period, and separately recover the amount from a company whose employee or subcontractor provided or accepted one. Under section 8705 a contracting officer can simply offset it against what is still owed. One point the other way: section 8703 treats having reported as favorable evidence of responsibility in a later debarment proceeding. The implementing clause sits at 48 CFR 52.203-7, with FAR 3.502-2 summarizing how it fits together.
If the arrangement is purely commercial
Where no government contract is involved, the exposure is state law and the federal fraud statutes. New Jersey's commercial bribery provision, N.J.S.A. 2C:21-10, makes it a crime to solicit, accept, or agree to accept a benefit as consideration for knowingly violating a duty of fidelity owed as an agent, employee, partner, trustee, or fiduciary. It is graded on the value of the benefit, and anything above $75,000 is a second degree crime. It reaches the insider directly and needs no federal hook.
If the vendors were coordinating with each other
Two or more vendors arranging their bids moves the conduct from commercial bribery into criminal antitrust. Where foreign officials or foreign intermediaries are involved the analysis shifts again, into ground covered in building an FCPA compliance program that holds up under 2026 DOJ scrutiny and how to vet a foreign business partner.
When an allegation lands
The first 48 hours decide how much of the case survives. The instinct to bring the employee in and ask is the most reliable way to lose it.
Engage counsel first, so what follows sits under privilege. Preserve email, messaging, and shared drive content for the buyer, the vendor contacts, and everyone in the approval chain, and suspend any deletion schedule that touches them. Pull the accounts payable and purchase order data yourself rather than asking the subject's department. Say nothing to the vendor. Do not change the employee's system access in a way that signals a review, because access changes are visible and they trigger destruction.
Scope quietly, then decide. If the data holds up, the next questions are about recovery and referral, and those are covered in can you recover money stolen by an employee. If it is heading for litigation, whoever performed the analysis will have their credentials and independence examined, which is why the standards in what makes a credible expert witness in a white collar fraud case matter long before anything gets filed.
Frequently Asked Questions
How long do these schemes usually run before anyone catches them?
The ACFE's 2026 study found a median of 12 months across all occupational fraud, with losses climbing sharply the longer a scheme continues. Procurement schemes sit at the longer end, because they generate no accounting exception and the relationship they depend on is one the company believes is going well.
Can internal audit handle a kickback allegation?
Internal audit can surface the indicators and often does. What it is usually not positioned to do is interview a subject, handle evidence to a standard that survives challenge, or produce work that holds up if the matter becomes litigation or a referral. Independence is also a practical problem when the subject sits inside the reporting line.
Is accepting gifts from a vendor illegal?
Not by itself. The line is consideration. A gift becomes a kickback when it is exchanged for a decision the recipient owed the company in good faith. That is why disclosure policies matter more than dollar limits. The undisclosed gift is the one that proves the vendor can buy discretion.
What is the difference between a kickback and a bribe?
The terms overlap in practice. A bribe is generally paid to induce a decision. A kickback is generally paid out of the proceeds of a decision already made, which means the company funds its own loss. Kickbacks are self-financing, and that is why they scale.
Do we have to report a suspected kickback?
It depends on the contract. Federal primes and subcontractors under the anti-kickback clause carry a written reporting obligation once they have reasonable grounds to believe a violation may have occurred. Purely commercial companies generally do not, though industry regulation, insurance conditions, and lending covenants can each create one. That is a question for counsel on the specific facts.
Can we get the money back?
Often, though it depends on how fast the matter is scoped and where the value went. Routes include restitution, civil action against both the employee and the vendor, fidelity bond or crime policy claims, and offset against what is still owed under the contract. Each carries a different evidentiary burden.
Start with a conversation
If a vendor relationship at your company does not sit right, the useful next step is a quiet look at the data, not a conversation with the buyer.
Falcon Consulting Group conducts procurement and vendor fraud reviews, forensic accounting engagements, and internal investigations for companies across New Jersey and the New York metro area. Our associates include former FBI, IRS-CI, and Inspector General investigators alongside CPAs and Certified Fraud Examiners.
You tell us what you are seeing. We help you work out whether this is a data question, an interview question, or something that needs counsel involved from day one. Review our services or contact us for a confidential discussion. Everything said in that first conversation stays there.
Thomas W. Raftery III served 22 years as an FBI Special Agent and was the first appointed Inspector General for the Delaware River Port Authority. He deployed with the Special Inspector General for Afghanistan Reconstruction, is a Certified Fraud Examiner, and holds an MBA from Drexel University with a concentration in accounting.
This blog post is for informational purposes only and does not constitute legal advice or a legal opinion. Consult qualified counsel regarding any specific situation.