Where and how to report suspected Medicaid fraud

Report suspected Medicaid fraud to your state's Medicaid Fraud Control Unit (MFCU), which is a dedicated law enforcement office inside your state's Attorney General's office. Every state has one. You can also report to your state Medicaid agency directly, or to the federal Office of Inspector General (OIG) if the fraud involves multiple states or a large provider. The fastest route is usually your state's MFCU because they investigate fraud full-time and have the power to prosecute.

You do not need proof or a complete case — you need only a reasonable suspicion. Report what you observed, when you observed it, who was involved, and which Medicaid program (regular Medicaid, Medicare-Medicaid, managed care plan). Write down names, dates, and specific actions if you can. If you are a healthcare worker or Medicaid recipient reporting from inside the system, your report carries more weight because you have direct knowledge.

Most states accept reports by phone, mail, email, or online form. Some have a dedicated fraud hotline number on the back of the Medicaid card itself. You can report anonymously in most places, though providing your contact information helps investigators follow up if they need clarification.

Key Takeaways

  • Your state's Medicaid Fraud Control Unit, located in the Attorney General's office, is the primary agency that investigates Medicaid fraud and has the legal power to prosecute.
  • You can report fraud by phone, mail, email, or online form depending on your state, and you do not need complete proof — only a reasonable suspicion and specific details about what you observed.
  • The federal Office of Inspector General accepts reports of fraud that crosses state lines or involves large providers, and maintains a national hotline at 1-800-HHS-TIPS.
  • Most states allow anonymous reporting, though providing your name helps investigators confirm details and follow up with you if needed.
  • Healthcare workers, billing staff, and Medicaid recipients all have standing to report fraud, and retaliation against someone for reporting is illegal under federal law.

What counts as Medicaid fraud

Medicaid fraud is billing the program for services that were not provided, billing for more expensive services than were actually given, billing the same service twice, or submitting false information to get Medicaid coverage. Common examples include a provider billing for office visits that never happened, a pharmacy billing for prescriptions never filled, a nursing home billing for care levels higher than what the resident received, or a person lying about income or assets to get coverage they do not may have access to for.

Fraud is different from abuse, which is billing practices that are wasteful or unnecessary but not intentionally dishonest. Fraud requires intent to deceive. If a provider simply made a billing error or coded something incorrectly by accident, that is usually not fraud — but if they did it repeatedly or ignored corrections, it may cross into fraud.

How to find your state's Medicaid Fraud Control Unit

Search online for "[Your State] Medicaid Fraud Control Unit" or "[Your State] Attorney General Medicaid Fraud." The MFCU office is part of your state's Attorney General's office, so you can also call the main Attorney General line and ask for the fraud unit. Most states publish their fraud reporting phone number and mailing address on the state Medicaid website.

If you cannot locate your state's MFCU, call your state Medicaid agency directly — they can tell you where to report and may accept the report themselves. You can also report to the federal Office of Inspector General at 1-800-HHS-TIPS (1-800-447-8477) or online at oig.hhs.gov. The federal hotline is especially useful if you are reporting a large provider, a chain of facilities, or fraud that spans multiple states.

What information to have ready when you report

Gather as much detail as you can before you call or write. Write down the name of the provider (doctor, hospital, pharmacy, nursing home, managed care plan), the specific dates you observed the problem, what service was billed versus what was actually provided, and the names of any people involved. If you are a patient or family member, have your Medicaid number and any bills or explanation of benefits statements that show the suspicious charge.

If you are a healthcare worker or billing staff member, include the patient's Medicaid number, the claim number if you have it, and the amount billed. Describe exactly what you saw — for example, "The provider billed for a 60-minute office visit on March 15, but the patient was in the office for 10 minutes" is more useful than "The billing seems wrong." Dates and amounts matter because they help investigators pull the actual claim from the system.

You do not need to have all of this information. Report what you know. Investigators will request additional details if they need them.

Protection against retaliation for reporting

Federal law protects you from retaliation if you report Medicaid fraud in good faith. Retaliation means being fired, demoted, suspended, threatened, or harassed because you reported fraud. This protection applies whether you report to your employer, to the state MFCU, to the federal OIG, or to law enforcement.

If you are a healthcare worker and your employer retaliates against you for reporting fraud, you can file a complaint with the U.S. Department of Labor's Occupational Safety and Health Administration (OSHA). If you are a Medicaid recipient and your managed care plan or provider retaliates, report it to your state Medicaid agency. Keep records of the retaliation — dates, what happened, who was involved, and any witnesses — because you will need them if you file a complaint.

What happens after you report

The MFCU will review your report and decide whether to investigate. If they open an investigation, they will gather records from the provider, interview staff, and review billing claims. This process can take weeks or months. You will not usually hear back about the outcome unless you provided your contact information and the case is significant enough to warrant follow-up.

If the investigation finds fraud, the MFCU can prosecute the provider criminally, seek civil penalties, or both. The provider may be required to repay Medicaid, be excluded from the program (meaning they can no longer bill Medicaid), or face criminal charges. If the fraud involved a Medicaid recipient lying about income or assets, the state may recover the overpayment or refer the case to prosecutors.

You do not need to testify or be involved further unless you are subpoenaed as a witness. Most investigations proceed without the original reporter's involvement.

Reporting fraud you suspect as a Medicaid recipient

If you receive Medicaid and you see charges on your explanation of benefits that you did not authorize, or if you suspect a provider billed for services you did not receive, report it to your state Medicaid agency first. They can review your account and flag suspicious claims. You can also report directly to the MFCU using the same process as anyone else.

Keep copies of any bills, receipts, or explanation of benefits statements that show the problem. If a provider is billing for services you never received, write down the dates you did not go, the service that was billed, and the amount. If you suspect identity theft — someone using your Medicaid number without your permission — report it to both your state Medicaid agency and the MFCU, and ask to place a fraud alert on your account.

Frequently Asked Questions

Can I report fraud anonymously?

Yes. Most states allow anonymous reporting by phone or mail, and the federal OIG hotline accepts anonymous tips. Providing your name and contact information helps investigators follow up if they need clarification, but it is not required. If you do provide your name, ask the investigator about confidentiality protections in your state.

What if I am not sure whether something is fraud or just a billing error?

Report it anyway. You do not need to prove fraud — you only need to describe what you observed. Investigators are trained to tell the difference between intentional fraud and honest mistakes. If it turns out to be an error, no harm is done. If it is fraud, your report may stop it.

Will I get in trouble if my report turns out to be wrong?

No, as long as you reported in good faith based on what you actually observed. Good faith means you had a reasonable reason to suspect fraud, not that you were guessing or making accusations without any basis. Reporting something you genuinely believed was wrong will not result in legal consequences for you.

How long does a Medicaid fraud investigation take?

Investigations vary widely depending on the size and complexity of the case. A simple billing error might be resolved in weeks. A large provider with multiple suspicious claims might take months or longer. You will not usually receive updates unless you provided your contact information and the case results in prosecution.

What if the fraud involves my managed care plan?

Report to your state Medicaid agency and the MFCU the same way you would for any other provider. Managed care plans are required to follow the same billing rules as traditional Medicaid providers. You can also file a complaint with your state's insurance commissioner if the issue involves how the plan handled your coverage or claims.