The NDIS pays out $46.3 billion a year. A company three weeks old can start billing it, because nobody checks the age of a provider's ABN at the registration gate.

The 33-warrant week

The AFP commander who ran the November 2025 week of action described the conduct his officers were chasing in plain terms.

"The AFP will not stop in its pursuit of these groups who chop and change companies."

AFP Commander Jason Kennedy, 19 November 2025.

"Chop and change companies" is not a turn of phrase. It is the mechanism. A network registers an entity, bills the scheme, and dissolves the entity before compliance catches up, then does it again under a new name and a new ABN. The detection signal that would catch it earliest - a brand-new ABN attached to a fresh provider registration - is the signal the gate does not read.

The pipeline

The mechanics are public. Incorporating a company is near-instant. Obtaining an ABN is near-instant. A provider registration application takes a matter of weeks to process. Once approved, billing can begin. A fraudulent network can operate for months before the pattern of claims attracts scrutiny, then wind the entity up and start again. The Fraud Fusion Taskforce has described disrupting more than 2,500 providers with problematic claiming patterns05. ESTIMATED

The clearest documented example of the multiple-entity structure is Operation Banksia, one of the six operations in the November 2025 week. The AFP alleges a syndicate operating several NDIS providers across Western Sydney and Adelaide claimed more than $40 million, including, on the AFP's account, claims submitted for participants who were incarcerated at the time the supports were supposedly delivered01. It was an investigation with charges anticipated, not yet laid, at the time of the release. It is an allegation.

Where the cycle has run to its conclusion, the courts have convicted. In October 2024, under Operation Pegasus, three people were jailed over a $5.8 million combined NDIS and GST fraud, with combined sentences of 12 years and 10 months and more than $2 million in assets restrained02. VERIFIED That case is the pipeline completed: register, bill, extract, and, for once, get caught.

The cheapest signal

The age of an ABN at the moment a provider seeks registration is the cheapest fraud signal available. Checking it is a single automated lookup against a public register: the Australian Business Register already publishes the registration date of every ABN. A registration flow that flagged any provider applying with an ABN under twelve months old for enhanced due diligence would cost an API call, not an Act of Parliament.

The scheme does not require it. In October 2025 the Auditor-General found the NDIS Quality and Safeguards Commission's regulatory functions only "partly effective" and its regulatory decision-making "not guided by a risk-based strategy", and recorded that the audit did not examine provider registration in detail at all03. VERIFIED What the gate does screen is the people: in deciding whether to register an applicant, the Commissioner must have regard to whether a banning order has ever been in force against the applicant or any of its key personnel06. VERIFIED What it never asks is anything about the number behind the provider beyond the fact that one exists. A known bad actor can be stopped at the gate by name; a first-time operator with a clean record and a three-week-old ABN cannot, because the age of the number is not a question the gate asks. ANALYSIS

The scheme is not failing because fraud is sophisticated. The November 2025 operations describe networks running the oldest trick there is: a new company, a new number, a fresh start. It is failing because the cheapest check, the age of the number behind the provider, is not made at the point where a provider first reaches the money. ANALYSIS

Macdara Ó Murchú