Investigations by East Anglia Bylines’ Spotlight team show that for the two years between 2020 and 2022, staff at Thurrock Council’s NATIS worked on a criminal investigation into the theft of £1.1mn from Luton Borough Council. NATIS staff are not police officers – and it appears they can neither price nor provide an invoice for the work they did.
How much was that?
A Freedom of Information Act (FOI) request (ref FOI 3499) made by the Spotlight team revealed that Thurrock never produced an invoice for Luton Council or Bedfordshire Police for the work.
Thurrock stated that “it is not possible to calculate this as the costs of investigations were not separately recorded” and advised that a manual search would exceed the cost cap defined under Section 12 of the Freedom of Information Act.
NATIS – the National Investigation Service – is a specialist fraud investigation unit operated by Thurrock Council. Established in 2018, it investigates serious fraud and economic crime affecting public bodies and government funds. Although it works alongside police forces and government departments, its staff are council employees rather than police officers.
NATIS is no stranger to scrutiny
Much has already been written about NATIS and the ‘wasteful and inefficient’ service it operated when investigating Bounce Back Covid Loans (BBCL), which commenced in late 2020. We also covered how its predecessor, a partnership with Southend and Castle Point Councils, also known as the Counter Fraud Investigation Directorate, ended in acrimony in 2019. This is in addition to reporting by the East Anglia Bylines’ Spotlight team into the use of NATIS.police.uk website and branding, concerns over weak managerial oversight, and the gulf between what it was paid to investigate potentially fraudulent Covid Bounce Back Loan applications and what it recovered.
This latest investigation focused on what NATIS did between the end of the partnership with Southend and Castle Point in October 2019 and the beginning of the BBCL contract in September 2020.
What happened?
The Luton fraud itself took place in March 2020, just before the Covid-19 lockdown began, and involved money for the Mark Rutherford School, which had been awarded £1.1mn in local government funding during the 2019/20 financial year. The money was to be released to the school once key milestones in the building of a new education block had been achieved.
The South East Midlands Local Enterprise Partnership (SEMLEP) was the regional body responsible for administering the funding. SEMLEP confirmed that the milestones had been met and approved the claim on 26 February 2020. Luton made the payment on 6 March.
However, somewhere between 5 and 6 March, plans to divert the money appear to have been made, using what is known as a mandate fraud. Luton Borough Council, which manages financial services for SEMLEP, received a request to change the bank details for Mark Rutherford School. Luton complied.
The result was simple and costly. The £1.1mn was paid into a bank account set up by criminals. One of their IP addresses was in the Middle East.
The report also reveals that Luton was not the only authority targeted. Similar attempts were made against Bedford Borough Council at around the same time, but without success.
The fraud was not detected until 17 April 2020. After an internal investigation and contact with its bank, Luton informed SEMLEP that the payment made on 6 March had been misappropriated. SEMLEP immediately reported the matter to Action Fraud, at the time the national reporting platform for fraud and cybercrime, for assessment.
According to a report later provided by NATIS to Luton Council, Action Fraud passed the case to Bedfordshire Police’s cybercrime team.
A surprising decision and not the only one
Once the case was with Bedfordshire Police’s cybercrime team, Detective Inspector Tiling at Bedfordshire Police and Michael Dineen, NATIS’s Head of Crime Operations, then reviewed the report and agreed that NATIS would lead the investigation.
This decision raises an obvious question: what manner of agreement was in place between Thurrock Council and the police to allow this to happen?
An FOI request was made to Luton Borough Council in April 2026. Their response (ref LU27663) stated “Information relevant to the investigation was provided to Bedfordshire Police.” In a follow-up response to FOI 3499 Thurrock said that “3rd party material not provided by Bedfordshire Police was obtained by use of court orders and submission of requests in accordance with the Data Protection Act 2018” in an effort to identify those responsible.
Its digital forensics unit examined numerous devices through the summer and into late autumn 2020. NATIS also made direct enquiries to other local authorities and several companies. Those enquiries led to potential suspects and, according to the report submitted to Luton Council, checks were made on the Police National Computer aimed at identifying the registered owners of some 46 vehicles allegedly bought with money linked to the fraud.
These enquiries were inconclusive. In July 2021, over a year after the fraud, only 13 vehicles had been registered as being sold to new keepers; the remaining 33 vehicles were recorded as ‘notified no longer registered keeper’ and with no insurance, no MOT and/or marked as ‘In trade’.
The net is cast wider
As the investigation continued, it became clear that those believed to be behind the fraud had fled the UK.
By August 2022 the investigation was still incomplete. In section 5 of the report NATIS conceded that it had “been unable to establish, from the evidence held, who is behind the email compromise that enabled the fraud and attempted fraud”.
The report did indicate that the earliest identified unauthorised access of an email account related to the case was at 14.30 hrs on 4 February 2020 from an IP address in the United Arab Emirates. The report notes that the locations change regularly around the globe, suggesting a sophisticated breach intended to hide the attacker’s identity.
The suspects, so far as the report shows, remained at large. NATIS said arrangements had been made to create a record on the Police National Computer and have it circulated as wanted.
Who pays?
But we return to the most striking – and the most basic – detail. Based on our Freedom of Information requests to Luton (LU27663) and Thurrock (FOI/3499) councils, Thurrock never invoiced any organisation for the work undertaken by NATIS on the case. Further enquiries to Thurrock in response to that FOI suggest the council does not know the actual cost of the two-year investigation.
That is not a minor administrative gap. It goes to the heart of public accountability.
How much did it cost?
Commercial estimates for investigating a fraud involving around £1mn suggest that a figure in the region of £160,000 would not be unusual. Yet Thurrock appears unable to say what this investigation cost, who paid for it, or how that spending was tracked.
While the investigation was underway, NATIS entered into a service level agreement in September 2020 with the government’s Department for Business, Energy and Industrial Strategy, later the Department for Business and Trade, in relation to recovering money from Bounce Back Loans that had been obtained fraudulently.
But this case appears to have fallen outside that agreement. No third party was invoiced. The obvious question, then, is whether Thurrock council taxpayers ended up funding the investigation.
That leaves a serious and awkward possibility. If suspects were ever arrested and brought to trial, in order to recover its costs, Thurrock Council’s own fraud unit might first need to be subjected to forensic accounting to establish what it had spent pursuing the case.
The original fraud remains unresolved. But so too does a second question, and it points back at Thurrock itself: how did a council fraud unit run a major criminal investigation without keeping track of the cost?
Thurrock Council was approached for a comment regarding the source of the funding for the investigation, but no response was received.
More from East Anglia Bylines
Truth is power
Nominate an organisation that needs scrutiny
