NDIA Accountability Project

Lack of oversight for unregistered NDIS providers impacting vulnerable people

‹ PrevPage 1 of 11 · Source p. 1Next ›

INDEPENDENT INVESTIGATION

NDIS PROVIDER INTEGRITY

They Don’t Exist. But

They’re Getting Paid.

A street-by-street audit of every registered NDIS provider in one Sydney postcode — Fairfield (2165), New South Wales — and what happened when the public register went dark.

INV EST IG ATO R D AT A S C O P E
Dennis Rigon NDIS provider register 1,075 listings reviewed
68 · Pensioner · Sydney Fairfield LGA 2165 864 unique providers

Dennis Rigon — Independent researcher · Fairfield LGA 2165, NSW · June 2026 Page 1 of 11

INDEPENDENT INVESTIGATION | NDIS PROVIDER INTEGRITY

FAIRFIELD LG A 2165, NSW

I am 68 years old and I am a pensioner. I am not a registered NDIS provider and derive no income from the scheme. Over recent weeks, working alone at a laptop and using only free, publicly available tools, I checked every registered NDIS provider listed in one Sydney postcode, one address at a time. What I found is set out here. The uncomfortable question it raises is not about me. It is about why a $50 billion national scheme’s own systems did not find it first.

W H E R E T H I S B E G AN

Why I Started

I did not start with a spreadsheet. I started with my sister. She is a woman living with disability, and she is the reason any of this exists.

Early in 2026 she was approached by an operator working from a local shopfront — not registered with the NDIS, and not a registered aged-care provider — trading under a name almost identical to that of a legitimate service. It was the second time she had been targeted this way: on an earlier occasion, too, an operator that was not a registered NDIS provider had coerced her into trying to leave her legitimate provider. This time, she was encouraged to sign documents on a phone she does not know how to use, with no paperwork and no explanation of her rights. An email account in her name, which she cannot operate, was then used to contact her existing, legitimate provider and attempt to move her care across without her knowledge. It was stopped by a single piece of luck: a staff member at her real provider copied me, her authorised representative, into the email. Without that, the transfer would have gone through and she would never have known.

I reported it. The aged-care regulator closed the file, and so did the disability scheme — each on the same ground: the operator was not registered with them, so it was not their concern. That answer is what made me dig. If an operator that targets a vulnerable person can fall outside both the NDIS and My Aged Care simply by never registering, then how many others are there, and how would anyone ever know? I could not check the unregistered operators; no public list of them exists. But I could check the registered ones. So I took a single postcode — my sister’s — and looked at every registered NDIS provider in it, one address at a time. This report is what I found.

W H Y T HIS M AT T E RS

If an operator never registers, it can look as though no one is responsible for

what it does to you. ‘Not registered’ became the reason no one acted — and it happened to my sister twice.

THE METHOD

One Address at a Time

I downloaded the public provider data for the Fairfield local government area (postcode 2165) — filtered to providers the NDIS had paid in the previous three months — and assessed it manually. This is the most important point about the sample: these are not dormant registrations. Every provider in this audit had received public money in the last quarter. For each listing I located the registered business address on street-level map imagery to see whether anything resembling a disability-support service actually stood there, and I visited the provider’s website where one existed. I recorded a concern only where the available evidence did not support a functioning service at the registered address. The classifications are deliberately conservative — they are verification observations and investigative leads, not findings of fraud against any named entity.

THE NUMBERS

More Than Half Cannot Be Cleanly Verified

I assessed 1,075 listings — 864 unique providers once multiple outlets of the same ABN are merged — every one a provider the scheme had paid in the previous three months. Every registered address was checked on street-level imagery; every available website was visited. This is what I found.
LISTINGS REVIEWED VERIFIED CLEAR (48%)
HIGH / EXTREME RISK
SUSPICIOUS

| FOR REVIEW | NOWEB SITE | | CONFIDENTIAL ADDRESS | LOW TRANSPARENCY |

Of the 1,075 listings, 516 — just 48% — could be verified as genuine. The other 559 (52%) carried at least one integrity concern: 58 high or extreme risk, 318 suspicious, and the rest flagged for review or verification — with hundreds more lacking a website, a checkable address, or any public presence at all.

                                         Fairfield LGA 2165 — 1,075 listings by risk classification.

WHAT THE GOVERNMENT HAS ALREADY SAID

This Is Not an Attack on the Scheme

It is offered in the same spirit the Minister for the NDIS, Senator Jenny McAllister, has invited from the public: she has said repeatedly that some of the most important intelligence about wrongdoing comes from outside the Agency, and that the NDIA has now assessed tens of thousands of tip-offs. What follows is that kind of intelligence — done systematically, one address at a time, for a single postcode.

The size of the problem is officially acknowledged. On Sunrise on 4 May 2026 the Minister confirmed the Agency’s own estimate that integrity leakage runs at about 8 per cent of the scheme, adding that the Government considers that figure too high. The former head of the Australian Criminal Intelligence Commission had earlier estimated it could be in the order of 15 to 20 per cent. The higher figures used later are not my invention — they sit within the range officials have themselves put forward.

The ghost-provider pattern is real and is being prosecuted. The same interview concerned Operation Benz — a case in which an individual is accused of submitting fake claims to their own fake NDIS business. That is precisely the pattern this audit found recurring: a registration and a bank account, but no identifiable service at the address. My finding is simply that it is not a one-off; it is a structural class of listing that the public register cannot currently distinguish from a genuine operator.

The enforcement build is welcome — but it sits downstream. The Government has grown the integrity workforce from around 30 to around 500, stood up the Fraud Fusion Taskforce, and is expanding mandatory registration from 1 July 2026. Those measures mostly act after a claim is made. The Minister has said the next step is to “stop this activity before it begins.” The gap is exactly there: nobody in registration verifies that a provider physically exists where it says it does. That is the cheapest prevention control, and it is missing.

THE PROJECTION

If These Rates Held Nationally

These are the provider-level rates from one postcode. As an indicative extrapolation — not a measurement — if the same proportions held across the national provider population this sample is drawn from (on the order of 67,000 active providers), that would imply, in round terms:

  • ~3,750 ~18,300 ~33,500 HI GH / EXTR EM E R ISK SUSPI C IOUS C AR R YI NG A CONC ER N

This is a projection of patterns observed in one area, offered only to indicate scale. It is not a count of confirmed cases and should be tested against the national data.

THE FINANCIAL IMPLICATIONS

The Government Admitted 8.3%

On 1 May 2026 the NDIA’s integrity transformation chief told the parliamentary inquiry that “integrity leakage” ran at about 8.3 per cent of roughly $45 billion in scheme payments — in the order of $3.7 billion a year, combining criminal fraud with accidental non-compliance.

— NDIA testimony to the parliamentary inquiry, 1 May 2026

That 8.3 per cent is the figure the Agency itself put on the record, and the Minister has called it too high. The chart below shows what the annual cost would be at that rate and at higher rates, applied to the same ~$45 billion base. The higher figures are not estimates attributed to anyone — they are arithmetic sensitivities, included to show how quickly the numbers move.

| Annual leakage at the NDIA’s own 8.3% rate and at higher illustrative rates, applied to ~$45bn in payments | |

WHAT IT COSTS YOU

On the Government’s own 8.3% figure, that is roughly $10 million leaking from the scheme every day — money meant to reach people with disability.

THE GHOST PROBLEM

You Can’t Find Them — But the NDIS Pays Them

STORY 1 — THE ADDRESSES THAT LEAD NOWHERE

Across Fairfield, registered NDIS providers cannot be found at the address on the public register.

Using street-level imagery and mapping, I checked every registered address in the dataset. 45 high-risk listings showed a closed shopfront, a residential house, an empty lot, or no business of any kind at the registered location — the ‘ghost’ pattern. A separate 61 listings give their registered address as ‘CONFIDENTIAL’, removing the ability to verify a premises at all. A legitimate provider has premises, staff and clients; a ghost provider has a registration, an ABN and a bank account. A system built on self-reporting struggles to tell the two apart. All of these listings were active on the register at the time of review.

SUGGESTED LINES OF INQUIRY

How are providers with no verifiable premises still registered and being paid? Does the Commission conduct site checks? How long have these listings carried unverifiable or confidential addresses?

THE ADDRESS PROBLEM

Many Providers, One Letterbox

STORY 2 — THE SAME ADDRESS, SEVERAL COMPANIES

A recognised fraud marker: different registered entities clustering at one address.

318 listings (29.6% of the sample) carry an address-based flag — 148 showing multi- tunit address masking, 156 with address inconsistencies that do not reconcile with mapping, and 14 operating from residential premises. Separately, 129 listings are registered across just 52 addresses, meaning multiple different ABNs share a single street address. Multi-unit masking — registering from a high-rise building, serviced office, mail-forwarding service, or an industrial unit shared by many entities — is well documented. The ABN is real and the address exists, but no identifiable disability-support business operates there. NDIS registration does not require physical verification of a business address.

SUGGESTED LINES OF INQUIRY

Has the Commission ever audited address clustering? What payment volume is associated with providers at shared commercial addresses?

THE TRANSPARENCY PROBLEM

No Website. No Answers. Still Paid.

STORY 3 — THE “GHOST” INVISIBLE PROVIDERS

A large share of providers cannot be found, contacted or verified online. 296 listings have no website at all. A further 124 carry so little public information that legitimacy cannot be independently assessed — no contact staff name, no verifiable service description, no usable contact identity other than a mobile number. Together that is roughly one in three listings. This matters for participants and families, not only investigators. A person in Fairfield trying to find trustworthy support is navigating a register where a large minority of listed businesses have no visible presence. Registered providers are not required to maintain a public web presence, so they can collect public funds while remaining opaque to the people depending on them.

SUGGESTED LINES OF INQUIRY

Is the Commission aware of the scale of the transparency gap? Does it run digital audits? What recourse does a participant have when a provider cannot be verified?

INDEPENDENT INVESTIG ATION | NDIS PROVIDER INTEGRITY | FAIRFIELD LG A 2165, NSW

A N E W D E V E L O P M E N T The Register Has Gone Dark

This audit was only possible because the public provider data, downloaded on 29 May 2026, included each provider’s full registered street address — which is what allowed one person to check, address by address, whether a service actually stood there.

As at 19 June 2026, that data is gone. A fresh download of the same Fairfield postcode returns 675 listings with not one street address among them — every entry now shows a suburb only, or “confidential.” The same is true of a second, unrelated postcode, Maitland (2320), where none of 220 listings carries a street address. The bulk data export has also been withdrawn, and the NDIS’s own ‘find a provider’ guidance now describes the finder as returning only website, phone, email and suburb. No public explanation for the change has been published.

And a third change, the most consequential of all. The 29 May data could be filtered to providers that had been paid in the previous three months — the very filter this audit’s sample was drawn from, and the single public signal that linked an unverifiable listing to money actually leaving the scheme. That filter no longer appears on the public tool. The ghosts can still, with effort, be seen; which of them are being paid can no longer be seen at all. Unlike a home address, there is no privacy reason to conceal whether a provider has been paid public money.

29 May       19 June       0 / 895
  F ULL STR EET ADD R ESSES         0 STR EET ADDR ESSES — SUBUR B     ADD R ESSES  I N THE 19 JUNE
        PR ESENT                        ONLY                           PULLS

There may be a legitimate privacy reason — many providers are sole traders working from home. But the effect is the same whatever the motive: the single piece of information that lets anyone confirm a provider physically exists has been removed from public view. It protects the provider’s address at the cost of the public’s ability to verify the provider is real.

This matters most for the people the scheme exists to serve. A disabled person choosing a provider can now look up only a suburb and a phone number; for roughly two in five Fairfield listings there is no website either. ‘Registered’ and ‘a real, findable business’ have been quietly decoupled — at the very moment the Agency says fraud is its priority and that the answer is more registration.

IF Y O U’ RE C H O OS I NG A PR OV I DE R T O D AY

You can see a suburb, phone number, email maybe website — and nothing else. You cannot independently check that the business is real or that anyone is actually there. ( there is no longer a physical address) You now have to take its word for it.

Dennis Rigon — Independent researcher · Fairfield LGA 2165, NSW · June 2026 Page 9 of 11

INDEPENDENT INVESTIGATION | NDIS PROVIDER INTEGRITY | FAIRFIELD LG A 2165, NSW

WHAT I AM ASKING

Questions for the Commission and the Ministers

I am not in a position to determine which listings represent fraud, error, or legitimate arrangements I could not see. That is the job of the Agency and the regulator. But the patterns are consistent enough to warrant answers to the following:

  • Does the NDIS Quality and Safeguards Commission verify a physical business address before granting registration — and does it conduct any site checks afterwards? If not, why not?
  • How many registered providers currently hold a “confidential” registered address, and how is the existence of those providers confirmed?
  • Has address clustering — multiple unrelated ABNs at a single address — ever been systematically audited across the register?
  • What public-presence or transparency requirement, if any, applies to a registered provider receiving public funds?
  • Will the mandatory-registration and digital-payment measures now in train verify that a provider physically exists where it claims to operate — not merely that it has registered?
  • Why, as at June 2026, does the public register no longer display street-level addresses or offer a bulk data export — and was the change subject to any public consultation?
  • Why is the public no longer able to filter the register for providers paid in the past three months — the one signal that linked an unverifiable provider to money actually leaving the scheme?
  • If that change protects provider privacy, what now allows a participant — or the public — to verify that a registered provider physically exists at a genuine place of business?
  • What public money has been recovered from providers that cannot be located — and where recovery is not possible, what becomes of those funds?

What is being done to recover the millions already lost to fraud and return them to taxpayers — and will those responsible face the full force of the law, or will it be quietly written off?

INDEPENDENT INVESTIGATION | NDIS PROVIDER INTEGRITY | FAIRFIELD LG A 2165, NSW

ABOUT THE INVESTIGATOR

Dennis Rigon

Independent researcher · Sydney, Australia

I am a old pensioner. I am not a registered NDIS provider and derive no income from the scheme. I undertook this work because the scheme matters — it exists to support some of the most vulnerable people in the country, and every dollar paid to a provider that does not really exist is a dollar taken from someone who needs it.

I conducted this assessment alone, in my own time, one address at a time, so the findings would be defensible rather than fast. The complete dataset — every listing, classification and note — is available for independent examination, and I am happy to walk through the methodology with the Agency, the Commission, or a parliamentary inquiry.

If a 68-year-old pensioner with a laptop can check an entire postcode by hand, I cannot understand why an agency of thousands, with full access to the payment data, has not done the same for the rest of the country.

These classifications reflect what could or could not be verified from public information. They are investigative leads, not findings of fraud against any named entity, and should be independently confirmed before any are relied upon.

Dennis Rigon — Independent researcher · Fairfield LGA 2165, NSW · June 2026 Page 11 of 11