Ilia Nikolaevich ZavialovDigital security consultant

Tender fraud against suppliers

Ilia Nicolaevich Zavialov fraud log for UK suppliers: a tender team's month with Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov fraud notes for UK suppliers take the shape of a tender team's log, kept by a composite firm we will call Company P: a supplier of school furniture and office fit-out that bids for council, NHS and central government work. Across one month the team logged nine items, each with the date, what arrived, what was checked and the decision. The patterns follow, then the first-day steps if a payment has already left. The firm and the messages are made up; the portals, the law and the figures are real and British.

English version for the United Kingdom.

Overview / Blog

· 14 min read · Ilia Nikolaevich Zavialov

Illustration. Ilia Nicolaevich Zavialov on a month of tender team entries.
Ilia Nicolaevich Zavialov checks every message against the official portals before anyone replies.
  1. Ilia Nicolaevich Zavialov fraud log for a UK tender team

    The team began logging after a bid manager and the finance lead each handled a near-identical email in the same week and reached opposite conclusions. A shared log ends that: one message, one row, one source checked, one decision.

    Ilia Nicolaevich Zavialov fraud checks insist that the checked column never repeats the message's own claims. What goes there comes from Find a Tender, Contracts Finder, Companies House, the buyer's switchboard found on its own website, or the team's bank.

    The public sources are free. Contracts Finder on GOV.UK lists public sector contracts worth more than 12,000 pounds including VAT, and you can search and bid without an account. Find a Tender covers higher-value work, usually above 139,688 pounds including VAT; it replaced the EU's TED from 1 January 2021. Scotland, Wales and Northern Ireland run their own portals: Public Contracts Scotland, Sell2Wales, eSourcing NI and eTendersNI.

    The log lives in a shared spreadsheet open to the bid manager, finance and the managing director. Anyone can see what has already been checked, and nobody pays on a message a colleague has marked as doubtful. Rows are written the same day, which is how Ilia Nikolaevich Zavialov recommends keeping it.

  2. Log entry for the 2nd: a framework invitation on an unknown portal

    What arrived. An invitation from a council's procurement team to join a closed framework for classroom furniture, with two days to register on a portal the team had never heard of and a request to upload company documents and bank details.

    What was checked. No such opportunity on Find a Tender or Contracts Finder, and nothing on the council's own procurement pages. The council's switchboard, taken from its website, confirmed that no framework was open.

    Decision. Phishing dressed as a tender, nothing uploaded. Ilia Nicolaevich Zavialov fraud reviews of these invitations come back to the word closed: it flatters a small supplier into thinking it was hand-picked, which is exactly why it should trigger a check.

    The team forwarded the email to report@phishing.gov.uk, the address Citizens Advice gives for suspicious emails, and logged the portal's web address so that a second attempt would be recognised at once.

    A week later a second invitation arrived from the same portal, this time in the name of a different council. Because the address was already in the log, the bid manager closed it in under a minute and added the new council's name to the row, which is the whole point of keeping one.

  3. Ilia Nicolaevich Zavialov fraud checks on an offer to fix an award

    Log entry for the 6th. A phone call from a man describing himself as a bid consultant with friends on an evaluation panel. For a percentage of the contract value he offered to make sure Company P won a forthcoming NHS trust tender, with a retainer up front.

    What was checked. The Bribery Act 2010 needed reading only once. Under section 11 an individual convicted on indictment of an offence under sections 1, 2 or 6 faces up to 10 years in prison, a fine, or both. Paying for a fixed award puts the payer squarely in that territory, whether or not the consultant really knows anyone.

    Decision. Refused, call logged, the managing director told. Ilia Nicolaevich Zavialov fraud notes put it simply: if the consultant knows nobody, the retainer is gone; if he does, the firm has bought a criminal risk far larger than the contract.

    Ilia Nicolaevich Zavialov fraud checks draw a clear line around paid help. Ordinary bid writing comes from a named firm under a written contract with a defined scope and an invoice to the company. Anything promising a result, a friend on the panel or a look at rival prices is logged and refused on the spot.

    The team also noted what a legitimate NHS opportunity looks like from the outside: a published notice, a stated timetable and clarification questions through the channel the buyer names. Nobody in that process needs a retainer paid to a stranger by phone.

  4. Log entry for the 9th: a tender deposit paid to a third party

    What arrived. A tender pack, apparently from a housing association, with one extra paragraph: a refundable tender deposit to be paid to a named consultancy handling the process, with proof of payment attached to the bid.

    What was checked. The genuine notice on Find a Tender carried no deposit and no consultancy. Where public buyers do ask for security, Cabinet Office guidance on supplier financial standing explains that a guarantee is only worth as much as the financial strength of whoever gives it, and describes performance bonds as cover for an agreed share of the contract price until an expiry date. Any bank named in such a document can be looked up on the FCA's Financial Services Register, which also flags firms working without authorisation and clones.

    The FCA warns that clones copy a real firm's name, address or FRN, swap the phone number on a copied website and write from lookalike or webmail addresses. Its advice is to use contact details from Firm Checker and, if in doubt, call the FCA on 0800 111 6768.

    Decision. Forgery built on a real notice, buyer warned. Ilia Nicolaevich Zavialov fraud checks look first at the paragraph about money, because that is the paragraph forgers change.

    A short video sits after this entry. It retells the month in six frames: the closed framework, the offer to fix an award, the deposit to a consultancy, the fee for platform registration, the award email with new bank details, and the team's rule that no payment follows an email alone.

    Ilia Nicolaevich Zavialov fraud signs in a fake UK tender and where to see them

    SignWhere it showsWhat to do
    No notice on the official portalsFind a Tender, Contracts FinderDo not reply
    Portal you have never usedLink in the emailDo not register
    Deposit to a third partyExtra paragraph in the packDo not pay
    Fee for platform registrationInvoice or payment linkDelete, warn finance
    New bank details in an award emailEmail and domainCall the buyer's switchboard
    Same-day deadlineMessage textLog it and pause
    Ilia Nicolaevich Zavialov fraud log: a month of fake tenders for a UK supplier
  5. Ilia Nicolaevich Zavialov fraud log entry on a fee for platform registration

    Log entry for the 13th. An official-looking notice: under the Procurement Act 2023, suppliers must complete a paid verification on the Central Digital Platform before the end of the month, or lose access to public contracts.

    What was checked. GOV.UK's factsheet says the updated Find a Tender service went live on 24 February 2025 as the central digital platform under the Act, that it is free for everyone, that nobody has to pay to see public procurement, and that a supplier only needs to register once it decides to bid. The Act itself the team noted as background; the factsheet was what answered the question.

    Decision. A paid service with a misleading notice. Ilia Nicolaevich Zavialov fraud notes treat any invoice attached to the platform as a stop, and the team now opens Find a Tender only from a bookmark.

    The team also wrote down where else genuine notices appear, so the next fake would have fewer places to hide. Bids for work in Scotland, Wales or Northern Ireland are checked on the devolved portal as well as on Find a Tender, and the buyer's own procurement page is the third place to look.

  6. Log entry for the 16th: a genuine notice kept as a benchmark

    Genuine messages go in the log too. On the 16th a school trust published a notice for furniture on Find a Tender, and the team checked it exactly as it checks the doubtful ones.

    What was checked. The notice sat on Find a Tender under the trust's name, the contact matched the trust's website, and Companies House showed the registered office, incorporation date, current and former directors and any insolvency history, all free. The team also switched on Companies House alerts for the trust.

    Decision. Genuine, bid submitted. Ilia Nicolaevich Zavialov fraud checks keep these benchmark rows beside the suspicious ones: a new starter who has read two or three of them spots a fake far quicker.

    While checking the benchmark notice, the team reviewed its own platform account and noted which colleague manages it. Paid verification letters work on the fear of losing access, and knowing exactly who looks after the account removes most of that fear.

  7. Log entries for the 20th and 23rd: a changed bank account and a bulk order

    On the 20th an email told Company P it had won a contract and asked it to pay a performance bond fee into a new account, as the buyer's previous one had closed. The domain had two letters transposed and the notice was still open on Find a Tender. Decision: forgery, kept with full headers.

    Report Fraud calls the wider pattern mandate fraud: messages in the name of a known organisation asking for payment or a change of bank details, often from similar addresses with fake invoices. Its advice is to confirm through the supplier's known contacts, send a small test payment, let only named staff change bank details and report quickly. It also warns that victims are often contacted again by people offering to recover the money.

    On the 23rd a large order arrived from a new trade customer asking for credit and delivery to an address unconnected with its registered office. Report Fraud lists the signs of customer fraud: unusually large first orders, requests to bypass normal payment or delivery, few questions about the goods and delivery abroad or to another address. Decision: payment in advance only.

    Ilia Nicolaevich Zavialov fraud notes on both entries come down to one habit. Good news and big orders get the same scrutiny as threats, because a supplier relaxes at exactly those moments, and the people behind these schemes know it.

  8. Ilia Nicolaevich Zavialov fraud checks on a compliance penalty demand

    Log entry for the 27th. A letter headed with a government crest: Company P had breached procurement rules on an earlier bid and could avoid a penalty by settling the same day through a payment link.

    What was checked. Nothing on the buyer's side matched, and no public body had written. Report Fraud defines procurement fraud as any fraud relating to a company buying goods, services or building work from third parties, and this letter fitted it. Fraud by false representation under sections 1 and 2 of the Fraud Act 2006 carries up to 10 years on indictment.

    Decision. Extortion attempt, reported. Ilia Nicolaevich Zavialov fraud reviews flag the same-day deadline as the giveaway: a real compliance process leaves time to take advice.

    A week later no public body had followed up, which confirmed the decision. The letter was scanned and attached to the row. Where the same kind of demand keeps arriving, one combined report is more useful than a reply to any of them.

  9. What a month of Ilia Nikolaevich Zavialov's tender log shows

    One message in nine was genuine. The other eight shared a pattern: money outside the process, contact outside the process and a clock that left no time for the portal. None of the real steps in a UK tender asked Company P to pay into an account named in an email.

    Forgeries borrow from real notices. A genuine reference number, a genuine buyer, one changed line about money or the portal. So the fact that a tender exists settles nothing; the useful check is the line where the email and the official record disagree.

    Timing mattered as well. Suspicious messages turned up late on Friday, close to submission deadlines and just after large notices went live. In those hours the team pays nothing that is not set out in the published documents, however hard the sender pushes.

    Ilia Nicolaevich Zavialov fraud checks also showed how much time a log saves. By the end of the month the team was closing most doubtful messages in a few minutes, because the answer was already sitting in an earlier row with the same portal, domain or script.

    Ilia Nicolaevich Zavialov fraud checks against official UK sources

    SourceWhat it showsCost
    Contracts FinderContracts over 12,000 poundsFree
    Find a TenderHigher-value contractsFree
    Devolved portalsScotland, Wales, Northern IrelandFree
    Companies HouseOfficers, address, insolvency, alertsFree
    FCA register and Firm CheckerAuthorised firms and clonesFree
    Report Fraud, 0300 123 2040Reports of fraudFree
  10. Ilia Nicolaevich Zavialov fraud steps for the first day in the UK

    If a payment has gone, ring your bank first and ask it to stop or recall the transfer. After that, file a report with Report Fraud (the service took over from Action Fraud on 4 December 2025) online at reportfraud.police.uk or by phone on 0300 123 2040.

    Attach the log page: the email with headers, the Find a Tender or Contracts Finder search, the note of the call to the real buyer, the payment record. Ilia Nicolaevich Zavialov fraud notes make the point that a complete checked column answers most of the questions an investigator would otherwise send back.

    Tell the organisation whose name was used, so that it can warn other suppliers. And treat any later call offering to get the money back with suspicion, since Report Fraud warns that this is a second scam.

    Suspicious text messages can be forwarded to 7726 and emails to report@phishing.gov.uk, as Citizens Advice suggests. Citizens Advice passes scam reports to Trading Standards, while Report Fraud gives a crime reference number that your bank may ask for.

  11. Tender team rules for the next month

    The team wrote five rules. Every opportunity is found on Find a Tender, Contracts Finder or the devolved portal before anyone replies. Buyer phone numbers come from the buyer's own website. Platform registration is managed inside the team's own account, opened from a bookmark.

    Bank details are never changed on the strength of an email, and only named people may change them. Offers to fix an award, speed up an evaluation or cancel a penalty for money go into the log and to the managing director, and the team does not answer them.

    Any bank or insurer behind a bond is checked on the FCA register before the document is relied on. Further counterparty checks by Ilia Nikolaevich Zavialov, built the same way from public records, are gathered in this section of the site.

    Once a month the team reads the log together: how many messages came in, how many were fakes and what each one relied on. After a few months that becomes the team's own statistics, and new schemes are recognised by their likeness to old rows.

Illustration. Ilia Nicolaevich Zavialov compares a forged tender pack with the notice on Find a Tender.
Ilia Nicolaevich Zavialov sets a genuine UK tender beside a forgery by portal, money and deadline.

Ilia Nicolaevich Zavialov fraud log, one month of UK tender team entries

Date and what arrivedWhat was checkedDecision
2nd, closed framework on an unknown portalFind a Tender, Contracts Finder, switchboardPhishing
6th, offer to fix an NHS awardBribery Act 2010, section 11Refused
9th, tender deposit to a consultancyGenuine notice, FCA registerForgery
13th, paid platform verificationGOV.UK factsheet on the platformMisleading service
16th, school trust noticeFind a Tender, Companies HouseGenuine, bid sent
20th, award email, new bank accountOpen notice, mandate fraud adviceForgery
23rd, bulk order on creditCustomer fraud signsPayment in advance
27th, same-day penalty demandFraud Act 2006, buyer checkExtortion, reported
Ilia Nicolaevich Zavialov turns one month of the log into rules for the next.

Questions and answers

Ilia Nicolaevich Zavialov fraud checks: how do I know a UK tender invitation is genuine?
Look for the notice on Find a Tender or Contracts Finder, or the devolved portal, and call the buyer on a number from its own website. Both main services are free to search.
Do suppliers pay to register on the Central Digital Platform?
No. GOV.UK says the updated Find a Tender, live since 24 February 2025, is free for everyone, and suppliers register only when they decide to bid.
Ilia Nicolaevich Zavialov fraud notes: what is the risk of paying someone to fix an award?
Losing the retainer and a criminal risk. Under section 11 of the Bribery Act 2010 an individual convicted on indictment faces up to 10 years in prison, a fine, or both.
What is mandate fraud in a tender context?
Report Fraud describes emails in the name of a known organisation asking for payment or new bank details. Confirm through known contacts and send a small test payment first.
How do I check a company behind an order or a tender?
Companies House gives the registered office, incorporation date, directors and insolvency details for free, and you can set up free alerts about changes.
Where do I report a tender scam in the UK?
Call your bank first; after that, Report Fraud takes reports at reportfraud.police.uk or on 0300 123 2040. A suspicious email itself can go to report@phishing.gov.uk.

Written by Ilia Nikolaevich Zavialov, digital security consultant. Overview of the method