I Thought Cash Kickbacks Were Untraceable. Then I Saw How Investigators Actually Find Them.

How Cash Kickbacks Get Found: The Money Is the Last Step

A black plastic bag. A parking garage. A handshake with no transfer record. That is the image many people carry when they think about pharmaceutical kickbacks. They assume cash is safe because cash leaves no bank trace.

Investigators do not start with the bag. They start with the prescription data.

The double-ten review

Hospitals run a periodic review called the double-ten review. It lists the top ten drugs by spending and the top ten doctors prescribing them. The report goes to discipline inspection.

A drug that stays on that list for years. A doctor whose prescriptions dwarf those of peers in the same department. A supplier whose winning bid dates line up with a new director’s arrival. These are data problems, not medical ones.

The data does not say who took money. It says something is off.

Data-led investigation

Discipline inspection and audit teams aggregate millions of insurance claims, procurement records, prescriptions, and consumable usage records. Then they run models.

Suppliers whose bid dates overlap with a director’s tenure come up. So do departments whose consumable use jumps after a personnel change. Companies with the same controller, the same phone number, the same address, taking turns winning bids. A sales representative’s territory and the prescription volume of certain doctors moving together.

This analysis does not need a name. It needs an anomaly.

Once the anomaly appears, the next step begins.

Audit: find the abnormal, not the villain

Auditors work through total analysis, doubt discovery, and scattered verification. They spread the data out. Which cost category is out of line. Which supplier’s win rate is out of line. Which department’s growth is out of line. Then they verify the doubt.

A consumable that went from a few million yuan a year to tens of millions. Investigators ask who pushed the tender, who wrote the specifications, who chose the experts, who signed in the department, and who owns the supplier.

A drug that ranks high in insurance reimbursement while cheaper equivalents work just as well. Investigators ask who prescribes it, who promotes it, and what relationship connects the promoter to the prescriber.

The data circles the suspicious spot. It does not need an answer yet.

Where the cash comes from

A pharmaceutical representative cannot pay out millions from a salary. The money has to come from the company. That means cashing out.

Auditors look at sales expenses: consulting fees, conference fees, hotel fees, promotion fees, service fees. They look for the same entity issuing large invoices again and again. They look for conference invoices that do not match the agenda. They look for sign-in sheets with names of people who never showed up, staged photos, and no hotel stay records.

CSO companies. Consulting firms. Marketing firms. Money moves through layers. It becomes cash. Then it moves to certain people.

But money leaving a company account under an expense name leaves contracts, invoices, fund flows, reimbursement lists, and accounting vouchers. Cash cuts the transfer record. It does not cut the source.

Piercing review

Some people think cash into property is safe. A laboratory director in Chongqing, She Qian, took 1.82 million yuan in benefits. Much of it moved through loans and went into real estate. She had IOUs written. She thought the paper made her safe.

Investigators traced each purchase. They compared the source of her property funds with the timeline of the briber’s profits. She had money in her accounts but borrowed from people she managed. The borrowing happened around benefits. The IOUs meant nothing.

She owned more than thirty properties across Hainan, Zhejiang, and Sichuan. Property registrations, bank flows, loan relationships, and the briber’s profit dates matched. The cash had changed form. It became property, cars, wealth products, relatives’ accounts, spending records. Those leave traces.

The evidence chain

In one case, a representative named Yang bribed forty-nine medical staff members between 2019 and 2024. The evidence chain included bank statements, transfer records, labor contracts, social insurance certificates, performance payout tables, expense use reports, marketing service agreements, reimbursement lists, and accounting vouchers.

Single items look ordinary. Together they form a map. Investigators can see when he joined the company, which hospitals he covered, which doctors he contacted, how much expense the company gave him, under what name it was reimbursed, where the money went, and when the doctor bought property or a car. The timelines cross.

Investigators do not rely on confession alone. Confessions change. They flip. They deny. Invoices, fund flows, contracts, camera footage, and call records do not disappear easily.

One person breaks

A network can be complex. It can still break at one point.

After a supplier wins a bid, investigators may pull him in for questioning. They demand his phone be unlocked. They check call logs and WeChat records. The timid ones confess on the spot. Then they are taken away and asked to name the leaders they dealt with.

The logic is harsh. Break one person. Use pressure and incentives. He drags others down. One by one, the network comes out.

The first person is chosen by data. Prescriptions and devices. Start with the largest amounts. A department with abnormal usage. The director is almost certain to be involved. Follow the supplier back to the sales representative. Cameras make the rest easy.

Cameras, phones, timelines

Key hospital departments have high-definition cameras: emergency, inpatient, laboratory, equipment, pharmacy. Footage is kept for at least ninety days. A representative’s prohibited activity can be fixed on video.

Discipline inspection also pulls key information: a director’s abnormal funds, close contact with suppliers. Some cases use silent preliminary verification. The target does not know he is being watched.

If the briber confesses and the bribe-taker denies, investigators compare. They ask when you received money, when the briber cashed out, whether the paper trail and fund flow match, and whether the money matches your property or car purchase timing. When the timelines cross, denial space shrinks.

One case was built by checking three thousand call records, one by one. Now add WeChat messages, bank flows, and seized phone data. The evidence chain is tighter than before.

The logic changed

Before, investigators found a lead and then investigated. Now, data filters out anomalies first. Then evidence is built around the anomaly.

Cash has no transfer record. It cannot change the source and destination of money. Company cash-out leaves invoices. A doctor who takes cash has to spend it. Spending leaves records. Cash into property. She Qian thought that was safe. Thirty-plus properties. Traced. Sentenced.

The investigation looks past the stack of cash. It looks at everything abnormal around it: abnormal procurement volumes, abnormal invoices, abnormal fund flows, abnormal relationships. Stack them together. That is evidence.

Compliance is the only line

For pharmaceutical representatives, the only safe line is compliance.

Compliance means no cash instead of a transfer, no loan written on paper, no conference fee turned into an invoice, and no CSO company used as a pass-through.

Data now leaves a shadow. Procurement data. Prescription data. Invoices and reimbursements. Bank flows. Phones and WeChat. Cameras and timelines. Cash cuts only the last transfer record. It does not cut the earlier groundwork or the later destination.

The case begins with a spreadsheet cell. It ends with a receipt, a timestamp, a property registration. That is how cash kickbacks get found.