NDIS Tech Is Stalling. Providers Still Have to Pay Safely

The short answer: The Business Council of Australia and major disability providers say the $50 billion NDIS is held back by outdated pricing and technology, including a planned digital payments platform that has not been rolled out. Until systems modernise, NDIS provider payment fraud risk sits with providers, so every supplier payment should be verified before it leaves the account.

Key takeaways

• The BCA wants NDIS regulatory and administrative costs cut by 25 per cent by 2030 and a three-year technology investment pipeline.
• A planned NDIS digital payments platform has not been rolled out, according to former Treasury official Stephen Anthony.
• About 12 per cent of provider time is spent on administration, says Kismet co-founder Mark Woodland.
• Fraud enforcement in the scheme is active, but it targets false claims. Your own outgoing payments are your responsibility.
• Verify the business, the person and the bank account before paying any supplier.

What did business say about the NDIS this week?

Big business and disability providers are pressing the government to modernise the National Disability Insurance Scheme. The Australian Financial Review reported on 27 October 2026 that the BCA will warn the $50 billion scheme is “bogged down in red tape” and “hostage to an outdated pricing model” that pays providers by the hour rather than for outcomes (AFR).

Stephen Anthony, who chaired the government’s review into NDIS pricing, questioned why a planned digital payments platform had not been rolled out. BCA chief executive Bran Black said a more productive NDIS means “cutting unnecessary paperwork and using technology better”. The BCA also backs reforms to tackle fraud. Previous Mandala Partners modelling, cited by the AFR, suggested digital reform could save $2 billion a year.

Why does outdated technology raise NDIS provider payment fraud risk?

The article is about scheme design, not payment fraud, so this is our reading. When systems are manual, money moves on emails, PDFs and spreadsheets. Kismet’s Mark Woodland told the AFR that around 12 per cent of provider time already goes on administration. Stretched admin teams processing invoices by hand are the conditions business email compromise relies on: an urgent email, a changed bank account, and no time to check.

Is fraud already a problem in the NDIS?

Yes, though the high-profile cases are fraud against the scheme. In October 2026 the Fraud Fusion Taskforce charged a Sydney man who allegedly, as director of a registered NDIS provider, submitted about $1.89 million in fraudulent invoices for services never provided (AFP). The taskforce is made up of 25 agencies.

That enforcement protects the scheme’s money. It does not check who your organisation pays. Payment redirection against providers, such as a fake “new bank details” email from a cleaning, transport or therapy supplier, sits outside it. We are not aware of a published figure for redirection losses among NDIS providers specifically, so we won’t guess one.

What does a payment redirection attempt look like?

Our business email compromise guide covers the pattern. A message arrives that looks like a regular supplier, often from a look-alike domain, saying their bank details have changed and an invoice is due. The Australian Signals Directorate’s latest report describes a campaign using more than 400 look-alike domains to trick businesses into urgent payments (cyber.gov.au). Nothing has to be technically hacked for the money to go to the wrong place.

The check before any payment

1. The business is real. Confirm the supplier’s ABN is active and matches (ABN verification before payment).
2. The person is who they say they are. Confirm bank detail changes through a contact you already hold, not the one in the email.
3. The BSB and account belong to that business. Name matching through Confirmation of Payee helps, but it’s name matching only (bank account ownership verification).

ezyshield runs that bank account check live before a payment is released, which takes the pressure off a stretched admin team.

How solid is your supplier setup? Score it with the free Vendor Onboarding Scorecard, or check a BSB with the BSB Validator.

What should NDIS providers do this week?

• Make “no bank changes from email alone” a written rule for anyone who pays suppliers.
• Re-verify the bank details of your top 20 suppliers by value.
• Separate who changes supplier details from who approves payments.
• Use our guide to verifying a supplier’s bank account in Australia as your checklist.

FAQ

What is the NDIS digital payments platform? It’s a planned system for paying NDIS claims digitally. According to the AFR, former Treasury official Stephen Anthony questioned why it has not yet been rolled out.

Who investigates NDIS fraud? The Fraud Fusion Taskforce, a group of 25 agencies co-led by the NDIA and Services Australia, including the AFP and the NDIS Quality and Safeguards Commission.

Are NDIS providers at risk of payment redirection fraud? Any organisation that pays suppliers by bank transfer can be targeted. Providers with manual invoice processing and a high admin load should verify every bank detail change.

Does Confirmation of Payee protect NDIS providers? It checks that the account name matches, which helps. It doesn’t prove the account belongs to the business you intend to pay.

Reform will take years. The check before your next payment takes seconds.