Doug Cameron is an old-style Labor man. He was born into a working-class family in Bellshill, Scotland, was “hopeless” at school, and left to qualify as a fitter and machinist.

He was active in the union movement in Scotland and, after migrating to Australia at age 22, was active here as well. He worked in the ship repair, motor vehicle and power industries, rose through the ranks of the Australian Manufacturing Workers’ Union and became a vice-president of the Australian Council of Trade Unions before entering the senate a decade ago.

We mention his modest formal qualifications to emphasise a point Cameron himself makes. He has no background as a tax accountant or lawyer.

So why, then, could he see within a few days that there was something very fishy about a company processing vast sums for public sector contractors, while the vast bureaucracy of government and associated labour hire firms apparently remained oblivious for a year?

We are talking, of course, about the alleged Plutus Payroll scam.

On Thursday last week, the Australian Federal Police announced the arrest and charging of nine people in relation to an alleged $165 million fraud against the tax office.

“Everything else requires proof of identity, but bizarrely this is the one area where you don’t have to prove anything.”

It was not only the huge amount of money involved that made the bust newsworthy. Other details added spice to it. Two of those involved were Adam and Lauren Cranston, the son and daughter of Australian Taxation Office deputy commissioner, Michael Cranston. Cranston snr, while not alleged to have been party to the fraud, was alleged to have abused his position as a public official, by passing on information.

The details of the profligacy and indiscretion of the alleged fraud kept coming all week: two aircraft, a couple of dozen racing and luxury cars, a dozen motorbikes, 18 houses, guns, jewellery, expensive watches and fine wine, millions in cash and other money stashed in more than 100 bank accounts or invested in shares.

All of this was allegedly financed by a crooked payroll operation. As the federal police explained last Thursday:

“The legitimate payroll company – run by the syndicate members – accepted money from legitimate clients to process payroll on their behalf. This money was transferred to seven subcontracted companies known as tier 2 companies, which then made payroll payments to individual workers of clients.

“The directors of these tier 2 companies are known as straw directors. They are essentially a front – individuals recruited to appear to be running the companies, but the syndicate members retain effective control.”

Those tier 2 companies did not remit the tax they should have, which is where the fraud is alleged to have taken place.

Now, back to Doug Cameron.

The first complaint about Plutus came to his office from an unpaid contractor on May 3. Cameron went to social media to air his concerns and seek other people in similar circumstances. He and his staff were subsequently contacted by several dozen people. They asked those people to provide details from their pay slips, and discovered a variety of related company names.

His office enlisted the parliamentary library to search Australian Securities and Investments Commission (ASIC) records. And they quickly compiled a list of the so-called tier 2 companies.

Then his staff began researching the directors of these related companies. Their method was very simple: they checked Facebook profiles and networks and searched names on Google.

They turned up a host of people whose profiles screamed “straw director”, Cameron says.

“It was obvious these directors are people who never had any experience in the payroll business,” he says. “We found a young kid who’d been on an assault charge who was a company director. Another one was a plumber. And so on.

“If I, on the basis of some complaints to my office, can find out within a couple of days that there’s a web of companies hanging under Plutus that stink, what due diligence was being done within government?”

It’s a good question. And the answer, on the basis of evidence to senate estimates hearings this week, appears to be none.

A couple of days after Cameron questioned Plutus’s integrity on social media, the company contacted his office, pushing him to back off.

“The Plutus PR guy rang and asked for me to ring them, saying this was a commercial dispute and Plutus were the victims, that I had the wrong end of the stick in suggesting there could be bad behaviour or corruption.”

Cameron says his reply, via staff, was that he would be happy to talk to the directors of the companies. That didn’t happen. Instead there came a long letter from the flack, blaming the tax office.

“Plutus Payroll’s bank accounts were subject to a garnishee order from the ATO last Thursday 27 April, effectively stopping the company’s ability to make payments to its valued contractors,” it said.

The letter complained that “no warning and no previous correspondence had been received from the ATO – as Plutus is completely and strictly tax compliant, the company could scarcely understand the severity of this action”.

Plutus had tried to get in contact with the tax office’s compliance unit, but had failed, and so:

“On 1 May, frustrated by the ATO’s non-communication, the company took the responsible decision to suspend its business activities and enlisted our assistance with the nearly impossible task of trying to manage the social and paid media fallout from now nearly 2000 people not receiving their pay.”

The letter portrayed the dispute with the ATO as some kind of mistake, the exact nature of which could not yet be revealed, “in order to avoid the risk of aggravating the negotiation with the ATO…”

The spin doctor conceded only that “one of the subcontractors with whom they [Plutus] have a deed of arrangement may be in breach of their compliance with the ATO”.

The tone was indignant. By holding Plutus responsible for the debt of this subcontractor, the ATO “brought a nearly $400M company to its knees”.

Cameron didn’t buy it and wrote to ASIC and the ATO, giving the details of what he had found and expressing his concerns.

A couple of weeks later, when the police swooped, the senator’s bullshit detector proved accurate. There was no misunderstanding: this was not a trivial matter involving just one subcontractor. In fact, there had been an eight-month investigation, codenamed Operation Elbrus, involving almost 300 AFP members, in conjunction with the ATO, into what the police called an alleged tax fraud of “unprecedented” scale.

Which brings us back to Cameron’s question: Why had no one seen it earlier? The police had done their job, but too late. Investigators told the media it was likely half the money would never be recovered.

“Surely alarm bells should have rung sometime before $165 million was allowed to disappear,” Cameron says.

In estimates on Tuesday, Labor’s Penny Wong sought to establish in questions to senior bureaucrats from the Department of the Prime Minister and Cabinet what was known about Plutus and when.

She was told the head of the department, Martin Parkinson, had been informed about the investigation only three days before it became public knowledge.

Since then, PM&C had been trying to determine “any exposure or involvement it had … and also to contact a number of other agencies to ensure that they were doing the same thing”.

Wong asked whether this meant there was potential exposure for the entire public service. Parkinson’s answer was simple enough: “Yes.”

How much money was involved? They didn’t know, but the Department of Finance had been tasked with finding all the details. Later, they came back and said PM&C had paid $1.3 million through recruitment firms to Plutus.

Said Wong: “It would be useful to understand, wouldn’t it, how much public money has gone through a company which is now accused of skimming money off, to try to get a sense of the quantum of potential – I do not want to say ‘loss’ – risk?”

Yes, definitely, they said. That was something they would be “looking at”.

As the questioning went on, it became clear the bureaucrats knew little not just about Plutus but about the contractual arrangements pertaining to outsourced contract workers in general.

The Plutus example, said Wong, threw up a “broader systemic issue”. What “procedures, policies or safeguards” were in place to ensure the probity of service providers?

When the government was “directly procuring”, said one of the PM&C bureaucrats, “we do a risk assessment which does consider those matters…” But beyond that “we do not have visibility of the third parties with whom they might be contracting”.

That is to say, if government enters into a contract with a service provider, and that service provider in turn uses another company to provide, say, payroll, government knows nothing about it.

Plutus was a case in point. The PM&C people told Wong their department and the payroll company had no direct relationship.

Wong wondered whether the government at least placed on the primary contractors, of which it did have “visibility”, any onus to ensure those with whom they subcontracted also adhered to particular standards.

She suggested a couple of reasonable expectations, such as “don’t skim off the tax office’s component” or “our expectation is that who you are sending us is legit”.

The woman from PM&C ducked and weaved, but in essence the answer was “no”. There were no such explicit expectations.

To be clear, this is not a direct consequence of the policy of any particular party of government. It is a consequence of what one expert in the area calls the “deconstruction of the employer-employee relationship”. The new economy of outsourcing and short-term contractual gigs has led to a proliferation of intermediate parties.

“I don’t know what Plutus’s specific arrangements were, but I can tell you how these arrangements generally work,” Mark Molesworth, a tax partner at BDO, says.

“There are certain things you can’t do as an individual doing contract work directly for government. You can’t salary sacrifice, for example. So in a number of these arrangements what you do instead is contract with a service provider and then they pay you a salary, net tax and their fee, if any, and superannuation contributions and so on.

“In essence it turns a contractor relationship into an employment relationship. There is no direct contractual relationship between you and the government.”

And there may be multiple layers of intermediaries. In the Plutus case, it appears the primary contracts were between government and large labour hire firms, which in turn steered workers to Plutus for payroll services, which in turn ran a multitude of allegedly dodgy subsidiaries that paid the workers.

The big attraction of Plutus was that it offered its services free, instead of charging the usual 2 or 3 per cent commission, which might explain how their business grew so big in only a year.

“One wonders why, if you were astute, you would not be suspicious that someone would do for you for free what has previously cost thousands of dollars,” says Michael Dirkis, professor of taxation law at Sydney University.

The structure of the alleged Plutus scam, Dirkis says, was very similar to the so-called phoenix schemes that have operated in a variety of industries, notably construction.

“There you had particular construction firms that would set up other companies to hire all the labour for a project, which would not remit the amounts held for pay-as-you-go tax. Or superannuation.

“By the time the tax office realised and was ready to take legal action, these companies had been put into liquidation. And then another company would arise within the same group and take over the labour hire operation, rising from the ashes, hence phoenix.”

As Doug Cameron found when he began searching the names of the directors associated with the various Plutus subsidiaries, they had no relevant skills. The allegation is that these directors directed nothing – the conspirators simply paid them small amounts for the use of their identities.

It is ridiculously easy to become a company director, says Professor Helen Anderson, of Melbourne University Law School.

“There are 100,000 plus companies incorporated in Australia every year. You can incorporate within an hour by going to one of the service providers advertised on ASIC’s website, and paying $400.

“You can do the form yourself if you want, and send off an old-school cheque. Write in your name, address and date of birth, which might be correct or incorrect, it’s entirely up to you.

“You might be a real person or not a real person. And no one checks anything, so long as you haven’t chosen the same company name as somebody else. That’s the only checking.

“And ASIC will allow you to backdate directorships for years and years, provided you pay a big enough fee.

“Everything else requires proof of identity, but bizarrely this is the one area where you don’t have to prove anything.”

Most disturbingly, she says, you can even make some other person a company director without their knowledge.

Anderson and a team of other academics – professors Ann O’Connell, Ian Ramsay and Michelle Welsh – have spent the past three-and-a-half years, and $400,000 of government grant money researching means by which governments might address phoenixing and also other “abuses of the corporate form”, such as those alleged against Plutus.

“We’ve just put out a final report and the No. 1 recommendation is a director identity number [to facilitate] data sharing and verification,” Anderson says.

“You need at least to require directors to prove their identity, to enable ASIC and the tax office and others to track people and say, ‘Hang on, this guy’s turning up all over the joint. This 93-year-old grandmother happens to run 20 construction companies, we think she might be a dummy director.’ ”

On Wednesday, Labor’s employment spokesman, Brendan O’Connor, announced his party’s support for a director identification number, which would require a 100-point ID check.

It seems so simple and practical that you have to wonder why it wasn’t done before. It might well have saved the tax office $165 million lost to the alleged Plutus scam.