Companies are at risk of being investigated by the U.K.’s tax authority over fears that up to two out of every three employees continued to work during lockdown while their employers illegally claimed their salaries from the government’s furlough program, according to research recently published by the Universities of Cambridge, Oxford and Zurich.

Over 9 million employees in the United Kingdom have been furloughed since the country’s lockdown in mid-March but are guaranteed 80 percent of their salaries—capped at £2,500 (U.S. $3,250) per month—under the government’s Coronavirus Job Retention Scheme (CJRS) so long as they do not perform any work.

But with the CJRS reportedly costing around £14 billion (U.S. $18 billion) per month, HM Revenue & Customs (HMRC) is keen to make sure the funds have been used appropriately.

On Monday the U.K. government said up to £3.5 billion (U.S. $4.5 billion) in CJRS payments may have been claimed fraudulently or paid out in error. HMRC told Parliament’s Public Accounts Committee it believes between 5 percent to 10 percent of furlough cash has been wrongly awarded.

The regulator is writing up to 3,000 “nudge” letters each week to advise employers they may have overclaimed and should rectify any errors made as a result.

A furlough fraud hotline and online reporting system have also been set up to encourage anyone to report suspected fraud to HMRC anonymously. So far, 8,000 calls have been received, and HMRC is now looking into 27,000 “high risk” cases in which they believe a serious error has been made in the amount an employer has claimed.

Lawyers say companies should take the time now to audit claims they have made under the CJRS to prevent the regulator from taking any investigative and/or enforcement action.

Under the U.K.’s newly enacted Finance Act 2020, HMRC has the power to recover furlough payments that were wrongly claimed and, in some situations, even charge penalties and other costs.

If HMRC discovers a company wrongly claimed furlough pay, it can impose an income tax charge for an amount matching the overpayment. However, if HMRC believes the company deliberately claimed furlough pay it was not entitled to, or tried to hide its actions, it can also charge the company a hefty penalty of up to 100 percent of the overpayment.

There are also strict deadlines for companies to tell HMRC about overpayments: In general, a company must notify HMRC either within 90 days from the overpayment or by Oct. 20.

If a company does not come forward voluntarily, HMRC can ask it to provide information to verify claims and even raise an income tax assessment. If the tax authority believes money is due following an assessment, it can also charge the company its costs, together with interest and penalties on any late repayments.

Lawyers say the furlough scheme is not straightforward and suggest many companies have struggled to keep up with the government’s changing—and sometimes conflicting—guidance and rules.

For example, a recent rule change in July aimed at creating more flexibility for businesses means staff are now allowed to return to work part time but remain furloughed for the rest of their normal working hours, which makes calculating how to claim for furlough pay more complicated.

Lawyers also say companies may have inadvertently claimed furlough pay when they were not eligible to do so or their circumstances may have changed, meaning what was a valid claim has become invalid through no fault of the company’s.

Joanne Frew, national head of employment at law firm DWF, says, “Considering the complexity of the CJRS and the timescales involved to submit claims, it is understandable that employers will have made some errors.”

Alex Christen, employment lawyer at law firm Capital Law, says companies should review furlough payments to make sure they have not claimed any money they were not entitled to.

She also says if a company is contacted by HMRC about a fraudulent claim, it should cooperate fully and provide HMRC with any information that might help show the claim was either properly made, or that the company genuinely believed it was entitled to claim for some or all of the furlough pay.

She adds that if HMRC decides the company made an “innocent” mistake, it would be unlikely the company would have to pay any penalties or other costs, though it would be required to pay back the overclaimed amount.

“Genuine errors should not attract penalties, and HMRC has issued guidance for companies that have realized that they have claimed too much and want to make a repayment,” says Christen.