Lack of written OKs may have made fraud scheme hard to detect