The same way you detect any other fraud. It can range from analysis to whistleblowers. The point is not even to catch all fraud, it's to catch it often enough that most people and companies will not attempt it.