How retaliation risk complicates fraud investigations