National Lottery operator Camelot has been fined £3 million by the gambling watchdog after paying out a £2.5 million jackpot claim to someone with a "deliberately damaged ticket".
The penalty - to be donated to good causes - was handed down by the Gambling Commission over a 2009 incident that went undiscovered for six years.
The £3 million penalty included £2.5 million "to represent the amount that would have been received by good causes had the prize claim not been paid", the commission said.
Hertfordshire Police revealed that detectives arrested a man after being alerted by Camelot in October 2015 but he was later released without charge.
Camelot chief executive Andy Duncan apologised for the firm's failures, calling it "unique" and "not repeatable today".
He told reporters: "Effectively, a claim was made with a deliberately damaged ticket, we believe. The prize that was paid out for that claim was £2.5 million.
"That person submitted a claim, it went through the normal prize payout process and at the time, based on the evidence available, from what we can see after the event albeit a long time ago, that seemed to be a reasonable decision to have made based on the evidence at that time.
"It was only when subsequent evidence came to light in autumn of 2015 that it cast doubt on the original decision. So it couldn't have been known at the time."
Mr Duncan declined to answer questions about whether the alleged fraud was an inside job, or whether the firm still possessed the dodgy ticket.
But he said no one else came forward to claim the money, and it would not have been included in a subsequent rollover.
Camelot had earlier said police decided earlier this year to take no further action over the alleged fraud.
The commission said while its investigation "could not be certain a fraud had taken place, it was more likely than not that a fraudulent prize claim had been made and paid out".
It ruled that Camelot breached the terms of its operating licence over control of its databases, the way it investigated prize claims and its processes "around the decision to pay a prize".
But it added that the firm had already taken steps to ensure that a similar problem would not happen again.
A Hertfordshire Police spokeswoman said: "An allegation of fraud connected to a lottery win from 2009 was investigated by (our) specialist cyber and financial investigation unit working with the Gambling Commission.
"As part of the investigation a man was arrested on suspicion of fraud by false representation. Following a thorough investigation the man was released with no further action to be taken against him."
A £2,525,485 jackpot from a draw on March 11 2009, went unclaimed until shortly before the September 7 deadline the same year for it to be given to good causes, according to news reports at the time.
The winning ticket was reported to have been bought in the Worcester or Malvern areas of Worcestershire.
Camelot had previously been fined £300,000 by the Gambling Commission in July after publishing inaccurate Lotto Millionaire Raffle results on the National Lottery website for an hour on October 10 last year, allowing them to be viewed by more than 100,000 people.
Labour called on the Government to report to MPs over what it called "the great Lotto robbery", saying it prevented a seven-figure unclaimed prize being donated to good causes at the time.
Shadow culture secretary Tom Watson called for an urgent statement by the Government, saying: "Camelot has very serious questions to answer about this fraud, which should never have been allowed to take place.
"So too do ministers. Karen Bradley was asked only yesterday in Parliament about security breaches at the National Lottery and she failed to offer assurance that the Government is taking steps to improve it."
Camelot revealed in November that it believed "around 26,500 players' accounts were accessed" in an attack by cyber criminals, adding "fewer than 50" had activity take place after the hack.
A Department for Culture, Media and Sport spokesman said: "It is right that the Gambling Commission has acted in this case and assured us that Camelot has put controls in place to mitigate against any similar licence breach in the future."