In reality, whistleblowers always get screwed. You would have to extensively cover your own ass, and gather evidence that absolves you, specifically, of wrongdoing first.
If you are reporting time worked as anything other than the actual number that you were working, that is illegal. So alternately, start reporting the actual hours worked. If your employer makes an issue of it, tell them that you will need a signed, written copy of any order they give you that instructs you to violate the law.
If you get fired, you can retaliate by getting someone sent to jail.
Furthermore, our government customer didn't care as long as they got their deliveries on time and as cheaply as possible. I know in theory a program office can't lean on DCAA, but in practice (especially considering the clearance situation) I don't know if the PO would obstruct such an investigation. After all, from their POV getting what they want for less is not fraud.
The DoD inspector general hotline is (800) 424-9098 or http://www.dodig.mil/hotline/hotlinecomplaint.html .
The GAO fraudnet hotline is (800) 424-5454 or https://www.gao.gov/cgi-bin/fraudnet.cgi .
Have yet to encounter a contracting environment where is is true. In fact, I was explicitly told that since I was salaried I was expected to put in whatever work it took to make deadlines, despite only putting 40 hours down on my timecard. Considering the facility I worked in had a DCAA office embedded in it I find it hard to believe the government did not know this was going on.