Checking Account Fraud: When Employees Steal (Part 7)

In the previous column, we covered common insider checking account fraud involving stolen revenue checks. This column, the last in the series, underscores the importance of reviewing the volume of activity in small checking accounts, and it also offers lessons from the past – what fraud examiners can learn from actual case histories.

REVIEWING ACTIVITY IN SMALL CHECKING ACCOUNTS 

Employees frequently use small checking accounts, such as petty cash funds, advance travel funds, trust funds, and purchasing funds when attempting to pull off a disbursement fraud scheme. They choose these funds hoping they will be overlooked during audits and fraud examinations because the imprest fund amounts aren’t significant. Fraud examiners should use different criteria when deciding whether to review them. Instead of using the size of the account as the determining factor, we should consider the volume of activity that has occurred in the accounts during the period.

As shown in the following cases, fraud perpetrators first deposit stolen revenue checks in these accounts and then create extra disbursements from these accounts to misappropriate funds. An unusual activity pattern in the account, such as a greater number of transactions or disbursements than normal, might be a prime fraud indicator.

EXTRA DISBURSEMENTS FROM CHECKING ACCOUNTS 

When a corrupt employee deposits stolen revenue checks into a checking account, he or she must find a way to get those excess funds out of the account so the money can go toward personal use. Perpetrators’ past methods help us look for future schemes. So how do these unscrupulous employees get the money out of these checking accounts?

METHOD NO. 1: CHECKS ISSUED IN FRAUDSTER’S NAME 

Employees issue checks from the checking accounts made payable to themselves, to cash, or to the name of a financial institution. They often even leave the payee on the check blank. Once this has been done, they can now deposit the checks into their personal bank accounts, buy cashiers’ checks from financial institutions, or purchase money orders from post offices or grocery stores.

Clerk/Treasurer Lives the Good Life at Town’s Expense
Beth had been the clerk/treasurer of a small town for about 20 years. Her job duties weren’t segregated; she managed practically all financial activity for the town with little or no monitoring by her supervisor, the mayor. This enabled her to misappropriate $90,256 over three years.

This disbursement scheme had two major elements. First, Beth made fictitious disbursements from the general disbursement checking account and falsified the check register to conceal these irregularities. The mayor wasn’t involved in the scheme, but he facilitated these unauthorized activities when he unwittingly pre-signed blank checks Beth later used to perpetrate this crime.

She used a correcting typewriter to issue 106 checks totaling $79,586 made payable to herself, to petty cash, to a bank, and to some legitimate vendors. She omitted these transactions from the disbursement registers she presented to the town council for approval, which left gaps (another red flag for fraud examiners) in the numerical sequencing of checks listed from one disbursement register to another.

The town’s annual budget was $1 million; however, the loss from Beth’s scheme averaged 3 percent of the town’s annual operating budget and began to deplete its reserves. The mayor asked Beth about the decreasing savings and she explained that a new law had been reducing the amount of money the state distributed to small governments each year. The mayor accepted this as a plausible explanation. Beth’s clever response allowed the scheme to continue for another year before the external auditors detected it during a routine biannual audit.

Beth deposited falsified personal and petty cash checks into her bank account and cashed the checks made payable to the bank. When she issued fictitious checks to valid vendors, she initially typed the vendor name on the payee line of the check. She then used the typewriter’s correction capability and removed the vendor name from the payee line and replace it with her name. Finally, she deposited those checks in her personal bank account.

After the bank redeemed the checks and returned them to the town with its monthly bank statement, she again used the correcting typewriter and removed her name from the payee line and then replace it with the original vendor name. After this alteration, all the town’s documents reflected the same vendor information.

Beth hoped this concealment effort would prevent exposure of the fraud. But she made the mistake of retaining the altered checks on file when she initially began to misappropriate funds from her employer. She later corrected this by destroying the redeemed checks on future fictitious disbursement transactions to prevent anyone from detecting the false payee information. However, she didn’t destroy the redeemed checks for the fictitious transactions in the earliest part of the scheme, an omission that subsequently led to her downfall.

Beth also used the town’s credit card to make unauthorized purchases totaling $10,670. She began an obsessive-compulsive shopping spree to buy clothing on the Internet. She had all the purchases delivered directly to the town hall, explaining to her co-workers that no one was at her home to accept them. Everyone accepted this plausible explanation because her husband worked during the business day. She never created any supporting documents for these fictitious disbursements.

The town’s banker detected the fraud when he noticed unauthorized personal clothing purchases on the monthly credit card statement. He then notified the mayor. The external auditors immediately began to investigate the town’s disbursements. They discovered the altered checks from the initial phase of Beth’s disbursement scheme in the office files. This gave them probable cause to subpoena Beth’s personal bank account. Their review of the bank deposits from the bank’s microfilm records then led to the discovery of the rest of this disbursement fraud.

The court sentenced Beth to 14 months in the state penitentiary and ordered her to make restitution to the town for the amount of the loss plus audit costs.

METHOD NO. 2: CHECKS ISSUED TO FALSE VENDORS 

Fraudsters issue checks from organization checking accounts to pay their personal bills and credit card accounts or even fake payments to false vendors. The vendor names are usually valid businesses, but the transactions are fictitious.

The employee can deposit checks issued to false vendors into his or her personal bank account by altering the payee name or falsifying the endorsement by adding “pay to my name” on the back of the check.

Checking Account Custodian Lives an Extraordinary Lifestyle
As discussed in the March/April 2009 column, Julie misappropriated $188,307 from her employer in five years while serving as the custodian of two checking accounts – one for a private nonprofit organization, which had the school district’s identification included as part of the name on the account, and the other for an official school district advance travel fund.

Julie’s supervisors never noticed these irregularities because they didn’t monitor her work by assigning an independent party to review the bank reconciliations of the two checking accounts. This fatal flaw is a common internal control weakness in checking account frauds.

External auditors detected this fraud during a routine examination of the advance travel fund when they noticed that the name of the payee on the front of some redeemed checks didn’t match the endorsement information on the back of the checks. While reviewing her other duties and responsibilities in the organization, the auditors then found similar irregularities in the private nonprofit organization checking account Julie managed.

The court sentenced Julie to a nominal period in jail and ordered her to make restitution to the school district for the loss amount plus audit costs.

METHOD NO. 3: ABSENCE OF BACK-UP DOCUMENTATION 

Fraudsters don’t bother to prepare supporting documents for the irregular disbursement transactions from checking accounts when they know that managers don’t properly monitor their work. Most unscrupulous employees don’t spend a lot of time or energy concealing their actions when they don’t have to. But employees might try to conceal their actions by creating false documents when a supervisor is present and actually monitors their work.

However, Beth’s case in Method No. 1 and Sam’s case, below, are both good examples of situations in which the fraudster has to prepare fictitious supporting documents to process the transactions through the organization’s general disbursement system. They had no choice.

Superintendent Learns a Lesson About Greed
As discussed in the May/June 2008 column, Sam, a school superintendent and chief executive officer, misappropriated $29,060 from an educational service district in four years. He took control of the entire authorization and approval process for disbursements and then prepared and approved false transactions to withdraw funds from the district’s general disbursement checking account.

This disbursement scheme consisted of two major elements. First, Sam repaired two personal vehicles at the district’s expense by falsifying copies of the repair invoices from the vehicle dealer. He used white-out to eliminate the information about his vehicles and then entered false data indicating the organization’s vehicles had been repaired instead. These falsified documents weren’t the original source documents for the transactions, an attribute that fraud examiners should always look for during investigations.

The district reimbursed Sam for 36 personal purchases of groceries, books, electronics equipment, garden supplies, and other general merchandise. He altered cash register tapes by cutting out the detail of the purchased items and leaving only the name of the store at the top and the total amount at the bottom. He then taped the two pieces together and submitted the receipts for payment. This is what I call a cut-and-paste document, another attribute that fraud examiners should always look for during investigations. He prepared a false list of the items he said were purchased for the schools, such as televisions and other video equipment, to support the disbursements in the district’s accounting records. These unauthorized purchases weren’t big enough to bring them to the attention of the finance officer or the governing board.

Second, Sam processed false documents to obtain payment for personal vehicle gasoline, his family’s lodging expenses while on vacation, and false travel expenses for automobile mileage, meals, and hotel costs. His behavior was so outrageous that five employees in the accounting office put their jobs on the line to become whistle-blowers and report Sam’s actions to the district’s external auditor.

The court sentenced the superintendent to two months in jail and 30 days of community service and ordered him to make restitution to the district for the total loss amount plus audit costs.

METHOD NO. 4: DISBURSEMENTS MUST BE TIMED 

Thieving employees usually issue fictitious disbursement checks in the amount of the extra deposits they’ve previously made into the checking accounts they control. The sequence or timing of disbursements and deposits is critical. We must first know how each checking account operates so we can understand how perpetrators launder money in an organization.

For general disbursement checking accounts and for most other types of an entity’s checking accounts (such as petty cash funds, trust funds, and purchasing funds), perpetrators deposit the stolen revenue checks into the checking accounts before issuing checks to themselves and paying their personal bills and credit cards to avoid an overdrawn account that would attract attention.

For advance travel fund checking accounts, perpetrators deposit the stolen revenue checks into checking accounts after issuing checks to themselves from the accounts. In one of these transactions, the disbursement is first made to an employee for upcoming travel, followed by the employee’s reimbursement of the travel advance after the trip has been completed. When fraud exists, these fictitious trips create excess activity in the account. In addition, the fraud timing matches this flow of transactions.

BEST INTERNAL CONTROL: OWNER OVERSIGHT

During the monthly bank reconciliation process, owners of businesses or their designees should carefully examine the bank statement and all redeemed checks and check endorsements for every account in the organization to identify the most common irregularities caused by outsiders and insiders such as those described in this series of columns. This means every checking account – no matter how small.

When disbursement irregularities are identified, an independent party should examine the supporting documents for the transactions to determine if the expense is for a legitimate vendor and for an official business purpose of the organization.

LESSONS LEARNED 

Let’s review some of the finer points of fraud deterrence in checking accounts:

• Unopened bank statement and check enclosures should go directly to the owner or an independent party designated by the organization.
• If possible, small business owners should perform the monthly bank reconciliation. But if they can’t, they should at least review bank statements and redeemed checks for any irregularities before giving them to the treasurers or account custodians who will perform the bank reconciliations.
• Business owners or designees should ensure the payees for the redeemed checks match the check registers, the accounting systems or disbursement records, and the check endorsements. Then they can determine if each disbursement transaction represents a payment to a valid vendor for a legitimate business expense.
• Business owners or designees should scan bank statements to determine if there are more deposits in, and more disbursements from, the checking accounts than would normally be expected.
• We should use both the size of the accounts and, more importantly, the volume of activity that’s processed through the accounts as criteria to determine whether to review them in fraud examinations. 
• The ways in which perpetrators have concealed fraud in the past provide guidance to help us understand the methods they’ll use to evade detection in the future.
• Fraudsters often omit transactions from disbursement registers, which cause gaps in the numerical sequencing of checks listed from one register to another. Put this test in your fraud detection toolbox. 
• We must first know how each checking account operates so we can understand the methods fraud perpetrators use to conduct money laundering activities. Fraudsters deposit stolen revenue funds before disbursing funds from most types of checking accounts to themselves or paying their bills from the account. But, in advance travel funds, the false disbursements are made from the account before the stolen revenue funds are deposited.

WHAT SUPPORTING DOCUMENTS EXIST IN DISBURSEMENT FRAUD CASES? 

The short answer to this question is that fraud perpetrators falsify supporting documents, never prepare them in the first place, or purposefully destroy them after creation. In the next several columns, we’ll examine the types of document falsifications commonly found in disbursement frauds in the general disbursement checking account and in all other types of checking accounts within the organization.

Regent Emeritus Joseph R. Dervaes, CFE, CIA, ACFE Fellow, is retired after more than 42 years of government service. He remains the vice chair of the ACFE Foundation Board of Directors.  

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.