And they're off!

Three former frat brothers devised a high-tech scheme to win $3 million at the Breeders' Cup. Here's how they did it and how investigators quickly caught them.

Owners of racing horses and bettors all know that before the track announcer shouts, "And they're off!" that all wagering has ceased for that race. However, some of our older readers might recall the 1973 Academy Award-winning movie "The Sting" with Paul Newman and Robert Redford. The main characters set up a phony off-track betting (OTB) parlor to convince a "mark" they could delay the horse racing results long enough to place a wager before those results would be communicated over the telegraph wire. The movie was based on a scam, known as "the wire," perpetrated by Charley and Fred Gondroff on an Englishman in New York City in 1914. (See "The Big Con," by David W. Mauer.)

Three former frat brothers kept the scam alive by using 21st-century technology to outsmart the system and steal $3 million in winnings from the 2002 Breeders' Cup World Thoroughbred Championships races. We'll describe how the fraudsters pulled it off, and how investigators quickly caught them.

OLYMPICS OF THOROUGHBRED RACING

For thoroughbred owners, horse trainers and racing fans the yearly Breeders' Cup (the more common name for the race) is akin to the Olympics. In the words of Jim Gluckson, director of event communications for the Breeders' Cup, "The Breeders' Cup is the most prestigious global event in thoroughbred racing. Since its inception in 1984, the event has grown from one day and seven races worth $10 million to its current format of two days, 15 races and total purses exceeding $25 million."¹

On Oct. 26, 2002, approximately 46,000 horse-racing fans were at Arlington Park Race Track, in a suburb of Chicago, for the Breeders' Cup.² Exactas, Exacta Box, Trifectas, Trifecta Box and Pick Six were just some of the exotic wagering options offered at the race track and OTB parlors nationwide that Saturday. In other words, there were lots of ways to bet and lose money. (See definitions of racing and betting terms. Learn more about the world of thoroughbred racing.)

When a horse named Volponi (Sly Old Fox in Italian), a 42 to 1 shot, won the Classic (the major race of the Breeders' Cup and the last leg of the Pick Six) at Arlington Park, it almost assured few winners would be in the Pick Six betting pool that day.³ (Pick Six means picking the winning horse in six consecutive races.) In fact, there was only one winning wager: a bet telephoned to an OTB parlor in the Catskills region of New York State. This "lucky" person now had more than $2 million credited to his or her betting account. (The OTB parlor had to withhold $1 million from the $3 million winnings for income taxes.)

Picking one winner for the occasional racing fan is hard, but picking six consecutive winning horses is akin to a million-to-one shot.⁴ This rare winning bet would certainly bring with it excitement, notoriety, scrutiny and, perhaps as they say in the racing industry, a "stewards' inquiry." (The stewards are race officials who are responsible for enforcing the rules.) In this case, the red flags of fraud were waving all along the path to the winners' circle.

AGAINST ALL ODDS

At about 9:15 a.m. on Oct. 27, an unknown tipster called James Gallagher, the vice president of Pari-Mutual Operations for the New York Racing Association (NYRA), to ask him if he was aware that "all Breeders' Cup Pick 6 winners came from the Catskill OTB" and they were "getting into the tote system [or electronic betting]," according to supporting deposition signed by Gallagher on Oct. 30, 2002. (The tote system collects all betting data and calculates odds for the racing industry.)

The tipster comments, if true, could have had devastating repercussions for the integrity of the gaming industry. Gallagher contacted technicians for Autotote — the company that collects electronic betting data from OTB corporations through which the winning bet was placed — to verify the tipster's allegations. Their investigation revealed that there was one $12 winning wager on the Pick Six; the bettor had picked the first four races correctly and then played all the horses correctly in the final two races. (On the betting ticket this is listed as "all/all" and is commonly referred to as a "wheel.") This entire bet consisted of 96 possible combinations at $12 per bet for a total wager of $1,152.

To veteran race officials like Gallagher and Bill Nader, NYRA senior vice president, the probability of someone winning this type of bet was highly unlikely. Why would a bettor spend so much money covering the last two races when one wrong pick in races one through four could have lost the entire wager? If the bettor was going to spend that much money covering 96 combinations, it's more likely he would spread out his picks in earlier races.

NYRA immediately notified Breeders' Cup and Arlington Park officials so they could freeze the wire transfer of funds until a thorough review could be conducted.

Each industry has its own fraud indicators; for the horse-racing industry, analysis on the vast amount of betting pattern data can detect unusual bets. When the bettor picked the winners of the first four races individually and then "wheeled" the remaining horses in the last two races, it guaranteed he or she would pick the Classic winner but only if the first four selections were correct.

Investigators determined that the bet had been placed through the Catskill (N. Y.) Off-Track Betting Corp. system via its Integrated Voice Response (IVR) system. The IVR system allows bettors to place wagers via a telephone touch-tone keypad. The system requires that players apply for access before they can use it.

FRAUDSTERS' DRY RUNS

New York State Police investigators interviewed Arthur Weinfeld, vice president/director of operations of the Catskill OTB Corp. Weinfeld, among other duties, reviews activity on the telephone wagering system and Internal Revenue Service reportable payouts.

Earlier in October of 2002 he noticed a $1,757 payout to a first-time customer from a Pick Four play in which the bettor individually correctly picked the first two legs and then selected the winners in the last two legs. Several days later the same customer won a Pick Six wager that produced a payout of $107,608. The bettor made a $16 wager for each individual bet and correctly selected one horse in the first four legs and all horses in the last two for a total bet of $672 in 42 combinations.

"A closer examination of the bet," Weinfeld says, "did not indicate any outrageous selections, and appeared to be a customer getting lucky," according to a Nov. 10, 2002, signed statement by Weinfeld. He interviewed the winner, Glen DaSilva of New York City, by telephone after DaSilva faxed his claim for the winning wager. At the time, Weinfeld didn't detect anything suspicious, and a check was mailed to DaSilva.

(Weinfeld probably should have conducted an in-person interview. If he did so today, we might recommend that he read "Liespotting: Proven Techniques to Detect Deception," by Pamela Meyer, CFE, published by St. Martin's Press LLC.) As it turns out, these two bets were just successful dry runs before the main event in three weeks: The Breeders' Cup with its larger betting pools. The culprits now realized they could commit betting fraud.

When Weinfeld heard that the winner of the Pick Six had made his bet through the Catskill OTB, he discovered that a new customer had made the wager 20 minutes before the start of the first leg of the race. The bet singled the first four winners and combined them with all the horses in the last two legs, which meant there were 96 possible combinations and a $12 bet was placed on every combination.

Weinfeld was immediately suspicious and associated the bet with DaSilva's prior wagers. Derrick Davis of Maryland called on Monday and said he was the winning bettor. Tuesday's New York Daily News headline posed a perilous question for racing and gaming regulators about Davis' winning wager in the article, "Better Bettor Or Otb Hacker?"

The New York State Racing and Wagering Board lacked prosecutorial powers so it asked for help. On Oct. 29, then Gov. George Pataki directed the New York State Police to assist. Jorge Plata, the lead investigator from the state police special investigations unit worked with investigators from the racing and wagering board and the FBI.

PAY THE WINNER OR ARREST THE CROOK?

The state police computer crimes unit was tasked with securing and analyzing the mountain of digital evidence. The U.S. attorney's office was called in. All worked together to manage interviews, recover evidence and follow leads under enormous time constraints as pressure mounted for Arlington Park to pay the winner.

On the surface, no connection seemed to exist between DaSilva and Davis. Public database research tools such as Accurint, a paid public database research site operated by LexisNexis, revealed that these 29 year olds had shared a common address in the 1990s: Kappa Epsilon, a fraternity on the campus of Drexel University, at 3421 Powelton Avenue in Philadelphia. Grand jury subpoenas to the fraternity yielded a list of fraternity members from 1992 through 2002, which showed that DaSilva and Davis were in the same frat pledge class.

Investigators interviewed employees of the Catskill OTB hub that received the suspect wager. The OTB's Pamona, N.Y., headquarters includes administrative offices and call centers. The Poughkeepsie, N.Y., headquarters houses betting parlors plus the computer servers that run all operations. Investigators learned in May and June of 2002 that Autotote Inc. installed the IVR system that handled the phone-in bets. The programmers were periodically at the Poughkeepsie server site during the implementation of the system.

MAGIC MODEM

A modem on the system, which allows programmers to install software upgrades and correct any glitches from the Delaware home office, is normally turned off — a control measure for preventing hacking attempts from outside the system.

On the day of the Breeders' Cup race, an unidentified person called the Catskill customer center to report problems placing bets on the IVR system. The systems manager at the Poughkeepsie hub attempted to identify the problem, but his password for logging onto the system wasn't working. He called the Autotote call center where by great "coincidence," Chris Harn, one of the senior programmers, was there on his day off. The hub turned on the modem so Harn could access the system and made repairs for the alleged problem at about 2 p.m.

At just before 5 p.m., Harn called the Poughkeepsie hub again and told them he had inadvertently stopped the backup tape and needed its personnel to physically restart that tape. A stopped tape automatically ejects from the system and must be physically reinserted to begin taping again.

Investigators then began to look at the betting system. They learned that the OTB ceases all Pick Six betting just before the first leg is run. All money collected for the bets is forwarded to the host track — in this case, Arlington Park.

After the fifth leg of the Pick Six is official, the host track scans all the betting sites around the country and retrieves the wagers that are still viable. That leaves a window of opportunity for someone with access to local systems and appropriate expertise to make changes to wagers before the fifth race becomes official.

When officials at Autotote began to try to confirm that the winning wager was valid they discovered that the backup tape of the computer system had an interruption. (Missing tape segments are often incriminating as Richard Nixon found out in 1973 with his 18½ minutes of disappearing White House tapes.)

Autotote managers were suspicious because Harn, one of the lead programmers, was at the Autotote Delaware office on his day off. He explained that he needed to get out of his house because of the stress of a young child. However, as all fraud examiners know, employees who work when they aren't scheduled are red flags. Similarly, employees who never use vacation or sick time are also suspicious. Most employees covet their time off and those that vary from the norm create a reason for further investigation.

Harn said that during the day of the Breeders' Cup he had fixed a problem with the IVR system that was affecting betting. However, he was inconsistent in his stories. Harn first claimed that he hadn't been in the live system but later "recalled" that he had been.

The Delaware site keeps logs to track when their personnel perform maintenance and updates for customers. Harn didn't note any of his activities for the day of the Breeders Cup — a violation of security controls. He said that he had erroneously stopped the tape and asked the Catskill employees to restart the tape at approximately 3 p.m. Programmers and later investigators reviewed computer logs and discovered that the tape was in fact stopped between 4:50 p.m. and 5 p.m. This coincided with the time between the fourth and fifth legs of the Pick Six races — the ideal time to falsify a bet of the type that had won. (Timeline analysis is an old but still viable law enforcement technique.) After supervisors confronted Harn with the discrepancy, he obtained legal counsel and had no further communication with Autotote, which fired him. Any law enforcement professional knows that "lawyering up" is a red flag.

(For future investigations of this type, we might recommend that investigators recruit a CFE who's skilled in proper interviewing techniques so they can avoid confrontations with suspects and possibly obtain confessions.)

Obviously, Harn had become the prime suspect, but how could he have pulled it off? Could investigators tie Harn to DaSilva and Davis? They immediately pulled Harn's employment application and to their great surprise discovered that he had lived at the same Drexel fraternity in the early 1990s. After investigators received subpoenas to search the fraternity records, they discovered that all three had pledged at the same time. What are the odds of three people who pledged the same fraternity in 1992 claiming they didn't know each other in 2002? It's not happening in spite of how many bottles of beer were consumed. 

Investigators now had to show a more recent connection among the group. The IVR system application had phone numbers for Davis and DaSilva, and they knew Harn's from Autotote records. A telephone toll analysis proved to be the nail in the coffin for the trio. "The review of phone logs," said Plata during an interview with us, "was the icing on the cake as far as tying the group together in the scheme."

Investigators reviewed phone records of the three phones looking for connections. Records, obtained by subpoena, contained information such as if calls were incoming or outgoing, the times the calls began and ended, and the phone numbers of the connecting parties. Those records revealed that Harn and Davis had spoken eight times on the day of the Breeders' Cup. The first was a call from Davis to Harn about 1½ hours before the first leg of the Pick Six. They then spoke again about 10 minutes after the first leg and again after the third leg. The last call was about 45 minutes after the sixth leg. By then, Harn prepared Davis for the inquisition that was sure to follow.

The phone logs also revealed that Harn had placed the original bets, using Davis' account, on the Catskill phone betting system. Further analysis showed that Harn had also talked with DaSilva during his previous two wins.

SLEEPLESS NIGHT SPAWNS SCHEME

So how had Harn manipulated the system? He later told Plata and others that his scheme came to him during a sleepless night shortly after installing the IVR system in the Catskill OTB. Twenty minutes before the first leg of the Pick Six began, phone records showed that Harn placed wagers into the IVR system using Davis' account. He placed the bets with single winners in the first four races and wheeling the last two. He also placed red herring wagers wheeling the first two and singles in the fifth and sixth so if anyone looked they'd see other losing bets with similar characteristics. That was the easy part. His first hurdle would be accessing the local systems, which meant he had to have a reason for local employees to turn on the modem without raising suspicion. If a problem was reported to a local office, they were usually handled locally, but if a local official couldn't access the system because his password had been changed they would call Delaware and ask for help. Harn would have to be at work on his day off because there was only a small window of time in which to fix a bet.

Telephone records showed that the call complaining of a problem at the Catskill IVR system was placed a little before 1 p.m. He also had the ability to change the password on the Poughkeepsie manager's account so the manager wouldn't be able to check the problem. So, he did exactly what Harn wanted and called Delaware for help. Harn now had his excuse to ask Poughkeepsie to turn on the modem giving him access to the Catskill system.

In a bit of good luck (for Harn) and because of a lack of strict adherence to control protocols, the modem wasn't turned off immediately after the problem was resolved. This allowed Harn to re-enter the Catskill system at 4:50 p.m. between the fourth and fifth races to edit his "winning" ticket.

Getting in was only half the problem. He now had to locate the wagers he'd made in a system containing thousands of bets. On top of that, the system records the bets on three separate magnetic tapes: the master, the slave and the clone. Finding and altering the wager in a small window of time could never be done manually. So Harn created an executable computer program he called "nosey" to find the bets.

Even with the extra help of his software, Harn found it difficult to complete the task in the narrow time window. He changed the first four legs to winners and left the wheels in place. Dealing with his last problem, the ejected backup tape, Harn called the server hub and told them he inadvertently "fat fingered" their logger and needed them to reinsert the tape — another breach of controls through social engineering that went unreported and unnoticed until investigators began looking back.

As forensic computer investigators feverishly looked for the smoking gun evidence of an altered ticket, Thomas Hurbanek, an investigator with the state police computer crime unit, found the slave tape. He now thought they were going to wrap up the whole investigation, but he found that employees had inadvertently reused the tape and all valuable information was destroyed.

Investigators learned that Harn had been manipulating the system before he had hatched the betting scheme. He'd designed a program that searched the system for winning tickets that had never been cashed. Harn would reprint the tickets before the winnings were turned over to the New York State's office of unclaimed funds and have DaSilva and Davis cash them at local OTBs.

MOTIVE, MOTIVE

Why did Chris Harn commit the betting fraud? Perhaps an answer lies in the written statement of one Harn's co-workers: "Our wives are both Peruvian and talked frequently. I know he was having marital problems. He purchased a new home … about two months ago for approximately $180,000. Out of the blue … he had the house painted, new hardwood floors put in and the basement completely finished. This seemed odd to me as his wife does not work and he does not have a second job or work overtime here."

So why did DaSilva and Davis go along with their old frat brother's idea of a modern wire fraud? Some people say there is no monopoly on stupidity, but Harn had been making money on the reprinted ticket scam since 2001, and the Catskill OTB test runs had worked perfectly. Success does breed more adventurous schemes and internal controls were rather porous and ineffective, so the three amigos probably rationalized the scheme would work.

PICK SIX SECURITY ENHANCEMENTS

In August 2003, the National Thoroughbred Racing Association's Wagering Technology Group issued the report, "Improving Security in the United States. Pari-Mutuel Wagering System: Status Report and Recommendations," in conjunction with Giuliani Partners LLC. The report emphasized Pick Six security enhancements. The good news was that many of the OTB parlor operators across the U.S. had instituted numerous changes in their software systems and security procedures prior to this report. Most notably, bets now aren't held locally until after the fifth races; the OTBs forward them to the tracks as soon as they freeze bets for the first races.

When Autotote fired Chris Harn, they classified him as a "rogue software engineer." Be wary of people with back-office knowledge in any organization. Remember two of the more recent former back-office employees: Jerome Kerviel at Societe Generale in France in 2008 and Kewku Adoboli at UBS in United Kingdom 2011. They became rogue traders and caused losses to their employers of €4.9 billion and £1.3 billion respectfully. All three knew how to find weaknesses in computer applications and had reasons to take advantage of the opportunities.

WHEELS OF JUSTICE AT THOROUGHBRED SPEED

The Breeders' Cup fraud aftermath came swiftly. The three frat brothers were charged with violating federal wire and computer fraud plus money laundering statutes. The first (of the three) to talk got to walk. Well, almost — Harn, the mastermind, did most of the singing and got a year and a day in prison for his guilty plea and cooperation. DaSilva, who made the first two suspicious wagers received two years, and Davis, the "winning bettor," earned 37 months for his part in the fraud.

The three committed their fraud in late October, the federal government filed charges in early November, they pleaded guilty in late November and they were sentenced in March 2003. Five months from the fraud to sentencing — the wheels of justice at thoroughbred speed.

Because there was only a single day of racing there was no carry-over of the winning pool to the next day; so, the $3 million pool was subsequently divided to the winning ticket holders of five of the six races in the Pick Six. As is customary with most Pick Six pools, 25 percent of the total betting pool is reserved for individuals who selected five of six horses. Their initial payout was approximately $4,600 per winning ticket and those tickets would now be worth an additional $39,000.

Henry Gondroff went to Sing Sing prison in 1914 for his fraudulent "wire" deeds. In "The Sting," Paul Newman and Robert Redford faked their film deaths and went on to make more movies. Our three frat brothers probably found out it's better to be writing with a pen in college blue books than being in the pen wearing prison blue shirts.

You'll be happy to know that Volponi lives on a horse breeding farm in South Korea. View his historic race.

The authors thank the New York State Police for its approval of this article and the case's lead investigator, Jorge Plata, a 26-year veteran of the state police for his willingness to share his notes and detailed remembrances.

Richard Hurley, Ph.D., J.D., CFE, CPA, is a professor at the University of Connecticut School of Business.

William Mosher is an ACFE associate member. He has been with the New York State Police for 26 years and is the senior investigator supervising the Financial Crimes Unit.

¹Gluckson writes in an email to Richard Hurley: "The Breeders' Cup annually draws the world's best horses, trainers and jockeys to one site to decide the champions in virtually every division of Thoroughbred racing. Horses from England, Ireland, France, Germany, Italy, United Arab Emirates, Saudi Arabia, Japan, Hong Kong, Brazil, Argentina, Canada, as well as the United States compete in the event. The $5 million Breeders' Cup Classic is the climactic race of the Breeders' Cup. The winner of the Classic has been awarded the coveted title of Horse of the Year, 11 times."

²The 2012 Breeders' Cup is scheduled to run over two days Nov. 2-3 at Santa Anita Park in Los Angeles, Calif. Purses will range from $500,000 to the Classic's $5,000,000.

³See the payouts and photos of the winning horses for all the races run at the Breeders' Cup on Oct. 26, 2002. Races five through ten were the Pick Six races. See the complete program and results for the 2002 Breeders' Cup.

⁴Richard Hurley calculates that the actual probability of selecting six winners for the Breeders' Cup Ultra Pick Six wager was calculated at 3.6688e^-7 because of 14, 13, 12, 13, 8 and 12 horses running in races five through 10.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.