Mary Jane betrays the boss and embezzles $400,000

Thanks to tuition paid by her employer, Mary Jane pursued an accounting degree and learned how to embezzle more than $400,000 in six years. The company discovered her fraud one year after she received her degree. Learn the basics of the investigation component of this fraud examination.

Mary Jane looked like many fraudsters: unremarkable. She was 40 years old; medium-length brown hair; short, unpolished nails; drab clothing. She was a faithful 16-year bookkeeper at ABC Manufacturing — a small, family-owned business. She and Tom, married since she was 19, had three children.

However, Mary Jane was anything but ordinary. Actually, she was extraordinary because the company discovered that in six years she had casually stolen more than $400,000 and had altered checks and credit card statements to conceal her embezzlement. Ironically, her employer unwittingly paid her to rob them blind — it reimbursed her tuition for her college education in accounting and even gave her paid time off to attend classes.

Her asset diversion fraud benefited from an overly complex accounting system, a lack of separation of duties and an inadequate management oversight — classic problems of a family company. Here’s the story of Mary Jane, our fraud examination and how a small business painfully learned anti-fraud principles after it trusted a “normal” employee.

THE EMBEZZLER IN THE NEXT CUBICLE

The average value of property stolen per strong-arm robbery is $1,244 (the FBI’s “Crime in the United States”). However, the median loss from an occupational fraud case is $140,000 (ACFE’s “Report to the Nations on Occupational Fraud and Abuse: 2012 Global Fraud Study”). The scary street criminal that ripped you off likely has a police record. But the person who embezzles from your company usually is someone you see every day and has never been arrested. It’s someone who has a spouse and kids, a college degree, appears proficient and always seems on top of his or her game. The worst part is it’s usually one of your most trusted long-term employees who’s betrayed your trust.

After the company discovered Mary Jane’s fraud, our team of three CFEs interviewed witnesses, collected key documents, assisted the business in filing for and collecting its crime insurance coverage, provided information to the police and prosecutor, and presented several weeks of ongoing accounting and financial management remediation to the business.

(The company gave us permission to write this article if we protected its privacy. We’ve changed the names of the business and current and past employees. Mary Jane’s prosecution might still be pending.)

RED FLAGS FLYING

Red flags often are hidden in “silos” — managers and employees in separate departments might detect suspicious activities, but if they don’t communicate with each other then a fuller picture of possible fraud might not emerge. That probably happened at ABC Manufacturing.

Here are the circumstances and red flags that led up to the discovery of this embezzlement. During recent tough economic times, the firm took steps to keep itself financially afloat, which included reducing staff and hours of the remaining employees. Everyone had to do more with less. Also, the business owner’s wife, let’s call her Sarah, went back to work in the family business to be in charge of all administration.

Sarah first asked Mary Jane to decipher the Byzantine accounting system, but Mary Jane was no help. Many employees observed Mary Jane’s obstinance.

The company IT tech told us, “Looking back now, I think Mary Jane was hiding her wrongdoing, and Sarah was a threat for finding it. Mary Jane had this attitude that Sarah was snooping in things that didn’t concern her. ‘An owner snooping in company affairs that didn’t concern her.’ What a joke.”

The plant manager said, “Mary Jane did not let any of the office help do anything in the books when she was gone.” The inside sales manager said, “Many people had attitude problems with her.” The purchasing manager said, “She didn’t want certain things done while she was away.”

Based on employee and owner interviews, we found that Mary Jane was intelligent and a hard worker but also a complainer, irritable, defensive, disgruntled and unwilling to share her duties. We later found she was living beyond her means (a new car and swimming pool even though her husband was unable to work), had family problems and was having an affair — all classic personal characteristics and behavioral red flags that often point to business fraud. The probability of fraud is heightened if a sufficient number of these attributes are combined with opportunity and the capacity to rationalize fraudulent behavior. (See header “Analyzing Mary Jane’s behavior with fraud triangle.”)

(The sidebar, “How to identify a fraudster 5+5” at bottom, contains some of the personal characteristics and behavioral red flags I list when I give lectures to business groups. I’ve found that if fraud examiners identify at least five characteristics in subjects from each list, they should further investigate.)

Of course, if ABC Manufacturing had looked for these red flags in their employees’ behavior and conducted a fraud prevention inventory, it might have deterred some of Mary Jane’s damages.

BOSS' WIFE IS TENACIOUS

Mary Jane wasn’t answering Sarah’s requests for financial information and information about the accounting system. Sarah sensed that something was wrong. She spoke with a former company accountant, now long retired; he suggested she obtain some basic financial documents directly from the bank and credit card vendor.

The company credit card invoices provided by the bank indicated multiple charges to a cable TV company and Western Union cash transactions. Cancelled petty cash checks provided by the bank were thousands of dollars higher than identical check number copies and information recorded in company cash disbursements files.

An attorney referred the company owners to the licensed private investigation agency for which I work. Our job was to investigate the alleged embezzlement, interview key employees and document the evidence.

CHECKS AND CREDIT CARDS

We identified two areas of asset diversion: check alteration and credit card fraud. Mary Jane used the general ledger to try to conceal these frauds. She also altered and cashed petty cash checks for amounts higher than the amounts indicated in the company check register. Mary Jane used a company credit card to pay personal expenses. She altered the credit card statements to exclude her personal expenses and made general ledger entries to asset accounts and prepaid items to further conceal the transactions and close the books.

ACCOUNTING SYSTEM FAILURE

The accounting system’s insufficient separation of duties was a major deficiency. The use of one company credit card number for multiple employees invited irregularities. Mary Jane’s immediate supervisor had insufficient accounting experience and training to provide adequate oversight.

A CONFESSION-SEEKING INTERVIEW

Often fraudsters don’t consciously realize it, but they psychologically seek release from the stress of ongoing frauds and often express feelings of remorse. Sometimes their need to unload the guilt is larger than facing the consequences of the crimes. A fraud examiner’s techniques and strategies will directly influence the probability of a confession. There’s no substitute for interviewer training and experience. Establishing rapport through pacing the subject, stories, suggestions, asking open questions, discerning motives, etc. often may provide an environment in which the subject does confess. That’s what happened one Monday morning in the spring of 2011 when Jack E. Sandlin, CFE, the president of the PI firm, interviewed Mary Jane. She had no idea that we were investigating her. There was less than a month between the time we began our investigation and her one interview.

Sandlin questioned Mary Jane about the apparent difference between petty cash checks in the company files and identically numbered cancelled checks furnished by the bank. Check No. 33921 was recorded as $296.48 in company records; however, according to a copy obtained from the bank, the check amount was $3,296.48 — $3,000 more. Mary Jane acknowledged the check was payable to her and that she endorsed the check. After several false attempts during the interview, she realized that she couldn’t successfully explain the $3,000 difference. She knew that she’d been exposed. After a short break to allow her to regain her composure, the recorder was turned back on. Following is the transcribed dialogue of that interview:

Sandlin: “Let me ask you about the petty cash again. Did you divert the cash for personal use?”

Mary Jane: “Yes.”

Sandlin: “All right. How much? How long’s it been going on?”

Mary Jane: “Probably three years.”

(Evidence indicated that it had been going on for six years or more.)

Sandlin: “All right. Has anybody else been involved in it with you?”

Mary Jane: “No.”

Sandlin: “Okay. … On the [company credit] card … there are items that were on the charge card that you say are part of [an asset] account and part of that included your mortgage payment. What other kinds of charges … were you doing on [the company credit card]?”

Mary Jane: “Cell phone and electric bill.”

(Evidence indicated that other personal expenses were paid with the company credit card including cable TV bills of more than $200 per month.)

Sandlin: “All right. On … [your personal] payments from month-to-month — the bills paid online — did anybody review the actual bill and sign off on that?”

Mary Jane: “No.”

Sandlin: “Okay. And besides … the petty cash stuff, did you create any vendors?”

Mary Jane: “No.”

Sandlin: “Okay. So you haven’t been making vendor payments — "

Mary Jane: “No.”

Sandlin: “ — under anything that you created? Do you know of … payments being made to any vendors that are in your accounting system that are not actually vendors —”

Mary Jane: “No.”

(At Mary Jane’s request, a brief discussion was held off the record.)

Mary Jane: “I truly am [sorry] and I know this is not an excuse, but … I didn’t have — I don’t want to make excuses, so I guess I won’t even tell you that.”

Sandlin: “Well, you’ve had financial difficulties, haven’t you?”

Mary Jane: “My husband … he’s been very sick. I didn’t know what to do. I know I could have probably went to [business owner] like I did in the past and asked for help, and I am truly, truly sorry, and I will do whatever it takes to make this right, and nobody else was involved, it was all me. And it started, and I thought — like I’m sure everybody thinks — it’s just a little bit [I’m taking], I can catch up, and then it just kept up. I don’t know how else to explain it to you other than I am truly, truly sorry.”

AFFAIR WITH AN OLDER MANAGER

Employees told us that Mary Jane began having an affair with a manager, Robert, from another department during the time she was embezzling. He was 14 years her senior. Robert also had check-signing authority. Here is part of that interview:

Investigator: “Okay. Who signed that [petty cash] check?”

Mary Jane: “It was Robert ________.”

Investigator: “Okay. So why would Robert sign a $2,349.50 check to petty cash?”

Mary Jane: “Well, probably because sometimes I would give him the checks, he would sign extra checks that weren’t filled out.”

Investigator: “In advance?”

Mary Jane: “Uh-huh.”

Investigator: “Okay. Just signing blank checks in case he wasn’t around, and you needed one?”

Mary Jane: “Yeah.”

(Mary Jane said Robert wasn’t involved with her crimes. We later interviewed Robert who said that he didn’t know that she was committing fraud. We didn’t have evidence to the contrary, but he might have been withholding information.)

MARY JANE IS SHOWN THE DOOR 

(The owner of ABC Manufacturing now joined the interview.)

Company owner (reading from prepared script): “You shall immediately leave the property of ABC Manufacturing Incorporation and may not return to the property. You may not access or otherwise use any computer programming or networking, including email accounts used by ABC Manufacturing Incorporation or used in your employment with ABC Manufacturing Incorporated. Your personal effects will be sent to you as soon as reasonably possible.”

Mary Jane: “Okay.”

Sandlin: “Okay. … We’ve got a fellow sitting in a room over here. I’m going to ask him to step out. He’s going to walk you down to your work space. If you have a purse down there, he’ll pick up your purse. Everything else in your work space will be photographed, inventoried, and what’s identified as personal will be packaged and sent to your house. We’re not going to make a scene about this, we just ask that in accordance with what was just read, that you not have any contact with any of the employees, and if you would come back, you know, on the property or around any of the peoples’ homes or anything like that, it could be a criminal violation, and so we don’t want you to inadvertently, you know, do something that would cause or create that situation, and that’s why this statement was read that to you, so — okay?”

Mary Jane: “Okay.”

Sandlin: “Go ahead.”

Mary Jane: “What’s going to happen to me?”

Sandlin: “That won’t be up to me. We just put the information together and then submit it to the company, and then they’ll make a determination on how they want to proceed going forward. It’s possible that the police could be involved; it’s also possible that … there could be a civil action. So — we’re talking about a lot of money — I mean you know that better than I do. Okay? We’ll tell the law enforcement officers that we have this interview and that you indicate you want to make this right.”

Mary Jane: “I do, I do. I will do whatever.”

Sandlin: “There’s no — there’s no promises. I mean nobody can sit here and make you a promise.”

A security guard hired for this occasion escorted Mary Jane out of the building. We secured Mary Jane’s computer, and our forensic computer technician mirrored its hard drive. Our team of CFEs audited the specific accounts in question and conducted tests of other accounts. We didn’t find irregularities in the other accounts.

ANALYZING MARY JANE'S BEHAVIOR WITH THE FRAUD TRIANGLE

We can scrutinize Mary Jane’s behavior with the three sides of Dr. Donald Cressey’s Fraud Triangle:

• Financial pressure: The fraudster determines that a personal financial problem can’t be solved through legitimate means; this tends to be the initial crime motivator. In this case, the evidence points to Mary Jane’s husband’s illness and her extramarital affair as the elements.
• Opportunity: The fraudster sees the solution to her financial problems with a minimum perceived risk of disclosure. Mary Jane was a trained accountant intimately familiar with ABC Manufacturing’s overly complex accounting systems. Internal controls were nonexistent. Her supervisor provided little professional oversight; the company didn’t employ an outside accountant or auditor.
• Rationalization: Fraudsters see themselves as ordinary people who are caught in a bad set of circumstances. In her confession testimony, Mary Jane cites her husband’s illness as the reason for the asset diversion. 

REMEDIATION AND A BRIGHT FUTURE

One team member provided ABC Manufacturing with part-time onsite remediation and acted as a temporary accountant while bringing internal controls to the system. The team also continues to cooperate and assist local law enforcement and the prosecutor’s office. ABC Manufacturing is cash-flow positive and appears to have a bright future.

We believe that Mary Jane has sold her home, moved closer to her parents and is working as a bookkeeper at another firm. We haven’t found any record of her arrest, and we believe that she’s working out a financial settlement with ABC Manufacturing.

During our interviews, a female employee told us, “I had lunch with Mary Jane almost every day for years and had no idea that she was stealing from us.” Everybody at ABC Manufacturing felt betrayed. However, morale has picked up and will stay that way if the company can prevent future Mary Janes.

The author thanks his team members, Jack E. Sandlin, CFE, and Jean R. Patterson, CFE, CPA, for their contributions to this article. Sandlin has more than 35 years of law enforcement and investigation experience. During the time, he served with the Indianapolis Police Department, organized its first white-collar crime unit and was deputy chief of police. Sandlin is president of Jack Sandlin & Associates in Indianapolis, Ind.

Patterson has more than 25 years of accounting management and tax experience. During that time, she focused on small businesses — the dental field, in particular. She now provides litigation support and business fraud risk assessment.

Greg Wright, CFE, CFP, CLU, ChFC, is a former financial analyst division and plant controller for a large international manufacturer. He held insurance and securities licenses for more than 30 years serving municipal and private sector clients as a broker-consultant. Wright is the president of the ACFE’s Central Indiana Chapter.

Sidebar:

How to Identify a Fraudster 5+5©

Personal characteristics 

• Intelligent.
• Inquisitive.
• Egotistical.
• Risk taker.
• Rule breaker.
• Wheeler dealer.
• Hard worker.
• Greedy.
• Complainer.
• Defensive.
• Irritable.

Behavioral red flags 

• Living beyond means.
• Big spender.
• Unusually close to vendor or customer.
• Lied on résumé.
• Legal or financial problems.
• Divorce or family problems.
• Disgruntled.
• Addiction.
• Refusal to take time off.
• Keeps unusual work schedule.
• Unwillingness to share duties.
• Intimidates subordinates.