Leave no stone unturned . . .

Over my years investigating fraud and money laundering as a special agent for the U.S. government, I thought I had seen it all. This case was different. In just more than one year the suspects had received almost $10 million in investor funds and then vanished without leaving a trace. Except for one little piece of evidence . . .  

It started out like other fraud schemes. The suspects placed advertisements in local newspapers around the country promising huge returns on their investments. All people had to do was call the telephone number listed in the ad, and a representative would give them the information that they would need to get in on an investment of a lifetime.

The scheme was simple. For just $1,500, the investor could purchase an ATM machine that would be placed in a casino, fast food restaurant or other retail establishment and would earn the investor about $1 to $2 per ATM transaction. Even better, the company would do all of the work maintaining the ATMs.

The scheme worked so well that in just more than a year the suspects had received almost $10 million from more than 300 investors. Many victims purchased multiple machines; most were hard-working individuals who invested their life savings and retirement accounts.

In the beginning, everything looked fine. Investors received monthly earning statements and could even view their accounts on a website. According to their statements they were making great returns. But all of that came crashing down more than a year after the scheme began. As investors tried to track their investments, they quit receiving investment statements, the company stopped answering phone calls, and no one could find a single ATM machine that the suspects supposedly had used their investments to purchase. Investors eventually called the authorities to help search for their money.

By the time authorities began investigating, the suspects had vanished. All that remained were empty apartments and bank accounts. We discovered that the business address was a mailbox in a strip mall, and the telephone number listed in the newspaper advertisements was for an answering service that forwarded calls to temporary cell phones that were switched out every couple of weeks. The suspects even used fictitious or stolen identities when they talked to investors.

As the investigation continued, the leads went cold. The individuals involved in the scheme had vanished without a trace, and the paper trail went dead. As we struggled to find any new leads, we discovered in a stack of documents that one of the suspects listed a personal reference in an application to purchase a vehicle. Using this last bit of evidence, we tracked down the personal reference, conducted interviews and convinced them to have the suspect contact us.

A couple of days later, one of the suspects called us from a pay phone in central Mexico. He said that he was hiding in Mexico because the guys running the fraud scheme had threatened his and his family’s lives and told him to leave the country. Through his cooperation, we were able to identify the mastermind of the organization, a man we will refer to as “Chris.” According to the cooperating suspect, Chris had approached him and his wife about setting up the business and bank accounts, and in return they would get paid a small amount each month for running the local operations. As part of the operations, the cooperating suspect was instructed to take out thousands of dollars in cash from the business bank account (i.e. fraudulent proceeds) and send it to Chris via FedEx.

Chris’ use of temporary services (like cell phones, answering services and mailboxes), his use of fictitious names and unwitting suspects, and the bulk cash shipments by FedEx made it extremely difficult to trace any direct evidence linking Chris to the fraud scheme.

However, using the investigative techniques I outline below, we identified Chris and his associates, his bank accounts, his sources of income and his personal assets (houses, boats, cars, etc.). We conducted an extensive financial analysis of the records, which showed that the cash in Chris’ bank accounts and his purchases of cars, homes and other toys were tied — through either direct or circumstantial evidence — to the illegal activity and the bulk cash shipped to him through FedEx. Ultimately, the financial analysis and money trail lead to the successful prosecution of Chris and three other associates, with Chris sentenced to 20 years in prison and ordered to pay more than $6 million in restitution. 

INVESTIGATIVE TECHNIQUES

The key to this investigation, as in all investigations, was our use of all of the available resources and techniques to discover and analyze evidence. A small piece of information buried in a pile of evidence eventually lead to the apprehension and the subsequent prosecution of the suspects. You never know what will give you a solid lead. Sometimes it’s the combination of several pieces of evidence that ultimately helps you piece together a scenario.
Some of the basic, but often overlooked, investigative techniques in fraud examinations may include: 

1. Public records. 
2. Interviews.
3. Sources and Informants.
4. Analysis of physical and electronic evidence.
5. Surveillance.
6. Following the money (financial analytics and forensics). 

1. Public records
At the beginning of a fraud examination it’s important to gather as much information as possible about the suspects, the businesses, its owners and employees, related parties, etc. Public records searches can identify historical, current and other relevant information from court records (civil and criminal), business records, real and personal property records and even news articles.  

Reviewing public records also can help identify such things as possible rationalizations or motives for committing fraud (for example, debts and liens) or identify lifestyles that aren’t consistent with the suspect’s employment.

A good amount of public records can be retrieved on government and public websites that provide online access to electronically stored records. Many courts also maintain at least some information on their websites that are useful for the fraud examination.  

Also, several commercial providers charge fees to access large databases of public records or even conduct public records’ searches for you.  

Public records searches were key in our fake ATM case to help identify the suspects and their businesses. In addition, once we were able to identify the suspects, the public records searches helped us find assets such as houses, cars and boats that were tied to the illegally obtained money.

2. Interviews
Interviews should be focused on gathering evidence through facts and other information supplied by the witnesses. Interviewers should be objective, fair and impartial.

According to the ACFE’s 2013 Fraud Examiners Manual (3.202), “All good interviewers share certain characteristics. Above all, they are ‘people persons,’ and are talented at human interaction. Successful interviewers are the type of people with whom others are willing to share information. In most interviews, much pertinent information results from volunteered information, as opposed to responses to a specific question. The good interviewer displays interest in his subject and in what is being said.”

You should conduct interviews throughout all phases of the fraud examination. As you obtain evidence from investigative techniques, you may identify additional leads and persons of interest, find new evidence or records and may identify additional witnesses. The purpose of interviews is to obtain background information about the witnesses and their knowledge of the subject matter and targets of the investigation. In general, like the peeling of an onion, the fraud examiner will first interview peripheral witnesses, progress to those with specific knowledge and then interview the targets last.

(Rarely, the fraud examiner might decide to interview potential targets in the beginning of the investigation. Although not discussed in detail in this article, the fraud examiner should become familiar with interviewing rules, skills and strategies and when it’s appropriate to interview targets. Also, the fraud examiner needs to be aware of potential legal issues when he or she is considering interviewing any possible targets. See sidebar, “Legal considerations when conducting an interview,” at bottom of article.)

In our fake ATM case, gaining the cooperation of the people we interviewed was integral in the prosecution of the suspects. The interview with the personal reference of the suspect hiding in Mexico had very little face value but ultimately led us to a key suspect. And through an interview with the fugitive calling from a payphone in Mexico we were able to convince him to return to the U.S. and fully cooperate in the investigation. 

3. Sources and informants
In many fraud examinations we find individuals who are willing to cooperate and provide information. Some will talk only if they can remain anonymous. Sources and informants can come from employee hotlines, whistleblowers or anonymous letters. Others come from business partners, employees, friends or neighbors.

Here’s a key distinction between sources and informants:    

Sources provide information based on their occupations or relationships to the suspects and aren’t culpable.  

Informants have some involvement in the alleged offenses, either directly or indirectly, and may have some culpability. The cooperation of our suspect out of Mexico turned informant helped us unravel the scheme and identify the mastermind.  

Whether dealing with sources or informants, they might have hidden motives for providing information. Therefore, be sure to try to corroborate information with facts or evidence.

4. Analysis of physical and electronic evidence
Many crime procedural television shows highlight forensics of physical evidence. Whether it’s crime scene investigators in New York or Miami, TV will have you believe that some sort of physical evidence solves every investigation in 60 minutes. And although physical evidence such as traces of hair or blood might not play a role in fraud examinations (let’s at least hope not), there are some of types of physical evidence such as fingerprints, handwriting analysis or forged document analysis that can be very useful, as was the case in our investigation.

Computer forensics, on the other hand, is almost a necessity in today’s fraud examinations. Of course, a tremendous amount of information is stored on servers, desktops, laptops, tablets, smartphones and thumb drives. And subjects can store and access unidentifiable data from virtually anywhere via the “cloud.” [Via cloud computing, subjects can store and access data and applications on computer networks (wireless local area networks, the larger Internet, etc.) rather on personal computers or devices.]

Fraud examiners should keep current with the latest tools to collect and analyze physical and electronic evidence. (The fraudsters are certainly doing it!)

5. Surveillance
Surveillance is an effective tool in identifying subjects, potential witnesses and suspects and their activities plus residences, businesses, vehicles, etc. As described in the Fraud Examiners Manual (3.306), “Surveillance, whether by foot or vehicle, is predominantly an exercise in common sense, skill, tact, and ingenuity on the part of the observer. Carefully planned and properly executed surveillance can be of tremendous value in an investigation; conversely, lack of preparation, poor timing, and unsound surveillance practices can destroy an otherwise good case.”

Surveillance of individuals will be mobile or fixed. When you use mobile surveillance — following a subject on foot and by vehicle — you need to make thorough plans to avoid detection. Mobile surveillance is useful in identifying additional associates/targets, witnesses, assets (houses, cars, bank accounts, etc.), businesses and other information.

Fixed surveillance — observing a target (a “stakeout”) at a residence or business from a vehicle or house — can also help identify potential witnesses or additional targets.

Investigators often use “drive-bys” to document lifestyles and take photos of expensive cars and boats and other big expenditures. Drive-bys also can help establish business operations, or, as in the above case, help prove that alleged business activities are shams. 

6. Follow the money . . .
In the 1976 Academy Award-nominated movie “All the President’s Men,” Washington Post reporters Bob Woodward, played by Robert Redford, and Carl Bernstein, played by Dustin Hoffman, investigate the Watergate scandal and U.S. president Richard Nixon. In the movie, Woodward is talking with the Watergate informant, “Deep Throat” (later identified as a former FBI associate director), in a dark parking garage. When Woodford presses the informant for more information because the story was going dry, Deep Throat offers the now-iconic phrase, “Follow the money.”

Nothing rings more true to a fraud examiner than those words. Financial analytics and forensics have been instrumental in taking down some of the most notorious criminals in U.S. history. As financial markets continue to become more global and financial transactions more complicated, organizations increasingly need fraud examiners who understand complex financial transactions and know how to uncover fraudulent activity. (Just ask the people hiring at the FBI or U.S. Drug Enforcement Agency.) Fraud examiners should be able to clearly and simply communicate results of financial analytics to juries, boards of directors, prosecutors and clients who may not have the first clue on how to read bank statements.

Most often, indications of wrongdoing may not be evident just by glancing at financial records or statements. What appears to be an innocuous $50 payment to a vendor may actually add up to thousands of dollars in embezzled funds over an extended period. Financial analytics and forensics can also help identify potential witnesses, co-conspirators or unknown bank accounts. Analyzing accounts payable records can help identify fictitious employees or vendors. An analysis of the accounts receivable books may uncover books that are being cooked or potential inflated sales figures.

Tracing financial transactions can be accomplished through either direct or indirect methods of proof.

The direct method of proof, like its name implies, involves the direct tracing of specific financial transactions traced from the source of the payment (such as the financial institution, person, etc.) until its final destination. As shown in the illustration above, sometimes the tracing can involve multiple financial institutions, persons or entities and even international locations.

Often, especially in fraud schemes, not all financial information is available for direct tracing. In these cases, use the indirect method, which relies on circumstantial evidence to link financial transactions together and prove whom ultimately ends up with the money.

Some of the indirect methods of tracing include: 

• Expenditures.
• Net worth.
• Bank deposits.  

For additional information on these methods, refer to the 2013 Fraud Examiners Manual, Investigation, Tracing Illicit Transactions, 3.801-3.856.

ALL THE TOOLS IN YOUR ARSENAL

Even the smallest piece of evidence can be significant, but you have to find it. Fraud examiners should be familiar with and utilize every available tool to investigate fraud. Keeping current with techniques and technology is integral to today’s fraud examinations. We used every one of these techniques to catch the fraudsters; skipping one could have stymied the entire investigation.

Eric Lee, CFE, is a manager in the Forensic, Investigative and Dispute Services practice with Grant Thornton LLP.

Sidebar:

Legal considerations when conducting an interview
Interviews, and especially admission-seeking interviews, may expose a company and a fraud examiner to certain legal risks. Thus, before engaging in an interview, fraud examiners must understand the ramifications of their actions. This requires an understanding of particular legal issues and how they limit or affect the ways in which an interview may be conducted. However, because employee rights vary from case to case, fraud examiners should always consult with an attorney regarding the specific laws and regulations for their states or localities.

Legal authority to conduct interviews
In most instances, legal authority isn’t required to interview people or to inquire into matters. The U.S. Constitution doesn’t prohibit private citizens from inquiring into virtually any subject area, as long as the rights of individuals aren’t transgressed in the process. Generally, no license is required to conduct interviews; however, if the interviewer represents himself as an investigator, some states require a license. (See the Fraud Magazine July/August 2013 "Career Connection." — ed.)

False imprisonment
False imprisonment is the restraint by one person of the physical liberty of another without consent or legal justification. In the context of employee interviews, a claim of false imprisonment may be made if the interviewer locks the interview room, stands in front of the exit or refuses to let the suspect leave.

Use of deception in interviews
Surprisingly, the use of deception to gain information can sometimes be employed legally. The theory is that information can be obtained by nearly any means, with the exception of force or threats. The interviewer, however, might not employ any deception likely to cause an innocent person to confess. The use of deception isn’t justified regarding promises of leniency, promises of confidentiality, or to obtain a monetary or business advantage.

Frazier v. Cupp
In Frazier v. Cupp, 394 U.S. 731 (1961), the U.S. Supreme Court indirectly recognized the necessity of using deception during interviews. In this case, the suspect confessed to a homicide after the interrogator falsely told him that his alleged accomplice had confessed to the crime. On appeal, the Supreme Court ruled that the deception alone was insufficient to invalidate the confession.

Recording interviews
In some circumstances, recording an interview might be illegal. Both state and federal law limit an employer’s right to record employee interviews during an investigation. In fact, in some states, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.

If recording an interview without the respondent’s consent is legal, consider recording the interview covertly. Covertly recording offers an advantage in that it provides an accurate record without disturbing the flow of the interview. If there’s to be a covert recording and the subject asks if the interview is being recorded, don’t lie. Explain that it’s in the subject’s best interest that an accurate recording be made, and he can have a copy when completed.

Source: ACFE’s 2013 Fraud Examiners Manual, 3.204

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.