Sorry, this fraud has been disconnected, part 2

In part 2, the evidence mounts against Dan Jackson as the author's fraud examination begins. Jackson remains obstinate through his indictment and prosecution.

As we left part 1, Chloe Portela, NyTell's financial controller for the data center consolidation (DCC) project, had calculated that 70 percent of the DCC had been consumed, which was about 30 percent over budget. She pulled copies of invoices for ITC — one of the project's supposed vendors. Chloe had never heard of the company. In a panic, she talked with her boss, CFO Brooke Nokklekort, who called the author, a fraud examiner for NyTell. Management is very concerned.

Experience has taught me that it's important to manage the expectations of executives and keep them from hyperventilating over their own speculation. Corporate life is rarely exciting, and, even when fraud or serious misconduct occurs, it tends to be less serious than originally feared. Well, not always.

By this time, NyTell had paid 64 invoices from ITC and TES. CFO Brooke Nokklekort explained when we met that, although she had signed off on the invoices of more than $25,000, she'd simply relied on the earlier approvals of Chief Information Officer Chet Plumpton and Financial Controller Chloe Portella, as well as seeing Dan Jackson's "OK to pay" on the invoice. Brooke told me that her entire department was at my disposal and that she had already told Chet to shut down the project until this was straightened out. For good measure, she said, "I already called Oslo about this, and I am surprised you didn't hear the big shots screaming from across the Atlantic."

A quick call to Ollie Eckmer in Procurement confirmed that they had no contracts, statements of work or rate cards for either company. There would be no project-related documentation for ITC or TES other than the invoices.

Nancy Lynn in Accounts Payable confirmed that, other than the DCC Project, NyTell hadn't paid either company for any other project. Nancy Lynn accessed BOONIS and got me copies of the ITC and TES invoices. I reviewed the invoices and noticed two things that piqued my curiosity. First, each one of them appeared to have Dan's "OK to pay" and signature on them. The invoices were the PDF images pulled straight from BOONIS. This meant that Dan approved the invoices before they were even sent to NyTell for payment.

The second thing was the time stamps on the invoices. The dates on the invoices varied, but most of the time stamps weren't contemporaneous with the invoice date. Some of the invoices also shared the same time-stamp date. This meant that the invoices were probably submitted in batches rather than individually.

But why? What vendor sits on his invoices and lets them pile up? By sorting the invoices by time stamp, it appeared that many were submitted near the end of a calendar quarter. I asked Chloe if there was any significance to the calendar quarter. "We do a project review at the end of every quarter to see how we are doing," she explained. "If there is any extra money in the budget, Brooke makes us give it back right away."

Because ITC and TES had Pennsylvania addresses, I checked with the Pennsylvania Department of State for corporate filings. It turned out that ITC was a Pennsylvania corporation with offices at 20 Hollow Road, New Park, Pennsylvania. The registered agent for ITC was Jake Marshall. An online White Pages search confirmed the address was Marshall's home address.

A similar search was made for TES. TES was also a Pennsylvania corporation with offices at the same address. TES's president was also Jake Marshall.

NyTell's treasury department retrieved images of the canceled checks mailed to ITC and TES. I compared the checks. The endorsements showed that all the checks had been deposited in the same bank account. The handwriting matched on some of the endorsements for checks sent to both companies indicating, of course, that the same person endorsed checks for both ITC and TES.

I now had objective proof tying ITC and TES to Jake. Jake was implicated directly into the likely fraud scheme. But even if he had some friendship with Dan, could I show that there was collusion?

The next step was to confirm that the invoices were bogus. Besides Dan and Jake, five NyTell USA employees worked full time on the project. I interviewed each of them, and we pored over the ITC and TES invoices. The employees collectively explained how each of the invoices was fictitious. The services described were either not needed for the DCC project, provided by HAL or provided by NyTell's IT staff. Additionally, none of the witnesses recalled knowing or meeting anyone from ITC or TES.

So the investigation was presented with the obvious question: If ITC and TES were "ghost" vendors, and no one ever saw them, how did NyTell end up paying the invoices?

It turns out that Dan and Chloe had a different process for approving the ITC and TES invoices than with the other vendors. "Dan said it would save us both some time," Chloe explained. The two agreed that the placement of Dan's signature on an ITC or TES invoice meant that he had already validated the invoice and determined that payment by NyTell was appropriate. Unfortunately, Chloe never questioned why Dan had a special process for only two vendors but not the others. She also never questioned why Dan was receiving invoices from only these two vendors before BOONIS received them. She saw Dan's signature, and that was it.

Chet also relied blindly on Dan's signature. Chet approved invoices of more than $2,500 and less than $25,000. He consistently assumed that Dan's signature meant Dan had already validated the invoice. Chet never validated an invoice personally or asked other core team members for information; instead he relied exclusively on the information from Dan. Chet and Chloe failed to consider that, as the invoice was referred higher for approval, the next approving manager would view their earlier approval as an indication that the invoice was valid.

I had my evidence against Jake. Now that I had spoken to everyone else, it was time to confront Dan.

Building blocks

Dan started off the interview in his usual glad-handing way. He expressed shock that NyTell might have been defrauded. "Anything I can do to help you, you just let me know," he promised.

I approached his interview in a building-block style. First Dan admitted that before NyTell should pay any invoice, the following must be true: 1) the services described in the invoice were actually performed, 2) the services were done by the vendor submitting the invoice and 3) the services were not rendered by someone else.

Dan also explained that he was the "go-to guy" for validating project invoices. He acknowledged that each of the signatures on the ITC and TEC invoices were, in fact, his.

I then got Dan to admit that he knew the significance of his signature in the invoice-approval process. He admitted that Brooke and Chet would be relying on his earlier validation if they also had to approve an invoice.

Considering that he had validated the invoices, I asked Dan to justify the use of the ITC consultants described in the invoices. Dan explained that the services from ITC consultants were necessary because there were resource gaps in the delivery of project services. (The investigation had already determined, however, that there was no business need for additional services from ITC.)

Under further questioning, Dan's explanation collapsed. He said that he didn't make the decision to engage additional ITC consultants. Although he was the project executive and the person validating the invoices, Dan claimed that he neither knew who made that decision nor why it was necessary. Dan admitted further that no one on the core team had asked for the additional resources, and he never made any inquiries to determine if additional resources were needed.

Moreover, although he validated the ITC invoices, Dan couldn't explain the specific services ITC provided. He never saw a time sheet to substantiate the consulting work, and no invoice identified a consultant. Dan didn't set the consultant's hourly rates, and he didn't know who did. Dan admitted that he had no idea whether the time billed and the rates specified in an invoice were accurate. Dan never made any inquiries to find out either.

Despite his damaging admissions, Dan insisted that TES was needed. He claimed that TES provided necessary staff-augmentation, cabling and hardware-rental services because HAL had underresourced the project. Dan said he made the decision to engage TES. But, with some probing, Dan conceded that he neither met nor knew anyone from TES who provided services to the project. TES's fees weren't established before the services were purportedly rendered. Dan also never made inquiries to the core team whether or how TES was providing the services.

Dan, the project executive, had effectively conceded that he approved more than $1 million in invoices for two companies he didn't know and for services he couldn't explain. He was savvy enough to know he'd dug himself a hole he couldn't climb out of.

To close the loop, I emailed Jake after Dan's interview to request his assistance contacting the management at ITC and TES. The email explained that time sheets and other information were needed to validate certain invoices.

Jake replied quickly with his own email. He wrote that "in regard to ITC & TES, they are both my companies and I handle all the invoices and billing." Jake was unable to provide time sheets for the consultants, however, because "they were lost due to a stolen laptop while traveling abroad."

I replied a few hours later. Because of the "theft," I asked Jake to 1) identify the ITC and TES employees and consultants who provided services to the project, 2) identify the NyTell employees and consultants who might confirm that these services were provided and 3) provide copies of any documents TES created in connection with the extensive services it provided to the project. Not surprisingly, Jake didn't reply to this email.

Although it was outside the scope of the investigation, we had reason to believe that Dan had been defrauding NyTell in other schemes before he met Jake. The red flags were there, but everyone missed them: the lifestyle, the trusted employee who feels underpaid and unappreciated, and the one person who controls both all the information and key duties. Because he set the budget and tracked the expenses, Dan even knew when there was sufficient slack to quickly submit some ITC and TES invoices.

NyTell terminated Dan's employment and Jake's "engagement" immediately after the investigation was closed. His career now in tatters, Dan muttered as he left the corporate offices carrying the box of his credenza knickknacks and paperweights, "I'm glad my father is not alive to see all of this."

Referral to the FBI

Once the investigation was complete, I contacted the FBI. Because the company checks were sent by U.S. mail from New Jersey to Pennsylvania, I knew the FBI would have jurisdiction under the mail-fraud statute. I gave them my forensic investigation memo and all the exhibits to prove that this was a fraud scheme and not just bad corporate management. Fortunately, my "gift-wrapping" of the investigation appealed to them — "You did 90 percent of the work for us," the agent told me later over a beer — and a criminal investigation was opened.

The subpoenaed bank records for ITC and TES showed that all deposits in the account were followed almost immediately by a corresponding cash withdrawal. In other words, Jake was laundering the money he received from NyTell. The FBI quickly determined that NyTell's money had paid for home renovations, expensive cars, payments of mortgages and credit card bills, trips to Las Vegas and the Dominican Republic and season's tickets for the Baltimore Ravens. To ensure that Dan was in as much trouble with his wife as with the feds, the FBI showed that Dan's mistress had been ensconced and maintained in an expensive condo near the family home.

Two months later, the Middle District of Pennsylvania indicted Dan and Jake on multiple counts of mail fraud and money laundering. The indictment also included one count of criminal forfeiture to allow the seizure of their homes, cars and bank accounts.

Nevertheless, Dan maintained his innocence. His explanations ranged from "Marshall duped me" to "I saved NyTell more money than you think I stole." After multiple continuances, it looked as if Dan and Jake were going to take their chances with the jury, but the internal investigation and the FBI investigation were too airtight. Finally, Dan and Jake accepted the inevitable and negotiated a plea bargain with the U.S. attorney.

Standing before the judge in one of his Brioni suits, Dan was now a ruined man. Since his firing, his wife had left him and his assets had been seized. He was paying his lawyer with money from his relatives. But Dan claimed only to have "made mistakes" and "cut corners." Even the prosecutor was amazed that Dan still failed to accept responsibility. Jake, to his comparative credit, took responsibility for his role. He did his best to explain to the judge that this was just an unfortunate, unwise step in an otherwise exemplary life.

The judge, however, saw things differently. Jake was sentenced to 30 months in federal prison. Dan received 37 months because he had also abused a position of trust with NyTell. The judge ordered them jointly and severally to pay NyTell restitution of $1.5 million.

It was a bill from the phone company that Dan and Jake will never be able to pay.

Lessons learned

Based on the lessons we learned from Dan and Jake, NyTell changed a number of its internal policies and procedures:

• Accounts payable staff members now conduct spot-check validations of invoices to raise the perception of detection. The spot check includes contacting the vendor that submitted the invoice.
• Invoice approvers can no longer safely rely on the validation efforts of their subordinates. Each approver is responsible for personally validating each invoice.
• Project duties are segregated so that budgets, purchases, approvals and information do not rest exclusively with one person.
• Financial controllers must understand the projects for which they are providing oversight.
• Company vendors must be prequalified and placed on a master vendor list. Vendors must also have contracts and statements of work on file before any work begins.
• Fraud-awareness training is provided annually to the finance staff to help spot the red flags of fraud.
• The company will promote increased use of the whistleblower line, including mandatory reporting of fraud concerns.

This article is excerpted from the "Bribery and Corruption Casebook: The View from Under the Table," edited by Laura Hymes, CFE, and Dr. Joseph T. Wells, CFE, CPA, published by John Wiley & Sons Inc. © 2012. Used with permission. Names of persons and organizations in this case have been changed.

Meric Bloch, J.D., CFE, CCEP-F, is the senior director, global compliance, for Jabil Circuit Inc. He has conducted more than 300 fraud and serious misconduct investigations. He's an author and frequent speaker on investigation topics.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.