Taking down a crooked film producer

Fraud Magazine recently spoke with three veteran CFEs about how they break open and dissect investment scams and claw back stolen capital. Though these practitioners weren’t involved in this ongoing Hollywood case, they’ve reviewed the public records. And they’re deeply experienced in the case’s functional components: financial investigation, digital forensics, and asset tracing and recovery. As these experts reveal, their tools and techniques also are potent weapons against other kinds of schemes.

Fraud works best when its victims are distracted. What better place then for deceit to flourish than in Hollywood, on Broadway or any of the streaming media services where myth rubs shoulders with the profit motive? Even so, many people find it hard to turn down a role — of any kind — in the entertainment industry. That’s why some say the next best thing to starring in a play or film is investing in one.

Sometimes, but not always. The FBI field office in Los Angeles, California, demonstrated the downside of show business investments in its ongoing probe of a scheme that began in 2015 and neared its end with the perpetrator’s arrest in 2019. In that case, a Tinseltown fraudster has pleaded guilty to duping two small groups of foreign investors — one in China, another in South Korea — into giving him millions to fund his production of what turned out to be a nonexistent film. The investigation continues because the FBI is looking into whether the defendant committed other similar frauds, possibly with help from conspirators.

To each group of investors, it seemed like the right opportunity when a supposed Hollywood film producer, Adam Joiner, approached them via U.S. contacts. Joiner was looking for help in financing what he said was a joint project with California-based Netflix to produce “Legends,” an adventure-fantasy film featuring historical and fictional characters. Netflix would distribute the movie globally, he said.

Although it was reported that the two investor groups individually performed due diligence, amazingly they found no extraordinary risks. Under separate agreements with Joiner they wired him a combined total of $14 million to fund the film’s production. The investors knew that the complex project would take some time to complete. So, they waited patiently with visions of big returns after Joiner said he’d signed up a world-famous executive producer and an Academy Award-winning director. Joiner also forwarded emails and signed contracts he said he’d received from enthusiastic Netflix executives.

Yet the investors began to worry as many months passed, and Joiner didn’t answer their queries. Finally, he threatened them with a lawsuit if they continued, as he put it, to “harass” him. The investors’ attorneys then advised them it was time to alert law enforcement in California and, at their request, contacted the FBI on their behalf.

[Because the case against Joiner was still pending as Fraud Magazine went to press, the Department of Justice (DOJ), of which the FBI is a part, wouldn’t speak on the record about it. However, the DOJ did share as background some of the court records that detail the government’s case against Joiner. These documents are otherwise available through fee-based services (such as the Public Access to Court Electronic Records website) and thus are discussed, but not presented, here. – ed.]

The bureau goes to work

Once the investors’ attorneys had notified the FBI of the victims’ losses, the bureau’s Los Angeles field office assigned a special agent in its Complex Financial Crime Squad to investigate. The agent’s immediate task was to identify sources of information shedding light on the victims’ allegations. He began by obtaining, from Joiner’s bank, records of the deposit account Joiner had set up specifically to receive funds from investors in his “Legends” project. Those records indicated Joiner was the account’s sole owner and that the Chinese and South Korean groups had indeed wired a total of $14 million into the account in 2016 and 2017.

Joiner’s bank records also revealed that he’d used more than $5 million of the investors’ money to buy a townhouse in Manhattan Beach, 15 minutes outside of Los Angeles, and that he’d transferred an additional $4.3 million to a separate bank account possibly linked to another film project in which Joiner was involved.

The FBI special agent interviewed representatives of the two investor groups by telephone. They forwarded him the “Legends” distribution contracts Joiner had sent them, which bore signatures purportedly of Netflix executives. But when the agent interviewed the executives, they said the signatures on the contracts weren’t theirs and that they’d never even heard of Joiner or his film project.

The special agent, after verifying the victims’ assertions, moved on to locate and secure admissible evidence that Joiner himself had forged the emails and contracts. Such proof could come only from the electronic devices Joiner had used throughout the scheme. Because he didn’t have a business office, they most likely were in his home. The special agent had to be certain that the $5 million townhouse was where Joiner lived. A request for a search warrant must precisely specify its physical scope and investigative purpose.

First, the agent consulted a law enforcement-accessible database that indicated Joiner still owned the property. Then, staking out the location in Manhattan Beach, the agent observed Joiner relaxing on its balcony. He recognized Joiner from a driver’s license photo he’d obtained from the California Department of Motor Vehicles.

The agent then prepared an affidavit of his assignment, activities and findings. He needed to establish before a judge probable cause for (a) the DOJ criminal complaint charging Joiner with three felonies and (b) for two warrants — one to arrest Joiner and a second to search his home, phone and computers for evidence of his apparent frauds. The affidavit also sought permission to press Joiner’s fingers to his digital devices or expose his open eyes to any biometric sensors that might restrict access to the devices.

A U.S. attorney in the Central District of California then submitted in federal court the affidavit as an attachment to a complaint charging Joiner with wire fraud, in that he used cross-border communication networks to commit his fraud; money laundering, in that he illegally used the U.S. banking system to convert the illicit proceeds of his scheme into the purchase of a house instead of fulfilling the contractual obligations he agreed upon with his investors; and aggravated identity theft, in that he forged emails and contracts he falsely claimed were from people who in fact knew nothing of him or his phony project.

Beyond this point in the investigation, the DOJ hasn’t distributed further information about the case or its ultimate disposition, but has issued two press releases that summarize the case’s initial stages. The first release (Aug. 27, 2019) reported the department’s Aug. 13, 2019 filing of a criminal complaint (including the special agent’s affidavit) against Joiner based on the FBI’s investigation. The second DOJ release (Oct. 18, 2019) reported Joiner’s admission to one count of wire fraud as part of a plea agreement that would’ve reduced the number of charges and the term of his imprisonment.

After Joiner signed the agreement, though, he blatantly violated its terms by forging escrow documents to illegally sell the house he’d illegally bought with his victims’ money. This drew additional felony charges to which Joiner has also pleaded guilty and will lead to a longer sentence — pending conclusion of the FBI’s ongoing investigation.

Since then, Joiner’s sentencing hearing has been repeatedly postponed until after prosecutors determine what additional charges are ultimately warranted. The DOJ hasn’t publicly revealed what digital evidence the FBI obtained to prove Joiner forged the emails and contracts. But the evidence must have convinced Joiner that a jury would’ve convicted him. He faces up to 20 years in prison for the charge to which he pleaded guilty. Additional charges, if proven, could lengthen Joiner’s already long sentence.

After Joiner signed the agreement, though, he blatantly violated its terms by forging escrow documents to illegally sell the house he’d illegally bought with his victims’ money.

Insider view

ACFE faculty member Alton Sizemore, CFE, CPA, CFF, has investigated hundreds of financial frauds during his 25-year FBI career, including service as assistant special agent in charge of the bureau’s Birmingham, Alabama, field office and his subsequent years in private practice. Sizemore is now president of the consultancy bearing his name in Birmingham.

“This was a very well-handled, ‘textbook’ FBI investigation,” he says. “They interviewed the victims by telephone or in person and gathered every bit of relevant documentation.”

But Sizemore is critical of and puzzled by organizations that — like these victimized investor groups — don’t perform thorough due diligence. “Why didn’t they ask more questions before putting up that much money?” he asks. “It certainly paid off when someone else later questioned the paperwork Joiner forged to remove liens on the townhouse he fraudulently sold. One call to Netflix would’ve exposed the fraud.”

Sizemore adds that even though, as fraud examiners, we’re trained to question things others wouldn’t, we still have to guard against our own potential complacency. “It’s our responsibility to find out whether the supposed facts make sense,” he says. “Exercising professional skepticism doesn’t mean questioning people’s integrity; it means verifying that their statements are accurate. That’s how you expose fraud.”

Sizemore had a private-practice case in which someone had fraudulently obtained a big loan from Sizemore’s client — a bank — by claiming he had a large receivable from a nationwide business. “I dialed security for that company,” he says. “ ‘I want to know if your firm owes this guy over a million dollars.’ They checked: ‘Never heard of him.’ All it took was one call to prove he’d lied and committed bank fraud.”

In another loan fraud case Sizemore worked, a real estate agent secured a bank loan by claiming she’d earned $300,000 several years earlier. “My eyebrows rose when I heard that,” he says. “Had everyone already forgotten the housing market tanked then? It just didn't make any sense, so I checked. It turned out her claim was fiction. Once again, experienced people passively accepted a fraudster’s unsubstantiated assertions,” Sizemore says. “It was yet another example of why CFEs must always apply the highest levels of professional skepticism.”

Search warrants

“The purpose of a criminal complaint is to tell a judge that investigators and prosecutors have probable cause to seek further investigative authority,” Sizemore says. “We’ve gathered this evidence that the suspect violated these laws. Based on that, we need the court’s permission to enter his premises in search of additional evidence we’ve specified.”

After reviewing the affidavit and complaint, the judge in the Joiner case granted the warrants because it was probable that investigators would find on Joiner’s computers digital evidence of the allegations in the criminal complaint.

“You have a stronger case when you obtain proof from the suspect’s machine,” Sizemore says. “If your evidence is from the victim’s device, the suspect might say, ‘I don’t even know who that person is. He could have had a friend pretending to be me, or it could’ve been someone who didn’t like me that defrauded them and tried to make it look like me.’ Joiner couldn’t say that. The evidence came from his own computer.”

Deficiencies in evidence

Of course, it’s not always possible to obtain conclusive evidence from a suspect’s home, workplace or possessions. That’s why investigators and prosecutors sometimes have to depend on victims for proof of their fraud allegations.

“The deficiency I most frequently faced in working with victims was their inability to give me basic documentation of how someone defrauded them,” Sizemore says. “I’d ask for anything they could show me about how they came to know the person, how I could get in touch with him, whether they had email proving he lied to them or bank statements showing the stolen money going out, but a good many victims don’t have any of that.” This often applies to other forms of proof as well.

“ ‘Have you met the suspect in person?’ I’d ask. ‘Did you record any of your phone calls? Can a relative or friend corroborate what you’ve told me?’ Many times, the answer was, ‘No. It all was done over the phone. I was alone and didn’t record the call.’ That makes it hard to help such victims.”

While documentation is important, other key elements also come into play. “Investigators evaluate several factors to determine which victims are prepared to proceed with the prosecution,” Sizemore says. “It’s essential that victims can articulate, one, that they were defrauded; two, how it happened; and three, the fraud’s impact on them personally. A victim who can’t do that isn’t able to help an investigator go forward.

“If the victim has a poor memory, little or no documentation, a poor reputation or other negative factors, a prosecutor will be less likely to want to go to trial and put that victim on the stand. A good investigator proves the case but also considers possible defenses,” Sizemore says. “Fortunately, that wasn’t the situation for the investors Joiner cheated. The great distance between Joiner and his victims contributed to their rash investment decisions, but the electronic communications that made the fraud possible also left a digital trail the FBI used to bring Joiner to justice.”

Over the edge

“A forged email can be the deciding factor when someone falls for a scheme like this,” says ACFE faculty member Walt Manning, CFE. He’s been a digital forensic specialist for many years, following a career with the Dallas Police Department. Manning is now president of the Techno-Crime Institute in Green Cove Springs, Florida.

An email’s sender, recipient and subject fields are just a small part of the message’s header. The rest isn’t displayed unless you know how to reveal it. Among other details, the header also identifies each machine that handled the message on its passage from one email server to the next. “A fraudster can easily manipulate almost all that,” Manning says. He recommends trying out Google’s free online tool for assessing the legitimacy of any given email header. (See “Email diagnostic tools” at the end of this article.)

He suspects that when the FBI analyzed the headers of the emails supposedly from the executives at Netflix, it was easy to see they originated elsewhere. “If I wanted to create a phony email chain between me and supposed representatives of Netflix, I’d set up a fake account in one of their names,” Manning says. “Then I could send messages back and forth, even though I’d be the only person involved. I could use that chain of fake messages to influence potential investors, just as Joiner admitted doing.”

Manning says numerous Web sites offer services that make it easy to send emails that look like they came from someone else. “They route messages through a variety of email service providers,” he says. “This process replaces the original email header with one showing the rerouting service’s server as the originating server — a deception easy to fall for if you’re not alert to it.”

Detecting tampered email

“Fraudsters who forge email sometimes unwittingly leave digital fingerprints that a fraud examiner with the right expertise and legal authority can gather as admissible evidence,” Manning says. “Or they neglect to synchronize the key entries email servers incrementally add as a message passes through them.”

Almost every email message passes through several different email servers during transmission, and each server creates its own entry in the message’s header, Manning says. Individual email servers have a unique name and Internet Protocol address. So, if a message seems suspicious, Manning compares these items in the message header to make certain they match. When they don’t agree, that’s a red flag. “Findings like that are worth citing when interviewing a suspect,” he says. “If you suddenly say, ‘Tell me more about this email from Netflix,’ it might spur the suspect to inadvertently reveal valuable details.”

Also, a fraud examiner scrutinizing a suspect’s email might find evidence pointing to several schemes. “The messages in just one email account might contain leads to multiple frauds and possible conspirators in, for example, intellectual property theft, vendor fraud, insider trading or other frauds,” Manning says.

Detecting fake documents

After reviewing DOJ and FBI documentation of the Joiner case, Manning searched online for “Netflix Agreement.pdf” and found a memorandum of understanding between an outside producer and one of the Teamsters unions involved in a Netflix production.

“Any fraudster could use this official document as a template, and also as a guide to the kind of wording typically used in such agreements,” he says. “The DOJ complaint and FBI affidavit gave me the impression that Joiner was fairly well-connected in the industry. Maybe someone he knew at Netflix gave him an electronic version of a genuine distribution agreement that he then converted into the phony contracts he sent his investors.”

Manning says it’s easy to change the system date and time on Apple or Windows computers to anything desired, which causes subsequently sent or received emails and documents to appear to have been generated at the altered date and time. Thus, an email chain started an hour ago will look as if it happened weeks earlier, unless you look deeper. Most users won't be able to distinguish the fake message chain from a real one.

Gathering and preserving evidence

Manning stresses that electronic evidence should be collected and preserved in accordance with digital forensics best practices. “If you aren’t able to engage a certified digital forensic specialist, be aware that you might be questioned in court about why your investigation didn’t apply the highest professional standards when gathering and presenting its evidence,” he says.

While it’s crucial to ensure key evidence gets admitted, Manning says, it’s even more important to do everything possible to make sure it doesn’t disappear before you can evaluate it. “Some users configure their tablets and smartphones to delete opened messages after a certain period,” he says. “So, don’t just seize a device and then store it in a secure location until you have more time to examine it.

“When you finally get around to taking a closer look, the messages you sought might have been automatically deleted,” Manning says. “As soon as you’ve collected a device, arrange for it to be quickly preserved and imaged in a forensically appropriate manner. The sooner you do that, the better your chances of getting that evidence admitted.”

At the same time, Manning says, be alert to the strong possibility that some of a suspect’s or victim’s data might also have been copied onto USB drives and other external storage devices or automatically backed up by iTunes or other cloud-based apps. Likewise, he adds, wireless carriers might maintain logs of useful data. However, obtaining them will likely require a court order, he says.

Film flimflam

David Wall, J.D., CFE, CPA, is impressed — but not in a good way. “Joiner’s use of his investors’ money to buy a $5.2 million home has to go down as one of the stupidest maneuvers in the history of fraud,” he says. Wall is a forensic accountant in the Riverside, California, District Attorney’s Office.

“You steal $14 million in a film flimflam. Then you invest the bulk of the stolen money in the most traceable asset: real property. And you put your actual name on the deed. Brilliant,” Wall says. “Most asset searches are far more difficult than this one was. But we tracers have our methods, and they produce good results.”

Wall notes from his review of court documents that until immediately prior to Joiner’s sale of his home, it was subject to judicial liens related to the fraudulent movie scheme. “Those liens rendered the property unmarketable,” he says. “But Joiner got around that by forging release documents and submitting them to title and escrow officers who erased the liens on his illegally purchased home.”

The right focus

First and foremost, Wall says, a CFE on a tracing assignment must discover as many assets as possible. Whether they’re the alleged product of a matter being litigated is irrelevant to the search. Any CFE can perform most search procedures, but only a CFE working on a criminal case can ask the prosecutor’s office to go before a judge to seek a search warrant. If civil litigation has been filed, the CFE would submit a report to the civil attorney, who can issue a subpoena.

Prior to issuance of a subpoena, though, the best way to begin a search is through scrupulous examination of relevant records at government repositories, such as the secretary of state and the department of corporations, Wall says. “The information they maintain is limited. But it’s always a good place to start,” he says.

Because banking regulations require financial institutions to “know their customers,” depositors must present identifying documentation when opening an account and gaining access to the financial system, Wall says. “Once you know where the suspect’s accounts are, you go to his bank and get his account application, signature card, and any supporting documentation available,” he says. “If you’re working for a prosecutor, some banks will give you this information more readily than if you’re working for a civil attorney. The major banks don’t play games, but a one-branch savings and loan might not cooperate if the suspect is one of their big depositors.”

Before visiting the suspect’s bank, find out which financial institution the victims wired their investments to, Wall advises. Then track down any accounts into which the suspect might have moved the investment funds, and put a search warrant or civil subpoena on the bank to find out who owns the account into which the investor’s proceeds were deposited. “Use the signature cards and ownership records to demonstrate who owned the account, who signed on it and who controlled the funds,” Wall says.

Next, review the account statements and the transactional documentation to find out where those proceeds went and to identify the original accounts of deposit. “You don't just look at what was going on in the account on or after the deposit of investor funds,” Wall says. “Examine the records for a period of years and do a detailed analysis of all the transactions. Even if there was a very small or seemingly innocuous transaction a year or more ago, it could lead you to another account, perhaps a shell company of which you weren’t aware. Sometimes, when there are a great many transactions, budget constraints prevent you from examining as many of them as you’d like to.”

Wall tries to review at least two years, but that’s not always possible. “In a sparsely transacted account — say, 50 to 100 transactions a month — I look at the entire seven years, the retention period most major banks observe,” he says. But he advises against fishing expeditions. “Don’t ask for records you can’t justify examining.”

Various online research services sell information on bank account holders to attorneys and the government, he adds. “If you want to open a new account, the bank will query one or more such services to see whether you bounce checks, have closed other accounts with outstanding debt or have otherwise been a bad risk,” Wall says. “So, if the court orders the seizure of a defendant’s bank account and he tries to quickly move his funds to another bank, one of these services will have a record of it.”

Searching for real property

“I subscribe to the kind of online search tool hosted by a title company, which provides a digital facsimile of the actual title deed,” Wall says. (Other types of sites offer only an abstract derived from the original.) “To see the source document, I click on a hyperlink and boom, there it is. That would satisfy an independent CFE’s clients, whether they’re prosecutors or civil attorneys. They might have to get a certified copy before going to trial, but this meets their immediate need to see a copy of an entire document.”

Wall says the government hasn’t yet publicly identified the escrow company that facilitated Joiner’s sale of his home before the prosecutor could seize it. There are two kinds of escrow companies in California, he says. Some are divisions of a large title company; others are affiliated with a real estate broker. The latter are generally small and often poorly managed. Moreover, they have a clear interest in seeing that a sale closes and the affiliated broker earns its fee.

“Setting aside any particular prosecution, in general I always look at the escrow company in a sale like this, in which forged documents are at issue. It’s not always the case obviously, but it is certainly possible that someone at the escrow company might have looked the other way or otherwise facilitated the fraud,” Wall says.

“As a general proposition, I would also look at the buyer in any situation where a defendant slips the noose so miraculously. Mind you, I don’t have any reason to believe these points are relevant to Joiner’s situation,” he says. “But these are obvious investigative tactics suggested by the facts. Our financial system isn’t perfect, but it has many checks and balances. Fraud examiners just have to know how to put them to good use.”

A professional always has an explanation

In 1975, The New York Times described Adela Holzer as “Broadway’s hottest producer.” After starting successfully as an investor in the 1968 musical smash “Hair,” she went on to achieve the feat of producing more than one hit on Broadway at the same time. But over the next three decades, the Times reported in her January 2020 obituary, she spent a total of 14 years behind bars for schemes that ran from land deals and oil wells to international car dealerships and immigration scams. (See Adela Holzer, Whose Fall From Grace Was Theatrical, Is Dead, The New York Times, Jan. 8, 2020, by Anita Gates.)

When NYPD detectives approached Holzer on Manhattan’s 43rd Street to arrest her for the last time, she ran. After a brief foot chase, they caught up and had to pin Holzer to a car hood while handcuffing her. She explained that she thought the detectives were muggers … in the daytime, in midtown. No fraud examiner experienced in the ways of crooked producers would have expected any less a performance, especially so close to the theater district.

Read "A revolution in investigative strategy" at the end of this article.

Robert Tie, CFE, is a contributing writer at Fraud Magazine. Contact him at robertxtie@gmail.com.

Email diagnostic tools

• Check for tampering in an email header: Google Admin Toolbox.
• Trace an email by revealing its full header: Google Email Header Analyzer.

A revolution in investigative strategy

By Walt Manning,CFE

Technology-powered fraud is growing exponentially and surpassing investigators’ capacity and expertise. We’re long overdue for a vast improvement in the way we deliver digital forensic analytical services. A good first step would be to abandon the idea of training selected investigators as gurus who’ll handle all technology-related cases and each task they involve.

For example, there’s no sense in using seasoned experts to search the Web and identify relevant hits, maintain a chain of custody, be a first responder, collect and manage data and review forensic analyses. If we instead cross-train investigative staff in the routine aspects of an investigation, we could pick and choose those necessary for an assignment. That would enable us to more efficiently deploy seasoned specialists wherever they’re desperately needed but in short supply. This will work if versatile managers coordinate and prioritize these resources at the most efficient and cost-effective levels.

It’ll be a hard sell in our industry, where change occurs incrementally. But we’re already losing the battle and can’t afford to go on as we are. Without immediate improvements, today’s crisis will only worsen.