Anatomy of a Fraud Investigation

some in the boxes. However, I didn’t remember seeing much in the way of credit card information. I knew I would have remembered if I saw a monthly merchant statement, but what about the individual charge slips and the terminal close-out slips?

When I arrived I went and found the senior accountant. I discussed the meeting I had with the office manager, and told him I wanted his help looking through the boxes for any credit card activity. Together we went to the storage room where we found the evidence tape intact across the door. As he slit the tape to allow us to enter, I recorded the date and time in my notebook. I then retrieved my notes regarding the contents of each box. The contents were not specific to every item in the box, but rather provided an overall description of what was within each box.

We located two boxes that appeared to contain information we were looking for. One box came from the woman’s desk (the crier), and the other originated from the closet where older records were maintained by the division. I locked the storage room, and we each brought a box into the room we had been using all along. We emptied the contents of each box onto a separate table and sorted through the contents. In the first box we found a manual receipt book along with charge slips. There were no close-out or end-of-day slips, and the receipt book appeared to be only the most recent book that was still in use when we arrived on the first day. I flipped through the receipt book and identified two distinct handwriting styles, one much more prominent and frequent than the other. While not a handwriting expert, the more common handwriting appeared to me to be the handwriting of a woman. The other handwriting style on the receipts was much more rushed and mechanical. I surmised the frequent handwriting was that of the woman, and the less frequent handwritten receipts were likely completed by the office manager.

As I flipped through the book I also recognized that the payment methods selected for the more frequent handwriting included cash, check, and charge methods. When I focused only on the second handwriting style receipts, I didn’t see any that were marked paid by credit card or cash. The only receipts I observed in that handwriting were for payments received by check.

I sorted the charge slips we found, and reviewed each individual slip. There were only a few slips, and nothing unusual was noted on them. I figured the slips and end-of-day close-out reports must have been forwarded by the woman to the office manager for reconciling

Tracking Down Leads (The Plot Thickens) 125

and recording into QuickBooks each day, and therefore a folder or file must have existed somewhere with all the day’s charge slips and close-out reports contained within it. It was not to be found in this box.

We turned our attention to the second box. There were two older receipt books in the box. In flipping through the pages, I noticed the same handwriting styles, with the majority of the receipts completed in a woman’s style of handwriting. Just as we had done with the other box, we looked for charge slips, terminal close-out slips, and mer- chant statements, but none were found.

LEARNING POINT As a fraud examiner, it is important to obtain a basic understanding of handwriting, and how to identify basic patterns within handwriting. Much information is available to obtain such understanding without having to become an expert in the field. It is also important to identify a handwriting expert who can be brought into a case to expand upon your basic knowledge should the handwriting in question become a key element of the case, such as with forgeries.

The fraud examiner should be able to recognize the significance of handwriting within the context of a case, and preserve any relevant evidence in such a way as to allow the handwriting expert to examine the evidence.

In this case, it appeared to me that a woman likely wrote the majority of the receipts, and that a different handwriting style was used for a lesser portion of the receipts. The second handwriting style appeared to be that of a man’s writing.

FRAUD FACTS Analyzing handwriting is a long, careful process that takes a lot of time and, under ideal

circumstances, a lot of comparison samples, or exemplars (documents that have a known

author). It’s not a matter of looking at two documents and saying, “Hey, they both have a

‘B’ with a down stroke extending below the line—same author!” In the case of the

Lindbergh kidnapping in 1932, the police had a slew of questioned documents. In all, the

(Continued )

126 Anatomy of a Fraud Investigation

It was starting to look like payments by credit card were not processed, but that would mean the division’s revenue should be less than expected based on the number of members and the programs offered beyond membership. I needed to know if all of the members’ payments were properly deposited into the division’s bank accounts.

I asked the senior accountant to perform a reconciliation of the member payments to the actual bank deposits for a one-year period. I instructed the senior accountant to use the member listing contained within the computer system, and multiply each member by the average membership fee. Once calculated, I instructed the senior accountant to then obtain all the bank statements for the division for the same period and enter all the deposits to the division’s account(s) into a spreadsheet. I told the senior accountant that the actual payments (deposits) should come out higher than the calculated fees based on the program fees and other user fees collected from members.

kidnapper sent 14 notes to Lindbergh with ransom instructions. Handwriting analysts had

no problem determining that all of the ransom notes were written by the same person. But

preexisting exemplars from the main suspect, Richard Bruno Hauptmann, were scarce, so

the police had to get samples from Hauptmann in the police station by way of dictation.

From those requested exemplars, handwriting analysts determined a match.1

LEARNING POINT With the potential for theft of receipts, it is important early on in the engagement to determine if the payments documented through whatever system the victim organization used, computerized or manual, reconcile to the actual bank deposits for a given period. For example, the documented payments received for each month should reconcile to the actual bank deposits made for the same month, taking into account any timing differ ences and deposits in transit. With remote deposit capture (desktop deposit ing) growing in popularity and use, the timing differences should be lessening. If the payments received (as documented by the organization) do not reconcile to the actual deposits, then the differences need to be

(Continued )

Tracking Down Leads (The Plot Thickens) 127

I returned to the box listing to see if there were any other boxes that could contain the missing receipt books and credit card slips. I didn’t find other possible boxes, but reviewing the list reminded me of the box containing the controller’s laptop. We had seized the laptop on the first day and sealed it closed with evidence tape, only to forget about it for a few days. I needed to talk with Tim about what, if anything, could we examine on the laptop retrieved from the controller’s office.

I left the senior accountant in the room with the two boxes and headed off to Tim’s office. He wasn’t at his desk, but I could hear his voice from down the hallway. I followed the sound of his voice until I reached him, and asked him if he would be returning to his office. He said he would be right back. I headed back toward his office, and within moments he was back at his desk.

I asked him if he had discussed the controller’s laptop with counsel. He said he had not, and suggested we call counsel together to discuss the laptop issue. We called counsel, and the first question we were posed was if we determined if the laptop belonged to the division or the controller personally. I suggested that since the controller consciously left the laptop on his desk, that it likely belonged to the division. Counsel asked if we had found any evidence of the division buying a laptop in the past year or so. I stated we had not, but we also didn’t set out to look specifically for any purchases of laptops. I suggested that I review the QuickBooks activity to see if there were any computer purchases in the past year. If I found any transactions, I would look through the boxes of

(Continued ) resolved. If the bank deposits are greater than the payments documented, there may be other items included within the deposits that are not payment related. If the payments are greater than deposits, hopefully the organization maintained sufficient details regarding each bank deposit to allow you to research individual deposit items within each deposit, and compare that detail to the individual documented payments for the same time periods. By reconciling deposit by deposit, the differences should be identifiable (pro vided deposit details are maintained by the organization). Without those details, it may be impossible to determine the differences in detail, such as in the case of a lapping scheme.

128 Anatomy of a Fraud Investigation

evidence to see if we had original invoices for the purchase matching the laptop. Based on that discussion we decided it would be best to leave the laptop sealed as is until we better determined whom it belonged to.

While we had counsel on the phone I shared a brief summary of my interview of the office manager, as well as my conversation with the informant. Based on my description of information obtained through those meetings, we collectively decided that we would likely find that member payments were being diverted into the identified bank account and used to pay the United Alliance account. Without forming any conclusions or proceeding with tunnel vision, the scheme made sense since all of the items related to that scenario were not found with all the records collected from the division. It had to be more than a mere coincidence that we didn’t have the member credit card charge slips, terminal close-out slips, manual payment receipts, bank records for the identified bank account, or the United Alliance statements. I knew, in time, we would have the pieces to put the scheme together. The question that still remained in my mind was whether there were other schemes perpetrated at the division.

I returned to the senior accountant, who had put the records back into the respective boxes and was now working on his laptop

LEARNING POINT While the laptop may not seem significant, determining whether to access the laptop or not could impact the integrity of the entire case. It is not uncommon for a suspect to set up the victim organization, creating a means for a counterclaim against the organization. The controller may have left his personal laptop behind intentionally, expecting us to dive right into his hard drive and access all his personal information. Then, he could claim an invasion of his privacy or some similar claim, potentially diverting some of the attention from the focus of the investigation his potential thefts from the organization. It would be unfortunate to the investigation and the organization for us to have taken such detailed measures to ensure the admissibility and integrity of all other collected information, only to have the laptop cloud all our efforts. The case was progressing nicely, and the laptop would have to wait until ownership and access issues were resolved.

Tracking Down Leads (The Plot Thickens) 129

with an Excel spreadsheet. I carried the boxes back into the storage room, closed and locked the door, and sealed the door again, noting the time in my notebook. I asked the senior accountant if he needed anything further of me today, and he indicated he was all set and would be working on the analysis for the rest of the day. I decided to end my day and return to my office to attend to other matters.

130 Anatomy of a Fraud Investigation


I took out my notebook, recognizing it was getting quite full from all my notes I had been taking. I knew I had another blank notepad in my bag if needed. I introduced myself, and the informant indicated she already knew who I was. I asked her why she wanted to meet. She said she wanted to tell me things about what was happening at the division. I told her that I wouldn’t enter her name or refer to her in my notes, but that by meeting with me, she was potentially creating problems in maintaining her anonymity. She said she understood the risks, but thought it would be better to help by providing the information she knew.

She started by telling me the woman in the office I refer to as ‘‘the mole’’ had a close relationship with the controller, having worked together at their previous place of employment. She stated the woman was brought to the division by the controller, and that the woman was not to be trusted. She said that when she spoke with the woman about what was happening at the division, co-worker to co- worker, unbeknownst by the woman that she was speaking with the informant, the woman indicated that she had been in regular contact with the controller and the office manager. She stated the woman said they had told her not to worry, and that they would be back to work soon as there was nothing to be found in a financial review of the division.

She said the woman wasn’t paid much and had personal issues, with associated costs exceeding her means. She said that when we ultimately received the monthly United Alliance statements, we


would see personal expenses charged to the United Alliance account under the woman’s card activity. She said the controller was very much aware of the charges, but allowed the woman to use the card to make ends meet with her issues.

I asked her where the United Alliance statements and information were maintained. She said the controller kept the United Alliance activity in his desk. I thought about the first day and the controller removing papers from his desk with Tim observing his actions. She pretty much confirmed my belief that the controller removed the evidence wewere seekingwhen heleftwiththe papers.Iaskedher how she came into possession of one of the United Alliance statements, the one she had given to Tim. She said she noticed the statement on the controller’s desk, and copied it without him knowing. She said she made a quick copy and put the statement right back on his desk. He was not in the office at the time and did not know the statement was even copied. I asked her if the office manager had knowledge or possession of the United Alliance activity. She said the mail came to the division each day and the office manager opened and reviewed all the statements and invoices. Included were the monthly United Alliance statements. She said she believed the office manager opened and reviewed the activity on the United Alliance account, then provided the monthly statement to the controller.

I asked her if she knew how the United Alliance account was paid. She said she didn’t have any idea how the account was paid. I asked her if she was familiar with the bank accounts and bank statements. She said she had no information about the bank accounts, other than seeing the bank statements time and again on the office manager’s desk. I asked her if she knew anything about the one identified account. She said she was not familiar with the account.

I then asked her if she knew of any other schemes or issues perpetrated at the division beyond the United Alliance account. She in turn asked me if I had asked anyone about how credit card payments to the organization were handled. I told her I had dis- cussed credit card payments with the office manager and the woman who worked with the office manager (a.k.a. ‘‘the crier’’), and provided her a brief review of my understanding. As she listened, I watched her shaking her head, anxious to cut me off and interject, but allowing me to finish. As soon as I finished, she said that I described the ideal process of how it was supposed to work. I asked her to describe for me how it actually worked.

120 Anatomy of a Fraud Investigation

She said members would come in to make a payment using their credit card. If the woman was at her desk, the woman handled the payments and processed the charge on the member’s card while they waited. However, if the woman was not in or available, the office manager would handle the transaction. The office manager would obtain the card information and may or may not process the charge right away while the member waited. Sometimes the office manager processed the charge, and other times he simply collected the information to process at a later time. He would mark the member’s invoice or slip as paid, and tell them their slip would act as a receipt. The payment wasn’t processed, the member didn’t sign a charge slip, and no receipt was written out from the book. She said many nights, the end-of-the-day close-out of the credit card terminal was never processed, and at times it could go for a week or more before the terminal was closed. She suggested that I look further into the daily close-out and reconciliation of credit card payments by members.

As she described the delay in processing the charges by the office manager, it dawned on me that the office manager could have had different schemes occurring through the credit card payments. One scheme was that the office manager simply didn’t charge members’ cards. I failed to see how the office manager would have personally benefited from not processing charges to members’ cards, and not documenting their payments with receipts from the receipt book. I thought maybe the office manager was simply lazy, or perhaps didn’t know how to process charges and didn’t want anyone else to know it. These possibilities made no sense to me.

I then thought it could have involved the office manager offering members who came in to pay by credit card a discount if they paid him directly in cash. He could have diverted their payments and made it look like he was taking a credit card payment, knowing that he would never process a charge as the member had already paid by cash (directly to him).

I thought of a third possible scheme where the office manager could have been accumulating unprocessed charges, and on days when he diverted funds through some other means, he could have used the unprocessed charges to fill the void left from his theft.

For now, it didn’t matter. The information she was providing only showed me that the office manager had lied to me in the interview regarding how the credit card processing worked. I asked her what else was happening at the division. She said that when I had

Tracking Down Leads (The Plot Thickens) 121

received and reviewed the United Alliance account activity for the past few years, it would all be there for me to find. I asked her if she thought anyone else was involved with the United Alliance account or any other fraudulent activity at the division. She said she didn’t know, but that the three people we had been discussing were definitely involved. She suggested that I speak with each employee of the division. I told her I planned to talk to the remaining individuals including her before I finished the financial review.

Since she came to see me, I had one last question I needed to ask. I knew she might not answer me, but I had to know if there wasn’t some hidden agenda or personal vendetta being pursued by the informant by providing information about the controller and assist- ing with the investigation.

I asked her why she took a chance copying the United Alliance statement and why she came forward with the information. I watched her the entire time I asked the question to see how she would react. Without hesitation or any obvious signs of deception in her body language or demeanor, she said she had thought something was going on financially for quite some time, but was never able to put her finger on it. She said she never had access to the financial aspects of the division, and although she had a hunch that the controller was using the card for personal purposes, it wasn’t until she saw the statement left on the desk, likely in error. She said she knew

LEARNING POINT It is not uncommon for whistleblowers or individuals providing you with information to have their own agenda. Anonymous tips could be genuine, or they could be false and misleading, directed toward affecting someone they are targeting or diverting attention away from themselves. A common motive for leaving false tips, especially if hotlines are available, may be revenge, jealousy, personality differences, or other personal issues unrelated to the tip or information provided. Leaving a false accusation is a quick way to put someone you don’t like under a microscope, or worse.

It is important to keep an open mind when reviewing tips and informa tion provided, to ensure the information is reliable and worthy of an investigation.

122 Anatomy of a Fraud Investigation

something wasn’t right with how the office manager processed credit cards, but thought that maybe the office manager simply left the information for the woman to process when she was available. She said she thought that if she started asking questions to learn more about what they were doing, especially without knowing if others could be involved, it could jeopardize her employment at the division. She also said that she waited until she had positive proof that something was happening.

I suggested to her that she not talk about the matter with anyone, and simply sit back and wait for the investigation to be completed. I cautioned her that if she spoke with too many people or said the wrong thing to the right person, she could end up identifying herself as the source leading to the financial review. She said she planned on keeping quiet and would wait to see what happened. I thanked her for stopping by and talking with me. I reached out and shook her hand as she stood up, then she turned and walked out of the office.

! ! !

Back to my notebook to fill in the information she provided. I wondered how I was going to determine what the office manager was doing with the credit card payments. It was going to be like looking for a needle in a haystack. The office manager didn’t process charges on a regular basis, but rather merely filled in at times. The office manager didn’t fill out receipts, so I wouldn’t be able to identify anything from the receipt books. The office manager may or may not have ever processed the charges, so they may or may not have been included within the merchant statement of activity (the monthly credit card details). If the charges were never processed, there would be no way of determining who the members were who paid either by cash to the office manager, or by credit card for those never processed. How was I going to figure this out? Members could pay their dues, as well as pay for program fees and other separate fees such as trips and apparel.

Membership payments could be reconciled, by comparing the membership roster for a period to the payments received by indi- vidual members pertaining to the same period. Members who were active on the roster should have corresponding payments in the system. If, however, some payments from members were diverted,

Tracking Down Leads (The Plot Thickens) 123

and payments from other members were applied to the earlier diverted members’ accounts to conceal the diversion (also known as lapping), the reconciliation could become very time and labor intensive, if it could be completed at all. With regard to other types of payments, I hadn’t thought of a way to reconcile the activity and compare it to something to ensure all the payments had been accounted for.

Part of me knew that I was going to find that the actions of the office manager in processing (or not processing) member credit card payments was linked somehow to the bank account missing all the details that was likely used to pay the monthly United Alliance statements. If I was to find it true that the diverted funds were deposited into the bank account only to be used to pay down the United Alliance account, and that the office manager never used his card for personal purposes as he stated in our meeting, I wondered how the office manager would have personally benefited from doing all this in the first place?

I figured the fastest and most efficient means to determine what went through the bank account, and what comprised the deposit details into that bank account, was to push Tim harder to get the monthly statements and deposit details from the bank.

I made a quick call to Tim to share the new information that the informant provided. I told him he should echo the warning I gave to the informant about keeping quiet or running the risk of divulging her identity as the informant. He said if he spoke with her again in the future he would reinforce what I had told her today. I asked him to get me the bank statements and deposit details from the bank as quickly as possible. I told him I was going to continue reviewing other aspects of the case rather than jump into a very time-consuming reconciliation of credit card payments, to save the organization both time and money, but also that the bank may provide us all the information we need within the statements and deposit details, precluding our having to spend significant time and cost reviewing the credit card activity.

! ! !

After a brief conversation with the human resource director, I headed back to the boxes. As I drove back, I remembered seeing receipt books in the boxes, not too many of them, but there were

124 Anatomy of a Fraud Investigation

Place your order
(550 words)

Approximate price: $22

Calculate the price of your order

550 words
We'll send you the first draft for approval by September 11, 2018 at 10:52 AM
Total price:
The price is based on these factors:
Academic level
Number of pages
Basic features
  • Free title page and bibliography
  • Unlimited revisions
  • Plagiarism-free guarantee
  • Money-back guarantee
  • 24/7 support
On-demand options
  • Writer’s samples
  • Part-by-part delivery
  • Overnight delivery
  • Copies of used sources
  • Expert Proofreading
Paper format
  • 275 words per page
  • 12 pt Arial/Times New Roman
  • Double line spacing
  • Any citation style (APA, MLA, Chicago/Turabian, Harvard)

Our Guarantees

Money-back Guarantee

You have to be 100% sure of the quality of your product to give a money-back guarantee. This describes us perfectly. Make sure that this guarantee is totally transparent.

Read more

Zero-plagiarism Guarantee

Each paper is composed from scratch, according to your instructions. It is then checked by our plagiarism-detection software. There is no gap where plagiarism could squeeze in.

Read more

Free-revision Policy

Thanks to our free revisions, there is no way for you to be unsatisfied. We will work on your paper until you are completely happy with the result.

Read more

Privacy Policy

Your email is safe, as we store it according to international data protection rules. Your bank details are secure, as we use only reliable payment systems.

Read more

Fair-cooperation Guarantee

By sending us your money, you buy the service we provide. Check out our terms and conditions if you prefer business talks to be laid out in official language.

Read more