Tag Archives: cash fraud

Basic Cash Concealment Strategies

One of the topics in which readers of this blog have expressed consistent interest over the years regards the many strategies of cash asset concealment employed by fraudsters; especially by embezzlers of relatively small sums from employers, who seem particularly creative at such manipulations.  Regardless of the method used to hide ill-gotten assets, one fact remains constant; proceeds from illicit activities must be disguised in some way to avoid being discovered. Those the ACFE dubs ‘asset hiders’ have developed many sophisticated techniques for working the system and accomplishing the goal of concealing their gains; in attempting to track down and recover secret stores of cash, the fraud examiner is presented with a true challenge, and the first step in meeting this challenge is to understand how asset hiders work. This post will concentrate on the concealment of raw cash.

There are three primary ways to hide cash assets. They are:

— Currency hoards;
— Cashier’s checks and traveler’s checks;
— Deposits to financial institutions.

The most basic method for hiding cash is the currency hoard, in which a person simply stores cash in a hidden location, usually in his or her home or on her property. This is the proverbial ‘cash under the mattress’ technique. In a typical home, hiding places for currency or other valuables can range from the obvious to the ingenious.

For example, precious metals and jewelry can easily be hidden in a layer of cooking grease at the bottom of a pot. The space beneath the bottom drawer of bureaus, chests, and cabinets is also a commonly used hiding place. Loose bricks in the wall or fireplace can disguise small spaces for hiding things. A more complex scheme is to build a false ceiling below the original ceiling and then use the space between the two as a hiding place.

Another place to hoard currency is in furniture. The hollow spaces of upholstered furniture make these pieces a good hiding place. Many people find false bottoms in drawers or inside stereo speakers useful places for hiding cash.

The basic structure of the home itself provides many opportunities for creating hiding places. One of the most common spots for hiding objects is in the walls. Cunning hiders may construct false walls in closets or pantries, or they may build large cavities into a wall, which is then covered with a mirror or a painting. Installing false light switch plates and electrical outlets provides easy access to spaces between walls and generally appear quite normal, although amateurs often leave tell-tale marks on the plate screws. These marks often provide searchers with signs of tampering and can lead to the discovery of a cache. An even simpler method is to hide currency inside the electrical boxes behind real electrical plates. If a larger space is needed, hiders sometimes remove the box from the wall and build a shelf below it. Significant amounts of currency can be hidden in these spaces. Currency hoards can also be hidden above ceiling light boxes in the space below the attic.

The plumbing system provides other natural hiding places. For example, many bathrooms have access holes under the sink, which are usually covered with a removable chrome disk. These access holes are designed so a cleaning ‘snake’ can be inserted into the main drain when the lines are clogged. This space is easily utilized as a hiding space. Floor drains are also used for hiding currency. Excellent hiding places can be created by installing false pipes that appear to be part of the home’s plumbing. Some individuals hide objects and money in shower curtain rods. Other places frequently used for hiding are air ducts, doors, and stairways. Heating and cooling system ducts are generally easy to access and have plenty of empty space. Hollow core doors are easily rigged for hiding. The top surface of the door can simply be cut away, allowing access to the natural secret compartment inside. Enclosed staircases have dead space underneath that is accessible. If the staircase is not enclosed, there may be usable space for small objects behind each of the risers. Stairs can be hinged, creating a hidden compartment underneath.

Cashier’s and traveler’s checks are another method used to hide assets. These instruments are useful for several reasons:

–They allow asset hiders to easily disguise their financial dealings from asset seekers like law enforcement, CFEs and forensic accountants;
–They help disguise the asset hider’s financial dealings and reduce the amount of currency physically carried;
–Cashier’s checks or traveler’s checks in denominations of less than $10,000 are negotiable financial instruments that can be exchanged almost any place in the world.

Whilst efforts to control the use of wire transfers for money laundering have traditionally been focused on banks, examiners also need to be aware that there are non-bank money transmitters that fraudsters often use to conceal cash assets.  These non-bank transmitters specialize in money transfers for individuals rather than businesses. In addition to other services, most non-bank transmitters sell money orders and traveler’s checks. These companies range from large international enterprises like Western Union to small mom-and-pop neighborhood check cashing businesses.

There are several reasons fraudsters like using non-bank transmitters. First, non-bank transmitters allow individuals to cash personal checks or wire money to family members nationally or in other countries. Check cashing companies and other sellers of money orders, such as convenience stores and grocery stores, provide a much-needed service to people without bank accounts. Second, non-bank transmitters allow individuals to obtain many individual traveler’s checks and money orders in amounts less than $10,000 each. Most states regulate check cashing and the sale of money orders with licensing and bonding requirements. The Money Laundering Suppression Act of 1994 required all money transmitters to register with the U.S. Department of Treasury. Furthermore, like other financial institutions, these businesses are required to file currency transaction reports (CTRs) for transactions of $10,000 or more in currency and coins, and they are required to file Suspicious Activity Reports (SARs) with the Treasury Department for certain classes of suspect transactions.

Check cashing companies have been known to receive illegally earned or stolen currency and use it to cash legitimate checks for their customers, thus avoiding CTRs or to structure transmittals by issuing multiple traveler’s checks and money orders for less than $10,000 each. Third, the transactions of non-bank transmitters will not trigger a mechanism for identifying unreported cash. Although money transmitters are classified as financial institutions, they are not depository institutions but operate through accounts with commercial banks. And, unlike bank accounts, which contain copies of deposits and canceled checks used in locating assets, non-bank money transmitters do not maintain copies of deposits and canceled checks. Unless the money order or traveler’s check appears in the financial records of the asset hider, it will likely go undetected since there is no place for the investigator to begin a search. However, once a money order or traveler’s check has been specifically identified, it can be traced back like any other financial instrument.

Banks and other financial institutions are frequently utilized by secrecy seekers as vehicles for hiding or disguising currency. The methods used may be as simple as renting a safe-deposit box and storing currency or valuables inside.  Searching the safe-deposit box of a suspected embezzler for evidence is not easily accomplished. It requires a court order. But; even if access to the box is denied, the investigator in a hidden asset case can often make educated guesses as to the contents by observing the movements of the hider. For instance, if the subject makes a visit to her safe-deposit box after attending an antique jewelry collector’s exposition, the examiner could surmise a collection of jewelry items is stored therein. Trips made to a safe-deposit box before foreign travel may indicate that the hider is moving money from his or her native country to a foreign location.

The banking system is, without question, the most important vehicle of both lawful and unlawful financial transactions. While most bankers are not active participants in asset hiding, it can be extremely difficult to distinguish between legitimate transactions and those conducted by secrecy seekers. Some bankers even prefer to close their eyes to the sources of their deposits and, in doing so, knowingly accept tainted funds. It’s important to understand how secrecy seekers use bank deposits and funds transfers to hide assets.  For the examiner, it’s important to know that most large banks have computer programs that can retrieve a specific wire transfer record. Many medium-sized banks cannot electronically retrieve specific wire data more than a month old, and some banks would have to search manually for records. However, even small banks usually send their international money transfers through one of the large Money Center banks, thus creating a record. Many large banks have enhanced their record-keeping systems to assure themselves and bank regulators that they are in full compliance with the Bank Secrecy Act. Some institutions have systems that monitor the wire transfer activity of certain accounts and generate periodic reports highlighting the consolidation of incoming wires followed by an outgoing wire transfer. Most of these systems are designed to monitor only customer accounts and do not record funds transfer services provided for non-depositors for which the bank serves only as an intermediary.

To conduct a successful wire transfer search, the examiner should have as much information as possible relating to the transfer in question when contacting the appropriate entity. Having the following information on hand will help make the search much more efficient:

— Date of transfer
— Amount of transfer
— Names of sending and receiving institutions
— Routing numbers of sending and receiving institutions
— Identity of sender and designated receiver
— Input sequence and/or output sequence

While most banks do not actively participate in fraudulent transfers, some signs for the examiner that could indicate collusion between a bank and its customer are:
— Allowing clients whose funds are not of foreign origin to make investments limited to foreigners;
— Acting without power of attorney to allow clients to manage investments or to transmit funds
on behalf of foreign-registered companies or local companies acting as laundries;
— Participating in sequential transactions that fall under the government reporting thresholds;
–Allowing telephone transfers of funds without written authorization and failing to keep a record of such transfers;
— Entering false foreign account number designations with regard to wire transfers.

Plum Street Dialogue #4 – Some Fraud Schemes Involving Cash

patio-set-5Over the years I’ve been involved in on-going discussions with any number of practicing certified fraud examiners, many of whom have provided me with excellent insights on every aspect of the profession.   Using the notes I’m constantly taking, I thought it might be fun (and instructive) to cast some of their thoughts on actual practice in the form of a series of fictitious dialogues on everything fraud examination.  This third is a discussion on the topic of financial fraud; the dialogue is between three composite fraud examiners, Glenn, Alex and Terrie.  Our three friends meet, as before, after work, in the garden behind Glenn’s house on Plum Street in the Fan District of Richmond, Virginia.

[As we join our friends in the shade of Glenn’s patio, Terrie is talking about one of her recent cases specifically as well as cash fraud schemes in general … she’s saying that there are numerous schemes that employees use to defraud organizations. The schemes generally involve cash, accounts receivable, inventory, purchasing, investments and fixed assets, as well as the manipulation of payroll and personal expenses.]

Terrie:  Cash defalcations, like the case I’m currently working on, are probably the most common of all employee embezzlement schemes. Since most companies keep relatively good control over cash, the schemes are frequent but rarely material.  A little more complex scheme involves kiting. Kiting is the process where two or more banks are used to create artificial deposits. Checks written on one bank are deposited in the other and then cash is removed from the second bank. In order to keep the checks from being returned, the fraudster writes new checks periodically. All kiting schemes require banks to pay on unfunded deposits.

Alex: In your experience, Terrie, what’s the best way to go about detecting cash frauds?

Terrie: I use several basic techniques to detect cash frauds. Classically, they include bank reconciliations, cut-off bank statements, surprise cash counts, investigation of customer complaints, journal entry review, and the review of historical sales and cost trends.

Alex: I just finished working a case involving accounts receivable.

Glenn: What do accounts receivable schemes look like?

Alex: There are about four that I’m aware of: lapping, fictitious receivables, diversion of payments on old written-off accounts, and borrowing against the receivables.

Glenn: Define lapping …

Alex: The term is used to describe a method of concealing a defalcation where cash received from a customer is misappropriated by the employee, and at a later date cash received from another customer is credited to the first customer’s account. The second customer’s account is credited still later by cash received by a third customer, and so on. These lapping schemes are usually detected when the scheme becomes too difficult to conceal, when an employee makes a mistake by not crediting the right account, or the customer subsequently complains (which they almost always do). Old or written-off accounts receivable are almost always vulnerable to theft by cashier and accounts receivable employees. Because few controls exist on written-off accounts receivable, subsequent payments can sometimes be diverted. That’s exactly what happened in the case I just finished.

Fictitious accounts receivable are also a common way businesses attempt to artificially inflate their assets and income. They are also sometimes furnish motive for salesmen and others to meet quotas and receive commissions.

Glenn:  According to the speaker at one of our Richmond Chapter’s recent training events, employees will even use the company’s accounts receivable as collateral for their own personal loans.

Alex:  Just as there are four basic schemes, there are four basic detection methods for accounts receivable frauds. They include matching deposit dates, customer confirmations, accounting cut-off analysis, and trend analysis on written-off accounts. Account receivables frauds can be prevented through the adequate segregation of duties. The collection of cash, posting of accounts receivable, and the writing off of old uncollectible accounts receivable should all be done by different personnel if possible. Also, some customer receipts can be made to a lock box rather than to the company’s normal mailing address. This allows the customer to make payments directly to the bank and therefore eliminate time delays.

Terrie:  Don’t forget inventories …because so many companies carry large inventories, these assets are particularly susceptible to abuse. The most frequent inventory scheme concerns the theft or appropriation of the company’s items. The theft of scrap sales proceeds is also pretty common. Because the amounts are generally insignificant to the company, scrap sales are usually not well controlled and good inventories aren’t kept.  In some instances, since inventory accounts are not generally reconciled until the end of the year, embezzlements can be charged to these accounts.

Alex: And how do you detect it? …

Terrie: Most inventory fraud is detected through missing financial documentation, physical inventory counts, or analytical review. If the company’s cost of sales has risen significantly from one period to the next, this could either be because of legitimate reasons or because embezzlements in significant amounts are being charged to the inventory accounts.

Glenn: And purchasing! …

Terrie: Right.  Don’t ever forget purchasing!

Glenn:  The purchasing function of a business is particularly vulnerable to employee abuses. Typical schemes involve fictitious invoices, over-billing, checks payable to employees, and conflicts of interest. Purchasing fraud doesn’t necessarily require collusion with another employee or an outsider, although it often occurs.  I recall a case where a vendor opened up a credit card account for the personal use of a client company’s purchasing officer.

Alex:  That’s a good one and, I would imagine, hard to detect.  Fictitious invoices are one of the most common red flags of employee fraud. They normally involve purchases for goods or services not delivered or rendered. An over-billing scheme is a method where the fraudster submits an artificially inflated invoice to her company for payment. The amount of the overpayment is then diverted or paid to the employee or an accomplice. In a few instances, employees simply make out checks to themselves, deposit the checks in their personal bank accounts, and then destroy them when they are returned in the company’s bank statement. Purchasing or accounts payable employees can also have duplicate payments issued for the same item. Conflicts of interest in purchasing occur when an employee, manager, or executive has an undisclosed interest in a business that supplies goods or services to his employer.

Glenn:  So, the bottom line, how are purchasing schemes generally detected in your experience?

Alex: By analytical review in some instances.  Going over the various general ledger accounts might reveal unusual or unexpected items.  The fraud examiner can also use the computer to facilitate analytical review of timing of bids, patterns of bids, amount of work, patterns of new vendors, and similar trends.

Terrie:  Duplicate addresses in the vendor file. And also addresses that look like addresses that match, like they are different companies, but they end up going to the same P.O. Box. That’s definitely one to look for. And going to a drop box. You know how you get situations where the address is let’s say 100 Warren Street, Suite 150. Well, that’s a drop box for post office box 150. You have to look for things like that. Vendors with post office boxes. You know you can have a post office box and have a check come to you. You should always have a street address. You should know for sure that’s a real street address or real company or just take the time to look it up.

[A pizza delivery man bearing two large boxes and an invoice appears at the edge of the patio and clears his voice…]

Glenn: Well, I see that dinner has arrived and we’ve only touched the surface … we can continue this discussion, if you want,  the next time we choose to meet.

Terrie:  Sounds like a plan!

Small Theft – Big Consequences

wire-bin-and-lettersOne of our associate Chapter members has become involved in her first fraud investigation just months after graduating from university and joining her first employer.  She’s working for a restaurant management consulting practice and the investigation involves cash theft targeting the cash registers of one of the firm’s smaller restaurant clients.  Needless to say, we had a lively discussion!

There are basically two ways a fraudster can steal cash from his or her employer. One is to trick the organization into making a payment for a fraudulent purpose. For instance, a fraudster might produce an invoice from a nonexistent company or submit a time card claiming hours that s/he didn’t really work.  Based on the false information that the fraudster provides, the organization issues a payment, e.g., by sending a check to the bogus company or by issuing an inflated paycheck to the employee. These schemes are known as fraudulent disbursements of cash. In a fraudulent disbursement scheme, the organization willingly issues a payment because it thinks that the payment is for a legitimate purpose. The key to the success of these types of schemes is to convince the organization that money is owed.

The second way (as in our member’s restaurant case) to misappropriate cash is to physically remove it from the organization through a method other than the normal disbursement process. An employee takes cash out of his cash register, puts it in his pocket, and walks out the door. Or, he might just remove a portion of the cash from the bank deposit on his way to the bank. This type of misappropriation is what is referred to as a cash theft scheme. These schemes reflect what most people think of when they hear the term “theft”; a person simply grabs the money and sneaks away with it.

What are commonly denoted cash theft schemes divide into two categories, skimming and larceny.  The difference between whether it’s skimming or larceny depends completely on when the cash is stolen, a distinction confusing to our associate member and prompting her initial question. Cash larceny is the theft of money that has already appeared on a victim organization’s books, while skimming is the theft of cash that has not yet been recorded in the accounting system. The way an employee extracts the cash may be exactly the same for a cash larceny or skimming scheme. Because the money is stolen before it appears on the books, skimming is known as an “off-book” fraud. The absence of any recorded entry for the missing money also means there is no direct audit trail left by a skimming scheme. The fact that the funds are stolen before they are recorded means that the organization may not be “aware” that the cash was ever received. Consequently, it may be very difficult to detect that the money has been stolen.

The basic structure of a skimming scheme is simple: Employee receives payment from a customer, employee pockets payment, employee does not record the payment. There are a number of variations on the basic plot; however, depending on the position of the perpetrator, the type of company that is victimized, and the type of payment that is skimmed. In addition, variations can occur depending on whether the employee skims sales or receivables (this post is only about sales…we’ll look at receivables later).

Most skimming, particularly in the retail sector, occurs at the cash register – the spot where revenue enters the organization.  When the customer purchases merchandise, he or she pays a cashier and leaves the store with whatever s/he purchased, i.e., a shirt, a meal, etc.  Instead of placing the money in the cash register, the employee simply puts it in his or her pocket without ever recording the sale. The process is made much easier when employees at cash collection points are left unsupervised as is the case in many small restaurants. A common technique is to ring a “no sale” or some other non-cash transaction on the employee’s register. The false transaction is entered on the register so that it appears that the employee is recording the sale. If a manager is nearby, it will look like the employee is following correct cash receipting procedures, when in fact the employee is stealing the customer’s payment.  Another way employees sometimes skim unrecorded sales is by conducting sales during non-business hours. For instance, many employees have been caught selling company merchandise on weekends or after hours without the knowledge of the owners. In one case, a manager opened his store two hours early every day and ran it business-as-usual, pocketing all sales made during the “unofficial” store hours. As the real opening time approached, he would destroy all records from the off-hours transactions and start the day from scratch.

Although sales skimming does not directly affect the books, it can show up on a company’s records in indirect ways, usually as inventory shrinkage; this is how the skimming thefts were detected at our member’s first fraud investigation client.  The bottom line is that unless skimming is being conducted on a very large scale, it is usually easier for the fraudster to ignore the shrinkage problem. From a practical standpoint, a few missing pieces of inventory are not usually going to trigger a fraud investigation. However, if a skimming scheme is large enough, it can have a marked effect on a small business’ inventory, especially in a restaurant where profit margins are always tight and a few bad sales months can put the concern out of business. Small business owners should conduct regular inventory counts and make sure that all shortages are promptly investigated and accounted for.

Any serious attempt to deter and detect cash theft must begin with observation of employees. Skimming and cash larceny almost always involve some form of physical misappropriation of cash or checks; the perpetrator actually handles, conceals, and removes money from the company. Because the perpetrator will have to get a hold of funds and actually carry them away from the company’s premises, it is crucial for management to be able to observe employees who routinely handle incoming cash.