ABOM Embezzlement
Fraudulent Billing/Cash Disbursement Schemes (Part II of III)
This article represents the second of a three-part series discussing the potential for embezzlement within a firm or organization by its Accountant Bookkeeper Office Manager (ABOM). Part one discussed how the ABOM could mishandle incoming cash receipts to commit fraud. This article will be discussing how an ABOM can mishandle outgoing cash disbursements to commit fraud. There are several fraudulent cash disbursement schemes that can take place within a firm or organization. These schemes fall under two main categories: billing schemes and check tampering schemes. It is possible for these schemes to go undetected for years if proper internal controls are not implemented.
[su_pullquote align=”right”]Resources:
Introduction To Fraud Risk Management
Fraud Deterrence And Fraud Detection
Fraud Risk Assessment And The Internal Control Framework
[/su_pullquote]
This article represents the second of a three-part series discussing the potential for embezzlement within a firm or organization by its Accountant Bookkeeper Office Manager (ABOM). Part one discussed how the ABOM could mishandle incoming cash receipts to commit fraud. This article will be discussing how an ABOM can mishandle outgoing cash disbursements to commit fraud. There are several fraudulent cash disbursement schemes that can take place within a firm or organization. These schemes fall under two main categories: billing schemes and check tampering schemes. It is possible for these schemes to go undetected for years if proper internal controls are not implemented.
Billing Schemes
Billing schemes are a common way for corrupt employees to embezzle funds from an unsuspecting firm. These schemes can take several forms including: shell company schemes, non-accomplice vendor schemes, and personal purchase schemes. Knowing how they are executed and the red flags they display can help a firm or organization be vigilant in protecting themselves from these schemes.
Shell Company Schemes
A shell company is a business entity which most often has no physical presence, no employees, and rarely generates any economic value.[1]  A corrupt employee will start a fictitious shell company that will be used to send fraudulent invoices to the victim firm or organization requesting payment typically for services. In my experience, a shell company’s name often uses initials such as ABC Services, Inc. The corrupt employee will also set up a bank account in the shell company’s name so that it can receive and deposit the funds. Banks typically require a certificate of incorporation or other proof of government registration; this document can be obtained legitimately for a small fee through the state or county. This becomes important later since the legitimate document can provide important information in uncovering the identity of the corrupt employee.
If the corrupt employee is the ABOM, entrusted by the firm, it may be relatively simple for them to add vendors to the firm’s vendor list or process invoices for payment. It is important to implement segregation of duties within the accounting functions of the firm or organization to make setting up this scheme more complex and less likely to occur. Without segregation of duties, the ABOM is able to process the false invoices quickly and receive embezzled funds. If a segregation of duties exist, it is still possible for a shell company to make its way onto the firm’s books.
The corrupt employee may collude with others if they do not possess the means to execute this scheme on their own. The corrupt employee may seek assistance from a disgruntled or complacent individual within the firm’s accounting department. The accomplice(s) would be someone who possesses the ability to approve new vendors, add new vendors into the firm’s vendor list, or process invoices; something the corrupt employee is unable to accomplish on their own. In return, the accomplice will share in a portion of the embezzled proceeds.
Once the corrupt employee(s) has the shell company set up within the firm’s system as a vendor, they are now able to generate and remit fraudulent invoices to the firm. Since the shell company is now part of the firm’s vendor list, it will be processed by the ABOM just like any other invoice. These invoices can be created on a personal computer and false invoices do not have to be of professional quality to generate a fraudulent disbursement.[2]  Most often, invoices will be sent for consulting services since this is a relatively generic expense account that may not be closely monitored.
Once the fraudulent invoice from the shell company is processed, the corrupt employee will receive a check for the invoice amount at their shell company’s address. Which can be deposited into the bank account set up in the shell company’s name, thus resulting in an embezzled cash disbursement. From here, the corrupt employee can make a cash withdrawal at the ATM and allocate the funds to his personal and potential accomplice(s) bank account.
There are red flags of shell company schemes that a firm or organization can look out for to thwart their existence. First, it is important to analyze financial records for patterns. Since the fraudulent invoices are being processed just like legitimate ones, they will appear on the financial statements. When analyzed over a three to five year period, the firm may notice that their consulting expense or other obscure expense account has grown in size with no justifiable cause. Once the firm notices this unusual trend, they can dig deeper into the suspicious looking expense accounts. It may become obvious that a vendor the firm does not recognize is being paid for services the firm did not use. It may also be obvious that billings to this vendor are frequent and have grown since the vendor was placed on the firm’s vendor list. These are signs that vendor is actually a shell company embezzling the firm’s funds. Other red flags include:
- Vendors that have only a post office box address
- Vendor billings that occur more frequently than once a month
- Vendor addresses that match employee addresses
- An insufficiency in internal control where a person who processes payments can also approve new vendors
Non-Accomplice Vendor Schemes
In a non-accomplice vendor scheme, the vendor does not participate in the fraudulent activity and is not aware of its occurrence. There are two ways that the ABOM or corrupt employee can take advantage of the firm using legitimate vendor invoices. The first is called a pay and return scheme and the second involves overbilling of non-accomplice vendor invoices.
In a pay and return scheme, an entrusted ABOM with too many responsibilities mishandles vendor invoice payments. The ABOM (corrupt employee) intentionally over pays invoices, double pays invoices, pays the wrong vendor for an invoice, or purchases excess goods from a vendor to later return. Without a segregation of duties, the corrupt employee can make one of these intentionally incorrect payments, then communicate with the vendor and request a refund or a returned check.  The vendor then issues a refund check or returns the firm’s check, which the corrupt employee will intercept and deposit into their own personal account.
A segregation of duties can reduce the rate at which this scheme occurs; if the ABOM is responsible for processing the invoice and drafting the check payment then a different person should be responsible for signing the check, thus ensuring a review that the amount being paid matches the amount of the invoice. A further step is to have a separate employee handle returned or refunded amounts so that no one person can embezzle the funds.
The ABOM may also engage in overbilling a vendor by duplicating an already paid invoice and paying it again or generating fake invoices from the vendor and paying them. Again, as with pay and return, the employee will intercept the refunded check to deposit into their personal account.
A major red flag in detecting this type of scheme is the double processing of the same vendor invoice. This scheme is best resolved through tighter internal controls. The firm can make sure that original invoices are processed and that copies of the invoice are not resubmitted for processing. This can be a part of the computer system that checks invoice numbers and amounts that are being processed against numbers and amounts already processed.
Personal Purchases Schemes
The final billing scheme is one in which the deceitful employee embezzles funds from the firm by using them to purchase items for their personal consumption or use. Within a firm or an organization, this may typically be conducted by employees who are tasked with stocking office and breakroom supplies and by employees who are authorized to use the firm’s credit card to purchase items.
The corrupt employee can place orders for breakroom supplies, for instance paper plates, and then increase the quantity after the purchase has been approved to take some home with them. This fraud can occur with a multitude of items that may be purchased as office and breakroom supplies. If the corrupt employee is authorized to make credit card purchases, they may be tempted to use the credit card to purchase personal items, which can be shipped directly to their personal residence.
It is important for the firm to check purchase receipts for supplies and credit card statements carefully to ensure items purchased are used within the firm or quantities purchased are not excessive. The corrupt employee may purchase items of nominal amounts at the firm’s expense; however, these amounts can accumulate over time to be significant. It is important to detect this fraud early to ensure that the firm’s funds are not being used to purchase items for personal consumption or use.
Check Tampering Schemes
Check tampering schemes are another widely used fraudulent cash disbursement method for embezzling funds from a firm or organization. Check tampering occurs when a corrupt employee embezzles funds by forging or altering checks drawn on a company account. There are several types of check tampering schemes: forged maker, forged endorser, altered payee, and authorized maker. Detecting and preventing check tampering schemes within a firm is universal regardless of the type of scheme taking place, it is most important to implement a segregation of duties for check preparation, signature, and delivery.
Forged Maker Scheme
In a forged maker scheme, the corrupt employee will forge an authorized signature on a company check. This usually involves a blank check, which is fraudulently written with a forged signature. At no point was this check ever intended for a legitimate recipient or purpose. For the corrupt employee of the firm to participate in this scheme, they must be able to obtain a blank check. For this reason, they are most often employees tasked with accounts payable functions within the firm and whose regular duties already include preparing checks.
One way for the firm to safeguard against this is to keep checks locked in a restricted area unless they are being used for their intended purpose. Once the employee is done writing checks, then they are returned to their locked, restricted area. It is also important to track check number sequences for missing checks which can be written to embezzle the firm’s funds. It is also important for custody of unsigned checks to be maintained.
Forged Endorser Scheme
In a forged endorser scheme, the corrupt employee will forge the endorsing signature of the recipient of the check. In this scheme, the corrupt employee must intercept a check that was intended to pay a legitimate party. Then a forged endorsement is used to deposit the check into the corrupt employee’s personal account. In this scheme, it is possible that the check was written by someone who had no intention of committing fraud.
To minimize this scheme from occurring, it is important to understand how an interception may occur. Once checks are written and signed, the firm should have protocols in place that they are then immediately delivered to their intended recipient. A red flag to this type of scheme arises when a vendor voices complaint over unpaid invoices. These complaints should be investigated fully, thus ensuring the check was not stolen and fraudulently deposited into a corrupt employee’s personal account.
Altered Payee Scheme
This scheme involves changing the payee of the check to the corrupt employee or an accomplice. As with forged endorser, this scheme involves intercepting a check that was intended to pay a legitimate party and altering it. Also like forged endorser, the person who wrote the check could have no knowledge or intention of the fraud being committed. The corrupt employee may also do a payee reversal, so that once the check is processed by the bank it will appear on the firm’s bank statement with the original intended payee’s name on it.
The easiest way to detect this is by preparing a bank reconciliation. Unless a payee reversal occurred, it will be obvious which checks cleared for a certain invoice based on the check number used to pay that invoice. The fact that the payee on the check does not match the vendor of the invoice will be a red flag to the firm. If the corrupt employee somehow altered the payee name so that it would show on the bank statement with the original intended payee, it becomes important to investigate vendor complaints of unpaid invoices to their fullest extent to ensure the check was not stolen.
Authorized Maker Scheme
In the authorized maker scheme, the corrupt employee is someone within the firm that has check signing abilities and makes out checks to themselves, an accomplice, or a shell company.
Authorized maker schemes are the hardest of check tampering schemes for a firm to detect. The best way to prevent this scheme from occurring is to require dual signature authorization of checks drawn from the firm’s bank account. Since it is possible that this scheme involves shell companies, it is important to maintain control over vender lists to ensure that checks are not written to fictitious vendors.
This article series is reprinted with permission from the author as previously published on McGovernGreene.com.
[1] 2016 Fraud Examiners Manual page 1.437.
[2] 2016 Fraud Examiners Manual page 1.439.
Craig L. Greene, CPA, CFF, CFE, MAFF, MCJ, is a founding partner of McGovern & Greene LLP, a forensic accounting CPA firm with offices in Chicago and Las Vegas.
Mr. Greene can be reached at (702) 818-1168 or by e-mail to Craig.Greene@mcgoverngreene.com.
