6/11/2014
Chapter 5: Check
Tampering
Case Study # 2
{ Lecture 4
{ “Shell Companies That Don’t Deliver”
“Shell Companies That Don’t
Deliver”
“Shell Companies That Don’t Deliver”
Has anyone in class ever set up an assumed
name – a d/b/a?
Do you think that something similar to this
could happen at your company?
What controls would you recommend to this
Company to assist them in preventing this
type of fraud from happening?
1.
2.
3.
What is Check Tampering?
Form of Fraudulent Disbursement
 Employee does one of two things:

Prepares a fraudulent check for own benefit
 Converts a check intended for someone else

4.
5.
What controls could be implemented to
ensure that an entity such as SRJ
Enterprises could not be authorized as a
vendor?
What systems controls could be utilized to
detect schemes such as this one?
Comparison of Median Loss
for Fraudulent Disbursements
$23,000
$25,000
$20,000
Register
Payroll
$72,000
$48,000
$50,000
$131,000
$131,000
Check Tamp
$120,000
$30,000
$26,000
$30,000
Expense
$128,000
Billing
$100,000
$100,000
$-
$20,000
$40,000
2010
$60,000
2012
$80,000
$100,000
$120,000
$140,000
2014
1
6/11/2014
Detection of
Check Tampering Schemes
Dollar Loss DistributionCheck Tampering Schemes
0.0%
1.4%
1-999
6.0%
12.3%
15.0%
1,000 - 9,999
10,000 - 49,999
22.8%
14.0%
12.9%
50,000 - 99,999
40.0%
100,000 - 499,999
500,000 - 999,999
6.8%
1,000,000 and up
0%
5%
29.2%
11.0%
13.0%
14.6%
10%
15%
20%
Check Tamp
25%
30%
35%
40%
18.1%
Internal Audit
Tip from Employee
By Accident
Internal Control
External Audit
Tip from Customer
Tip from Vendor
Anonymous Tip
Law Enforcement
45%
14.5%
10.8%
10.9%
4.8%
7.8%
4.8%
5.1%
0.0%
0.9%
0%
5%
18.4%
15.7%
10%
15%
20%
Check Tamp
Perpetrators of
Check Tampering Schemes
34.9%
21.3%
10.8%
6.2%
All Cases
23.8%
23.6%
25%
30%
All Cases
Size of Victim
Check Tampering Schemes
67.8%
30.0%
34.0%
Manager
10.0%
Owner
12.4%
0%
10%
20%
30%
40%
Check Tamp
50%
60%
70%
80%


1 - 99
Check tampering made up 18.2% of all
fraudulent disbursement cases.
The median loss in check tampering
cases was $120,000.
Third in popularity after billing schemes
and expense reimbursement schemes
45.8%
75.5%
12.2%
21.1%
100 - 999
8.2%
19.8%
1,000 - 9,999
4.1%
13.3%
10,000+
0%
10%
20%
30%
40%
Check Tamp
All Cases
Check Tampering Schemes

Number of Employees
75.0%
Employee
35%
50%
60%
70%
80%
All Cases
Check Tampering Schemes
Forged maker schemes
Forged endorsement schemes
 Altered payee schemes
 Concealed check schemes
 Authorized maker schemes


2
6/11/2014
Stolen Checks Countermeasures
Forged Maker Schemes


Perp forges name of authorized signer
Obtaining a blank check:
Perp usually has access to blank checks
Bookkeeper, a/p clerk, office manager, etc.
Checks not secured
Perp wrongly obtains key, combination,
password to gain access
Voided checks not destroyed
Print counterfeit company checks
Do not rely on the bank to catch forged
checks
Keep blank check stock secured
 Seal boxes of blank checks with security
tape
 Investigate out-of-sequence or duplicate
check numbers on bank statement
(indicates stolen or counterfeit check
stock)
 Promptly destroy any voided checks

Stolen Checks Countermeasures
Print check stock on watermark paper
supplied by company independent of
check printer
 Incorporate security threads in check
stock
 Periodically rotate check printers and/or
check stock (so counterfeits will stand
out)
 Use positive pay banking controls

Forged Maker Schemes

Positive Pay Banking

Company notifies the bank of the checks
that have been issued by the Company
Check number
Check amount
 Check payee



Checks are not cleared unless the payee,
check number and amount agree
Forged Maker Schemes
To whom is the check made payable?
To the perpetrator
To an accomplice
 To “cash”
 To legitimate vendors (purchasing
personal items)
 To fictitious person or entity


Forging the signature
Free-hand forgery
Photocopy legitimate signature onto check
 Signature stamps
 Computer-generated signatures


3
6/11/2014
Forged Signatures Countermeasures
Forged Endorsement Schemes
Intercept company check intended for
third party
 Convert check by forging endorsement
 This is not difficult at all

Strictly limit access to signature stamps
 Have authorized check signers verify
their signatures on canceled checks
 Investigate nsf checks or out of
balance conditions in checking account


Intercepted Checks Countermeasures
Forged Endorsement Schemes
Intercepting the check:
Perp’s duties involve handling signed checks
Signed company checks not secured
 Checks returned to company (incorrect
address)
 Alter delivery address – check mailed to perp


Separate functions of cutting, signing,
and delivering checks
 Surveillance cameras in mailroom
 Independently investigate customer
complaints that payments not received
 Investigate any returned check with a
dual endorsement
 Periodically lodge “test” checks in
payables system and follow their trail

Altered Payee Schemes
Intercept company check intended for
third party
 Change name of payee
 Method depends on who prepared the
checks

Example
Altered Payee Schemes
Checks not prepared by perpetrator:
Check washing
White-out payee name
 “Tacking On” (I.R.S. becomes I. R. Stevens)


4
6/11/2014
Altered Payees –
Countermeasures
Altered Payee Schemes
Checks prepared by the perpetrator
 Perp obtains signatures on blank checks (perp
highly trusted)
 Check typed or written in erasable ink
Require use of permanent ink on all checks
Strictly segregate check preparation from
delivery and bank statement reconciliation
 Use carbon copy checks (even if check is
altered, copy will have true payee, amount)
 Use computer-generated checks
 Consider eft’s in place of checks, where
practical


Perp gets authorized person to sign check
Signed check given to perp to mail
 Change payee and/or amount
 When cashed check returned with bank
statement, perp restores original name, amount


Authorized Maker
Schemes
Concealed Check Schemes
Very blatant, not very common
 Perp prepares check payable to self
 Gives check to authorized signer along
with stack of legitimate checks
 Check gets signed; signer not paying
attention, trusts perp.

Fraudulent checks written by perp with
check-signing authority
 Cash, pay personal bills, etc.
 Where controls prevent signer from
handling blank checks or bank
statements, perp uses influence to
override controls

Authorized Maker
Schemes
Authorized Maker
Schemes

Easy to do if the perpetrator also
reconciles the bank account
 Generally causes larger losses than the
other check tampering schemes
Case Study – 1993-1994


Victim – a Houston area physician




An M.D. Board Certified in Psychiatry
Ph.D. in Psychology
A Phi Beta Kappa
Perpetrator – the physician’s office manager



High school education
Employee of the management company the
doctor had hired to manage her practice
Had worked for the doctor for over 12 years
5
6/11/2014
Authorized Maker
Schemes


Authorized Maker
Schemes
Office Manager embezzled at least $1.5
million in a 16-month period
How was this fraud perpetrated?
1.
Office Manager (OM) wrote checks for
CASH or to other office employees to
take to the bank to obtain cash
2.
Office manager transferred cash from the
doctor’s security brokerage accounts (using
forged documents) to the doctor’s practice
bank accounts (where she had signature
authority)
Had office employees go to the bank and cash
these checks, allegedly cash for the doctor, and
bring the cash back to the office
Not small checks – ranged from $1,500 to
$9,800
Some days had several checks and some days
checks totaled over $25,000



Authorized Maker
Schemes
OM commandeered cash that was
intended for the doctor and kept it for
her personal use
3.
•
•
Insurance and other checks that were not actually
deposited to the doctor’s bank account
Cash payments from patients for insurance copayments
Authorized Maker
Schemes

What did I do?
Analyzed all bank activity from microfilm
bank records (all original documentation
had been destroyed by the OM)
Reviewed all checks for CASH or to office
employees and all checks to unusual
vendors to determine whether the check
was for a valid expense
1.
2.
Charged personal expenses to doctor’s
accounts (travel agency, etc.) and paid
the bills using the doctor’s funds
4.
Authorized Maker
Schemes
3.
Analyzed all checks to CASH and to office
employees to see how each was tendered –
done to see which tellers at the bank were
cashing the checks
–
4.
Authorized Maker
Schemes
5.
–
95% of all of these checks were cashed by 3
tellers (the branch had a total of 17 tellers)
Prepared analyses of the amount of
transactions in a 60-day window of liability
for the bank
Prepared additional analyses to estimate
the losses due to the actions (or lack of
actions) by:
–
6.
The management company
The securities brokerage firms (3 different
brokerage firms)
Traced cash taken from doctor’s accounts
directly into the personal/joint checking
account of the perpetrator
6
6/11/2014
Authorized Maker
Schemes
7.
Prepared analyses for Harris County
District Attorney to assist them in
bringing criminal charges against the
perpetrator
–
–
–
–
DA’s office took 2-1/2 years to take the
evidence to a grand jury
Grand jury did indict the perpetrator
DA’s office called the perpetrator to tell her of
the indictment and to schedule her arrest and
arraignment
Perpetrator committed suicide
7
6/11/2014
Cash Removed:
Checks in Nov. 1994 to Becky B.
11/02/94
 11/04/94
 11/07/94
 11/09/94
 11/10/94
 11/15/94
 11/16/94
 11/18/94
 11/21/94
 11/22/94
 11/28/94
 11/28/94
 11/29/94
 11/30/94
 TOTAL

$ 1,500.00
5,000.00
2,000.00
4,000.00
8,000.00
3,000.00
4,000.00
6,000.00
3,000.00
8,000.00
5,500.00
8,000.00
5,000.00
3,000.00
$66,000.00
Authorized Maker
Schemes

What could have been done to prevent
this type of theft from happening?
Checks to Cash
Cash removed from
deposits
Checks to employees:
 Lorraine M.
 Andrea L.
 Laurie B.
 Cheryl Z.
 Gene H.
 Christina F.
 Kay S.
 Becky B.
Totals -
$393,540.89

58,802.78

1,900.00
 15,100.00
 19,949.59
 12,470.00
 36,000.00
 37,700.00
 45,020.00
 372,347.35

 $992,830.61
Authorized Maker Schemes –
Countermeasures
Do not let check signers have access to blank
checks
 Require dual signatures over threshold amount
 Confirm all checks to current vendor list
 Spot-check cancelled checks for support
 Look for lifestyle changes in authorized signers
 Owner/Executive should review the unopened
bank statement, and look at all returned checks

8
6/11/2014
Concealing Check
Tampering

If perp reconciles the bank statement:
Code fraudulent check “void”
 When statement arrives, destroy bogus
checks
 Force totals on reconciliation (add wrong)


If payee/amount were altered:

Re-alter cancelled checks to match postings
Concealing Check
Tampering
Enter false info in disbursements journal
Code checks to very active or dormant
accounts
 If check to legitimate payee was
intercepted, perp may re-issue check so
payee doesn’t complain
 Create bogus support for check


General Check
Tampering Red Flags
Excessive number of voided checks
 Missing checks
 Non-payroll checks payable to employees
 Altered or dual endorsements on returned
checks
 Alterations to payee, amount on returned
checks
 Questionable payees or payee addresses
 Duplicate or out-of-sequence check numbers

Check Tampering
Controls

Separate the following duties




Require proper support for all checks
 Mail checks immediately after signing
 Watch for duplicate payments

Check Tampering
Controls
Check Tampering
Controls
Keep accounts payable records secure from
tampering
 Have bank statements delivered, unopened, to two
or more independent employees
 Bank statements reconciled by more than one
person
 Periodically rotate personnel who handle and code
checks
 Review both sides of the images of cancelled
checks
Check cutting and posting
Check signing
Check delivery
Bank statement reconciliation


Bank-Assisted Controls
Establish maximum dollar limits for checks
drawn on accounts
 Use positive pay system


Purchase company checks from reputable
producers
9
6/11/2014
Payroll Schemes
Chapter 6

{ Payroll Schemes
Occupational frauds in which a person
who works for an organization causes
that organization to issue a payment by
making false claims for compensation
Ghost employee schemes
Falsified hours and salary schemes
 Commission schemes


Ghost Employee Schemes
Ghost Employee Schemes
What do you think a ghost employee is?
Ghost employee: someone on the company
payroll who does not actually work for the
company
 Four steps to ghost employee scheme:
Adding the ghost to the payroll






Add ghost to payroll
Document time worked
Issue payroll
Deliver payroll
Ghost Employee Schemes

Documenting time worked
Only required for hourly employees
 Time must be calculated and approved
 Perp usually has authority to approve timecard
 Approval can also be forged


Once timecard approved, paycheck issued
Perp either has hiring authority or access to
payroll records
 Common methods:




Add completely fictitious person
Leave former employee on payroll
Add relative or friend of current employee
Ghost Employee Schemes
Delivery of paycheck
On-site delivery of paychecks: perp physically
misappropriates check
 Checks mailed: perp uses home address or mail
drop for ghost
 Direct deposit: perp uses own account or shell
account to collect deposits
 If ghost is an accomplice, checks delivered
directly to ghost

10
6/11/2014
Ghost Employee Schemes

Things to watch for in ghost employee
schemes:
Watch for employees that have a large number
of dependents
 Watch for employees that do not take part in
any benefits offered by the employer
 These things take cash out of the payroll for
insurance, taxes, etc., so the perp does not
want any of these taken out

Ghost Employee Schemes
Auditors performed a payroll check handout at
the New Orleans location
 Three checks left - one person left
 Last employee was the supervisor, who
requested the checks for the two employees
that were "absent” that day
 When auditor said he could not give the
supervisor the checks
 He showed that he was carrying a gun
Ghost Employee Schemes

Case Study – 1985
Victim – Elevator maintenance subsidiary of
a real estate developer
 Perp – Supervisor at the New Orleans, LA
location
 Financial analysis of New Orleans location
showed higher payroll costs as a % of
revenues than any other location

Ghost Employee Schemes


Ghost Employee Schemes




Victim – a family-owned laboratory glassware
manufacturing company
 Perpetrator – former corporate controller
 Controller did not show up for work when he
was due back from his vacation
Armed robbery
What procedures could have been
followed to prevent this type of theft?
Ghost Employee Schemes
Another Case Study – 1975

Auditor gave the supervisor the checks
Supervisor went to cash the checks and
was arrested for the theft

President of company called the
controller on the telephone
Did not reach the controller, but instead got
a recording -- “I’m sorry, the number you have reached
has been disconnected or is no longer in
service.”

11
6/11/2014
Ghost Employee Schemes
Ghost Employee Schemes


Controller had left everything in his office
locked –




File cabinets
Desk drawers
Credenza
Locksmith was required to obtain access to the
company’s records
Ghost Employee Schemes


This additional payroll did not show up in
“Salaries & wages” in the general ledger or the
financial statements
Started going over all company records:


Found that the controller had been writing
himself 7 – 25 paychecks each payday
 The extra checks were never registered in the
company payroll register and no taxes were
withheld

Ghost Employee Schemes

Controller had used the “Divide and
Conquer” Method of hiding the theft 

Further investigation of records provided the
“how” this deception was carried out -


Ghost Employee Schemes

Theft had been occurring for 18 months

Company loss - $385,000
Payroll bank statements – found checks on
statement that were not included in cancelled
checks – in every month
Requested copies of all missing checks from
microfilm
Had used journal entries, some as small as only
several dollars, to spread the amounts throughout
the G/L accounts
Largest charge to any account was less than $50
Small amounts meant that the auditors did not worry
about the entries
Most of the amounts ended up in various inventory
accounts
Ghost Employee Schemes
One more case – 2000
 Victim – Landscape Maintenance Company
 Perpetrator – Supervisor
 How –


Significant loss to a company with total assets of only
$2.5 million

Recovery - $ -0-


What procedures could have prevented this theft?


Supervisor kept former employee on the payroll after
employee left to go back to Mexico
Continued to report hours for over 2 years
Ghost employee scheme
12
6/11/2014
Ghost Employee Schemes Countermeasures
Ghost Employee Schemes
Payroll department did not question
this employee until the W-2 was
returned “ADDRESSEE UNKNOWN”
for the third year in a row
 Employee did not complain about the
additional income because he was no
longer in the USA
 Loss – Near $90,000

Separate hiring function from other payroll
duties
 Maintain personnel records independently of
payroll, and periodically compare the two
 Look for employees with no ssn, withholding
taxes, or other deductions from paychecks
 Periodically check for employees with same
address, ssn, bank account, etc.

Falsified Hours and
Salary
Ghost Employee Schemes Countermeasures
Keep paychecks secure until distribution
Distribution of paychecks should be independent
of those with hiring authority
 Investigate any returned paychecks with dual
endorsements
 Conduct proper background and reference
checks for all new hires


Overstate hours worked
Underreport leave time
 Overstate salary/rate of pay



This is the most common payroll scheme
Falsified Hours and
Salary
Falsified Hours and
Salary
Manually prepared timecards

Perp overstates hours worked
 Must get timecard approved:

Forge supervisor’s signature
Conspire with supervisor, kickback
Supervisor “rubber stamps” timecards
Poor custody procedures:


Perp gets timecard back after it is signed
Alters timecard to reflect extra hours
Automated timekeeping systems (usually very
simple schemes)



Accomplice “clocks in” absent employee
Employee clocks in, then leaves work
Instead of overstating hours, employees may
increase rate of pay


Requires alteration to payroll records
Perp or accomplice has access to payroll
13
6/11/2014
Falsified Hours and Salary –
Countermeasures
Tests for Fraudulent Payroll
Activity
Separate functions of payroll preparation,
distribution, and reconciliation
 Transfer of funds from general accts to payroll
should be handled independently of other
payroll functions
 Look for individuals with excessive overtime
 Look for payroll expenses that exceed budget
projections or prior years

Review employees who have significantly more
overtime than similar employees
 Trend analysis of budgeted vs. actual expenses
 Run exception reports for employees who have
had disproportionately large increases in wages
 Verify payroll taxes equal federal return tax forms
 Compare net payroll-to-payroll checks issued

Commission Schemes
Falsified Hours and Salary –
Countermeasures
All wage rate changes must be verified
by designated official and administered
through central HR department
 No sick leave/vacation without
management approval
 Compare payroll to production schedules

Salesperson fraudulently increases commissions
by overstating sales generated



Commission Schemes Countermeasures
Detecting Commission Schemes
Run periodic reports to show an unusual
relationship between sales figures and
commission figures
 Run reports that compare commissions
earned among salespersons
 Track uncollected sales generated by each
salesperson
 Conduct random samples of customers to
verify that the customer exists

Create fictitious sales
Alter price on existing sales
Claim sales made by other employees
Verify linear correlation of sales to commission
Look for high levels of uncollected sales
 Track commission earned per salesperson;
investigate unreasonably high levels
 Randomly contact customers to verify sales
 Commissions should be handled independently of
sales department


14