Want to Catch a Fraudster? Think Like a Cop | FTI Consulting

Company insiders familiar with your audit procedures may be tempted to exploit cracks in your compliance structure in an uncertain economy. Take heed.

Fraud professionals have a saying: Fraud goes up when the economy goes down.¹

Look no further than the Great Recession of 2008 for proof. According to a survey conducted by the Association of Certified Fraud Examiners, observable fraud surged across multiple business sectors during the crisis.² More recently, the Federal Trade Commission (“FTC”) reported a jump in consumer complaints of fraud during the pandemic.³ The FTC estimates that fraud cost consumers more than $3.3 billion in 2020, a rise from $1.8 billion in 2019.⁴

What drives this dark correlation? There are a few possible explanations: Tight money in an economic downturn can cause unscrupulous individuals to take unlawful risks. Layoffs can stretch compliance and security staff thin. Pressures to reach financial or other company performance goals can lead to falsifying reports or records.⁵

A wide variety of fraud types tend to occur in hard times as well. For every headline-grabbing multimillion-dollar wire fraud originating in the Caribbean, there are multiple cases of companies being exploited for more modest, ill-gotten gains. But things can add up. Procurement and payroll departments that lack oversight and internal controls are fertile grounds for all kinds of nefarious activity. Insiders with knowledge of operations and audit processes can take advantage of compliance cracks to slip in and slip out with illicit funds.

Whether the economy slows or not, the ongoing uncertainty around inflation, layoffs and rising interest rates may inspire more fraudsters to come out of the woodwork. What’s important now is to get ahead of issues by ramping up awareness and skepticism within your organization.

What’s important now… is to think like a cop. Where are the cracks in your organization? How creative can fraudsters be? Below are six real-life examples of attempted fraud (attempted because each crime was successfully resolved) that Peter Schablik, who recently joined FTI Consulting as a Managing Director in the Forensic & Litigation Consulting segment, experienced during his career in public accounting. Some are so simple it seems the fraudsters wanted to get caught. Others are more imaginative. Either way, the examples can help raise awareness of the fraudster’s mindset, no matter what shape the economy is in.

“A Light Touch” — A major New England bank had a purchase requisition approval process that required physical sign-off on a paper form. An individual in the bank’s Space Planning and Management department obtained an executive sign-off on one requisition and then added personal items for himself. One included a new chandelier to be delivered to his home.

Take Heed: Whether on paper or digitally, “trust but verify” adds an ounce of prevention.

“Two-Faced” — The head of payroll at a startup was also in charge of part-time employees. Big mistake. During a SOX* readiness project, the risk of using a single person in both roles became apparent when a roster of fictitious part-time individuals — who all happened to live at the same address as the payroll head — was uncovered.

Take Heed: Instead of waiting for a review, reduce nasty surprises by regularly checking the state of your compliance program.

“Sticky Fingers” — An adhesives company was being acquired by a larger competitor. Company owners received substantial compensation, but the management team felt left out of the negotiations and did not receive the severance package they expected. When the new company took over, they found that the database of prospects was gone. So were the complete formulas for creating the adhesives themselves. Where did the missing items go? To a competing company — started by members of the disgruntled management team.

Take Heed: When effecting a separation from company leadership, secure vital assets such as intellectual property, security codes and ownership documents.

“Double Dipping” — A senior manager for an internationally renowned accounting firm served two of its offices in neighboring states. Nothing unusual there. But because expense processing was decentralized, each office processed its own expenses. Talk about a loophole: The senior manager submitted his expenses accurately not once, but twice — once at each location. Hence, he pocketed two reimbursements at a time.

Take Heed: Centralizing processes when possible not only standardizes and adds efficiencies, but it can also seal up dangerous cracks.

“Credit for Trying” — A private bank that used email as an approval process for wire transfers discovered just how risky that can be after an individual hacked into the system and created fictitious wire requests. Management got lucky, however, and caught on prior to any payments going out. How? By recognizing that fishy email addresses used by the hacker were the same as those of recently terminated employees.

Take Heed: A single approval layer is never enough to protect against a determined fraudster.

“Trust Issues” — Private wealth organizations often emphasize customer service over internal controls. That’s asking for trouble. In one instance, representatives of a bank implicitly trusted their customers so much they did not regularly ask for passwords or return calls on wire transfer requests. On a Friday before a three-day weekend, one individual phoned in a $70,000 request and was insistent about processing the transaction that same day. The bank graciously obliged — and found itself duped out of $70,000.

Take Heed: Procedures are in place for a reason — no matter the pressure, following protocol is a major line of defense against fraudsters.

This is just an inkling of the creativity employed by fraudsters. Some truly clever schemes can go unnoticed until it’s too late to act. Through clear communication, collaboration across the organization and the wisdom of an expert in fraud prevention, management can protect their companies without having to wear a badge.