When Ms. Fraud comes knocking

by Steve Douglas on January 5, 2014

employee thief graphic

A 4000 word, $70,000+ case study in devastating employee fraud. How it happens. How it affects. And how to avoid it.

Let’s begin at the beginning. A really nice woman, we’ll call her N., had been my admin for years. I thought of her as my friend. Still do. She handled my accounts payable and receivable as well as most of the administrative duties of my business. I trusted her implicitly. As I had trusted her predecessor. And her predecessor too. And so on, back as far as the mid-90’s. Other than a few hiccups, I’d always managed to hire just the right person for this critical position. I also had a part-time bookkeeper, someone who had been with me since early 2000, and someone who, after committing such an act of absolute honesty, I’d safely trust with, well, pretty much anything I hold near and dear. We’ll call her S. for continuity. My little outfit was, for all intents and purposes, a well-oiled machine. Decent pay. Health benefits. Bills always up to date and taxes submitted on time. It was a wonderful setup.

Moving On.

Then came the time when N. got married and with her new husband, moved to another town, quite far away from my office. While she told me that she didn’t mind the lengthy commute, or the constant traffic, I knew N. would be leaving soon. I certainly would have. As predicted, she handed in her notice a month or so later. Though on the bonus side, N. promised to train her replacement. I appreciated that. Then, my bookkeeper told me she was looking for permanent work. A full time position. Her small stable of clients – including my company – was cool and all, but after a few had gone out of business, she wanted job security. Having been self-employed for the better part of twenty years, can’t say I blamed her. I was glad to give a glowing reference to the company that would later bring her on board. I don’t think they realize how lucky they are.

The New Hire.

Trying to overlap the placements so that the machine plodded on, I started the hiring process for an admin. And a bookkeeper. Let me tell ya, reading over resumes is arduous and in today’s climate, you get hundreds, sometimes thousands, for any job advertisement. I settled on some prospective new hires and began bringing them in for interviews. For the time being, I hired a commercial bookkeeping firm to do the books and they came in every two weeks, reconciling bank statements and the like. Meanwhile, I interviewed and eventually hired the woman we’ll call E. Looking back, the odds of hiring her were a couple of hundred to one. Lucky me. Though in my defense, her resume was solid. Years of experience. Good references. Quite personable, if not a little nervous during our initial interview. She claimed to have all the required skills for the position, and more. As N. had agreed to stay a while and train her, and at the same time assess her qualifications, I had no doubt that it would all work out, one way, or the other. After a few weeks, E. had quite impressed N. with her abilities, and N. gave a hearty thumbs up before tearfully leaving our premises for the last time. E. settled into her duties, and the bookkeepers continued to show up every two weeks. Despite losing two key personnel in the space of a month, things seemed to have gone surprisingly smoothly. I settled back into the ebb and flow of professional life. Blogging. Designing and animating. Launching websites. Dealing with clients. I hadn’t the smallest notion of what was headed my way. While reading on, keep in mind that most of what follows was only discovered after some pretty exhaustive rummaging through MYOB and Quickbooks files, bank statements, checks recovered from the bank and whatever cancelled checks E. neglected to destroy. Yeah. I think you know where this is headed.

It Begins.

Within a few months of starting, E. managed to nick some extra money using the oldest trick in the book. Writing checks made out to cash. Then forging my signature. The fact that the signature looked nothing like mine, which was in our account records, didn’t raise flags with the bank. Worse, several of the checks had little felt pen tick marks next to the signature line, indicating that someone at the bank had compared the two, when obviously, they hadn’t. A check made out to cash wouldn’t have raised any suspicion with our bookkeepers. Alas, there were also checks made out to “Petty Cash” too and why those checks were cashed is anyone’s guess. If anyone was to have flipped the check over, they would have noticed the checks were cashed through E.’s personal account, not the company’s. Sadly, nobody did. Thousands of dollars evaporated. And through some accounting chicanery that we still don’t really understand, E. made it all look cool in our books.

The Old Switcheroo.

One of the first things E. did was figure out a way to have the company pay for her cell phone. It involved a pretty simple ruse, yet one that wasn’t picked up by the bookkeepers we had at the time. She would present an invoice from our studio landline carrier, and a check made out to their cell phone division – very similarly named – with the corresponding amount. Naturally, I’d sign it. But rather than mailing the check, E. would take it to the provider’s retail outlet and have it applied to her account. Her cell phone. Only by flipping the cancelled check over and reading the barely legible dot matrix number on the back, would anyone realize that it had been applied to a different account than was originally intended. Our bookkeepers never did and this switcheroo went unnoticed for years. She began this theft not quite a month after N. had left. Later, E. would simply pay her cell phone account through our online banking. At the end of it, unauthorized cell phone payments added up to just shy of $8,500. Yep. Eight-and-a-half grand. While my own cell phone bill, a legitimate company expense, went largely unpaid. Because the company was sliding into treacherous financial waters. And expenses needed to be cut.

The Payroll Scam.

Then there was our payroll account. Our payroll is handled by one of the largest processors in the world and it’s a relatively simple system. Online employee accounts are set up with their pay rate, the various provincial and federal taxes, EI (Employment Insurance) and Pension contributions calculated automatically. These ‘withholds’ are automatically deducted from the employee’s salary, submitted to the CRA – a Canadian version of the IRS – on their behalf on a monthly basis and everything is tickedy-boo. Or should be. Turns out a lot of the presets on the online interface can be overridden. Payable taxes and contributions suppressed. All-in-all, someone with unfettered access to a company’s payroll account can do a lot of damage, someone with E.’s penchant for fraud, an awful lot more. Over one year, E. applied close to $10,000 more than she was meant to earn to her salary. How? She simply overrode the presets. At the time, I didn’t even know this was possible but she also overrode tax withholds, on occasion paying herself gross wages (before taxes) rather than net wages (after taxes). Because it was the same amount regardless of which way you sliced it, that anomaly didn’t show up in our books. We eventually paid tax on tax to clean up that mess. She paid herself unauthorized holiday pay on a regular basis. She even paid herself a bonus. At a time when the company was starting to collapse under the weight of her fraud. That, by the way, started almost a year to the day she was first employed. And a few weeks after a personal crisis started to demand a great deal of my mental real estate. But it wasn’t until almost 3 years later was this discovered. See, I didn’t check the bi-weekly payroll manifests. That was left to E. She input the payroll info. Supposedly checked the manifests when they were delivered. And answered the accountant when he had any questions. I didn’t understand it at the time, but she had complete control. And an unrestricted pipeline to company money. Adding insult to injury, when we had to cut E.’s hours due to the increasing financial pressure on the company, she took the time cut. But continued to issue herself full wages.

The Front Company.

I imagine if there’s one thing a thief doesn’t like is paying taxes on their ill-begotten gains, so E. found a way to dodge paying taxes over the next few years. How? Simple. She started to write checks to herself, using a front company – some outfit we’ll call SBS Supplies – that was never one of our vendors or suppliers. To this day, I have no idea who, or what SBS Supplies is, or was. Or what E.’s relationship was to them. The only thing I know is that any checks made out to SBS Supplies were deposited into her personal account without any question from her bank. Or ours. According to a police officer we’d later talk to, banks very rarely check deposits made through bank machines. The paper trail? That was the simple part of the equation. E. input the amount paid into our accounting system as various legitimate expenses – courier, our offsite web developer, taxes, you name it. Even entered a few as payroll. Completely different payees were written on the check stub than were applied to our accounting software. I suppose the input into Quickbooks required a little more thought so that everything balanced out. At least enough to pass cursory inspection. That would be, ultimately, the way we’d figure out which fraudulent checks were which. When there wasn’t an appropriate vendor invoice for the amount she had stolen, E. simply made one up. The signatures on the checks? A very poorly executed version of mine. Though to her credit, the forged signatures became closer and closer to the real deal as the theft wore on. And while E.’s ruse wasn’t terribly sophisticated, it was clever enough to pass through any safeguards I thought were in place. Single signing authority. Outside bookkeepers. And as much as it now pains me, an accountant review at our year end. Ironically, the longer E. worked for the company, the more I trusted her. And with that trust, came more and more unfettered access to company funds.

Trusting Blindly.

As the fraud wore on, amassing company fortunes seemed a long way off and I was only interested in if we could pay the major bills – our payroll, hosting, internet access, rent, phone and other company related expenses such as my my credit card interest. To that end, E. had a special Excel spreadsheet that she told me was ‘ahead’ of our online banking – it accounted for outstanding checks yet to be cashed, as well as money that was yet to arrive. I had no reason to disbelieve her and it seemed, at the time, the height of accounting efficiency. Of course I now know it was riddled with made-up charges, expenses that didn’t exist and account totals that had to have been dramatically inaccurate. Trouble is, that file sits on a computer desktop, forever locked because sadly, we neglected to snag the password during E.’s final days.

Gaining Control.

E. also became the liaison between the accountant and our records. Hell, one of our original stop gaps – our bookkeepers (not that they did much good other than reconciling bank statements at the end of the month) were let go. Why? Sadly, as part of cost-saving measures (ironically, due to the financial pressure beginning to build because of our dwindling line of credit) and because E. convinced me – quite logically – that it was an unnecessary expense. A function that we could handle internally. By E. I didn’t know it at the time, but this was akin to giving a fox keys to the chicken coop kingdom. Shortly after the bookkeepers’ last month, the thefts escalated. Dramatically. When E. was finally busted, and during a tearful verbal (and written) confession she admitted to forging checks to herself and SBS Supplies, but claimed (and wrote) that she didn’t know the amount. Took us awhile to sort to sort it out, but that amount was over $60,000. Yeah, you read that right. $60K. A hundred here. A couple of hundred here. Death by a thousand paper cuts. Over three years of unbridled theft, the amount can add add up. Quickly. To an average of $20,000 per year. That’s an awful lot of design work. And a lot of unpaid bills. Some that ultimately, we covered using my family’s personal funds. Intermingling personal money with corporate accounts payable is a terrible idea. And an accountants nightmare. But when you’re trying to keep a small company afloat, and its employees (E. included) employed, it’s a mistake that many small business owners make. See, you start to view employees as a major responsibility. Almost family. Even someone who is, under the radar, robbing you blind.

The Cover Up.

After her scheme came unglued, E. admitted to destroying almost every single cancelled check in our company records. See, rather than sending us each-and-every check with our bank statements, the bank sends us a page, or a few pages, of photocopied checks at 50% scale. It’s part of their green initiative. So when E. wanted to destroy evidence of her forged checks, she simply yanked the cancelled check pages off our bank statements and nuked them. Trouble is, that meant ALL our cancelled company checks were gone, not just the checks that E. saw as incriminating. That’s almost three years worth of records (E. had missed one banker’s box of checks – back when the bank actually sent the cancelled originals – so we had one year of records that managed to escape her destruction.) Getting copies of the destroyed checks from the bank’s microfiche files? A buck-fifty a pop. That adds up pretty quickly too and as we’ll see in the tally up at the end, a small part of the financial ripple-effect that happens when your company gets hit by an ongoing fraud. Once we did get them back, the check copies told quite the tale. Checks made out to E. herself. SBS Supplies. Cash. Petty Cash. Payments for driving license renewals. On a few stunningly ironic instances, company checks were sent to pay E.’s fines at the Ontario Court of Justice. With forged signatures. All totaled, there were hundreds of them. Hell, we had even paid over $600 for E.’s car repairs to the mechanic down the road. New brakes I think it was. Again, with a forged check. At the time, E. had told him that I was “lending” her the money. And the mechanic, who knew how I treated employees, had no reason to doubt her. Luckily enough, we were able to retrieve an invoice, made out to E., that also featured the make of her car. And her very personalized license plate, that somewhat prophetically, told us all we needed to know. That invoice went into the pile of documents we’d later turn over to the police. By the time we had assembled all the checks from the bank, the scope of the theft became apparent. To a small company like ours, it was massive. And it had almost put us out of business. It still may.

Adding It Up.

The final tally? We’ll never really know. Sixty-odd thousand in checks. Over eight grand in cell phone payments. Overpayments on payroll for at least three years. And as we ferreted through documents and digital files, we made one discovery after another. We have no idea if we caught it all. Nor will we ever. In the aftermath we found handwritten receipts for a few thousand – apparently some walk-in clients had paid in cash, with money that had never hit our bank account. Turns out E. had an old-fashioned, carbon copy receipt book and left a few lying around her office. When we had a corporate AMEX card, E. used it to pay for membership on some so-called “virtual world” websites. Those memberships went under “Internet Advertising” in our daily journals. Adding insult to injury, on the forums of one of these sites, E. had apparently bragged to her online buddies of playing, and interacting, while at work. Got a screen grab or two that still blow my mind.

The Ripple Effect.

Then there were the missed bills – checks that I had signed but were never delivered, or delivered late, to their intended recipients. A whole bunch to our registrar meant that a load of domains, some we’d had for 10 years, were deleted at the DNS level. $9.95 web addresses now cost $300.00 to bring back from extinction. Several were sniped by domain squatters who tried to sell them back to us for a hundred times more than they were worth. We could only retrieve a handful. At the time, I chalked up these events to incompetence, but after E. was gone, found out they were just another part of the fraud. She had been bottoming out one of our bank accounts on a fairly regular basis, and had been waiting for newly minted funds to arrive before sending checks to many of our service providers. A few missed payments to our Canadian web host saw our localized site go offline and drop from a number one spot on the .ca version of Google, to a position somewhere in the bowels of our intended keyword search results. That killed it for potential Canadian clients and the website never regained a primo listing. Again attributing that event to neglect, stupidity even, I had written E. a fairly pointed warning about that. I believe the appropriate phrase would be “shape up or ship out.” On several occasions, I wanted to fire her, but didn’t after her tears, trembling bottom lip, claims of personal hardships, and promises that she’d try harder to be “on the ball.” And even though our books told us differently, the money owed to our offsite web developer, a friend of mine from years back, had rose to over $4,000. E. had used his invoices as a way to legitimize, in our books, money she had absconded with. He was just too nice, and patient, to mention it, though it eventually derailed established plans for a complete website overhaul. Turns out E.’s fraud had impacted him too, and he simply couldn’t afford to “float” any more of his time. And so on. And so on. When you add up the theft, personal funds to cover expenses because of that theft, missed payroll and the rippling aggravation during and afterwards, the loss to my family, company and friends is quite simply, incalculable.

The Aftermath.

What happened to E. you might ask? She was let go. During a final meeting she offered up something about drugs, embellishing her tale with stories about addicts killing themselves on weekends over unpaid bills to dealers. I’m off the opinion it was nonsense, a pack of lies. This was no theft by an drug-addled mind. It was a methodical, carefully planned fraud that went on for years, starting shortly after she settled in. Seizing every single opportunity availed to her and with equally as elaborate efforts to cover it up. And despite E.’s insistence that she felt “bad”, or “guilty” about the whole thing – those feelings only surfaced when she was well and truly busted. When she was dismissed (for stealing what we believed at the time was $30K – $40K) she actually asked me to lie on her termination papers. To tell the government that I laid her off so that she could qualify for Employment Insurance. Brazen doesn’t come near describing it. It is, by the way, a serious offense to lie on somebody’s Record of Employment. It’s tantamount to fraud and naturally, I refused. Besides, and make no mistake about it, she was being fired, a small satisfaction, and I’d be damned if I was going to do her any favors. Or pay her severance. Unbelievably, and when that didn’t work, E. actually went to the Employment Standards Board, claiming that I had unceremoniously fired her because I discovered some “substance abuse.” When they phoned me to see if I had “just cause,” I had to tell them that no, she was let go because she had stolen the better part of seventy grand (the new tally) from my company. The “substance abuse” had been offered up as an excuse. Never heard back from them after that.

The System.

And the police? The jury is, quite literally, still out on that front. E. was charged with “fraud over $5000,” a fairly serious allegation, about six months after we first talked to the fraud squad. The first court appearance I was subpoenaed for was scheduled for over a year later. Turns out the judge got sick, everything was remanded over for a few months, and then there was some plea-deal supposedly cooking between the prosecutor (we call them “Crowns” in Canada) and the defense attorney. Several court appearances did little to move those negotiations along. Several years later and we’re no closer to closure than we were when this all began – apparently the wheels of justice turn slowly, if at all. And nobody in the justice system seems willing to cough up any information about the case, 1996 victim’s rights policies be damned. How the criminal case has turned out, or will turn out, I have no idea. I missed the last court date and am now, completely out of the loop. I guess a phone call to the arresting cop, or the prosecuting crown, would give me the answer I seek, but for some reason I feel like an interloper. Someone that’s sticking their nose where it doesn’t belong.

The Realities of Legal Action.

A civil suit, if I could afford it in the first place, is – at least according to my lawyer – a complete and utter waste of time. He advised me that I ran the risk of turning a $70K, $80K, $90K loss into a $100K. $120K or $130K loss through legal fees. All to get a court to agree that she owes me, or my company, the money that she stole. And to grant me the most expensive, yet largely worthless, piece of paper I could ever imagine. Oh, he’d launch the suit if I really wanted it, he told me, but not before “waivering me up the ass.” Basically, before unleashing the legal hounds, I’d have to agree in advance that there was little, if any, chance of recouping the stolen loot. See, it’s not really a good idea to sue people who don’t have any money or major assets to take. That’s just the way it is.

Accepting Blame.

At the end of the day, nobody is going to fess up – not my accountant, not the bank, not my old bookkeepers – nobody. I’m left holding the bag and ultimately, most of the blame. As fearless commander, I’m ultimately responsible for what goes down. Bottom line – I took my eye off the ball and paid dearly for it. The fog of time has rolled in, and other than collecting documents to hand over the justice system, and a seemingly stalled case in that system, the years of financial chicanery has started to fade from everyone else’s memory. Even E. – despite impending court appearances and possible criminal sanctions – is back to blathering on web forums about UFOs, Conspiracy Theories and The Loch Ness Monster. I on the other hand, struggle with profound depression to this day.

Lessons Learned.

So why write this screed? I write this as a cautionary tale for all that have read this far. Particularly, small business owners. See, here’s the thing. Trust no-one. Not your bank. Not your accountant. Not your bookkeeper. Not your assistant. Not even your partner. And even those that you do trust implicitly, verify. Often. And don’t feel bad about it. Further, if you have gut instincts, go with them, regardless of how dopey you feel. If I had’ve just followed some gut-level hunches early on, picking at the scab until I found out the details that laid just below the surface, I could’ve saved myself, my company (and ultimately, my family) the better part of a hundred thousand dollars. Or more. When my instincts told me to fire E. I should have. Trembling bottom lip be damned. But I didn’t. I tried to be the understanding “nice guy” boss. And we all know where nice guys finish up.

Checks and Balances.

Background checks are crucial for anyone that so much as touches any of your money. Or the accounts through which it flows. While nobody can give details due to privacy laws, I have it on decent authority that a $25 background check on E. would have convinced me not to hire her in the first place, if she even agreed to turn one in at all. Seems there’s some iffy stuff tucked away in her past. How serious? Recent or distant? No idea, but apparently serious enough to give pause. Especially for a job where trust is the number one requirement.

Dangers of the One Person Accounting Department.

Here’s another very expensive lesson I learned – don’t let anyone be the sole responsible party for your financial matters. Hire someone else, a second set of eyes. Or use outside resources. And even then, check things often. Have bank statements and cancelled checks sent to your home address. See, when someone writes the checks, reconciles the bank statements, looks after payroll and accounts payable/receivable, you are at extreme risk of being wiped out financially. All it takes is for you to hire the wrong person. I was lucky for years, managing to hire exceptionally ethical, conscientious bookkeepers and admins for the better part of a decade. That luck eventually ran out. What I didn’t know it at the time was this – I had brought a monster into my house. And gave her keys to the T-Bird. See, when I hired E. the rules had changed.

I simply didn’t realize it.

Post to Twitter

{ 3 comments… read them below or add one }