Backdoor Payroll Theft of Withholdings

By Charles Hall | Asset Misappropriation

Backdoor payroll theft is not common, but it is a real threat. Many auditors are unaware of this possibility. So they don’t look for it. In this article, I explain how the theft occurs.

Backdoor Payroll Theft

Gertrude, the payroll clerk, intentionally overpays company state withholding taxes by $25,000. She then amends her own W–2 so that it includes the excess payment (the $25,000 is added to her state withholding total). Once Gertrude files her personal state tax return, she receives an extra $25,000. In effect, she is using the state government as a funnel for theft.

In this business, Gertrude processes payroll and files all related payroll tax reporting information. Additionally, she makes payroll withholding payments and records payroll entries in the general ledger. Not uncommon in a small entity. Also, no second person reviews the W-2s before they are mailed.

The Weakness

One person is performing all payroll functions, so her actions are not visible to anyone else. Also, no second person is reviewing the W-2s before they are mailed.

The Fix

Have someone outside the payroll department review and mail the W-2s. Or add an additional person in payroll to create additional segregation of duties.

More Information About Auditing Payroll

See my article titled Auditing Payroll: The Why and How Guide. I provide information about payroll walkthroughs, risk assessment, and substantive procedures. So check it out.

Three Receipt-Fraud Tests (for Auditors)

By Charles Hall | Asset Misappropriation

City Manager Pockets Cash from the Sale of Excess Property

By Charles Hall | Asset Misappropriation

The Theft

Is it possible to convert large pieces of excess property to cash–all without anyone knowing? Apparently yes.

Two men, Alfred Ketzler (the city manager) and Alfred Fabian, were found guilty of wire fraud and theft from the city of Tanana, Alaska.

Picture is courtesy of AdobeStock.com

Department of Justice Indictment Press Release

So what happened?

First, the Department of Justice stated “Ketzler would acquire surplus federal property that was stored at several different locations without notifying the mayor of Tanana or the city council for the city of Tanana of the federal excess and surplus property obtained on behalf of the city of Tanana.”

The Department of Justice went on to say “that Fabian, for his part, would transport federal excess and surplus property obtained on behalf of the city of Tanana to storage locations in and around Fairbanks, Alaska, including his own residence.”

Finally, the indictment stated that once the excess property was received, Ketzler would sell the equipment to individuals and businesses, telling them the property belonged to the City of Tanana. He asked that the checks be made out to him personally. The indictment continued by saying Ketzler would deposit the checks in his personal account and make payments to Fabian.

The indictment stated that the men received approximately $122,000 in illegal funds.

The property sold included:

• Trucks
• Fork Lifts
• Bulldozers
• Other industrial equipment

Department of Justice Sentencing Press Release

A June 2014 Department of Justice press release stated:

Anchorage, Alaska – U.S. Attorney Karen L. Loeffler announced today that two Fairbanks men were sentenced on Friday, June 6, 2014, in federal court in Fairbanks after being found guilty of wire fraud and theft from a local government receiving federal funds.

Alfred Richard Ketzler, Jr., also known as “Bear” Ketzler, 57, of Fairbanks, Alaska, was sentenced to 16 months in prison to be followed by two years of supervised release by Chief U.S. District Court Judge Ralph R. Beistline. Ketzler pled guilty in March 2014. Ketzler has already paid restitution to the City of Tanana in the amount of $116,500.

Alfred McQuestion Fabian, 62, of Fairbanks, Alaska, was sentenced to six months in prison to be followed by two years of supervised release by Chief U.S. District Court Judge Ralph R. Beistline. Fabian pled guilty in March 2014.

The Weakness

The city may have had appropriate inventory controls (the DOJ press releases did not say). Most noteworthy, this case appears to reflect a circumvention of controls. The city manager had the power and ability to consummate transactions that were (apparently) not recorded on the city’s records. The indictment states that Ketzler did not provide the city with appropriate notice of the receipt and sale of the excess property. Also the payments received were not recorded on the city’s books.

The Fix

Organizations should do all they can in the hiring process to bring people in that are honest. How? Background checks and the calling of references are critical.

It is imperative that all property be included in inventory—as soon as title transfers to the city. And, obviously, all payments should be made to the city (in this case) and not to individuals. A receipt should be issued to the payor that details the reason for the payment, the amount, and who made it.

A Fraudster’s Refuge: The Appalachian Trail

By Charles Hall | Asset Misappropriation

Some fraudsters funnel money into fraudulent bank accounts. Today, I show you how one controller did so and walked away with millions.

The Theft

In May 2015 James Hammes was arrested for the theft of $8.7 million from his former employer, G&P Pepsi-Cola Bottlers. After Mr. Hammes was confronted about the theft in February 2009, he left his home and hid on the Appalachian Trail, which runs from Georgia to Maine. Hammes assumed a hiking name of “Bismarck” and spent several years on the popular trail. Fellow hikers enjoyed Bismarck since he seemed to be one of them.

How the Funds Were Stolen

The FBI reported the following:

Court documents show that Hammes’ embezzlement began around 1998. As a controller, he was responsible for all financial accounting and internal controls for his division, including supervising accounts payable to several hundred outside vendors. He carried out the fraud by establishing a new bank account for an existing vendor at a different bank. He then deposited hefty payments to that vendor—often $100,000 at a time—in the phantom account that he alone controlled. He then could transfer money from the phantom account to his personal accounts.

“He knew how to cover his tracks by manipulating audits and ledger entries,” Jones said. “He got away with it for so long because he knew how to manipulate his subordinates and how not to raise accounting red flags.”

So, Hammes opened a fraudulent bank account at another bank (one the company did not use) and deposited vendor checks into that account. Then he transferred funds out of the fraudulent bank account to himself.  Since he opened the account, he was the authorized check signer. Simple but effective.

The Weakness

If extra payments were made to vendors (and it appears that occurred), then the company may not have been reviewing vendor payments. If appropriate controls are not in place, it’s easy for a fraudster to make fraudulent vendor payments without detection, especially if hundreds of monthly checks are processed.

Also, it appears the company may have lacked sufficient segregation of duties since Hammes was able to disburse extra vendor payments without detection.

The Fix

Periodically, review the total payments made to each vendor. For example, generate the total monthly payments made to XYZ Company. Then compare the monthly payments over a two to three year period. If payments dramatically increase, then someone within the company may be making additional payments and stealing those checks. Or there may a legitimate reason for the increase. Either way, it’s wise to review vendor payments for anomalies. 

You might also contact your company’s bank (and other local banks) and ask for a list of accounts in your company’s name. Then compare that list to your general ledger to see if the accounts match. If mismatches are present (there’s bank account listed but no corresponding account in the general ledger), follow up to see why.

Positive pay is another strong payables processing control.

How $16 Million was Stolen from a Bakery

By Charles Hall | Asset Misappropriation

$16 million was stolen from a bakery. You read that right.

Today I show you how large sums of money can be taken from a small business with one simple fraud scheme.

The Theft

Sandy Jenkins, the controller of Collin Street Bakery in Corsicana, Texas, made off with more than just fruitcakes. He took over $16 million, so says the FBI. And what did Mr. Jenkins do with the money?

He used the funds in the following ways:

• $11 million on a Black American Express card
• $1.2 million at Neiman Marcus in Dallas
• 532 luxury items, including 41 bracelets, 15 pairs of cufflinks, 21 pairs of earrings, 16 furs, 61 handbags, 45 necklaces, 9 sets of pearls, 55 rings, and 98 watches (having an approximate value of $3.5 million)
• Wine collection (having an approximate value of $50,000)
• Steinway electronic piano (having a value of $58,500)
• 223 trips on private jets (primarily Santa Fe, New Mexico; Aspen, Colorado; and Napa, California, among other places), with a total cost that exceeded $3.3 million
• 38 vehicles, including many Lexus automobiles, a Mercedes Benz, a Bentley, and a Porsche
• And more…

How the money was stolen

You might think that stealing $16 million would require an elaborate scheme. But did it? 

Here’s an example of his method: Jenkins would print a check to his personal credit card company, but he would void the check in the accounting system. (He still had the printed check.) Then, he would generate a second check for the same amount to a legitimate vendor, but the second check was never mailed. Next, Jenkins would send the first check to his credit card company.

The result: Jenkins’ credit card was paid, but the general ledger reflected a payment to an appropriate vendor.

The Weakness that Led to the Theft

No one was comparing the cleared check payees to the general ledger. 

The Fix that Will Detect the Theft

Someone other than those who create checks should reconcile the bank statements to the general ledger. As they do, they should compare the cleared check payees to the vendor name in the accounting system. Some businesses have hundreds (or even thousands of checks) clearing monthly. Therefore, they may not desire to examine every cleared check. 

Alternatively, the business could periodically sample the cleared checks, comparing the cleared checks to the vendor payments in the general ledger. The persons creating checks should know that this test work will be performed. Doing so creates the camera effect. When people know their actions (in this case, the creation of checks) will be examined, they act differently–they are much less likely to steal.

If you desire a preventive control, require a second-person review of canceled checks.

Additionally, someone should be reviewing the profit margins of the company, comparing the ratios with prior periods.

Lastly, when segregation of duties is not possible, have the bank statements mailed to someone outside the accounting department such as an owner. That person should review the cleared checks before providing them to the accounting department. Alternatively, provide online access to the reviewing person. The reviewer should examine the cleared checks and provide documentation of his or her examination to the accounting department.

What Happened to Sandy Jenkins?

Sandy Jenkins was sentenced by U.S. District Judge Ed Kinkeade to serve a total of 120 months in federal prison. His wife, Kay Jenkins also pleaded guilty to one count of conspiracy to commit money laundering. Ms. Jenkins was sentenced to five years of probation.

In March 2019, Sandy Jenkins passed away in a federal prison.

Forthcoming Movie

You may be familiar with the movie Catch Me If You Can which chronicled the exploits of Frank Abagnale, one of the most brilliant cons of all time. Now, it appears there will be a new movie about another: Sandy Jenkins.