Corporate Account Takeover (the Importance of Using Bank Security Procedures)

By Charles Hall | Accounting and Auditing , Fraud , Local Governments

Some thieves gain control of company bank accounts using a corporate account takeover scheme. And with that control, they steal money. Below you’ll see how this type of theft occurs.

On March 17, 2010, cyber thieves hacked into the computers of Choice Escrow and stole the login ID and password to their online banking account. With that information, the thieves were able to submit a $440,000 wire transfer from Choice Escrow’s bank account to an account in Cyprus.

Courtesy of istockphoto.com

When Choice Escrow and the bank were unable to resolve their differences, Choice Escrow filed suit. The back-and-forth legal battle lasted until March 18, 2013, when a court ruled the loss was the responsibility of Choice Escrow. A major determining factor in the decision was Choice Escrow’s refusal of the dual control security mechanism offered by Bancorpsouth Bank. According to Article 4A of the Uniform Commercial Code, if an institution offers a reasonable security procedure to a commercial customer and that customer turns down that security procedure, then the customer is liable in the event of a loss.

Bancorpsouth Bank offered dual control to Choice Escrow twice. Not only did the bank offer this security feature to Choice Escrow, but Bancorpsouth also documented the customer’s refusal to use the security feature. The documentation of the customer’s refusal of the security features was a determining factor in this case. From a bank’s perspective, this case underscores the importance of a written agreement with commercial online banking customers and, more importantly, the importance of documenting the security procedures offered to those customers. From a user’s perspective, the case highlights the need to use the security procedures offered.

Corporate Account Takeover

Corporate account takeover is a term which has become more prevalent over recent years. Generally speaking, corporate account takeover occurs when an unauthorized person or entity gains access or control over another entity’s finances or bank accounts. This usually results in the theft of money in the form of fraudulent wire transfers or ACH transactions.

These fraud schemes first began to be noticed in 2005 but have since become much more widespread and frequent. Recent statistics have revealed that the fraudsters carrying out these schemes are actually becoming less successful in getting money out of a bank account. This reduction is due to both increased efforts on the part of the financial institutions, as well as better education of the customer to help them avoid becoming a target.

Usually, the financial institutions themselves are not the targets of the attack but rather the corporate customers of the institution. Using malware, social engineering, and various other methods, the fraudster obtains information about the customer’s online banking credentials. Once the online banking credentials have been obtained, a request for wire or ACH transfers is placed by the thief. Any business may be targeted for these types of attacks, but those at risk mostly are small businesses, governments, and nonprofits who have limited resources to protect against such threats.

Three Powerful Receipt-Fraud Tests (for Auditors)

By Charles Hall | Asset Misappropriation

Useful Governmental Internal Controls that You Need Know

By Charles Hall | Fraud , Local Governments

Below I provide useful governmental internal controls that you need to know.

Why am I providing this list of useful controls? Most small governments struggle with establishing sound internal controls. So, the list provides a foundation for preventing theft in your government. While not a comprehensive list, I thought I would share it.

Many of the internal controls listed below are also pertinent to nonprofits and small businesses as well. You will find this same checklist in The Little Book of Local Government Fraud Prevention (available on Amazon) which provides many more fraud prevention ideas.

I am providing general fraud prevention controls and then transaction-level controls for:

• Cash receipts and billing
• Cash payments and purchasing
• Payroll

Useful Governmental Internal Controls

General Internal Controls

1. Have bank statements mailed directly to someone outside of accounting; recipient should peruse bank statement activity before providing it to accounting
2. Perform surprise audits (use outside CPA if possible)
3. Elected officials and management should review the monthly budget to actual reports (and other pertinent financial reports)
4. Map internal control processes by transaction cycle (preferably done by a seasoned CPA); once complete, provide the map to all employees involved in the cycle; when control weaknesses exist, institute additional controls (see 11. below)
5. Use a whistleblower program (preferably use an outside whistleblower company)
6. Reconcile bank statements monthly (have a second person review and initial the reconciliation)
7. Purchase fidelity bond coverage (based on risk exposure)
8. Periodically request from the government’s bank a list of all bank accounts in the name of the government or with the government’s federal tax I.D. number; compare the list to bank accounts set up in the general ledger
9. Secure computer access physically (e.g., locked doors) and electronically (e.g., passwords)
10. Do not allow the electronic transmission (e.g., email) of sensitive data (e.g., social security numbers) without the use of protected transmission technology (e.g. Sharefile); create policy and train staff
11. Where possible, segregate who (1) authorizes transactions, (2) records transactions, (3) reconciles records, and (4) has custody of assets; when segregation of duties is not possible, require documented second-person review and/or surprise audits

Transaction Level Controls

Cash Receipts and Billing Controls

1. Use a centralized receipting location (when possible)
2. Assign each cash drawer to a separate person; require daily reconciliation to receipts; require second person review
3. Deposit cash timely (preferably daily); require the composition of cash and checks to be listed on each deposit ticket (to help prevent check-for-cash substitution)
4. Immediately issue a receipt for each payment received; a duplicate of the receipt or electronic record of the receipt is to be retained by the government
5. A supervisor should review receipting-personnel adjustments made to accounts receivable
6. Do not allow the cashing of personal checks (e.g., from cash drawers)

Cash Payments and Purchasing Controls

1. Guard all check stock (as though it were cash)
2. Do not allow hand-drawn checks; only issue checks through the computerized system; if hand-drawn checks are issued, have a second person create and post the related journal entry
3. Do not allow the signing of blank checks
4. Limit check signing authorization to as few people as possible
5. Require two employees to effectuate each wire transfer
6. Persons who authorize wire transfers should not make related accounting entries
7. Require a documented bidding process for larger purchases (and sealed bids for significant purchases or contracts); specify procedures for evaluating and awarding contracts.
8. Limit the number of credit cards and the chargeable maximum amount on each card
9. Allow only one person to use an individual credit card; require receipts for all purchases
10. Require a street address and social security or tax I.D. numbers for each vendor added to accounts payable vendor list (P.O. box numbers without a street address should not be accepted)
11. Signed vendor checks should not be returned to those who authorized the payment; mail checks directly to vendors
12. Compare payroll addresses with vendor addresses for potential fictitious vendors (usually done with electronic audit tools such as IDEA or ACL)

Payroll Controls

1. Provide a departmental overtime budget/expense report to governing body or relevant committee
2. Use direct deposit for payroll checks
3. Payroll rates keyed into the payroll system must be supported by proper authorization in the employee personnel file
4. Immediately remove terminated employees from the payroll system
5. Use biometric time clocks to eliminate buddy-punching
6. Check for duplicate direct-deposit bank account numbers
7. A department head should provide written authorization for overtime prior to payment

Your Recommendations

What additional controls do you recommend? Share your thoughts below.

College Aid Official Funnels Student Funds of $4.1 Million to Herself

By Charles Hall | Asset Misappropriation

Theft from colleges happens more than we think. After all, aren’t these guardians tasked with looking after our children? Even in places where we expect unselfishness, sometimes there’s a bad apple. Today, we review a fraud involving a college aid official. 

The Theft

When I was a student at the University of Georgia, I needed every dollar I could find. I ate my share of cheap hamburgers and peanut butter sandwiches. In the summers, I scouted peanuts and cotton to make ends meet. So when I see a college aid official stealing student money, I wince.

Picture is courtesy of AdobeStock.com

A New York college aid administrator used a simple scheme to steal $4.1 million of student aid funds. How? She made out financial aid checks to nonexistent students and then endorsed them over to the name of an alias. The administrator set up a bank account in the name of the alias and deposited the checks into the bank account, allowing her to convert the checks to cash.

How long did the theft go on? Over ten years. The fraudster stole most of the money in the last two years of the scheme. As is often the case, the thief became bolder over time. 

How many fraudulent checks did she issue? Over 1,000, each to a different student.

How was the fraudster caught? A change in the accounting system required cross-referencing of financial records.

The Weakness

No one was comparing the checks written to student admission files. Legitimate students have admission and other information that can be used to verify the students’ existence.

The Fix

A person other than the financial aid administrator should compare the student name on the check to student files to verify the existence of the student. If this control can’t be performed for each disbursement, it should be performed on a sample basis, and the persons creating and signing the checks should know their work is being monitored.

This test could be performed by someone in the financial aid office or by an external professional such as a CPA or a Certified Fraud Examiner.

The college can request from the bank the endorsement side of the cleared checks. If the back side of the checks are obtained, then the endorsements can be examined for appropriateness.

Banks Not Providing Cleared Checks

In an effort to save money, some banks don’t provide cleared checks to their clients. And very few banks (if any) provide the copies of the back side of checks. From a fraud prevention perspective, this is not good. Why? Because checks and endorsements can’t be inspected for potentially fraudulent activity. At least periodically, request some endorsements and test those on a sample basis. (The bank may require you to pay for these copies.) Additionally, as I said in another post, someone should be comparing cleared check payees to the general ledger–if not for every check, then at least on a sample basis.

Free Fraud Course

Click here for free ten-day fraud course.

Nonprofit Embezzlers Sell Donated Goods for Millions

By Charles Hall | Asset Misappropriation

Sometimes nonprofit embezzlers sell donated goods. Today, we examine how nonprofit employees can steal assets rather than cash and how you can prevent such thefts.

The Theft

Several workers at a California Goodwill pled guilty to taking over $15 million. Their scheme involved the selling of donated goods by the barrelful to private dealers who sometimes wheeled tractor trailers up to the rear of Goodwill stores.

Picture is courtesy of AdobeStock.com

The dealers sold most of the goods in Mexico. The thefts–involving seven primary culprits, four of whom were sisters–occurred over a twenty-year period that started in the mid-70s.

So how were the fraudsters caught?

One culprit went through a bitter divorce, and the husband disclosed the scheme to authorities.

The Weakness

The article describing this case did not provide details of the store operations, but it appears–at the time–inventories of donated goods were not properly documented. When assets, of whatever form, are not inventoried, they are more likely to disappear.

The Fix

Account for all inventories. Also, clothing that is sold in bulk should be documented. So each time a truck backs up to a store, the activity should be recorded—who received the goods, the sales price, who approved the sale, why the goods were sold in bulk. The store should have a policy that cash is not to be received for such sales.

Consider adding a whistleblower hotline. Nonprofit employees sometimes see signs of theft. Make it easy for them to report fraudulent activity. Doing so creates the camera effect. 

Also, install a security camera that records all loading dock activity.

Note–This case was adjudicated in the 1990s, and Goodwill has, since that time, made significant improvements to its controls.