Fraudulent Payments: Not on Signature Card

By Charles Hall | Asset Misappropriation

May 15

Today I show you how bookkeepers can make fraudulent payments without being on the signature card.

Auditors often focus on authorized check signers when considering who can fraudulently disburse funds. But might it be possible to make payments without being on the bank’s signature card? The answer is yes. 

Fraudulent payments
Fraudulent Payments without Being on the Signature Card

Here are a few ways to disburse funds without being on a signature card:

  1. Forgery
  2. Unsigned checks
  3. Wire transfer 
  4. Electronic bill pay 
  5. Signing checks with accounting software 
  6. Use of a signature stamp

1. Forgery

Since banks don’t usually inspect checks as they clear, a forged check will normally clear the bank.

2. Unsigned Checks

Again, since banks don’t normally inspect checks as they are processed, an unsigned check can clear the bank. (I saw one just last month.)

3. Wire Transfer

Many times–at the client’s direction–banks wire money with just one person’s approval. One nonprofit administrator stole $6.9 million in less than an hour because of this control weakness. 

I have also seen small-town business bookkeepers drop by a local bank and ask them to wire money. Banks, desiring to help their client, sometimes do.

Businesses should use the controls offered by banks. Otherwise, they might be on the hook for fraudulent wires.

4. Electronic Bill Pay

Anyone with the right passwords can make electronic bill payments to themselves or anyone else.

5. Signing Checks with Accounting Software

This one scares me the most.

Many businesses, in an effort to expedite the disbursement process, have authorized signatures embedded in the payables software, enabling the payables clerk to make a payment to anyone. If the payables clerk has access to check stock (and they usually do), watch out. Even if a second person is normally involved in processing checks with automatic signatures, how easy is it for the clerk to go by in the evenings and make fraudulent payments? This danger increases if the payables clerk also reconciles the bank account. Why? No second person is reviewing the cleared checks.

6. Use of a Signature Stamp

I cringe every time I see a signature stamp. Why not just ask the authorized signer to just sign plenty of blank checks? (Yes, I am being facetious.)

Just last year I worked on a case where the bookkeeper wrote manual checks to herself but entered payments in the general ledger to legitimate vendors for the same amounts. Why? To mask the payments.

Recipe for Disbursement Fraud

Give anyone (1) the ability to sign checks, (2) access to blank check stock, and (3) the ability to make the bookkeeping entry, and you have the recipe for theft–particularly if that same person reconciles the bank statement or if the person reconciling the bank statement does not examine the payee on cleared checks. If you can’t segregate duties (there are too few employees), here’s how to lessen segregation of duties problems in two easy steps

How to Audit Accounts Payable

Click here for detailed information about how to audit accounts payable and expenses.


About the Author

Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles is the quality control partner for McNair, McLemore, Middlebrooks & Co. where he provides daily audit and accounting assistance to over 65 CPAs. In addition, he consults with other CPA firms, assisting them with auditing and accounting issues.

  • Rolly Standish says:

    Mr. Hall,

    I appreciate the time you spend in writing about A&A and other topics. I specialize in auditing smaller nonprofits (not State and Local Govs) and strongly advise my clients to provide a non-signing Board member, who does not have signing authority, online viewing access to bank activity. To me, this is the strongest control to have for what you are describing above. Would you agree and/or would you suggest another comparable control procedure for a smaller organization?

    Thank you for any input…


  • Charles Hall says:

    Rolly, I think this is a great recommendation. I also recommend that the bank statements (a copy or the original) be mailed to a person other than the accountant (could be this same board member). Then the second person can peruse the activity–especially payees on checks. But if they are doing this online, this procedure may be redundant. The main thing is for the accountant or person dealing with receipts/disbursements to know that someone else can see what they are doing. Hope that helps. Thanks for your comment.

  • Armando Balbin says:

    That’s right, not much of a checking from the banks. The responsibility load is heavier on us.

  • Charles Hall says:

    Armando, I think people in general think banks do much more than they do (in terms of reviewing checks as they clear).

  • Benson Dana says:

    Another aspect of this is the fraudster who secured a credit card in the name of the organization and makes fraudulent purchases with it. Small minimum payments on a credit card account are enough to keep the wolves at bay for a good long while and can be made by the thief personally or from the business disguised as some other small expense nobody will question. One recommendation I have is that all organizations order a free credit report every year delivered to an independent member of management or the board or the independent CPA to look for irregularities such as the unauthorized credit card account or delinquent accounts.

  • Charles Hall says:

    Benson, great idea — one that I’ve never thought of.

  • Charles Hall says:

    Benson, yes, I like the physical bank account statements better as well (they are harder to ignore). Good points. Thanks.

  • Benson Dana says:

    Online viewing access to bank activity by a second person is a good idea, but be mindful of the weakness of the process. Human nature says the second person, being busy with life and other things, will simply not be as diligent as they expected or would want to be. They forget, time goes by, etc., etc. I prefer having duplicate statements mailed to them. Then they have a physical thing in front of them reminding them of their responsibility. It’s a nuanced difference but not irrelevant. Also, while scrolling online, it may be inconvenient to write down notes or questions, so follow up may not be as good as hoped. The can bring their copy to the board meetings and sign them as having been reviewed and enter them into the minutes.

  • >