Hoist on Their Own Petard — How Forensic Accountants Catch Small-Time Scammers

No law today. Let’s have a police procedural for a change. We’re in the mood for some white-collar stuff, so here goes.

Forget about the Madoff case. Most financial crimes are nowhere near as headline-worthy, nor do they involve such massive amounts of other people’s money. But smaller scams are just as likely to get prosecuted, and they’re just as much a felony as the big ones. And though the news may not report it, people get caught and convicted all the time.

And like Al Capone, the smaller scammers aren’t caught by the gun-toting detectives so much as by the green visor-wearing accountants.

It’s usually a case of self-incrimination. Defendants usually create the very evidence that puts them behind bars, in their financial books and records. Of course, most of them aren’t doing it on purpose. They’re not creating blatant records that flatly proclaim “here there be crimes.” Most take pains to avoid creating records of improper doings, and to conceal or camouflage the rest. But it is often those very attempts to hide their activities that wind up calling attention to them.

-=-=-=-

Every law enforcement agent knows that, to catch the “bad guys,” you need to follow the money. Who wound up with the cash or the assets? How did the money get from person A to person B, and so on to Mr. X?

One easy way to start is to look at public documents. Lots of records get publicly filed, for anybody to look at, and they can be good leads. Does Mr. X own a house? Pull the deed from the county clerk’s office. There’s going to be information that leads to the mortgage itself, and then Mr. X’s bank records are just a subpoena away. Probate records lead to the estate, which leads to more bank records and real estate records. Does someone have a rap sheet already? Maybe they had to post bond in an earlier case. That’s going to show the source of the lien, and lead to more assets. Dun & Bradstreet and similar records can tell whether someone has a lien against Mr. X — such people are often more than willing to give more information to law enforcement. Heck, even newspapers can be a source of leads to get an investigation started.

Paper begets paper. Or computer data. It is nigh impossible to have dealings of any significance without some record being kept somewhere, in some form.

When following leads, the investigator ought to have an idea of what he’s looking at. What kind of business is this company in? Where are they located? What do they spend money on? The investigator can’t tell whether something is unusual unless he knows what the usual looks like.

Maybe this is a kickback scheme. If I am demanding kickbacks from you, or bribes, or extortion payments so I allow you to keep doing business with me, then maybe I don’t want that money coming directly to me. And maybe you don’t want it coming directly from you. So perhaps I set up a “consulting” company to receive payments from you. Or maybe you set up a “customer” company to make payments to me. Or perhaps we do both. Maybe we have lots of shell companies, or only one. If the investigator figures it out, though, our cautions might turn around to condemn us.

Maybe you pay me with a no-show job. If so, you’d better be careful about who is holding back my payroll checks or delivering them to me. And is my pay typical of my job? A steady, constant paycheck is more typical of an office worker than a blue-collar worker, after all. These are possible tipoffs to an investigator. And paper begets paper.

-=-=-=-

So how else do they get the paper, apart from going to public records?

Subpoenas are the main stock-in-trade of the white-collar investigation team. Smart teams won’t subpoena the world, of course, because that just makes for far more work than necessary, while increasing the odds of tipping off Mr. X to the existence of the investigation. Instead, they’ll just limit their subpoenas to what they really need. Narrow requests also make more subpoenas necessary down the road, which keeps open a line of communication.

A shotgun subpoena followed by a narrower one just tips off defense attorneys like us. We see something like that, we have a chat with the client, and figure out what the investigators are probably looking for. We get all that extra time to prepare our defense.

When in doubt, utility bills are a common lead-generator, to figure out how someone is paying for their phone, cable, electricity, etc.

One thing they’ll probably want to see are old tax returns, especially for a business. Tax returns can be a mine of useful information, such as who formed the business, who the officers are, how much they get paid, who their accountant is (always a good person to interrog… ah, interview). And if the tax returns don’t match reality, well that’s another charge for the grand jury to hear, isn’t it?

The company’s accountant often did the tax returns for the owners and officers, too. Investigators can request the accountant’s retained copies of those returns, and find out all kinds of information about assets, mortgages, sources of income, etc.

Canceled checks are a high-want item. They’re one way of seeing who’s paying money to whom.

Bright investigators don’t settle for photocopies, but insist on originals. Critical information could have been whited out before copying. Photocopies are often illegible, and may not include the all-important information on the back of checks showing who deposited it and to what account.

In general, subpoenas are going to be issued to non-targets. There’s little point in asking the suspect to provide the evidence that will hang him. All it does is raise him up. And a savvy defense attorney is going to bring that client in to present the documents to the grand jury — because here in New York, for example, it is far too easy for the prosecutor to slip up and confer total transactional immunity on the client right there in the grand jury. (That’s a topic for a whole nother post.)

No, suspects aren’t usually the ones who get subpoenaed. They get searched.

-=-=-=-

Search warrants are a unique chance for the investigators to get all that stuff they never would have gotten from a subpoena. The “second set of books,” rather than the official set they keep for the IRS and other outside eyes. The secret records. (Although these can sometimes be viewed by an undercover posing as a legitimate potential buyer of the business.)

That’s what the investigators are hoping for: a “smoking gun” document of some kind. Original documents with all the info that got whited out in the subpoena response. Records of illicit payments made, cash skimmed, investors gypped. Evidence that customers were told one thing, but reality was something else entirely. It may be buried somewhere in all those boxes of docs and all those hard drives, but they can’t wait to find it.

These records may be as simple as a notebook or a wad of scratch paper. They could be as detailed as anything. Maybe there’s evidence of a cash payroll — which leads to questions of where that cash came from (the bank? really?) on top of issues of tax and benefits evasion. Maybe there’s a little black book recording paid bribes, or extortion payments received.

Search warrants are often a fine way to gain evidence of embezzlement. Maybe those personal expenses were paid for with the business’s money, or with investors’ deposits. A good search warrant team will have agents who know what they’re looking for, others speaking to the subject. Others will be busy talking to witnesses, family members, employees and others at the location, letting them think the cops know exactly what’s going on, so they’d better come clean.

In a suspect’s home, the search team might see pictures of that really nice boat, or expensive collections, or the like. Investigators love to see things like that, especially when the checkbook doesn’t show those expenses. A lifestyle and possessions beyond one’s official means is going to make them poke around for illegitimate sources of cash.

Obviously, the execution of a search warrant means the investigation ain’t a secret any more. So these usually come at the end of an investigation.

-=-=-=-=-

So how about some examples. Let’s say I have ABC company. Law enforcement subpoenaed or seized a bunch of payroll checks. Every week, my company is cutting a few dozen checks to employees. They all look totally legit, until one of the forensic accountants notices that Joe Blow tends to deposit four or five checks at a time, all on the same day. That means he’s probably not getting them each week like a normal employee, but is receiving a bunch of them once a month. That is typical of a no-show job. Joe Blow and I are now just that much closer to getting caught. Thanks, Joe.

Meanwhile, my manufacturing company DEF sends out invoices every month or so to Jack Nimble, charging tens or hundreds of thousands of dollars for all kinds of different products being delivered. Payment is due on receipt, send the check to my headquarters at 1405 Blank Lane, Suite 120. Unfortunately, the forensic accountant noticed that each month’s invoice number is one more than the previous month’s. Do I only have one customer, for all these things I’m selling? And Suite 120 turns out to be a mail drop box number. Suspicious. They’re going to watch that box and I.D. who uses it, and maybe figure out who’s paying for it. And due on receipt? Someone’s standing on the loading dock with a check for a couple hundred grand? No way. And anyway, how come there are no bills of lading, shipping records, or anything else indicating this really happened? This looks like Jack Nimble is paying me some kickbacks through a shell company.

Original checks are a treasure trove. I’m cutting tons of them to small suppliers, nothing more than $9500 or so. Oddly enough, however, they all tend to get cashed at the same check-cashing joint. They’re not deposited to anyone’s accounts. Looks like I’m laundering some money. Investigators are going to check up on these companies to see if they’re legit, maybe subpoena invoices, bills of lading and purchase order forms to see what’s going on.