Uncovering a Fraud with No Good Rhyme or Reason

What do trap music, a chauffeur costume and a “The Silence of the Lambs” mask have to do with fraud? A lot, apparently. These items were part of a case presented by International Paper fraud and compliance manager Melanie Roman at the 37th Annual ACFE Global Fraud Conference, “Rhymes and Crimes: Uncovering the Digital Trail to Corporate Credit Card Fraud.”  

To start, Roman defined what credit card fraud is, pointing out that there are two types: 

• External fraud deals with unauthorized transactions and skimming and data theft. 

• Internal fraud includes falsified expense reports and misuse of company credit cards. That is the type of fraud that the presentation focused on. 

This case was about following a digital trail, through its many twists and turns, to uncover internal fraud within an International Paper box-making plant. The allegation involved an assistant maintenance manager there, henceforth named by Roman as “John” (real name redacted), who was the subject of an ethics helpline tip involving potential credit card misuse. A member of John’s management uncovered some suspicious purchases that were unlikely to be business-related expenses. Among them were a video game console and video games, a camera and a MacBook (even though the company used HP computers). 

Unwrapping the Case 

John was interviewed by the company, and he admitted to buying the items and selling them on eBay for cash. John was suspended, company property was collected and he was escorted out of the building. The facility seemed happy with the outcome of their local investigation, so it looked like the case was closed. 

Well, not quite yet. Only one month of transactions was reviewed. As opposed to a local investigation’s potential bias, lack of expertise and limited access to data, Roman’s fraud investigation team could see a lot more data and they had the training to handle the evidence effectively. Since John had been with the company for a year, Roman’s team went back that far in John’s transactions and found fraudulent activity from the beginning. 

While the local investigation uncovered a month of fraudulent activity totaling about $5,000, Roman’s team found $67,000 worth of personal spending and $105,000 in questionable transactions, adding up to $172,000 in potential losses to the company. The investigation also revealed that a maintenance manager (Roman said we can call him “David”), who worked above John, may have been involved in the transactions. David had left his position six months prior because of a promotion to corporate, yet he was still named as the current manager with corporate card services for several months after he left. Someone had been doing the required approvals for the transactions. It looked like David was in on this scheme too, so now it was time for some employee email sleuthing. 

More Unwrapping and Some Rapping 

Roman’s team started their e-discovery in both John and David’s emails. 

“We found evidence,” said Roman. “Lots of it.” 

There was an email where David asked John to buy him four different things. Another email had David (four months after being promoted to a different department) asking John to buy 16 different things. 

“There's always a story to tell, and it's our job as fraud investigators to tell that story, to tell the complete story,” said Roman. “If we can't tell the complete story of what's happening, then how are we ever going to expect buy-in from the stakeholders to convince them that fraud occurred?" 

Roman and her team were unsure where to go from there. She said John was suspended, and he quit the company. If Roman’s team asked him for another interview, he probably wouldn’t cooperate since he was no longer with the company. The fraud investigation team also didn’t want to tip off the suspected ringleader, David, who was still with International Paper. So, now it was time for the investigators to do their own deep dives on David and John, using both internal and external records, like Google searches, social media platforms, property records, background checks, obituaries and more. 

Looking at the suspicious transactions, investigators saw a list of items with no rhyme or reason, or so it seemed. These are a few items from the varied list: 

• Entertainment items: two PlayStations, an Apple computer and several TVs. 

• Camera equipment 

• Home accessories? Curtains, toaster, lamp. 

• Arts and crafts? Cricut machine, different color rolls of vinyl, multipacks of T-shirts and plastic cups. 

• Other (?): Car divider curtain, chauffeur costume, straitjacket, “The Silence of the Lambs” mask. (Roman pointed out it was not Halloween at the time.) 

Roman and her team struggled to find connections between the items until they dug through OpenCorporates.com (which Roman highly recommended) to see if there were any businesses connected to David. They found an entertainment company, searched for the name of the company on social media and found that it was tied to a trap music rapper who was later revealed to be David. 

Combing through David’s music videos and photos, all the items started making sense. The arts and crafts items were used to create artist merch. The camera equipment, car divider curtain, and all the outfit and costume accessories were used in music video shoots. 

The Outcome 

Corporate security interviewed David and Roman said he denied everything. Still, the company had enough proof to terminate him. In total, a minimum of $230,000 was lost, but Roman believes the amount may have been double; her team just couldn’t prove it. The case was referred to law enforcement, but nothing came of it on the criminal side due to caseload, the loss amount and potential jurisdiction issues. 

This case provided an opportunity for anti-fraud program changes at International Paper. Some of the preventative measures in place now include fraud awareness training for employees at all levels and more data analysis tools.