One who is faithful in a very little is also faithful in much, and one who is dishonest in a very little is also dishonest in much. If then you have not been faithful in the unrighteous wealth, who will entrust to you the true riches? And if you have not been faithful in that which is another’s, who will give you that which is your own? Luke 16:10-13
We are working through the five possible cash disbursement schemes described by the Certified Fraud Examiners on their very helpful fraud tree. We are on category four – check tampering. So far, we have covered three of them: billing schemes, payroll schemes, and expense reimbursement schemes. Next time we will discuss register disbursement fraud.
And although checks are more rare these days, the Certified Fraud Examiners have included check tampering schemes on their tree. The fraud tree does need to be updated, and we will bring in some more contemporary frauds regarding electronic payments in a later newsletter. All of the newsletters in this series are excerpts from the self study book called “An Auditors Responsibility for Fraud in the Government Environment” that is available here https://yellowbook.ideamakr.com/
Check Tampering Schemes
Check tampering is a type of fraudulent disbursement that occurs when an employee converts an organization’s funds by either:
- fraudulently preparing a check drawn on the organization’s account for his own benefit, or
- intercepting a check drawn on the organization’s account that is intended for a third party and converting that check for his own benefit.
Here the fraudster diverts or alters checks written by the organization. The Association of Certified Fraud Examiners breaks check tampering into five categories:
- Forged maker
- Forged endorsement
- Altered payee
- Concealed check
- Authorized maker
The fraudster then might try to conceal the check-tampering scheme by doing a “forced” reconciliation. In this fraud, the bank reconciliation is manipulated to make the bank balance and the book balance match.
Forged Maker
Forgery occurs when someone signs another person’s name to a document or alters an original document. I admit to signing my husband’s name on credit card bills at restaurants and stores when he is otherwise engaged. In this case, I am the “maker”; I am the person who forges the document.
In a forged maker scheme, an employee misappropriates a check and fraudulently affixes the signature of an authorized maker on the check.
Have you ever seen that facinating Leonardo DeCaprio movie “Catch Me If You Can” based on the real life story of Frank Abagnale? If you have, you will remember Leonardo in a dark European barracks forging checks. Abagnale passed over $4.5 million in forged checks in the 60s. He was not the authorized maker!
We are not even safe from moms on the PTA!
The 37-year-old former treasurer of the Cold Spring School PTA was charged with possessing and cashing two forged checks from the PTA account. A recent audit of the PTA’s books showed several checks written to cash with no receipts. Also, two checks were determined to have forged signatures.[1]
Twenty thousand dollars won’t even pay the rent in Chicago! She was probably just getting started…
Chicago Inspector General’s Office Exposes Abuse of Funds[2]
Today prosecutors announced the indictment of a former project administrator with the City of Chicago’s Department Of Cultural Affairs for stealing $20,000 that was intended to promote tourism according to the Office of Cook County State’s Attorney Anita Alvarez.
Ming Liu, 38 of 2302 Shurt Circle in Urbana, IL, has been indicted on two counts of theft and one count each of official misconduct and forgery. If convicted she faces up to seven years in prison. Lui worked for the City of Chicago from 1997 through June 2006.
“Corruption and fraud at any level of government is outrageous and unacceptable,” said Alvarez. “Employees who blatantly disregard the public’s trust for their own gain will be prosecuted and held accountable.”
The indictment alleges that Liu’s work responsibilities with the Department of Cultural Affairs included performing accounting and banking functions for the Chicago Tourism Fund. Within that capacity, Liu had access to the fund’s checking account.
In July 2008, the Inspector General’s Office discovered a copy of a $20,000 check and began investigating because the check’s signature was inconsistent with others issued by the tourism fund. The evidence was forwarded to the Cook County State’s Attorneys Office.
In August of 2004, Liu created a $20,000 check from the fund’s checking account payable to herself. Liu then altered the payee of the check in the Chicago Tourism Fund’s electronic accounting system so that it appeared as if the check was payable to the United States Postal Service. Liu forged the signature of the Chicago Tourism Fund’s executive director on the check, and then deposited the check into her personal checking account.
How is this for creativity?
The Association of Certified Fraud Examiners shares the story of a woman using her boss’s business correspondence and the company copy machine. First, she made transparencies of his signature. These transparencies were then placed in the copy machine so that when she ran checks through the machine the boss’s signature was copied onto the maker line of the check. She made the fraudulent checks payable to herself, but falsified the check register so that the checks appeared to have been written to legitimate payees.
Forged Endorsement
The forged endorsement scheme is a check tampering scheme in which an employee intercepts a company check intended for a third party and converts the check by signing the third party’s name on the endorsement line of the check.
The biggest drawback to the scheme is that once it is uncovered, the documentation (the endorsement on the check) reveals who committed the fraud.
In City Of Anadarko Caddo County Special Audit July 2003 Through May 2007,[3] the State Auditor of Oklahoma tells of a very busy and very creative city employee. She had her hands in everything! Because the report is very lengthy, I’ve included only excerpts from the report.
The State Auditor and Inspector conducted a special audit of the records of the City of Anadarko, primarily those records relating to the request of the District Attorney. The results of the special audit are in the following report.
CONCERN AND FINDINGS
Although the focus of the concern, and this report, centers on funds missing from the court clerk and utility billing deposits, during the course of our fieldwork, we identified what appears to be a pattern of attempts, some successful and some not, by Katrina Pickens to obtain money fraudulently. This pattern begins in 2003 and continued through 2007. The methods and amounts are listed in the table that follows.
July 2003: Questionable payments for back pay totaling $2,085.60
On July 14, 2003, Katrina Pickens issued a letter to then City Manager, Alan Riffle requesting a salary increase. The letter stated, in part:
I thank you for the opportunity to serve the City of Anadarko. In the past nine months, I have proven myself a valuable employee. The Personnel office has been able to assume more responsibility easing the load that was assumed in the Finance offices. Completing more tasks that were neglected by my predecessor, I have saved the City money by not allowing individuals to linger on City paid benefits. I have complied with your request to obtain more knowledge of personnel, by attending various seminars. I know that I can continue to be an instrumental part of saving the City time and money. That is why I ask you now to move to a salary more appropriate to my knowledge, skills and abilities. Taking into consideration that I receive no overtime pay, no uniform allowance and workers compensation insurance is at a lower rate because of job position. I believe this to be a fair proposal for wage increase with respect to job title and responsibilities. I appreciate your serious consideration to this proposal.
On February 3, 2004, Robert Brooks (the then Finance Director) denied the request and, in a letter to Pickens, stated that she was to remain at $14.34 per hour and her next increase would be on September 30, 2005.
We obtained a personnel action form, originally dated 11/15/04 and changed to 11/22/04, providing for a salary increase for Pickens and providing for back pay totaling $2,085.60.
Cash Missing From Utility Billing Deposits = $160,961.36
Unauthorized Family Medical Leave Benefits = $11,215.58
Questionable Compensatory and Vacation Time Payments = $8,361.67
Cash Missing From Court Clerk Deposits = $6,028.00
Questionable Back Pay = $2,085.60
Total = $188,652.21
Although Finance Director Robert Brooks stated, in response to Pickens request, that she was not due for a pay raise until September 2005, it appears Pickens was able to obtain a raise from then City Manager Roy Rainey.
December 2004: Questionable payments for compensatory and vacation time.
We found one personnel action form apparently authorizing the payment for 80 hours of compensatory time. The form was dated December 20, 2005; however, it was not approved. We found no other authorization for the payment of compensatory time or vacation time.
July 2006: Unauthorized family medical premiums.
Interviews with David Edwards, Chief of Police, and Richard Bennett, Chief of the Fire Department, indicated that Pickens continuously expressed her discontent over the police and fire department employees receiving family medical coverage. According to both Chief Edwards and Chief Bennett, Pickens did not think it was fair that these departments were provided family benefits while she was not.
We obtained the payroll history for Pickens beginning in 2002. Starting with the January 6, 2006 payroll period, Pickens began receiving employer contributed medical coverage for her family.
Of the $889.40 total premium, the employee’s responsibility is $596.10 for medical, $45.98 dental and $17.66 vision. For the period January 6, 2006 through May 11, 2006, Pickens received unauthorized family medical coverage benefit totaling $11,215.58.
In the video taped interview with Stephen Campbell (DA investigator), Pickens indicated that City Manager Robert Williamson verbally authorized the family medical coverage. On June 12, 2007, Robert Williamson denied that he had authorized the change to Pickens family medical plan.
Upon reviewing Pickens personnel file, we found no written authorization for family medical coverage.
October/November 2006: Unauthorized attempt to withdraw retirement funds.
Cheri Weber provided us with a form she had found in which Pickens was attempting to withdraw her retirement funds. The form reflected that Pickens was terminated on November 9, 2006. Pickens; however, was not terminated until May 14, 2007.
Upon finding this form, Weber contacted Hedy Devero-Beal at DeMars, the city’s pension company, concerning this form. Hedy sent Weber the request forms Pickens had faxed to them.
The first request was submitted on October 25, 2006. According to Weber, Hedy contacted the City and asked if Pickens was still employed with the City of Anadarko. Hedy subsequently contacted Pickens who stated that she had been rehired. The request to withdraw funds was denied.
A second request to withdraw pension funds was faxed on November 9, 2006 reflecting that Pickens was terminated the same date. The form was ‘approved’ using the City Manager’s signature stamp. On June 12, 2007, the City Manager indicated that he knew nothing about the retirement form.
This attempt to withdraw retirement funds was also denied since Pickens was still, at the time, employed by the City of Anadarko.
Although Pickens continued her employment through May 14, 2007, we noted that retirement contributions were not withheld from her check after October 13, 2006.
June 2007: Unauthorized salary increase.
We obtained the “employee management” reports, which show changes in employee compensation. According to Cheri Weber, all salary increases require the approval of the City Manager on a “personnel action form”.
While reviewing Pickens’ personnel file, we noted she received a salary increase from $17.44 per hour to $19.88 per hour effective March 26, 2006. On June 12, 2007, City Manager Robert Williamson stated that he was not aware of this salary increase.
October 2007: Pickens assumes the duties of depositing money.
The City collects funds, through utility billing, for services such as water and sewer, electric service, garage sale permits, and business licenses. These funds are collected by the utility billing clerks at city hall.
At the close of each business day, the utility billing clerks reconcile the funds collected, and determine which funds should be placed in each account (General, APWA, AEDA).
A daily closeout report (“DCR”) is then created. The DCR reflects, among other things, the amount of cash and checks taken in by utility billing for each business day.
The DCR also reflects the amounts and composition of cash, checks and credit cards taken in for each individual till as well as the combined totals for the day. In addition to the total amounts of cash, checks and credit cards, the DCR also reflects any till shortages or overages as well as pre-deposits (direct deposits).
Once the tills have been reconciled, the funds are placed into a deposit bag and taken to a local bank where the deposit bag is locked up for the night. The following business day, the deposit bag is retrieved from the bank, the deposit slips are prepared and the funds are then deposited.
In October 2006, Katrina Pickens, Personnel and Payroll Director, informed Tracey Harris, deputy city clerk, that she would be taking over the task of making the deposits. According to Harris, Pickens stated that the reason she was taking over the deposits was because both Cheri Weber and Linda Howell, Finance Director and City Clerk, respectively, had complained about how she was doing the deposits. Both Weber and Howell denied making such statements.
We asked the City Manager if he was aware of Pickens taking over the deposits and he stated that he was not. According to the City Manager, Pickens was the de facto second-in-command for the City and she had, more or less, placed herself in the position of making the deposits.
Since we could not determine the exact date in October when Pickens took over the deposit duties, we performed a receipt to deposit test for September 2006 to determine if any shortages occurred immediately prior to Pickens assuming the deposit duties. We found no errors in the cash/check composition of the deposits nor did we find any errors in the deposit amounts.
For the period from October 2006 though May 18, 2007, it appears $160,961.36 in cash was receipted by utility billing but was not deposited into the City and Trust Accounts. In addition, we noted the City Court Clerk collected $6,028.00 in cash; however, those funds were not deposited into the City General Fund account. In total we identified $166,989.36 in cash that appears to be missing.
Cheri Weber, the City’s Finance Director, advised us that beginning in about November 2006, she had trouble getting the DCR’s from Pickens. When Weber told Pickens that she needed those reports in order to reconcile the bank statements, Pickens responded, according to Weber, by saying that she (Pickens) needed to learn how to reconcile the bank statements.
During the course of our audit, we identified what appears to be a cash/check replacement scheme. A cash/check replacement scheme involves using checks from an outside source to supplement a deposit, allowing cash to be removed, and having the deposit total balance match the expected amount of the deposit.
We cite the following as an example of how a check/cash replacement scheme works:
A person is expected to deposit $250.00 consisting of $100.00 in cash and $150.00 in checks. Rather than depositing the $100.00 cash, the person removes the $100.00 in cash and inserts a $100.00 check, from another source, into the deposit. Although the composition (amount of cash, amount of checks) has changed, the total amount of the deposit has not changed. $100.00 in cash was simply replaced with $100.00 in checks and the deposit remains $250.00.
The key element in a cash/check replacement scheme is having checks from a source other than the deposit being altered. During our audit fieldwork, we identified the following:
• Checks withheld from a single deposit were then used to replace cash in several
subsequent deposits.
• Checks from the court clerk deposits were used to supplement APWA deposits.
• False payroll checks were used to supplement APWA deposits.
• Checks were put in deposits that had not been processed through utility billing.
On May 3, 2007, Linda Howell was late arriving to work. When Howell arrived to City Hall she found that Pickens had already done the deposit and had already taken the deposit to the bank. During our testing, we found this deposit was short (May 2, 2007 DCR) $510.49 in cash and had an addition $510.49 in checks.
On May 11, 2007, the City Clerk, Linda Howell, was examining the deposits because the utility clerks had accepted a credit card payment on behalf of the court clerk. During this process, Howell discovered a discrepancy in the cash/check composition of the deposit. Howell found that a U.S. Treasury check, issued to the City of Anadarko, was in the deposit bag although utility billing had not receipted the check.
Subsequent to that discovery Linda Howell, Cheri Weber and Katrina Pickens met with City Manager Robert Williamson. During that meeting, Pickens allegedly stated that she had cashed a payroll check for someone. When Williamson was provided with a copy of the U.S. Treasury check, he questioned the validity of Pickens statement. This meeting occurred late Friday afternoon. The following Mondaymorning (May 14, 2007) Pickens was suspended from her duties.
Questionable payroll checks used to supplement deposits.
In a taped interview with District Attorney investigator, Stephen Coleman, Pickens indicated she had generated false payroll checks and used those checks to substitute for cash in the deposits. She stated that she issued the false payroll checks using employees who had left the employment of the City.
Checks issued by the City require the signatures of the City Clerk and Mayor. During an interview with Cheri Weber, she stated that Pickens had the signature stamps in her possession that were required on the checks.
For the purpose of further illustrating the check for cash substitution scheme, we selected a test sample of deposits in order to identify the specific checks used to conceal cash shortages. This was accomplished by obtaining the deposit composition for a particular day and tracing the checks to the daily postings to determine which checks were deposited and not posted.
A payroll check was issued to Eric Harlan, on December 22, 2006, in the amount of $1,024.19. This check was issued subsequent to his leaving the City’s employment and subsequent to him having received a final check for his vacation and compensatory time.
We obtained copies of additional checks issued to Harlen and compared the endorsement signatures of the additional checks to the questioned check. The endorsements signatures appeared to be different.
On June 21, 2007, we met with Eric Harlan at City Hall in Anadarko. Harlen was shown the questioned check and the endorsement on the check and asked if the signature was his. Harlen signed a sworn statement indicating the endorsement was not his.
This check was included in the deposit composition for the deposit on December 22, 2006 (December 21, 2006 DCR). Our testing for the December 21, 2006 daily report reflects that $1,024.19 cash was missing from the deposit.
On December 8, 2006, a payroll check was issued to Lehman Ware in the amount of $1,145.58. City records reflect that November 5, 2006 was Ware’s last day of employment with the City. We obtained copies of previous checks issued to Ware and compared those endorsement signatures to the endorsement signature on this check. The endorsements do not appear to be the same.
This check was included in the deposit composition for the deposit on December 11, 2006 (December 8, 2006 DCR). This deposit was missing $1,145.58 in cash and had an additional $1,145.58 in checks deposited.
On April 27, 2007, a payroll check was issued to Lynzee Shane in the amount of $510.49. Shane’s last date of employment with the City was April 5, 2007.
We obtained copies of checks previously issued to Shane and compared the endorsement signatures of those checks to the endorsement signatures of this check. The endorsements do not appear to be the same.
This check was included in a May 3, 2007 deposit in which cash, in the amount of $510.49, was missing and an additional check, in the amount of $510.49 was added to the deposit.
In addition to the above checks, we noted other payroll checks that, based on the documentation provided by the City, and the check endorsements, appear questionable. These checks included a payroll check issued to John Sage in the amount of $1,334.33 and a payroll check issued to Mitchell Valazquez in the amount of $469.61. We noted the check issued to John Sage was generated subsequent to his last day of employment.
We have provided our report to the District Attorney to determine if further action should be taken.
Altered Payee
Here, the fraudster changes the payee on the check so that he can deposit the check into his own account. An employee intercepts a company check intended for a third party and alters the payee designation so he or an accomplice can convert the check.
Using a pencil is an option!
Over seven years, Gayle Tatman stole over $200,000 from the Grove City food pantry for which she was treasurer. The food pantry helps the needy by providing food and paying bills.
Tatman wrote checks, in pencil, to fake individuals whose financial-aid worksheets she created. Once other volunteers at the organization approved the checks, she erased the pencil marks and wrote out the check to her creditors. When the organization began restructuring its finance operations in 2009, the board discovered falsified checks.
She also deposited pantry donations into four separate bank accounts, at least one of which was previously a legitimate account that the food pantry believed was closed.
Personal credit cards, house and car payments, as well as other personal expenses were paid for using the stolen money.[4]
Or you can wash the ink off with water
Greed prompts fraudsters to take risks that get them caught.
A 31 year-old Oregon man stole two checks from a residential mailbox, washed the checks, and made himself the payee. He rewrote one check, originally made out for $24.56, for $500. Then, on the memo line, he wrote “landscaping.”
When the man tried cashing the check, the bank employees recognized the fraudster and the scam. Earlier that day, the same man using the same technique had cashed a check at the bank. He made one too many appearances at the bank! The fraudster ran away when police arrived, but they caught him as he was scaling a fence.[5]
Don’t use acronyms
Ever notice that the IRS wants you to write checks to the US Treasury and not the IRS? That is because an employee was caught changing checks written to the IRS to I.R. Smith and depositing them to his own account![6] When I hand write a check I make sure to fill up the entire payee line with something – even if it is a horizontal line.
Concealed Checks
This is when an authorized signer is tricked into signing a check that she really doesn’t see or scrutinize. Imagine a secretary stacking checks for her boss and the boss signing everything in turn without looking at it. It could happen!
Authorized Maker
The authorized maker scheme is a check-tampering scheme in which an employee with signature authority on a company account writes fraudulent checks for his own benefit.
Although this doesn’t relate directly to checks, the authorized maker scheme reminds me of the vulnerability of my bank account from those corporations who are authorized to automatically withdraw funds from my account. My mortgage company and my insurance company always ask me to pay them directly and give them a voided check with all of my account information to set up the withdrawals. They may have all of this information without me sharing it with them intentionally, but I would much rather make the payment myself. I would never want to give a mortgage company this ability – especially given how many times my mortgage has been sold and reassigned over the years. Who are these people, and will they really protect my data?
The Association of Certified Fraud Examiners seems a little stuck in the 80s with their fraud tree. It left out the fraud that must be occurring with direct deposits of payroll checks, electronic bill pay, and electronic funds transfers. We’ll cover these frauds in a later chapter when we talk about the “Internet Fraud Tree.” For a preview of the Internet Fraud Tree, look here: https://www.safaribooksonline.
Yellowbook-CPE.com is registered with the National Association of State Boards of Accountancy (NASBA) as a sponsor of continuing professional education on the National Registry of CPE Sponsors. State boards of accountancy have final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website: