Lapping leads

The most common form of receivables fraud is lapping, where perpetrators apply receipts from one account to cover misappropriations from another. For example, rather than credit Customer A’s account for its payment, a thief may pocket the funds and later post a payment from Customer B to A’s account, Customer C’s payment to B’s account, and so on.

Unethical write-offs and discounts are also popular. Instead of crediting a payment to a customer’s account, fraudsters might pocket the funds and then record a bad debt write-off or discount to the customer. Even though incoming payments are diverted, the customer’s account would reflect the expected current balance.

Investigation and prevention 

If receivables fraud is suspected, a forensic expert usually can trace a sample of cash receipts to the sales ledger and deposit slips to find discrepancies in dates, payee names and amounts. An expert also may compare deposit slips against the books and send requests for confirmations to a sample of customers to verify current balances and payment histories. Bad debt write-offs, accounts with unexplained credits, increased customer credit limits and random adjustments to the accounts receivable ledger could also come under scrutiny during a fraud investigation.

But to help prevent receivables fraud from occurring in the first place, businesses should segregate duties. This means that an employee who handles incoming payments from customers should be different from the person who handles invoicing. Also consider assigning a different employee to manage customer complaints because complaints tend to increase if someone is misappropriating receivables. Other helpful controls include mandating vacation time and job rotation for all accounting staffers.

Consider audits 

You may also want to consider conducting regular (and surprise) audits of receivables. Not only might audits help catch schemes in progress, but they enable you to test your controls and ensure employees are following them to the letter. Contact us for help.

Look at the numbers

During the due diligence process of a merger or acquisition, forensic experts review financial statements for subtle warning signs of fraud. These include excess inventory, a large number of write-offs, an unusually high number of voided discounts for returns, insufficient documentation of sales and increased purchases from new vendors. Another suspicious sign is increased accounts payable and receivable combined with dropping or stagnant revenues and income.

Fishy revenue, cash flow and expense numbers as well as unreasonable-seeming growth projections warrant further investigation to determine whether financial statements represent fraud or they’re evidence of unintentional errors or mismanagement. The latter is common in smaller companies that don’t have their statements audited by outside experts or that may not have adequate internal financial expertise.

Watch for red flags

To determine whether unusual income figures indicate systematic manipulation, experts often consider whether insiders had the opportunity to commit fraud. A lack of solid internal controls usually raises red flags. Regulatory disapproval, customer complaints and suspicious supplier relationships can also indicate fraud. If warranted, an expert may perform background checks on your target company’s principals.

It’s important to note that some accounting practices adopted to present a selling business in the best light may be perfectly legal. However, if your expert finds evidence of intentional fraud —particularly at the executive level — you’ll probably want to rescind your acquisition offer. In less serious cases, you may simply need to make purchase price adjustments or even change the deal’s structure.

Manage risk

There’s a way to help protect your transaction even if a seller successfully hides financial manipulation and other illegal activities: Include an indemnification clause in the purchase agreement. Your advisors may have to wrangle with the seller over such details as the definition of “fraud” and liability limits, but such clauses can help you manage the significant risk most acquisitions involve. Contact us for more information.

But as with most technologies, fraud perpetrators have found ways to exploit QR codes — and steal from consumers and businesses. Here’s what you need to know.

How thieves use them

Last year, the FBI issued an alert about QR code tampering. Fraudsters replace or alter QR codes so that users are directed to malicious websites or inadvertently download malware onto their devices. Such schemes enable fraudsters to access victims’ account usernames and passwords and personal and financial information.

Unfortunately, it’s very easy for criminals to create QR codes using online tools. They replace the codes of legitimate businesses with their own by, for example, placing stickers over existing codes. Such stickers have been found on menus, parking meters, signs in front of businesses and packaging of all kinds. Fraudsters might also include them in phishing emails or printed advertisements, coupons or surveys sent through the U.S. Post Office.

Foiling schemes

Preventing QR fraud is similar in many ways to foiling phishing schemes. When you’re directed to a website, scrutinize it for authenticity. Fraudulent sites often look amateurish and feature misspellings and typos. The site’s name may be similar — but not quite the same — as the site you intended to visit. If you’re suspicious, don’t type in a username, password or payment information. Leave the site immediately.

Other ways to avoid QR code traps are to:

• Inspect physical objects for stickers or other signs the original QR codes have been replaced.
• Be careful about scanning any QR code included in an email. Try to verify the authenticity of the email first.
• Use only your phone’s camera to scan codes. You shouldn’t download a QR code app.
• Don’t make payments via QR codes. Go directly to the website by typing in the URL and only use payment processing systems that encrypt your information with SSL or TLS protocols.

Businesses can help protect themselves by routinely checking online and physical sites where they’ve placed QR codes for signs of tampering. Include a message with your QR code telling customers that they should notify you if scanning your code takes them to a suspicious site.

Be on guard

Not even QR codes are safe from fraud perpetrators. As with all types of fraud, your best defense is a good offense. Look closely at QR codes before you scan them and scrutinize the sites they lead to.

For this reason, financial statement fraud — the exaggeration or outright fabrication of numbers by insiders, such as owners and executives — is extremely dangerous. It can lead to criminal charges, lawsuits, large financial losses and even the company’s demise. It’s critical that your business do everything possible to prevent this type of fraud.

More common than you might think

Financial statement fraud involving large public companies has received considerable press coverage in the past couple of decades. But small and mid-sized businesses aren’t immune to this type of fraud. In fact, such schemes generally are easier to perpetrate in small companies where there’s less oversight.

Regardless of size and sector, financial statement fraud is probably more prevalent than you think. A well-received 2023 study by a University of Toronto finance professor finds that 10% of publicly traded companies are committing securities fraud.

These schemes can involve everything from overstating revenue and inflating assests, to understating expenses, hiding liabilities and omitting disclosures. According to the Anti-Fraud Collaboration of the Securities and Exchange Commission, the most common enforcement actions involving financial statements feature:

• Improper revenue recognition (43%),
• Operational reserves manipulation (24%),
• Inventory misstatement (11%), and
• Loan impairment issues (11%).

6 red flags

Although each fraud scheme is as unique as the company it victimizes, financial statement scams share certain characteristics that can tip off fraud experts and eagle-eyed stakeholders. These include:

1. Implausible revenue growth. A sudden or sustained increase in revenue, especially when the company faces harsh economic conditions, can be a cause for concern and deserves further investigation.

2. Relationship between expenses and revenues. Expenses typically increase as revenue grows. If a company reports significant revenue growth, its costs should also generally rise, unless there are extenuating circumstances.

3. Inconsistencies and anomalies. Closer scrutiny may be warranted if financial statements include numbers that are out of line with industry benchmarks, report a trend reversal with no plausible explanation or merely appear inconsistent with historical performance.

4. Related-party transactions. Transactions with related parties aren’t inherently problematic. There can be good reasons to engage in such transactions. But exercise skepticism if they’re hard to understand or seem to serve no purpose.

5. Changes in accounting methods. A company may have a legitimate reason for switching accounting methods. But such changes can mask weaknesses because they make it more difficult to compare performance between accounting periods and spot suspicious numbers.

6. Frequent changes in auditors. If a company changes auditors frequently, it could be a sign of conflict or represent an effort to conceal material financial misstatements.

Reducing risk

To minimize the threat of financial statement fraud, always encourage — and model — ethical business practices. This includes communicating clear expectations to executives regarding acceptable behavior. Be sure to empower rank-and-file employees (and other stakeholders) who may witness illicit activities by providing an anonymous reporting hotline.

Include a separation of duties and multiple layers of approval and oversight in your internal control policies. And make it nearly impossible for managers to override controls. Education also plays a critical role in preventing financial statement fraud. Put the basics of financial statement fraud and potential warning signs in your company’s training materials.

Personal stake

One of the most common reasons executives commit financial statement fraud is because their compensation depends on company performance. For this reason, look for ways to evaluate and compensate managers on several fronts — including on leadership and coaching — not simply on financial performance. Also rely on outside advisors who have no personal stake in your business’s financial results. Contact us for help.

Individuals and businesses are vulnerable

If criminals use your information to file an income tax return to claim your refund, the first notification of fraud you receive may be a denial of your return. Tax returns are identified via Social Security numbers (SSNs) and the IRS won’t accept two returns with the same taxpayer identity. Thieves make a point of filing as early as possible to get a jump on the legitimate taxpayer.

Tax-related identity theft isn’t limited to personal returns. Business identity theft can occur when a fraud perpetrator uses an Employer Identification Number (EIN) associated with your business to file a return. In either case, if the IRS receives a fraudulent request for a refund, it could issue it to the criminal via direct deposit or check.

4 red flags

Often, the IRS is responsible for uncovering tax-related identity fraud when confronted with the problem of two separate returns. But you also should be on the lookout for red flags, for example:

1. Your return is rejected. The most unambiguous indication of tax-related identity theft is when the IRS rejects your return based on a duplicate SSN or EIN. You may learn this immediately if you e-file your return.
2. The IRS notifies you. When the IRS discovers a suspicious tax return, it will contact the affected taxpayer through the mail. If you receive a letter indicating a problem, the IRS may ask you to complete a form to prove your identity. The IRS might also notify you that there’s a new online account in your name or that someone has taken over your existing account.
3. You’re asked to pay additional taxes. To trigger a refund payment, criminals often submit fictitious information to the IRS. If the agency conducts a review and learns that the return associated with your SSN or EIN contains incorrect amounts (usually after a return is processed), it may ask you for more money. The IRS could notify you that you owe additional tax, that it’s withholding a future refund or that it plans to take collection actions.
4. IRS records are incorrect. Criminals often invent sources of income to appear legitimate to the IRS and facilitate a refund. If, for example, the IRS issues an EIN you didn’t request, a criminal may be using your business’s identity to submit fraudulent returns.

How to report fraud

If it appears your tax-related identity has been stolen, your need to complete IRS Form 14039, Identity Theft Affidavit as soon as possible. The IRS then will assign your case to one of its employees who’s trained to help identity-theft victims. The employee will determine the scope of the fraud, make any necessary corrections to IRS records and assign to you a personal identification number to prevent criminals from using your SSN or EIN to file returns in the future.

You may also need to notify your state’s tax authority. Although less prevalent (because refunds generally are smaller), it’s possible someone could use your SSN or EIN to file a fake state tax return.

Prevent it from happening in the first place

Of course, the best defense against tax-related identity theft is offense. File early before a potential scammer can file a fraudulent return in your name. Ensure that your computer is well-protected from viruses, malware and other hacker weapons and watch out for phishing emails. Also take advantage of the ID.me program. After you verify your identity, you can use your ID.me account to securely communicate with the IRS and various other government agencies.

If you suspect you’ve become a victim of fraud or have questions about protecting your own or your business’s identity, contact us.

© 2022

Unfortunately, collusion schemes are common — they make up approximately 58% of all fraud incidents. So these five steps are recommended:

1. Enforce internal controls. Colluding thieves usually either ignore internal controls or take steps to hide noncompliance. For example, a colluding manager might override controls to allow another employee to commit expense reimbursement or payroll fraud. To prevent such scenarios, ensure controls function as they were designed. If an employee fails to comply with a control, does it raise a red flag? Are controls regularly reviewed for compliance and efficacy?
2. Conduct surprise audits. When employees know unexpected audits are a possibility, they’re generally less likely to attempt fraud. Surprise audits focusing on your company’s vulnerabilities (such as inventory or cash-on-hand) should be conducted by outside fraud experts. Keep the time and place confidential to only those who need to be in the loop. That way, a colluding manager is less likely to be able to warn fellow thieves or falsify an audit’s results.
3. Pay attention to relationships. Obviously, you want employees to get along and even be friends. But do any workplace relationships seem suspicious — for example, does a nonaccounting worker spend an unusual amount of time in an accounting staffer’s office with the door closed? Also scrutinize any employee relationship with a vendor that seems too chummy. When vetting vendors, ensure their personal information, such as addresses, don’t match those of any employees.
4. Monitor electronic communications. In partnership with your legal counsel, ensure you have the right to monitor employee communications, such as email or instant messages shared on your network. Investigate employees if their communications lapse into unintelligible code, appear unrelated to their primary roles or appear to violate your company’s policies and procedures.
5. Implement a job rotation program. When employees rotate positions, it’s harder for fraud perpetrators to hide criminal activity. If someone is resistant to participating in a job rotation plan, you might want to look closer at that employee’s work for red flags. Along the same lines, require everyone to take vacations. Employees who continually avoid time off or only want certain individuals to cover their work while they’re out generally deserve attention.

You can further impede criminally minded employees from working together by making all workers sign a code of conduct and by modeling ethical conduct. If you need help strengthening controls or suspect employees are colluding in fraud, contact us.

© 2022

But you can keep tabs on hardware such as desktops, laptops, mobile phones, tablets and the software you’ve purchased or developed to operate them, with IT asset tracking. Following is a three-step guide.

1. List your assets. The first step involves developing a list of the IT assets you need to track. Although third-party software can help simplify this task (especially if the software incorporates physical barcoding to identify and track physical assets), cost may outweigh the benefits for small businesses. In those cases, a simple spreadsheet can suffice. Regardless of the approach you follow, the goal is to identify every asset and ensure the tracking database or document is kept up to date.

2. Develop policies and procedures. Your company must have tracking mechanisms at every stage of the process — from ordering, receiving and assigning to retiring IT assets. When writing your policies, ask such questions as:

• Who’s authorized to purchase hardware or software?
• Is there a process to assign a unique tracking number to each asset?
• How should employees report possible theft or loss?
• What’s the procedure for reclaiming IT assets from employees leaving the company?
• Who’s allowed to access and update tracking records? 

3. Ensure compliance. To help ensure your IT asset tracking process works as designed, audit it periodically. The audit should focus on the accuracy of the tracking database. It should also document and verify that devices assigned to employees remain in their possession. Depending on the volume of hardware and software your company tracks, it may make sense to randomly select assets for scrutiny. If you find that assets are missing, investigate the incidents thoroughly.

These steps are important because lost or stolen IT assets are expensive to replace. Also, they can expose your company’s data, including customer information, to unauthorized third parties. In extreme circumstances, a missing device may enable a thief to gain access to your company’s IT network. Contact us for more information about preventing fraud and theft.© 2022

Connection to cybersquatting

Typosquatting is connected to cybersquatting, where someone registers a site’s domain name that includes a trademark and then tries to profit by selling that name to the trademark owner. With typosquatting, fraudsters register URLs that are common misspellings of company and brand names. For example, a bad actor might register landswnd.com and lnadsend.com. Then, when users try to visit the site of retailer Lands’ End but mistype the name, they may end up on a fake site that looks like the real one. Other human errors, such as typing the wrong URL extension (.com instead of .org) or omitting punctuation marks such as hyphens, can also work to typosquatters’ advantage.

According to Palo Alto Networks’ Unit 42 research, the most commonly targeted sites include Netflix, Microsoft, Facebook and PayPal. But any business can be vulnerable to this type of fraud.

Valuable information 

The goal often is to divert users away from competitors or draw traffic to their own sites (often pornography or dating sites). The greatest risk for users is that they’ll be diverted to a site where they’re induced to enter login information or download malware. Resulting identity theft can make big money for fraud perpetrators.

Typosquatting can also be used for corporate espionage. In one case, a law firm sued a programmer who had obtained a domain name similar to its own, except for a minor typo. The law firm alleged that the defendant had used his doppelgänger domain name to create fake email accounts and intercept email sent to the firm.

Protect online assets

To protect your business from typosquatting schemes, routinely check mistyped versions of your URL. If you find a questionable site, try to contact the domain name owner. The owner may have an innocent explanation. But if you believe the owner has malicious intent, you may want to file a complaint using the Uniform Domain-Name Dispute-Resolution Policy (UDRP) or pursue litigation.

© 2021