Sie sind auf Seite 1von 209

FRAUD DETECTION

AND INVESTIGATION
YOUR LECTURER

Head Agent
PALMER U. MALLARI
Chief, Technical
Intelligence Division
Understanding Fraud
What is Fraud?
Fraud is the knowing misrepresentation of the
truth or concealment of a material fact to induce
another to act to his or her detriment and a
misrepresentation made recklessly without belief
in its truth to induce another to act.
- Black’s Law Dictionary
What is Fraud?
- a number of delinquent behaviors involving the
use of deception thereby causing detriment to
individuals or organizations, to obtain benefit,
property or avoid a debt
FRAUD
Any means which deviated from normal
procedures which was/were employed by an
individual or group of individuals for the purpose of
furthering one’s interest/s or for personal gain
which resulted to the damage and prejudice to
another individual, mostly monetary in nature.

NBI Anti-Fraud Division Definition


Who commits fraud?
• No actual profile of a fraudster.
• No hard and fast rule to know whether a person
is capable, willing and may have the propensity
to commit fraud.

Fraud is the by-product of the breach of trust.


THE FRAUD TRIANGLE

Opportunity

Motive Rationalization
THE FRAUD TRIANGLE
OPPORTUNITY- a situation or condition
favorable for the attainment of a goal
THE FRAUD TRIANGLE
***Opportunity generally occurs when fraudsters
believe they are likely to be successful and
undetected in their acts.
THE FRAUD TRIANGLE
***In an office environment, fraudsters acquire
opportunity when they see weaknesses in the
internal controls of their intended victim.
THE FRAUD TRIANGLE
MOTIVE- the driving force that moves a person
to act
THE FRAUD TRIANGLE
***Motive often develops from financial pressure
resulting from a fraudster’s economic conditions
such as excessive life style, numerous money
obligations and the like.
THE FRAUD TRIANGLE
****Financial pressures take place when there is
a strong gap between a person’s cash inflows
and outflows. In order to bridge the gap, a
person resorts to fraud especially when the
opportunity allows him to do so.
THE FRAUD TRIANGLE
***A person who gets a taste of the luxurious life
would do anything in order to sustain it.
THE FRAUD TRIANGLE
***BASIC GREED: But more often than not, a
person who has enough would crave for more.
As the saying goes: “Man enjoys no
contentment.”
THE FRAUD TRIANGLE
RATIONALIZATION- the justification for an action
THE FRAUD TRIANGLE
***Fraudsters, despite the illegality of their acts
are convinced that outside factors other than his
own, were the driving force behind his actions.
THE FRAUD TRIANGLE
***Fraudsters, despite the illegality of their acts
are convinced that outside factors other than his
own, were the driving force behind his actions.
THE FRAUD TRIANGLE
***Internal fraudsters often offer the following
reasons:
THE FRAUD TRIANGLE
• overworked, underpaid
• lagging careers due to non-promotion
• double standard
THE FRAUD TRIANGLE
***External fraudsters meanwhile offer the
following reasons:
THE FRAUD TRIANGLE
• lack of concern from government

“my family needs to eat”


THE FRAUD TRIANGLE
***Eighty-nine percent (89%) of fraudsters under
investigation have cited the need for their
families to survive. Only 11 % of the total
claimed that they resorted to fraud just for the
fun of it.”
THE FRAUD TRIANGLE
• the “at least attitude”

“at least we are not selling illegal drugs”


“at least we do not resort to violent crimes”
THE FRAUD TRIANGLE
***In one case, a fraudster had the temerity to
brag that he made use of his “talent and
prowess” to perpetrate his acts- that at least no
one was hurt and that he was merely “partaking
of the victim’s excess windfall”.
THE FRAUD TRIANGLE
Companies focus their prevention efforts by
taking consideration of the factors brought about
by the FRAUD TRIANGLE. Since Motive and
Rationalization are factors beyond the control of
management, the only logical solution against or
at least minimize fraud is to deal with the
OPPORTUNITY factor.

“The Pro-active Approach”


PROACTIVE APPROACH
***Remove Opportunity by:

Strengthening of internal control.


PROACTIVE APPROACH
A strong internal control policy is one where
policies, rules and regulations, functions, duties,
and sanctions are well-defined.
PROACTIVE APPROACH
If budget and logistics allow, no person should
be performing multiple tasks that would enable
him to defeat the system.
PROACTIVE APPROACH
“Employee Code of Conduct”

A well-implemented code of conduct raises


awareness of acceptable business standards
and management’s commitment to integrity.
PROACTIVE APPROACH
Rule against “Double Standards”

“Laws are enforced for its general application”


PROACTIVE APPROACH
2. Employee Monitoring System

Employees should be monitored in terms of:


PROACTIVE APPROACH
• performance

• lifestyle

• attendance
CLASSIFICATIONS of FRAUD
1. BY METHOD OF COMMISSION:

• Asset Misappropriation
• Corruption
• Fraudulent Statements
By Method of Commission

1. Asset Misappropriation- the theft or misuse


of an organization’s assets.
Asset Misappropriation
1. Skimming- stealing cash from an entity before
it is recorded on the entity’s books and records.
2. Cash Larceny- stealing of cash from an entity
after it has been recorded on the entity’s books
and records.
3. Fraudulent Disbursements- when cash is
used to pay for non-existent or defective
expenses
Fraudulent disbursement schemes can
generally be divided into five distinct
subcategories:

1. Billing Schemes, in which a fraudster causes


the victim entity to issue a payment by
submitting invoices for fictitious goods or
services, inflated invoices, or invoices for
personal purchases.
2. Payroll Schemes, in which an employee
causes the victim entity to issue a payment by
making false claims for compensation

3. Expense Reimbursement Schemes, in which


an employee makes a claim for reimbursement
of fictitious or inflated business expenses.
4. Cheque Tampering, in which the perpetrator
converts an entity’s funds by forging or altering
a cheque on one of the entity’s bank accounts,
or steals a cheque the entity has legitimately
issued to another payee.
5. Register Disbursement Schemes, in which
an employee makes false entries on a cash
register to conceal the fraudulent removal of
currency.
By Method of Commission
2. Corruption- when fraudsters wrongfully use
their influence in a business transaction in order
to procure some benefit for themselves or
another person, contrary to their duty to their
employer or the rights of another. (Common
examples include accepting kickbacks, and
engaging in conflicts of interest.)
Corruption
Examples:

1. Accepting Kickbacks- different from


commissions
2. Engaging in Conflict of Interests
By Means of Method
of Commission

3. Fraudulent Statements- involves falsification


of an organization’s financial statements.
Fraudulent Statements
EXAMPLES:

1. Overstating revenues or assets


2. Understating liabilities or expenses
CLASSIFICATION
1. AS TO PERPETRATORS:

INTERNAL: Those committed by


employees/officers of the victim

EXTERNAL: Those committed by non-


employees or outsiders

INTERNAL-EXTERNAL: Those committed


either by combined employees and non-
employees or retired/resigned employees
AS TO PERPETRATOR

1. INTERNAL: Those committed by


employees/officers of the Victim
The investigation of frauds committed by its
employees/officers is difficult for the following
reasons:
1. Suspects enjoy advantage because they have
wide and thorough knowledge of existing
procedures and the victim’s operating system
***In the Philippines, a large percentage of
“Internally” committed frauds are committed by
those in the officers position. Before being
appointed as officers, they have served several
years of service in the company thereby making
them “well-versed” on procedures, transactions
and internal control policies. In the process,
these officers have an idea on how to override
and abuse the system, with impunity.
2. Suspects, due to their knowledge of the
system can hide their tracks on a day to day
basis until caught
***In the Philippines, most complaints filed by
victims against employees/ officers, were only
made months after the first incident of fraud was
committed or after the suspects have repeated
commissions of the fraud in a number of
instances. In effect, the victims only get to know
of the fraud after the suspects have been
relatively successful in perpetuating their illegal
activities.
***The same only suggests that suspects are
relatively successful in hiding their tracks for a
certain period until caught.
3. Suspects, due to the relationships they enjoy
with co-employees easily invite sympathy for
their illegal acts when investigated
* * * In the Philippines, as well as with other
jurisdictions, the legal system believes in the
legal maxim that “A suspect is presumed
innocent until proven guilty”. For this reason,
suspects when investigated by their employer for
fraud easily invite sympathy from their co-
employees, who meanwhile refuse or decline to
testify for reason of their friendship/relationship
with the suspects.
***There are even times that members of the
Investigating Team within the company are
personally known to the suspects under
investigation.
SUGGESTED POINTERS IN
INVESTIGATING INTERNALLY
COMMITTED FRAUDS

1. Make a checklist of actions to take and


expected results. Prepare timetable for such
activities.
a. A checklist serves as action plan for the
investigator. The same serves as his detailed
outline of the steps he will do to investigate the
case.
b. The checklist likewise serves as reminder of
the progress of your investigation, whether you
lag behind or is ahead of schedule.
2. Have a full and thorough understanding of the
victim company’s system and procedures.
a. An investigator should painstakingly
understand, study and evaluate the victim’s
operating procedures.
b. He should not understand the procedures
based on what was explained to him by the
victim but instead see documents, operations
manuals, and personally review the system.
c. An investigator should place himself on the
suspect’s shoes to empathically understand
motives and modus operandi.
3. Review of the suspect’s Duties and
Responsibilities, Performance Appraisal System
and Personal Data Sheet.
a. An investigator should painstakingly review a
suspect’s duties and responsibilities, functions
and work in order to determine what portion
thereof had been utilized and abused by the
suspect in perpetrating the fraud.
b. He should review the performance of the
suspect during the periods when the frauds were
being committed to determine whether suspect’s
performance faltered or remained stable to hide
illegal activities.
***In one case in the Philippines, a suspect has
been periodically absent in his work prior to the
discovery of the frauds he was committing. Later
on it was discovered that he has been attending
court hearings in a civil case. The case was his
motivation in stealing money from his employer.
c. Conduct lifestyle check.
***Take note of witness’ testimonies concerning
suspect’s sudden upsurge in lifestyle such as
purchase of properties, extravagant spendings,
leisurely travels and similar occurrences.
***The results thereof may be useful in
garnishment proceedings or search warrant
operations against suspects and in computing
the value of his illegal activities.
d. Review Personal Data Sheets
***Take note of previous employments and find
time to check existence of similar incidents from
past jobs and works.
***Review credentials submitted prior to
employment.
4. Full review of transaction documents
a. A review of the entire documents would give
an investigator a complete picture as to how the
fraud has been committed.
b. Authenticate photocopies. Find existence of
originals. In their absence seek ways to locate
them.
* * * In the Philippines, the Rules on Evidence
require the production of originals, or in the
absence thereof, the duplicate originals.
***Photocopies may be submitted as long as
originals can be presented during the proper
forum.
c. Review evidentiary value of each document
as not all documents may serve the purpose of
the case.
d. Find within the documents the imprint of the
suspect, meaning those which would prove his
hand in the preparation thereof.
Examples: Signatures, handwritings, and similar
forms of evidence
e. Take note of documents needed to be
examined in a laboratory examination.
***Most frauds involved the falsification of
documents and forgery of various signatures.
For this reason, a laboratory examination to
prove the same is inevitable.
f. Request for an audit (preferably independent
auditors) based on documents to determine
extent of damage.
5. Depending on the existing laws, make an
arrest/invitation of the suspect for purposes of
interviews, interrogation and filing the case.
6. If available, review statements given by
suspect to determine confessions and
admissions and whether the same jives with
what was discovered from the documents.
***Take note of confessions/admissions readily
volunteered by a suspect as the same may be a
ploy to divert a bigger issue or other unknown
suspects.
7. In the event a new suspect comes out,
immediately determine his participation in the
case and the extent of the benefits he derived
from the fraud.
8. File case the soonest time possible.
* * * Remember that until a suspect has been
placed on bars and his loot recovered, it cannot
be said that justice has been fully served.
9. Finally, compare your checklist and ponder on
actions taken and whether the same produced
the desired results.
AS TO PERPETRATOR
2. EXTERNAL: Those committed by non-
employees/non-officers of a victim company or a
person not related to the victim
Frauds committed by external forces pose
several difficulties to investigators, for the
following reasons:
1. Real identity of suspects.
***95 % of frauds committed by external forces
are committed by persons using false identities
(aliases).
***Most suspects use assumed names, falsified
documents and credentials. All subsequent
transactions or dealings with the victim were
therefore made using their assumed names.
2. Location of Suspects.
***Suspects of this type of frauds make use of
fictitious addresses and residences.
***Suspects are expected to abscond
immediately upon the completion of their illegal
activities.
***Professional fraudsters are known for their
pre-fraud escape plans.
3. Difficulty in recovery of the loot.
* * * Suspects are known to spend their loot
immediately upon their acquisition thereof. For
those frauds where multiple suspects are
involved, they would have parted the same
among themselves upon acquisition of the loot.
* * * Most suspects are known to launder the
proceeds of their illegal activities to legitimate
businesses or undertakings. For this reason,
recovery thereof would entail a lengthy judicial
proceeding.
4. Possible police protection of the suspects
* * * Most of the time suspects of this type of
frauds are daring because they are well
connected in the police.
5. Possibility of collusion with insiders.
***The knowledge of the victim’s control
procedures and policies always gives rise to
suspicion that he has connections from within
the victim company.
SUGGESTED POINTERS
1. Make a checklist of actions to take and
expected results. Prepare timetable for such
activities.
a. A checklist serves as action plan for the
investigator. The same serves as his detailed
outline of the steps he will do to investigate the
case.
b. The checklist likewise serves as reminder of
the progress of your investigation, whether you
lag behind or is ahead of schedule.
2. Have a full and thorough understanding of the
transactions violated by the suspect/s.
a. An investigator should painstakingly
understand, study and evaluate the victim’s
procedures concerning the transactions where
the fraud was committed.
b. The investigator should not understand the
procedures based on what was explained to him
by the victim. He should see documents,
operations manuals, and personally review the
system.
c. An investigator should place himself on the
suspect’s shoes to empathically understand
motives and modus operandi.
3. Full review of transaction documents
a. The review of the entire documents as
submitted by the suspect would give an
investigator a start-up information on how
suspect came up with his design to defraud the
victim.
b. For those suspects who submitted genuine
documents and made use of his real name, the
same would suggest that the suspect must have
come up with a plan to defraud the victim
subsequent to his first dealing with the victim or
as his transaction with the victim progressed.
c. For all documents reviewed, make it a point to
authenticate photocopies. Find existence of
originals and seek ways to locate them in their
absence.
***In the Philippines, the Rules on Evidence
require the production of originals, or in the
absence thereof, the duplicate originals.
***Photocopies may be submitted so long as
originals can be presented during the proper
forum.
d. Review the evidentiary value of each
document as not all documents may serve the
purpose of the case.
e. Find within the documents the imprint of the
suspect, meaning those which would prove his
hand in the preparation thereof.
Examples: Signatures, handwritings, and similar
forms of evidence
f. Take note of documents needed to be
examined in a laboratory examination.
***Most frauds involved the falsification of
documents and forgery of various signatures.
For this reason, a laboratory examination to
prove the same is inevitable.
g. Request for an audit (preferably independent
auditors) based on documents to determine
extent of damage.
4. Exhaust all means to determine true identity
of suspect/s.
a. Interview the person who had the most
dealings with the suspects or those whom he
first met.
* * * Take note of possible negligence by the
employees.
b. Conduct record check on assumed names.
c. Evaluate modus operandi and similar cases in
the past.
d. Review your Rogue’s Gallery. Have the same
reviewed by witnesses, preferably those
employees who personally met or transacted
with the suspect.
e. Visit the addresses as mentioned in the
documents even if the suspect was not a
resident thereof. Interview residents of the
community and present copies of his picture for
possible positive identification.
f. Review visitors’ logbook of the victim company.
Take note of instances when the suspect visited
the company using a vehicle. Verify license
plates with your Land Transportation Office.
g. Coordinate with Security Officers for past
occurrences of fraud where suspects’ pictures
are available.
h. Coordinate with police agencies and visit their
Rogues Gallery.
5. Depending on laws of your jurisdiction, make
an arrest/invitation of the suspect/s who have
been identified for purposes of interviews,
interrogation and filing the case.
6. If available, review statements given by
suspect to determine confessions and
admissions and whether the same jives with
what was discovered from the documents.
***Take note of confessions/admissions readily
volunteered by a suspect as the same may be a
ploy to divert a bigger issue or other unknown
suspects.
7. In the event a new suspect comes out,
immediately determine his participation in the
case and the extent of the benefits he derived
from the fraud.
8. File case the soonest time possible. Consider
the time allowed of your agency to detain
suspect.
* * * Remember that until a suspect has been
permanently placed on bars and his loot
recovered, it cannot be said that justice has
been fully served.
9. Finally, compare your checklist and ponder on
actions taken and whether the same produced
the desired results.
DETERRENCE AGAINST
EXTERNALLY COMMITTED FRAUDS

1. Strengthen internal control procedures. Review


existing ones and revise, amend and update
from time to time.
2. Strengthen policies concerning dealings with
new clients or persons you have just met. For
example, in banks, they practice a “KNOW
YOUR CLIENT” Policy that if possible, only
those known to bank employees and officers are
allowed to open accounts.
3. Again with banks, they take note of walk-in
account applicants. For those whose account
applications have been approved, they send
“THANK YOU CARDS” to the given address.
4. (For banks), in instances when account
applications have been denied, take note of red
flags and inform your branches of the matter.
5. Take note of information concerning
“customers” getting extra close with employees
and on another note, employees getting extra
attentive to customers.
6. Take note of instances when customers ask
more than sufficient information about the
company’s policies and procedures.
7. Give frequent inputs to security officers on
how to be observant of transactions being
performed by customers within the company.
8. Strengthen the function of your compliance
officers and invite full obedience to company
policies and government rules and regulations.
9. Establish a Rewards System.
AS TO PERPETRATOR
INTERNAL-EXTERNAL: Suspects are a
combination of insiders and outsiders or persons
known an unknown to a victim
This type of crimes pose serious difficulties for
the following reasons:
1. Pool of talents and resources between suspects
***The exchange of notes between insiders and
outsiders, as well as the pooling of resources
pave the way for commission of the fraud and
the hiding of their tracks with impunity.
***Insiders provide the information concerning
systems and procedures while outsiders provide
the rest of the necessities.
2. The secret “gameplan” of investigators and
management get released to suspects with ease.
***At the outset when investigators are not yet
aware that employees are in collusion with
outsiders, they unknowingly release information
about their gameplans which find its way to
suspects outside.
***Suspects upon receipt of such information get
to devise a plan to thwart investigative efforts
against them.
3. “Insider” suspects, for fear of reprisal from
their cohorts outside the company refuse to
cooperate to investigators and would opt to
shoulder all the liabilities.
* * * Since suspects from the outside are well
connected in the criminal underworld and even
with the police, they can easily threaten their
cohorts from within the company not to reveal
their names.
4. Difficulty in recovery of loot.
* * * Suspects are known to spend their loot
immediately upon their acquisition thereof. For
those frauds where multiple suspects are
involved, they would have parted the same
among themselves upon acquisition of the loot.
* * * Most suspects are known to launder the
proceeds of their illegal activities to legitimate
businesses or undertakings. For this reason,
recovery thereof would entail a lengthy judicial
proceeding.
SUGGESTED POINTERS IN
INVESTIGATION
1. Make a checklist of actions to take and
expected results. Prepare timetable for such
activities.
a. A checklist serves as action plan for the
investigator. The same serves as his detailed
outline of the steps he will do to investigate the
case.
b. The checklist likewise serves as reminder of
the progress of your investigation, whether you
lag behind or is ahead of schedule.
2. Full and thorough understanding of the
transactions violated by the suspect/s.
a. An investigator should painstakingly
understand, study and evaluate the victim
Bank’s procedures concerning the transactions
where the fraud was committed.
b. The investigator should not understand the
procedures based on what was explained to him
by the victim. He should see documents,
operations manuals, and personally review the
system.
c. An investigator should place himself on the
suspect’s shoes to empathically understand
motives and modus operandi.
3. Full review of transaction documents
a. Review of the entire documents would give an
investigator a start-up information on how
suspect came up with his design to defraud the
victim.
b. For all documents reviewed, make it a point to
authenticate photocopies. Find existence of
originals and seek ways to locate them in their
absence.
***In the Philippines, the Rules on Evidence
require the production of originals, or in the
absence thereof, the duplicate originals.
***Photocopies may be submitted so long as
originals can be presented during the proper
forum.
c. Review the evidentiary value of each
document as not all documents may serve the
purpose of the case.
c. Find within the documents the imprint of the
suspect, meaning those which would prove his
hand in the preparation thereof.
Examples: Signatures, handwritings, and similar
forms of evidence
e. Take note of documents needed to be
examined in a laboratory examination.
***Most frauds involved the falsification of
documents and forgery of various signatures.
For this reason, a laboratory examination to
prove the same is inevitable.
f. Request for an audit (preferably independent
auditors) based on documents to determine
extent of damage.
4. Exhaust all means to determine true identity
of suspect/s.
a. Conduct record check on assumed names.
b. Evaluate modus operandi and similar cases in
the past.
d. Review your Rogue’s Gallery.
e. Visit the addresses as mentioned in the
documents even if the suspect was not a
resident thereof. Interview residents of the
community and present copies of his picture for
possible positive identification.
f. Review visitors’ logbook.
g. Coordinate with Security Officers for past
occurrences of fraud where suspects’ pictures
are available.
h. Coordinate with police agencies and visit their
Rogues Gallery.
5. Based on documents at hand, determine
whether the employee/s who had a hand in the
processing of the transactions was merely
negligent or in bad faith, that is whether he was
in collusion with suspects.
a. Confront him/her of the results of your review
of the transactions and other findings.
b. Explain to the employees concerned the
extent of the liabilities he would face in terms of:
1. administrative liabilities- suspension,
termination from employment
2. criminal liabilities- imprisonment
3. civil liabilities- payment of damages and other
fines
c. Invite cooperation by explaining the benefits of
such and other positive consequences of his
confession, as well as negative effects of his
non-cooperation.
d. If employee cooperates, make sure that his
confession was reduced into writing.
***Depending on the laws of your jurisdiction,
allow a counsel to witness the
investigation/confession.
***In the Philippines, for the
confession/admission of a suspect to be
admissible as evidence, the interrogation of the
suspect must be witnessed by a counsel. The
suspect’s sworn statement must specifically
signify the presence of the counsel during the
taking thereof.
***Take note of confessions/admissions readily
volunteered by a suspect as the same may be a
ploy to divert a bigger issue or other unknown
suspects.
6. Review statements given by suspect to
determine whether the same jives with what was
discovered from the documents.
7. Depending on laws of your jurisdiction, make
an arrest/invitation of the suspect/s who have
been identified for purposes of interviews,
interrogation and filing the case.
8. File case the soonest time possible. Consider
the time allowed of your agency to detain
suspect.
* * * Remember that until a suspect has been
permanently placed on bars and his loot
recovered, it cannot be said that justice has
been fully served.
9. Finally, compare your checklist and ponder on
actions taken and whether the same produced
the desired results.
***In the event that an investigation was
inevitable, make sure that information are not
released “haphazardly”. Those who take part in
the investigation must take hold of information
on a “need to know basis”.