Over the last several weeks, I’ve talked a lot about fraud prevention. Today, let’s discuss one enormous tip for what to do when suspicion of fraud has occurred, and an investigation is imminent. Something that many people get wrong, right from the start.
Do not contaminate the scene of the crime. If an investigation is imminent and someone is placed on leave or terminated, treat their space (office, cubicle, desk, etc.) as a fully physical crime scene.
The Crime Scene
Think about a burglary. If you come home to your door kicked-in, belongings scattered and strewn about, things obviously missing, you immediately call the police and wait. You do not sweep up the glass and splinters, do a quick dusting and run the vacuum. Clues to how they broke in, careless fingerprints on remaining items, DNA in many forms could be everywhere. You want all the evidence available so that you increase the chance of the burglar being caught. Everything is a clue; everything matters.
That is generally common-sense in what is obviously a physical crime. Fraud is a crime too, and I don’t believe anyone would argue that fact. But many presume that fraud is an abstract crime. Money is stolen electronically, or documents are altered virtually. Many think that since the crime was committed through a computer, there is no evidence in the physical world. This couldn’t be further from the truth.
Wherever the alleged fraudster conducted business is an important, physical piece of the puzzle. Once I was going through a briefing process before an investigation that involved the chief financial officer. Management told me that after the CFO’s termination, they went into his office to clean up and boxed up the contents of his desk, file cabinets, and credenza. They wanted to be sure I had a clean place to do my work.
What was meant to be courteous actually destroyed significant evidence. When a fraud is suspected, it is extremely critical for my investigation to begin at the crime scene to obtain as much unspoiled evidence as possible.
Good Evidence
Commitment. Concealment. Conversion. We are not just looking to catalog inconsistencies that appear to be fraud. Fraud and stupid look just alike. If all we can find is evidence of commitment, it is very simple for an alleged perpetrator to claim they are just bad at their job, that they just didn’t understand how to do something properly. We must find evidence that they committed the fraud, that they concealed their actions, and that they converted the fraud into personal gain. Commitment, Concealment, Conversion.
Now, I don’t go into a fraud crime scene and dust for fingerprints or comb the office for hairs. So, what kind of good, physical evidence could I find in a suspect’s office? Here are some real-life examples from my investigations:
Passwords
The 3M company had no idea how much they would help the fraud investigation profession when they invented sticky notes. I cannot count the number of times I have been able to significantly advance an investigation because the alleged perpetrator wrote down their various passwords on a sticky note.
Flash Drives
Flash drives can be full of trails. Numerous times we have found the perfect trail of conversion from information contained on a flash drive, including lists of personal assets that we can use for recovery purposes.
Personal Bank Account/Investment/Credit Card Statements
We have found a multitude of these types of account statements in desk drawers or file cabinets in the alleged perpetrator’s office. Many of these statements provide the perfect banking trail of where ill-gotten gains were deposited or what the proceeds were used to purchase. It seems almost like the alleged perpetrator did the investigation for us.
Cell Phones/Cameras
A cell phone today is a mini-computer, ripe with potentially relevant evidence.
Computer Rules: Absolute “rules of spoilage” in the alleged perpetrator’s office
If computer is off, don’t turn it on
If computer is on, don’t turn it off
If it is a desktop, it is on, but must be moved, unplug it
If it is a laptop, it is on, but must be moved, remove the battery first
These specific rules prevent the operating system from performing its shut down or start-up processes that result in time and date stamping functions that change the scene from however the alleged perpetrator left it.
So many times, people feel the need to clean up for me before I begin my investigation. More than once, management has led me to the “crime scene” and said something like, “This place was a mess. We went through and got rid of personal items, threw away sticky notes and things like that. There were even random flash drives, maybe 8-9. But now you have some space to work.” And I get sick to my stomach. So much evidence gone.
Can You Use That?
There is so much confusion about right to privacy or expectation of privacy. But if your company has proper policy provisions in place that remove an employee’s presumption of privacy, it may be easier to admit these items as evidence. Again, why we stress the invaluable significance of a strong Fraud Policy inclusive of these provisions. I cannot require an alleged perpetrator to give me their password to anything, but a sticky note password left in an office may be legal to use. I cannot, myself, demand compliance with my request to provide to me their personal bank or credit card statements, but if I find them in their office, they may be legally available to me to use in my investigation. Of course, it is worth mentioning that legal counsel should be consulted throughout the investigative process to maintain lawful use of any of this type of information.
If someone in your company is placed on leave or terminated for suspicions of fraud, treat their space as a physical crime scene, just as you would a physical burglary. You are giving investigators the best chance possible to collect the best evidence.
Empowering small businesses to develop strong Anti-Fraud Programs is our mission. We provide consultations to design, evaluate, and improve your anti-fraud program. You can also get a step-by-step guide to design a program that can be tailored for your specific needs by purchasing Steve Dawson’s book, Internal Control/Anti-Fraud Program Design for the Small Business.
If you think there may already be fraudulent activity in your company, contact us today through our website.