Locating and recovering assets has always been an integral part of fraud investigations, but today that’s become the new mantra. So many firms these days care only about recovery.
A Recovery Mandate
Although the amount of money involved was quite significant — approximately $8 million — it was not a complicated scheme to unravel. Nothing much about it was noteworthy, with one exception: the client’s reaction.
The victim was a significant credit facilitator. It had discovered, through a random audit, that one of its top loan managers at a branch in Alberta had been colluding with a customer. By sheer chance, the audit took place on a day when the loan manager had called in sick. He had a serious cold, he said, and could be off for several days, if not longer. As a result, he had no idea the audit had occurred, or of the findings.
The audit revealed that the customer had applied for a $15-million loan to purchase inventory for his growing manufacturing business. The documents supporting the application had been audited by a reputable firm and seemed perfect. The ratios were exactly what a lending institution would be looking for before making such a loan. Paperwork showed that previous loans, obtained in Europe where the customer had started his business, had been promptly repaid.
It was as if the customer knew exactly what the credit facilitator needed to see. That was thanks to the colluding manager, it was later learned, who made sure his customer’s documents met all the loan-issuing standards.
When the loan manager approached his boss to get her sign-off on the agreement, he recommended the institution lend only $8 million. “Let’s start him off a bit smaller,” he suggested. “His paperwork looks impeccable, but it doesn’t quite justify $15 million at this point. We can increase the amount once he’s proved himself with us, not just to other institutions.”
The branch manager liked his way of thinking. “That’s a very sensible approach,” she said, as she approved the transaction.
Unfortunately, she had just been duped by one of the oldest tricks in the false-loan racket: ask for much more than you think will be acceptable to the lending institution and then settle for a lower amount.
When a forensic accountant was called in by the credit facilitator, he assumed his primary tasks would be to determine how the scheme worked, identify everyone involved, ensure there were no other frauds at the branch, recommend ways to prevent the scheme from recurring and, if possible, recover some or all of the $8 million.
He was right on only one count.
“We are pretty sure we know who did it and how they did it,” the client said. “All we’re interested in at this point is getting some of our money back. We don’t expect to recover all of it. That would be unreasonable. But we need enough to justify the cost of retaining your firm. Unless you can assure us that a reasonable amount of the money we lost is recoverable, your services will not be required.”
The forensic accountant wanted to say there could be a world of difference between being pretty sure who did it and how it might have been perpetrated and knowing those answers for a fact. He also wanted to point out that where some fraud exists, often there is more fraud. A thorough investigation was the only way to find out if other schemes had taken place.
But he held his tongue.
It was not the first time the forensic accountant had encountered a client that had only one objective in mind. He also doubted anything he said would dissuade the client from focusing exclusively on recovery. In the past few years, he had noticed a change in purpose for many companies victimized by fraud. A growing number of companies made it absolutely clear that recovery was their only objective when retaining him.
There were still files that required a traditional, full-scale forensic investigation but they were increasingly becoming the exception rather than the rule.
Several months earlier, for example, a potential client had made a similar demand to that of the credit facilitator: find me the money. The person had been in a partnership with his brother-in-law, whom he trusted implicitly. So much so that he allowed his sister’s husband to have virtual control over the company’s finances, including sole signing authority. This turned out to be as bad a decision as the one his sister made when she took her wedding vows.
One day the brother-in-law disappeared, as did the company’s secretary, along with almost $1 million from the partnership’s bank account.
The forensic accountant’s investigative research team quickly discovered the missing money had been wire-transferred to an account in the Cayman Islands. “It might still be there or it could be somewhere else by now,” he told the victimized partner. “Either way, it’s going to be very hard to find it because of the Cayman’s strict banking regulations. They generally don’t provide any details about their customers.”
“What are my chances of recovery?”
“Slim,” the forensic accountant replied. “Very slim.”
“Thanks for your efforts,” the partner said. “Send me a bill for whatever hours you worked on this today. I won’t be pursuing it any further.”
Following the Tracks
The false-loan scam, however, showed more promise for recovery. The perpetrators hadn’t been very clever beyond the creation of the false documents. They didn’t cover their tracks in any meaningful way, making it easy to figure out what they had done.
A preliminary analysis of the evidence showed that the loan manager and the customer came from the same European country and could be related. A call to the legitimate audit firm revealed that it had never heard of the company whose statements it had allegedly audited.
“The loan manager was nearing retirement,” the forensic accountant noted, “and likely did this to supplement his pension. He doesn’t seem like the type to run off to Brazil. If he’s planning a trip, he didn’t book it through your company’s travel agency. There’s a good chance we can find his assets. Probably those of his accomplice, too.”
The forensic accountant directed his investigative research unit to conduct a sources and uses of funds analysis. This procedure involves a review of an individual’s entire sources of revenue, if possible, and tracks how the money was spent.
Because the unit had access to all the client’s documentation, including direct-deposit information, it was fairly straightforward to ascertain several key points, including that the phony customer and the loan manager used the same bank and that the $8-million check had been deposited there. Was it possible some or all the money was in their accounts? “My gut says yes,” the forensic accountant told the client. “These guys are not as smart as they think they are.”
The client agreed and engaged the forensic accountant to conduct a full-scale investigation to recover as much of the money as possible. Working under the direction of the credit facilitator’s external counsel, the forensic team moved quickly to assemble and analyze every possible piece of financial evidence at the facilitator. Because they didn’t know when the loan manager might return to work, they first made copies of all electronic and paper files and maintained them offsite in a secure location. This procedure was videotaped and conducted in a manner that ensured an unquestionable chain of custody was followed.
It was evident the team needed access to the banking information of the two suspects and as quickly as possible. “Perhaps the loan manager’s illness was a godsend,” legal counsel surmised. “Perhaps that’s delayed them moving the funds somewhere else. The only way to find out is to get their banking records.”
Negotiations with the bank, however, proved fruitless. It refused to cooperate with the client’s legal counsel for privacy reasons. Initially stymied, the forensic accountant suggested they apply for a Norwich Pharmacal order, a somewhat arcane tool investigators use to obtain banking information. “One of its great qualities,” the forensic accountant said, “is that, if granted, the information is provided in secret. The suspects are not informed.”
The history of the order goes back to the 1970s when Norwich Pharmacal, a UK pharmaceutical company, discovered Hong Kong counterfeiters were producing unsafe knockoffs of their products and selling them in Britain and elsewhere under the Norwich label. As part of the company’s initiative to stop this happening, it asked Her Majesty’s Customs & Excise Commission to release shipping records connected to the alleged patent infringement. The commission denied the request, citing the Official Secrecy Act and common-law confidentiality with respect to taxpayers’ records.
Norwich appealed the decision to the House of Lords, which ruled in the company’s favor. It was greatly influenced by an obscure 17th-century principle called an Equitable Bill of Discovery, which said that under certain strict conditions, a third party to a wrongdoing had an obligation to disclose information to the victim, even if the third party was in possession of this information through no fault of its own.
About a decade later, this principle was applied to another landmark case before the English Court of Appeal called Bankers Trust Co. v. Shapira. In this matter, two fraudsters had conned Bankers Trust into cashing about a million dollars of worthless checks. The fraudsters had deposited their illicit gains in a branch of Barclays Bank in London. Barclays refused to cooperate with Bankers Trust, saying it had a duty of confidence not to provide customer information, even if the customers were scoundrels.
The judge thought otherwise. Citing Norwich, Lord Denning informed Barclays it had an obligation to cooperate, which it did. Since then a Norwich Pharmacal order has been used to obtain banking information that normally would be out of an investigator’s reach. Legal counsel has to establish a prima facie case of fraud, that a significant amount of money is at stake and show evidence that the alleged wrongdoer would likely move the funds to another location, where it may never be located or recovered, if informed of the legal undertaking.
In this matter, the credit facilitator’s legal counsel, with the assistance of the forensic accountant, prepared its case and was granted a Norwich Pharmacal order. Once in possession of the banking information, they saw that the loan manager had received $2 million in a series of large payments from the phony customer. All the money was still in his account.
The customer, however, had transferred $6 million to a bank in Europe where he lived. Fortunately, Canada had signed a Mutual Legal Assistance Treaty with this country. Under this treaty, signatories agree to provide various forms of jurisdictional cooperation in criminal matters, including fraud.
Legal counsel acted quickly to obtain a Mareva Injunction that would freeze the fraudster’s assets in the overseas bank. Although speed is essential, a Mareva has to be carefully prepared. If the injunction is set aside, a defendant could possibly be awarded substantial costs.
The injunction was granted and, as a result, the fraudster’s bank account was frozen. Eventually, a substantial amount of the $6 million was recovered. It turned out, however, that the fraudster had transferred some of the money to a bank in the Channel Islands, off the coast of Normandy, France. Comprised of the Bailiwick of Guernsey and the Bailiwick of Jersey, the islands are British Crown dependencies and not part of the UK. As a result, the treaty between Canada and the UK doesn’t apply, which is fine with the Channel Islands and their many banking customers who do business there because of its devotion to banking secrecy.
“We could apply for a Letter Rogatory [a formal request from one court to a foreign court to obtain judicial assistance],” legal counsel said, “but it could be years before it’s even answered and we have no idea if it will ultimately help us.”
The client declined to pursue that option and was more than satisfied with the outcome of the recovery process. It discovered that the manager had terminal cancer and had become ensnarled in the scam to provide a nest egg for his wife and children after he was gone. The opposite occurred. The loan manager was terminated with cause, although his employer chose not to prosecute him. An agreement was reached that the manager would lose his pension and other benefits accrued over his career.
In his final report, the forensic accountant included a disclaimer that noted the scope of the investigation had been limited to the one transaction in question. “Is it possible the manager had tried a smaller scheme beforehand to see if it would work?” he wrote. “This is a common pattern with people who have been honest and trustworthy during their career but, for whatever reason, become engaged in a fraudulent scheme. They are understandably nervous as to whether it will succeed and therefore do a dry run, sometimes more than one, to test the waters.”
Needless to say, the client never responded to the forensic accountant’s cautionary coda in his report. He knew it wouldn’t. He also knew his practice had changed. Locating and recovering assets, which had always been an integral part of it, was now for most clients the only real objective. “Find me the money” was the new mantra in fraud investigations, one he was certain he’d be hearing a lot more of in the years ahead.
From Uncovering Fraud: True Stories About Fraud, Fraudsters & How They Got Caught by David Malamed, edited by Paul McLaughlin. This column was first published in September 2011.