Source Documentation: Is Everything as it Seems?

Imagine you are conducting a fraud investigation. In your report, you conclude that some funds were misappropriated, but nothing close to the amount the company claimed. The other side’s expert issues a rebuttal report showing that the bank and credit card statements you used in your report were forged and/or manipulated. What could have been done to prevent this from happening — both for you as the investigator, and for the company that suffered the fraud?

Source documents and evidential matter are the foundation of any investigation. Therefore, it is imperative to understand where and from whom these documents were sourced. This article shows how investigators can identify statements that have been manipulated, and what owners/members of management can do to avoid suffering such fraud-related issues at their company.

Forging or manipulating financial documents are not new fraud techniques — however, the technology available today makes this manipulation much easier. As a result, it is even more important to evaluate the validity of source documents received during an investigation, even if they are from your own client. You should not assume that the source documents are a true and accurate representation of the actual activity that happened.

The following are actual manipulations of credit card statements, PayPal account statements, and other financial source documents that I came across in an engagement.

1. Payments were made to a perpetrator’s personal credit cards from a company bank account. To avoid detection, the perpetrator (an employee of the company) manipulated the company’s credit card statements to show that payments were made to the company credit card in the amounts paid to the personal credit card. To do so, the perpetrator downloaded a PDF of the company’s credit card statements from the financial institution’s website. They then manipulated the PDF document to show payments to the company credit card in the same amount paid to their personal credit cards. These manipulated credit card statements were then preserved in the company’s records.
2. The addition of fictitious payments to the company credit card statement led to large payment amounts but the charges on the company credit card statement did not support such large payments. To explain the fictitious payments “added” to the company credit card statement, the perpetrator changed the amounts of the charges included in the company credit card statement. The perpetrator also changed the total new charges in the summary section of the credit card statements.
3. Additionally, using the same techniques documented above, the perpetrator changed the names of several vendors in the company’s credit card statements to avoid showing that the company’s credit card was used to pay for personal expenses.
4. The perpetrator manipulated the credit card account numbers, replacing the statements for one account number with statements from another account.
5. Various PayPal accounts were used to make payments to vendors using the company’s credit card. The names of the vendors were changed on the company credit card to avoid showing payments to vendors for personal expenses.
6. The perpetrator established fictitious PayPal accounts in the names of former vendors and used corporate accounts to send money to these fictitious PayPal accounts. The perpetrator then used the proceeds from the fictitious PayPal accounts for personal expenses. They changed past invoices from former vendors to reflect the amounts and dates of payments to the fictitious PayPal accounts.

Here’s how we figured out that these source documents were manipulated:

1. It’s important to analyze all of the company’s and individual’s credit card, bank, and investment statements for accounts such as PayPal, Venmo, etc. for consistency. That was the first clue – the formatting of these statements didn’t seem consistent. The statements for the same account looked different from one period to another.
2. The second anomaly was that the calculation of the credit limit available on some of these credit card statements was not mathematically correct. On an account with a $15,000 total credit limit, there was a $10,000 current balance with an available credit limit of $9,800.
3. The total charges on certain statements did not add up to the total charges on the summary page of the credit card statement.
4. The credit card account number on the credit card statement did not match the account number on other statements from the same account. However, the change was not in the last four digits of the account number as one would expect when a new credit card number is issued. The change was only in the fifth to last digit of the credit card number, which generally never happens. Further analysis showed that the credit card statement was actually a personal credit card statement manipulated to look like a company credit card statement. While the perpetrator changed the last four digits of the credit card number from their personal to the company’s credit card number, they forgot to change the fifth to last digit of the personal credit card number.
5. The charges were not appropriately described in the credit card statement. After researching charges from entities such as Facebook, I found that there were key pieces of information missing from the description — including but not limited to reference numbers related to such transactions.
6. Multiple pages of the credit card statement were blank, which is extremely unusual. Often financial institutions document that a page was left blank intentionally, which was not the case here.
7. The type of information provided on the statement changed significantly from one period to the next.
8. On some monthly credit card statements, the ending balance (which was manipulated) did not equal the beginning balance of the next month’s credit card statements.
9. On a credit card statement, the calculation of the interest related to the current balance was not accurate. This was because the perpetrator manipulated the current balance but did not change the interest calculation to reflect that balance.

How to determine if a document was manipulated:

1. Never assume that documents you receive from your client are accurate. Make sure you analyze and evaluate the documents and understand who else has handled them and the source of the information. If you can directly subpoena documents from financial institutions, use those statements to conduct the investigation and cross-check the accuracy of the documents provided by your client.
2. A seasoned investigator looks beyond the card number and the date to determine whether the overall statement passes a “smell test.” An investigation should include an evaluation of trends within the same bank account/credit card statements over a period of time so that you can spot any obvious deviations.
3. If you are investigating a bank, credit card, or PayPal/Venmo statement, you need to understand what the actual statement should look like. One way to do that is to obtain a statement from the same financial institution for the same time period, but from a different engagement. In this engagement, staff members pulled up their own credit card statements from the same financial institution to see what the actual statement looked like.
4. Make sure the totals for deposits, withdrawals, payments, credits, and charges are accurate and that these totals tie into the summary of the statement. Look at the calculation of the available credit and see if it is mathematically correct based on the total credit line and the total statement balance.
5. An additional step could be to recalculate the interest shown in the statement to ascertain if it is accurate. While we did not calculate the exact interest, a cursory evaluation of the balance on the account and the credit card interest rate made it apparent that the interest calculation was not accurate.
6. While evaluating the charges, look for any that are round numbers and are for the same expense multiple times per month or multiple times in various months. Discuss with the client to determine if they are appropriate.
7. Analyze charges from the same vendor/financial institution on other statements to see if the description matches the one you are looking at. In this engagement, we researched what is included in a Facebook charge on the credit card statement. After looking at statements for other credit cards containing charges from Facebook and our research, it was clear the typical description was very different than what we saw in our client’s statement.

What can owners/managers do to avoid this happening at their company?

1. Internal controls are imperative. They are the first, second, and third lines of defense against fraud. Strong internal control policies that detail and document how a process should be conducted ensure that the corporate assets are protected and deters employees from temptation. Should these situations occur, these policies hopefully make it easier to uncover them before too much time has passed.
2. Audits are the highest level of assurance a certified public accountant can provide their client. Although audits are not designed to detect fraud, an auditor will look at your internal controls and most likely communicate to you if there are significant deficiencies and make recommendations to fix them.
3. An internal analysis can ascertain if the policies you have in effect are in fact conducted the way they should be. This process helps you understand if policies need to be amended to be more effective. You should constantly evaluate your internal controls and policies to determine whether they are meeting your business’s needs. Any revisions to internal controls and policies should take into consideration the ever-changing business and legal environments and new technology.

In conclusion, if you suspect that credit card/bank/investment account statements provided by your client may be manipulated, you should immediately communicate with the attorney and the client. Ask to subpoena statements directly from the financial institutions that created them. Source documents and evidential matter are the foundation of any investigation; therefore, it is imperative that these documents are accurate.