Asset misappropriation I: cash, billing and payroll schemes

Asset misappropriation is the most common form of occupational fraud. Most cases are small, but some run for years and become large, and because they are committed by employees who understand the organization's systems, they can be hard to see in the normal flow of transactions. This lesson explains how the main cash, billing and payroll schemes work at a conceptual level, what traces they leave in the records, which red flags point to them, and which controls prevent or detect them. The aim is recognition and prevention. ACCT-240 introduced the expenditure and payroll cycles and their controls; here we look at those cycles through the eyes of an investigator.

A useful way to think about any asset misappropriation is to ask three questions. How does the asset leave the organization? How is the theft concealed in the records? And how does the perpetrator convert the asset to personal use? Every scheme answers these questions in some way, and each answer leaves evidence: a document that should not exist, a record that is missing, an entry that does not fit the pattern, or money that arrives somewhere it should not.

Cash schemes: skimming and larceny

Skimming is the theft of cash before it is recorded in the books. A cashier who sells goods and pockets the payment without ringing up the sale, or an employee who intercepts customer payments that arrive by mail and never posts them, is skimming. Because the receipt never enters the accounting system, there is no record to reconcile, which makes skimming hard to detect from the books alone. Its traces are indirect: sales or gross margins that are lower than expected for the inventory used, customer complaints that their payments were not credited, or lapping, in which one customer's payment is applied to another customer's account to hide an earlier theft, producing a chain of late postings.

Cash larceny is the theft of cash after it has been recorded. Taking money from a cash drawer or a deposit after the sale is rung up, or diverting part of a bank deposit, creates a difference between recorded cash and actual cash. Perpetrators conceal larceny by altering records, recording false voids or refunds, or delaying deposits so that shortages are covered by later receipts. Its traces include frequent voids and refunds by one employee, deposits that reach the bank later or in smaller amounts than the cash receipts journal shows, and reconciling items that persist.

Controls against cash schemes are among the oldest in accounting: segregating the handling of cash from the recording of cash, issuing prenumbered receipts, depositing receipts intact and daily, reconciling deposits to receipts records, using lockboxes or electronic payments so that employees never touch customer money, requiring supervisor approval for voids and refunds, and rotating duties. As fewer customers pay in cash and more payments are electronic, skimming has declined in many businesses, but it remains important in retail, hospitality and any setting where cash or cheques are still handled.

Billing schemes

Billing schemes cause the organization to pay invoices for goods or services it did not receive, or for more than it should. They are among the most costly forms of asset misappropriation because payments can be large and recurring, and because they pass through the normal payables process, which is designed to pay invoices efficiently. The main variants are shell company schemes, pass-through schemes, pay-and-return schemes and personal purchases on company accounts.

In a shell company scheme, an employee arranges for a fictitious or dormant company to be set up as a vendor, submits invoices in its name and causes them to be approved and paid. The company may exist legally, with a registered address and a bank account, but provides nothing of value. In a pass-through scheme, the shell company does buy real goods or services from a legitimate supplier, but resells them to the victim at a mark-up, with the employee pocketing the difference; the goods arrive, so receiving records look normal, but prices are inflated. In a pay-and-return scheme, an employee deliberately causes a legitimate vendor to be paid twice or overpaid, then asks for the refund to be sent in a way the employee can intercept. In personal purchase schemes, employees use company purchasing processes or cards to buy goods for themselves.

Shell company schemes depend on two weaknesses: the ability to add a vendor to the vendor master without independent verification, and the ability to get invoices approved without evidence that anything was received. When the same person can do both, the scheme becomes simple to run. Concealment usually relies on keeping each invoice below an approval threshold, describing the services vaguely (consulting, logistics, maintenance) so that no goods receipt is expected, and spreading payments over time so that no single period looks unusual.

The traces of a shell company scheme are many, which is why data analytics catch them well. The vendor may have a residential address, a mail drop or the same address, telephone number or bank account as an employee. It may have no website, no tax registration number or one that does not validate, and invoices with sequential numbers, suggesting that the victim is its only customer. Invoices may cluster just below approval limits, describe services without receiving evidence, and be approved by the same person each time. Payments may rise over time, and the vendor may have been created by an employee who also approves its invoices.

Payroll schemes

Payroll schemes cause the organization to pay wages it does not owe. In a ghost employee scheme, someone who does not work for the organization, either a fictitious person or a real person such as a relative or a former employee, is kept or placed on the payroll, and the pay goes to an account the perpetrator controls. Falsified wage schemes inflate the hours, rates or overtime of real employees. Commission schemes inflate the sales on which commissions are calculated, sometimes overlapping with revenue manipulation. Workers' compensation and benefit schemes involve false claims under employer-funded programs.

Ghost employees leave clear traces when payroll data are compared with other records. A ghost may be paid without appearing in the human resources master, or may appear there with missing information such as a social insurance or social security number that is invalid or shared, no tax withholding elections, no benefits enrolment and no vacation taken. The ghost's pay may go to a bank account that is also used by a real employee. Former employees who continue to be paid after their termination date are a related problem, sometimes fraud by a payroll clerk who redirects the pay, more often a control failure in which the termination was not processed on time.

Controls include separating the people who maintain the employee master file from those who process payroll and those who distribute pay, requiring human resources to authorize additions, changes and terminations, having managers review payroll registers for their departments, comparing payroll to the HR master and to time records each period, and periodically validating employees by asking them to confirm their identity and banking information directly.

Testing the vendor and employee masters at Saltmarsh Industrial Supply Ltd.

After the hotline report about logistics invoices, Corbett Lane Forensic LLP begins with the master files. Comparing the payroll register with the HR master, checking for shared bank accounts, and matching vendors to employee addresses and accounts are standard first steps, because they use data the company already has and produce short lists for follow-up. The program below runs the three tests on extracts that have been reduced to a few records for illustration; the real tests ran on the full files.

# Payroll and vendor master matching at Saltmarsh Industrial Supply (all data invented).
# Test 1: people paid through payroll who are not active in the HR master.
# Test 2: bank accounts shared by more than one payee.
# Test 3: vendors whose address or bank account matches an employee record.
import re

hr = {  # employee id: (name, status, home address, emergency contact address, bank account)
    "E104": ("A. Okafor",   "active",     "22 Birch Lane",      "22 Birch Lane",      "00311-8842"),
    "E117": ("R. Calloway", "active",     "9 Quarry Road",      "14 Ferncliff Drive", "00418-2290"),
    "E121": ("M. Tremblay", "active",     "301 Water St",     "301 Water St",     "00205-7713"),
    "E133": ("J. Singh",    "active",     "57 Elm Court",       "12 Oak Avenue",      "00311-9054"),
    "E140": ("P. Novak",    "terminated", "8 Wharf Road",       "8 Wharf Road",       "00522-1468"),
    "E152": ("L. Chen",     "active",     "4 Spruce Terrace",   "4 Spruce Terrace",   "00611-3305"),
}
payroll = [  # pay period, employee id, name, bank account, net pay
    ("2026-01-15", "E104", "A. Okafor",   "00311-8842", 2210.40),
    ("2026-01-15", "E117", "R. Calloway", "00418-2290", 2645.10),
    ("2026-01-15", "E121", "M. Tremblay", "00205-7713", 1980.75),
    ("2026-01-15", "E133", "J. Singh",    "00311-9054", 2390.00),
    ("2026-01-15", "E140", "P. Novak",    "00522-1468", 1875.20),
    ("2026-01-15", "E152", "L. Chen",     "00611-3305", 2120.60),
    ("2026-01-31", "E140", "P. Novak",    "00522-1468", 1875.20),
]
vendors = {  # vendor id: (name, address, bank account, date created)
    "V2031": ("Atlantic Fastener Co.",          "1200 Commerce Way",   "00907-5521", "2014-06-02"),
    "V2177": ("Coastal Safety Wholesale",       "88 Industrial Park",  "00733-1180", "2017-09-15"),
    "V2410": ("Northfield Logistics Services",  "14 Ferncliff Drive",  "00812-6634", "2022-03-28"),
    "V2415": ("Bayline Packaging",              "5 Dockside Road",     "00641-2207", "2022-05-11"),
}

def norm(addr):
    a = addr.lower()
    a = re.sub(r"\b(street|st)\b", "st", a)
    a = re.sub(r"\b(drive|dr)\b", "dr", a)
    a = re.sub(r"\b(road|rd)\b", "rd", a)
    return re.sub(r"[^a-z0-9 ]", "", a).strip()

print("Test 1: paid but not active in the HR master")
for period, eid, name, acct, net in payroll:
    status = hr.get(eid, (None, "missing"))[1]
    if status != "active":
        print(f"  {period}  {eid} {name:<12} status={status:<10} net pay {net:>9,.2f}")

print("\nTest 2: bank accounts used by more than one payee")
owners = {}
for eid, rec in hr.items():
    owners.setdefault(rec[4], set()).add(eid)
for vid, rec in vendors.items():
    owners.setdefault(rec[2], set()).add(vid)
shared = {a: o for a, o in owners.items() if len(o) > 1}
print("  none found" if not shared else "\n".join(f"  {a}: {sorted(o)}" for a, o in shared.items()))

print("\nTest 3: vendor address or bank account matching an employee record")
for vid, (vname, vaddr, vacct, created) in vendors.items():
    for eid, (ename, status, home, contact, eacct) in hr.items():
        hits = []
        if norm(vaddr) == norm(home): hits.append("home address")
        if norm(vaddr) == norm(contact): hits.append("emergency contact address")
        if vacct == eacct: hits.append("bank account")
        if hits:
            print(f"  {vid} {vname} (created {created}) matches {eid} {ename}: {', '.join(hits)}")

Test 1: paid but not active in the HR master
  2026-01-15  E140 P. Novak     status=terminated net pay  1,875.20
  2026-01-31  E140 P. Novak     status=terminated net pay  1,875.20

Test 2: bank accounts used by more than one payee
  none found

Test 3: vendor address or bank account matching an employee record
  V2410 Northfield Logistics Services (created 2022-03-28) matches E117 R. Calloway: emergency contact address

Two results need follow-up, and they turn out to be very different. The first test finds that a terminated employee, P. Novak, was paid for two pay periods after his termination. Inquiry shows that the termination form reached payroll three weeks late and that the net pay of 3,750.40 dollars was deposited to Novak's own account; he repaid it when asked. That is a control failure, not fraud, and the report will say so. The second test is more troubling. Northfield Logistics Services, created as a vendor on March 28, 2022, uses the same address as the emergency contact that R. Calloway, the accounts payable supervisor, recorded in his HR file. A shared address is not proof of anything; families share addresses, and so do people who rent office space. But together with the hotline report, it justifies examining every Northfield invoice, who created the vendor and who approved its payments.

The match on the emergency contact address illustrates why investigators look beyond the obvious fields. Many organizations compare vendor addresses with employees' home addresses, so a perpetrator may use a relative's address instead. HR records often hold that address in emergency contact or beneficiary fields that payables staff never see.

cheque tampering and electronic payment fraud

In cheque tampering schemes, an employee forges or alters a cheque drawn on the organization's account, or intercepts a legitimate cheque and changes the payee or amount. Concealment typically involves altering the cheque register or the bank reconciliation. As payments have moved to electronic funds transfers, similar schemes appear in a new form: an employee changes the bank account details of a legitimate vendor or employee in the master file to an account the employee controls, so that the next payment goes astray. Controls include positive pay arrangements with the bank, which match each presented cheque against the organization's list of issued cheques, independent review of bank reconciliations, and a strict process for changing vendor and employee banking details, with confirmation through a known telephone number and a report of all changes reviewed by someone outside payables. Lesson 4 returns to payment redirection by outside fraudsters.