Asset misappropriation II: expenses, inventory and cyber-enabled fraud

Lesson 3 covered schemes that move cash through receipts, payables and payroll. This lesson completes the asset misappropriation branch with three further areas: expense reimbursement and purchasing card schemes, theft and misuse of inventory and other non-cash assets, and frauds in which outsiders use email, telephone and increasingly synthetic audio and video to trick employees into sending money. The last area is technically external fraud rather than occupational fraud, but forensic accountants are regularly asked to investigate it, quantify the loss and recommend controls, and the controls overlap with those for internal schemes.

Expense reimbursement schemes

Expense reimbursement schemes cause an organization to pay employees for business expenses that were not incurred, were personal, or were overstated. The four classic forms are mischaracterized expenses (a personal dinner claimed as a client meeting), overstated expenses (an altered receipt or a claim for a higher fare than was paid), fictitious expenses (fabricated receipts or claims for trips that never happened) and multiple reimbursements (the same expense claimed twice, perhaps once on a corporate card and once on an expense report, or on two reports a few days apart). Individually the amounts are usually small, but they can persist for years and are often committed by senior people whose claims receive little scrutiny.

Expense schemes leave traces that analytics can find: duplicate amounts from the same merchant within a short period, receipts with round amounts or consecutive numbers, claims on weekends or holidays when the employee was not travelling, mileage claims that exceed the distance between the stated locations, expenses in cities where the employee's calendar shows no business, and approvals by a subordinate. Receipt images can be examined for signs of editing, and generative tools that fabricate realistic receipts have made this harder; organizations increasingly rely on card data feeds and merchant data rather than images supplied by the claimant.

Purchasing cards, sometimes called procurement or P-cards, let employees buy low-value goods directly from suppliers without going through purchase orders. They save processing cost but transfer control to the cardholder. Common abuses include personal purchases, purchases from merchants related to the cardholder, and split purchases, in which a purchase that exceeds the card's single-transaction limit or the approval limit is divided into several smaller ones. Controls include merchant category restrictions, single-transaction and monthly limits, monthly review of statements by the cardholder's manager, and analytics on the full card data.

Testing purchases and expense claims at Saltmarsh Industrial Supply Ltd.

Saltmarsh Industrial Supply Ltd.'s policy requires controller approval for any purchase of 5,000 dollars or more. During the investigation, Corbett Lane Forensic LLP runs two standard tests on purchasing and expense data for the last quarter of 2025: one looks for possible split purchases, the other for duplicate expense claims. The program below uses a small extract for illustration.

# Two expense and purchasing tests at Saltmarsh Industrial Supply (invented data).
# Test 1 (split purchases): purchases by the same requester from the same supplier within
#   3 days whose total exceeds the 5,000 approval limit although each is below it.
# Test 2 (duplicate expense claims): same employee, same amount, dates within 7 days.
from datetime import date
from itertools import combinations

LIMIT = 5000
purchases = [  # (date, requester, supplier, amount)
    (date(2025, 10, 6), "K. Murphy", "Coastal Safety Wholesale", 4820.00),
    (date(2025, 10, 7), "K. Murphy", "Coastal Safety Wholesale", 4760.00),
    (date(2025, 10, 8), "K. Murphy", "Coastal Safety Wholesale", 3150.00),
    (date(2025, 10, 9), "D. Alvarez", "Atlantic Fastener Co.", 2400.00),
    (date(2025, 11, 3), "D. Alvarez", "Atlantic Fastener Co.", 2600.00),
    (date(2025, 11, 17), "S. Fraser", "Bayline Packaging", 4990.00),
    (date(2025, 11, 18), "S. Fraser", "Bayline Packaging", 1200.00),
]
print("Test 1: possible split purchases")
groups = {}
for d, who, sup, amt in purchases:
    groups.setdefault((who, sup), []).append((d, amt))
for (who, sup), items in groups.items():
    items.sort()
    for i in range(len(items)):
        window = [x for x in items if 0 <= (x[0] - items[i][0]).days <= 3]
        total = sum(a for _, a in window)
        if len(window) > 1 and total > LIMIT and all(a < LIMIT for _, a in window):
            print(f"  {who:<11}{sup:<26}{len(window)} purchases from {window[0][0]} total {total:>9,.2f}")
            break

claims = [  # (claim id, employee, date, merchant, amount)
    ("X-3301", "C. Varga", date(2025, 9, 12), "Dockside Grill", 486.50),
    ("X-3342", "C. Varga", date(2025, 9, 16), "Dockside Grill", 486.50),
    ("X-3355", "B. Osei", date(2025, 9, 20), "Air Atlantic", 612.00),
    ("X-3390", "B. Osei", date(2025, 11, 2), "Air Atlantic", 612.00),
    ("X-3412", "C. Varga", date(2025, 10, 3), "Metro Taxi", 38.00),
]
print("\nTest 2: possible duplicate expense claims")
for a, b in combinations(claims, 2):
    if a[1] == b[1] and a[4] == b[4] and abs((a[2] - b[2]).days) <= 7:
        print(f"  {a[0]} and {b[0]}  {a[1]}  {a[3]}  {a[4]:,.2f}  ({abs((a[2]-b[2]).days)} days apart)")

Test 1: possible split purchases
  K. Murphy  Coastal Safety Wholesale  3 purchases from 2025-10-06 total 12,730.00
  S. Fraser  Bayline Packaging         2 purchases from 2025-11-17 total  6,190.00

Test 2: possible duplicate expense claims
  X-3301 and X-3342  C. Varga  Dockside Grill  486.50  (4 days apart)

The split purchase test flags two patterns. K. Murphy bought from Coastal Safety Wholesale three times in three days, for a total of 12,730 dollars, each purchase below the 5,000 limit. S. Fraser made two purchases from Bayline Packaging totalling 6,190 the next day. Both need explanation, not accusation: inquiry shows that Murphy's purchases were urgent replacement equipment for a customer order and that he did not understand the policy, which management addresses through training and a policy change; Fraser's purchases remain open and are added to the review of purchasing in lesson 5. The duplicate test finds two claims by C. Varga, the vice-president of sales, for the same 486.50 restaurant bill four days apart. Varga's assistant says that the second claim was an error. The amount is small, but the investigation team notes it because Varga is also named in the revenue allegation, and patterns of conduct can matter in assessing credibility.

Inventory and other asset schemes

Inventory, equipment, supplies, tools and information can all be stolen or misused. Misuse, such as using a company vehicle or equipment for a personal side business, may not remove the asset but still costs the organization. Larceny schemes simply take the asset, from a warehouse, a job site or a retail floor. Concealment usually relies on the books: writing off stolen goods as scrap, damaged or obsolete; recording false sales or transfers; adjusting physical counts; or exploiting weak receiving, so that goods never recorded as received can be removed without a shortage appearing.

Traces of inventory theft include shrinkage that rises over time or is concentrated in particular locations, shifts or product lines; write-offs and adjustments approved by the same person who handles the goods; unexplained differences between perpetual records and physical counts; gross margins that fall without a pricing explanation; and goods shipped to addresses that are not customers. Controls include physical security, cameras, segregating custody of inventory from recording, independent counts and investigation of differences, approval of write-offs by someone without custody, and analytics comparing adjustments by employee, location and time.

Data and intellectual property are increasingly the most valuable assets an employee can take. Customer lists, pricing, designs and source code can be emailed, copied to removable media or uploaded to personal cloud accounts, often by employees about to leave for a competitor. Investigations of such cases combine forensic accounting with digital forensics (pointers in CISSP-116) and employment and trade-secret law, and the accountant's role is often to quantify the loss or the unjust enrichment of the competitor, discussed in lesson 11.

Cyber-enabled payment fraud

Some of the largest losses forensic accountants investigate today are caused by outsiders who manipulate employees into making payments. In business email compromise (BEC), fraudsters gain access to, or convincingly imitate, the email account of an executive, a vendor or a lawyer, and instruct an employee to make an urgent payment or to change a vendor's banking details. In invoice redirection, a real supplier's email is compromised or imitated, and genuine invoices are followed by a message saying that the supplier has changed banks. In executive impersonation, the fraudster poses as a senior executive who needs a confidential transfer for an acquisition or a legal settlement.

Generative AI has made these schemes more convincing. In early 2024, an employee of the engineering firm Arup in Hong Kong transferred about 200 million Hong Kong dollars, roughly 25 million US dollars, after joining a video conference in which the other participants, including someone who appeared to be the company's chief financial officer, were deepfakes. Police and the company confirmed that fake voices and images were used. The case is now a standard example of why controls must not depend on recognizing a person's face or voice.

The losses in these schemes are often unrecoverable once funds leave the receiving bank, so prevention matters most. Effective controls share a principle: a request to pay or to change payment details must be verified through a channel the requester did not supply. Payables staff call the supplier at a number already in the vendor master, not the one in the email; changes to banking details trigger a hold period and confirmation; high-value or unusual transfers require two people who verify independently; and staff are trained to treat urgency and secrecy as red flags. Email authentication standards, multi-factor authentication and banner warnings on external emails reduce the risk of compromise. When a fraud does occur, the first hours matter: the organization contacts its bank immediately to try to recall the transfer, reports to the RCMP or the local police service, and preserves the emails and logs for investigation.

In Canada, organizations and individuals report cyber-enabled fraud to the Canadian Anti-Fraud Centre and to the police, and the Canadian Centre for Cyber Security publishes guidance on email compromise. Banks can sometimes freeze funds if they are notified quickly.

Forensic accountants investigating a payment redirection loss reconstruct the sequence of emails and approvals, identify which controls existed and whether they were followed, quantify the loss and any recovery, and assess whether an insider assisted. They also help with the insurance claim: many commercial crime policies cover employee theft but treat social engineering losses differently, with sub-limits or specific conditions such as verification requirements, so the facts of what verification was performed can determine whether the loss is covered.