How did a giant tech company lose $5+ million due to one employee’s act of vendor fraud, and how can small businesses learn from their mistake?
A former HP, Inc. (HP) employee recently pleaded guilty to defrauding the company out of more than $5 million related to wire fraud, money laundering, and a related tax charge. The former employee was an executive assistant and finance planning manager for HP from 2017 to 2021. According to the U.S. Department of Justice, she was responsible for paying HP vendors and was issued multiple HP commercial credit cards to make those payments. However, the employee devised a fraudulent scheme to send unauthorized payments to several Square, PayPal, and Stripe merchant accounts under her control. Her scheme’s total and attempted loss is believed to be at least $5.2 million.
How did she (almost) get away with it? Here are the steps she took, according to the plea agreement:
- She set up bogus merchant accounts with PayPal, Stripe, and Square that she maintained under her control but appeared to belong to legitimate vendors.
- She then unlawfully sent payments from the HP credit cards to the bogus accounts by uploading falsified invoices to HP’s internal system and representing that the payments were made to legitimate vendors.
- She also made Square believe that the payments sent from the credit cards were sent to HP’s approved vendors for legitimate business transactions and falsely represented to her bank that the money from HP was for legitimate business transactions.
If you assume this type of business fraud can’t strike small businesses just as easily, think again. Small businesses are the victims of 38% of employee fraud cases, and businesses with the fewest employees had the highest median loss at $150,000, according to the latest Association of Certified Fraud Examiners (ACFE) Report to the Nations®.
This category of vendor fraud can only work when trust trumps checks and balances within the business leadership. You might assume the fewer people you have with their “hands on the money,” the better, but that’s not true when you (the business owner) are lax on internal controls.
So what can you do?
Asking for documentation may not help you thwart the scheme: ACFE reports nearly 60% of business fraud includes creating fraudulent evidence, including fake invoices and altered statements. Frankly, doctoring documents using a laptop or smartphone is easy to do these days.
Blindly trusting your most tenured and “loyal” employees doesn’t work, either. Most employee fraudsters are first-time offenders, and 45% are employees with at least six years at the company they’re defrauding. Plus, long-tenured fraudsters steal almost three times more and can take more than twice as long to catch than those who have been with the company less than five years.
You might start with these tips that include scrutinizing suspicious financials, out-of-character emails, staff who resist tighter controls, overly close vendor relationships, travel reimbursement irregularities, unusual employee requests, and big purchases. In a case like HP’s, simply asking to “show the work” could help. Ask to see the products, supplies, or results of the work claimed to be purchased.
Some industries are more susceptible to fraud than others. Those in real estate, construction, transportation and warehousing, and utility industries are especially vulnerable. When you have specific risk factors like these, internal audits are vital.
Once you suspect fraud is at play—or that the conditions are ripe for fraud—it’s crucial to work with someone who can investigate by “following the money.” A forensic audit can uncover fraud that has been overlooked in other ways time and time again. It can be especially helpful during times of transition—before the sale of your business, for instance. Feel free to contact us with questions.