Forensic Accounting with Leah Wietholter

“How do you receive money and when you receive money, what is the actual form of payment? Identify all the ways money enters your business and know who touches that money.” - Leah Wietholter Share on X

Data entry may seem boring, but you never know the story behind the information being entered and the patterns that emerge. Some data has distinctive characteristics that point towards fraudulent activities. Today’s guest is Leah Wietholter. Leah is the CEO and founder of Workman Forensics as well as the host of the Investigation Game Podcast. After working for the FBI, she has served as the Senior Certified Fraud Examiner in Tulsa and she currently volunteers as a treasurer for the Tulsa Crime Stoppers. With over 15 years of experience and more than 100 cases worked, Leah has honed her industry expertise to create the Data Sleuth Process, a scalable data-first approach to forensic accounting engagement and fraud investigations. 

“Most people who are committing embezzlement pay themselves in even dollar payments.” - Leah Wietholter Share on X

Show Notes:

• [1:03] – Welcome to the show, Leah! Leah shares her background and current role as founder of Workman Forensics.
• [2:08] – What sets Workman Forensics apart is their creative team and Investigation Games.
• [4:26] – Forensics accounting started becoming more common, but Leah shares how she became a part of the FBI accounting team.
• [6:13] – While in the FBI, she was heavily involved in data entry and also testified for grand jury after Hurricane Katrina.
• [7:58] – Many times, fraud is determined simply by entering data and seeing patterns.
• [9:25] – Leah explains a tool developed by Workman Forensics to see anomalies within data that indicate fraud.
• [11:41] – By building up from this information, categories for fraud risk can easily be seen.
• [13:18] – Business owners need to know what money enters the business, what form of payment, who touches the money, and what money leaves the business.
• [14:29] – Pay close attention to your payroll reports.
• [16:04] – You need to also know what is normal for your business, then always look for things that look off.
• [17:31] – Chris shares an unusual statement he received and why it looked odd.
• [19:08] – People committing embezzlement typically pay themselves in even dollar amounts.
• [20:57] – Indicators allow investigators a more defined set of data to look at more closely.
• [22:46] – If the person in charge of your bookkeeping isn’t reconciling, you have a problem. Leah explains what reconciling is.
• [24:57] – You don’t always know how much money you have if you aren’t reconciling.
• [25:56] – Most scams have a lifespan of 18 months, but in these types of financial fraud cases, Leah says they last several years.
• [26:58] – When it comes to financial fraud, Leah says it can’t always be prevented but it is important to detect it quickly.
• [28:21] – When money comes into your business, a certain amount is already called for. The money stolen is the profit.
• [30:11] – You can limit access to accounts through your bank.
• [32:14] – Leah shares the story of the craziest case she worked on.
• [36:12] – In this case, someone was using their own legitimate business to launder money through fake vendors.
• [37:25] – Many people think that if a large sum is stolen that the money can be found somewhere, but in most cases, it has been spent.
• [40:18] – In Tulsa, where Leah is located, there are a lot of casinos but the majority of the embezzlement cases she has worked on are by people with shopping addictions.
• [42:31] – One of the suspicious behaviors for high risk is being loved by management but not by others.
• [44:24] – The feeling of betrayal is the most emotionally charged in these events.
• [45:13] – As the owner, make it a process to check things every month.
• [46:50] – A red flag could be if bookkeepers or accountants are defensive when you want to check things.

“If someone is not reconciling, you don’t actually know how much money you have.” - Leah Wietholter Share on X

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review. 

Links and Resources:

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Workman Forensics Website
• The Investigation Game Podcast
• The Investigation Game

Transcript:

Leah, thank you so much for coming on the Easy Prey Podcast today.

Thank you so much for having me.

Can you give myself and the audience a little background about who you are and what you do?

I am the CEO and founder of Workman Forensics. We're located in Tulsa, Oklahoma. We're a forensic accounting and fraud investigation firm. I have six employees, the majority of which are investigators, as I'm sure you'd assume.

It's a wide range. We actually have a geologist that we turned into our data analytics manager. She is incredible with data and data analytics. Of course, we also have private investigators. I'm a private investigator. We have certified fraud examiners. I'm a certified fraud examiner. Then we have CPAs on our staff too.

What makes us even a little more different, though, is that we also have a creative team. We work investigations, for sure, but then our creative team helps us with marketing and all those things. We also provide trainings that are game-based trainings, and it's called The Investigation Game. It's a lot of fun.

We produced a podcast called The Investigation Game Podcast. More recently, I had the opportunity to write a book that Wiley Publishers is publishing that's about our data sleuth process. We're always doing something creative and working investigations. It's kind of my dream come true.

That sounds like a lot of fun.

Yeah.

Was there some precipitating event which got you interested in fraud investigation, or did you just kind of fall into it?

It's a little of both. I wasn't the victim of a fraud at all. When I was 12 years old, and maybe even before that, I just loved reading as a kid, primarily mystery novels. Then when I was about 12, I was listening to this radio drama.

They had this one character that was an agent for NSA. I think that was the first time in my life that I realized, “Oh, there's more than being a teacher or a mom for females.”  It was kind of a defining moment for me. So I thought, “That's it. I'm going to be an investigator.”

I think that was the first time in my life that I realized, “Oh, there's more than being a teacher or a mom for females.” -Leah Wietholter Share on X

I was very intense about it. I started studying about all kinds of investigating. By the time I was in high school, I had decided I'm going to work for the FBI, not with my agency of choice. When I went to college, I chose my major based on how the FBI hired. I was so strategic about this. Then they hired out of accounting programs.

I knew I could become an FBI agent if I did this, so I majored in accounting. My junior year of college, I was chosen as an FBI honors intern, where I got to work on the East Coast for 10 weeks in their internship program.

In doing that, I was then allowed to come back to Tulsa, because I went to Oral Roberts here in Tulsa. I got to come back to Tulsa, finish out my undergrad, and start my graduate degree while working under a forensic accountant at the local FBI office. That's where I got my start.

I started off as an investigator and then ended up here. After working for the FBI for two years, I worked in public accounting because I thought that would be a good life decision. I could always find a job if I had some accounting experience. It was the idea.

While I was working in public accounting in Tulsa, forensic accounting was becoming more popular for forensic accountants to work fraud investigations in the private sector before it went to law enforcement. Having worked for the FBI, the public accounting firm said, “Hey, I bet Leah could do this.” Totally different. That's not how it works. It's not just like a natural thing there.

I had to figure out how to do that without having subpoena power and those types of things, but I started doing that. I did tax in forensic accounting for two-and-a-half years. Then, over 11 years ago, I started working in forensics, which has become what it is today.

Nice. Out of curiosity, working for the FBI doing forensic accounting, is it mostly like criminal organizations, or is it corporations that you're trying to figure out if they've cheated on their taxes, or individuals, or just kind of a mix of everything?

At least when I was there, it seems like it was location. Since I was working out of Tulsa, there were a lot of white-collar crimes, but it was really happening at maybe a mortgage fraud. Maybe a company was taking advantage of some mortgage programs. Or embezzlement, which is what I still work today.

You probably see different cases in New York than you would in Tulsa, just because of the types of employers and things that we have here. For me, I worked on a pump-and-dump scheme, stock scheme, which was pretty fun and a little unusual for Tulsa area for those types of investment scams, although they exist in the areas of oil and gas around here.

Anyway, it was all over the place. I never knew. I ended up testifying before grand jury while I was there as the student position. I testified before grand jury about Hurricane Katrina fraud, so people who were taking advantage of FEMA funds. There was a priority to take action with those.

I testified before grand jury on those, but I did a lot of data entry while I was there, so anything that involves data. I was hand-entering bank statements into Excel. That was my job for the first year. All this nice software that we have now that we still complain that it's not perfect, it's still better than what I did for a year-and-a-half.

That sounds very, very tedious.

It was, but it was also the best foundation for what I do now.

Is the thing that when you're entering stuff into spreadsheets, you just start seeing patterns that your mind just puts together and says, “This is unusual”?

Yeah. There was this one case. I think it was the pump-and-dump stock scheme. I was handed this huge box of documents. “Leah, will you enter all of this?” “OK.” So I get to work on it. I found this $450,000 transaction, that on the bank statement, it said something about Belize.

At this point in time, I had not traveled very much. I don't know that I've traveled that much now, but definitely not been. I just remembered that my best friend in high school, she went on a vacation to Belize. So I knew it wasn't in the US. That's where I was at.

I remember I just went to research what this bank transaction said. Ultimately, it identified a bank account that no one had yet discovered that was in Belize. I actually got a call one day from an attorney with the SEC saying, “Hey, tell me how you found this bank account.” I was just like, “I was entering data into an Excel spreadsheet.” “Yeah, but how do you find it?” I'm like, “No magic. Just entering data.”

Anyway, they were able to start the process to try to seize that bank account from a foreign country and all that process. I remember the first few weeks, maybe months of entering data or bank information. I thought, “Oh, my gosh, I'm not going to make it here,” because I would just be so tired.

My eyes are crossing. But then once I realized, actually, I'm the first person that gets to look at what actually happened, then that started making this information come alive, that I can actually provide value to the agent who was talking to people. That opened a lot of doors in my career, just being able to see the story behind what I was entering.

That strikes me. It's interesting because having that first pass to look at the data, the first pass to look at what's going on, you can almost nudge the next investigator. “Hey, take a look at this. This seems odd.”

Right, yeah.

It was the thing that over your career, you've kind of learned to be able to identify almost from intuition that this seems like an unusual transaction.

Yeah. Actually, one of the things that came out of that is our entire process that we use now internally, that we go ahead and just say that we made available in our book. It's a perfect segue for that. I've talked about it in the book about how to find these anomalies within data, primarily bank statements, credit card statements, payroll reports.

By understanding the patterns within this data and what are the highest risk transactions to notice in a data set that could indicate fraud, we've built this process and subsequently tools that help us identify those things more quickly. I'll give you an example.

We do something where we take all of our bank statements that are in a case and we digitize them. Now, I don't have an intern that does that by hand, so we digitize these bank statements. Then we prepare something that we call our source and use summary report, which basically just says, “Here's where all the money came from on the deposit side. Here's where all the money went on a summary basis.” Real simple. You can do it in Excel.

What we've done internally is that we have our tools that we use to then identify, “OK, here are all of the payments to LLCs to anything that ends in LLC, Corp, Co, Inc.” That’s a section. We identify all transfer. We pull that out into a section, any wires. Those are kind of our big categories.

Those are the things that if someone is stealing money, these are really high-risk areas. This is what it's going to show up as on the bank statement. Someone who controls all of the bookkeeping, financial information in a company, a lot of times, they have access to the bank accounts where they can just go set up other bank accounts, that then would allow internal bank transfers between the two accounts really easily.

 

By separating those transfers out, we can then identify, “OK, are we aware of all of these bank accounts, or did this tell us about a bank account we didn't know?” Or LLCs. “By identifying these are all the LLCs that were paid out of this bank account, are we familiar with all of these vendors? Should all of these people have been paid?”

If we identify an LLC that we don't recognize, we can then go look at, “OK. Well, who owns this LLC? Oh, looks like this employee owns this LLC.” By using this kind of building up from our bank statement, credit card statement, payroll information, it's this experience that allowed me to see, “OK, these are our highest categories of fraud risk.”

Let's not talk about Fortune 500 companies. Let's start a little more practical, because there are a lot of mom-and-pop businesses out there with a single person in charge of the accounting, and that's me. From already where we've gone, that sounds like that's a big risk. What should owners of these small businesses be watching out for without having to dig too deeply into every single transaction?

The first thing to do is to start thinking about the finances of your business as real simple. How do I receive money? Whenever I receive money, what is the actual form of payment? Check, cash, credit card, PayPal, Venmo, whatever that looks like.

Identify what are all the ways that money comes into my business. Who touches all that money as it comes in? If someone was to steal money from me as it comes into my business, who would that be? Then lastly, how would I know?

Let's all use my business as an example. We bill monthly, so these bills go out to customers. If I had one person controlling everything, which I don't, it could be possible that they could get a check in the mail. Then they're going to take that check and go deposit it to a checking account that they've set up with my business name.

I need to make sure that I'm looking for, “Did I collect everything I expected to collect this month?” That's how I would know. That's an example of that. Then I want to look at, “How does money leave my business?” We're talking about just actual payments out of my business.

That might be for equipment that's going to be for payroll and payroll is going to be a big part. It might be that it leaves because I buy things on a credit card, so I might want to look at that. If I can identify all the ways that money leaves my business and then who touches the money, who approves it, who actually sends that payment, how would they steal money? And if they steal that money, how am I going to know?

The best way to identify that on the expenditure side is just to look at the bank statement and the checks every month. Just scroll through. Is there anything that you don't recognize? You're going to want to look at your payroll reports.

Do your payroll reports. “Am I paying people what I expected to pay them?” Especially look at the people that control it. I could get into a whole bunch of things on payroll. Then just look at the credit card statements.

There are some more granular tests you can do to make sure that you're not paying somebody's utility bill or that someone isn't putting their credit card that they're not paying that out of your company bank account. There are some more granular things. But if you can conceptually identify how does money come in, how does money go out, who touches it, how would they steal, and then how would I know, that's going to help you identify your best places to identify that.

It's interesting. It makes me think about my own accounting. I'm a small business. I do it all myself, which there are arguments for and against that. I found this interesting that a lot of companies that I work with, the company name on the transaction with the bank account either coming or going, is not anywhere near the public-facing name of the company.

I suppose there's a lot of that that's probably not incredibly unusual, that that sort of thing happens, that it's somewhat off. I guess the name being not recognizable, at least on the first pass, is not always a red flag. Or at least look deeper.

It's really what's normal for your business. If it's common like, “Oh, this company A, whenever they send payment, it looks like company B.” That's just normal for your business. What might be a concern is that if the person who controls deposits and reconciling sets up an account in your business's name and then tells company A/B, “Hey, we've moved our bank account and now you're going to deposit your money here.” That's where that risk would be.

On a bank statement, you just have deposits and you have expenditures. That's why we group and how we like to think about fraud risk are in those two broad categories because it fits with what you can see on a bank statement. In that expenditure side, then that's when you're looking for, “OK, did I expect to pay this person?” That's why we recommend doing that.

Sometimes, it might be that it is normal, that the company you're paying looks different, but you're going to know that as the business owner. It's just that from a data indication, it might be, “Hey, this is kind of weird.” “Oh, yeah, that's normal. This is how we always do it.”

I guess on the flip side of that, it's important for companies that are making payments to customers or vendors, however it works out, that what is showing up on statements is clear, concise, and makes sense. A really good example I have is a company that pays me commission for a little bit of stuff here and there. They have switched to using a third-party company to make payments.

I get this statement from this third-party company, which I don't recognize, saying that I'm getting paid on some account, which doesn't match up with any account that I have and it's for ad hoc work.

That's very vague.

Extremely vague. I ultimately went back to the company. I got a statement. Ultimately, I figured out, “It was a statement that you guys were going to pay me money, but there was no single line saying your company name or an account number that matched up anything I have with your company. It looks really suspicious. It looks like a phishing scam. You should probably fix this.” The person said, “No, we've heard of this issue before and that's just how the system works.” I'm like […].

If I got a piece of paper in the mail with that, I would have no way of tracking it back to the company I was dealing with. I guess it's important to make sure that your transactions are appearing on statements in ways that people can actually figure out who you are.

Right, that would be helpful.

Are there particular transactions? I know we talked about watching payroll. Are there more specific types of transactions that we should be watching out for that are higher risk?

On a more granular level, most people who are committing embezzlement pay themselves in even dollar payments. -Leah Wietholter Share on X

They're not necessarily writing themselves a check that's $1234.57 or something. It's just going to be $1500, $5000. I had one a couple of years ago, $200,000. They were normally $40,000-$50,000 payments to themselves. But then a couple times, it was $200,000-$250,000.

If you even just want to go and look in QuickBooks, or Xero, or whatever accounting software that you're using, you can just export all of the payments using Excel and a filter. Just filter for payments that end in even dollar amounts, or multiples of a hundred, or even multiples of 10, or multiples of a thousand. That will identify.

It doesn't mean that all of those are bad, though, because if you've gotten a bill from an attorney or a consultant, a lot of times those will just be a $5000 retainer or something. Those would be normal. But what I like about looking at, especially embezzlement cases from the eyes of the best data sources, which are bank statements, credit card statements, and payroll reports, is that I can use data and these indicators to help me find things that I wouldn't find otherwise.

I don't love the needle-in-a-haystack analogy because this is what I've done for my entire career, so I feel like I hear that all the time. But it really does data analysis and it doesn't even need to be scary. What we're talking about, this isn't magic. It's just understanding what's high risk. So looking for even-dollar payments out of all of the expenditures in a company is not complicated.

We can just identify those. Those are the indicators that then allow us, that's going to give us smaller data set to look at that we can actually wrap our minds around and then say, “OK, I expect $5000 to be paid to this attorney. I expect whatever to be paid to some consultant. Fine. But these, I don't recognize these companies.”

That allows us to then go in and say, “OK, let's go find the supporting documentation for, “Why am I paying ABC123 Co. $10,000?” Then maybe we research that on a Secretary of State website or wherever in each state where they register their businesses and say, “OK, who owns this? Oh, my goodness. Bob for manufacturing owns this business? Why are we paying Bob this money?” That's how that thought process works.

I suppose also someone who's wanting to kind of self-audit, let’s say, they need to, I assume, more than just look at QuickBooks because, I suppose, maybe not necessarily even clever, someone who's taken money from the company will not even log the transaction in QuickBooks.

That's correct. That's why looking at those bank statements are important. If you want to know what is actually happening in my business—I feel like a broken record—you need to look at bank statements, credit card statements, and the actual payroll reports. That's right, because a lot of times, if one person is controlling things and that person is stealing, they're not even reconciling QuickBooks.

A lot of times, if one person is controlling things and that person is stealing, they're not even reconciling QuickBooks. -Leah Wietholter Share on X

Anything that they don't want you to see, they're just not putting in QuickBooks, and then they're never reconciling. I like to tell small businesses, “If the person handling your bookkeeping is not reconciling, you have a major problem.” It may not even be that they're stealing money. But if they are not reconciling, you don't know how much money you have or that you've made. You cannot have reliable financial information without reconciling.

I sometimes do presentations for small businesses. I'll tell them like, “Yeah, the rest of my presentation is interesting. But if you are not reconciled, you should just leave now. You want to go get that settled. This might be interesting to hear about all these people who have stolen money, and bless their hearts, but if you weren't reconciled, you have a bigger problem.”

You cannot have reliable financial information without reconciling. -Leah Wietholter Share on X

And for people that are not in accounting and haven't done accounting, what is reconciling? It's something that individuals should be doing also on their statements.

Correct. We don't do it as much anymore just because of debit cards, credit cards, and all of that. Essentially, it is making sure that everything that you've paid on the company side, you need to see, “Did this clear the bank?” By comparing these two sources of information—QuickBooks to the bank account—you’re going to find out, “Oh, something cleared the bank that I didn't see in QuickBooks, or I have something in QuickBooks that hasn't cleared the bank yet.”

You may think in the bank that you have $20,000 left over for the month. Great, but then you find out there's a $15,000 check that hasn't cleared to a vendor. Really, you don't have $20,000, you have $5000 of actual cash. That's the process or idea of reconciling those things. If someone is not reconciling, then you don't actually know how much money you have because the only real number is what comes into the bank and what leaves the bank.

That's a little scary. You don't want some vendor who hasn't cashed a check sitting out there for an extra couple of months and all of a sudden you get swept for much larger amount of money than you were expecting.

Exactly.

I've unfortunately have had that happen one time, where someone sat on a fairly large check and it took me actually calling him saying, “Hey, I noticed you haven't deposited the check yet.” “Oh, it's still sitting on my desk.” I'm thinking, “It must be nice to have a business where you can let payments sit on your desk for months.” It's like, “Gee, I've got more money in my bank account than I think I should have in there. Oh, yeah, I looked at that one check, it hasn't cleared yet.”

Speaking from the banking, are there things that small businesses can put into practice, like the owners can put into place to prevent some of these superfluous illegal transactions from happening?

You might call me a pessimist, some might call me a pessimist, but I don't think that fraud is a financial fraud like what we're talking about. I don't think you can prevent it 100% of the time. It's about detecting it quickly.

I don't think you can prevent it 100% of the time. It's about detecting it quickly. -Leah Wietholter Share on X

The Association of Certified Fraud Examiners says that the median life of a scheme is 18 months. Out of every case I've ever worked, I might have had one or two. I've worked probably close to 150 cases in my career. I'm probably closer to 200 at this point if we throw in divorce cases, too.

I've worked a bunch of cases in my career. The majority of those cases, the theft has been going on longer than five years. If we just think about this, that loss is adding up every year. Every time I've worked a case that's happened for a long time, there's this exponential curve, that growth curve that you could draw based on that loss amount. It'll start small, they get more confident, more confident, more confident, and then at the end, there's just this huge loss.

Let's say that they're stealing $50,000 a year. That's still significant when we add all of that up over that timeframe. A few things. Like I said, it's not about preventing it 100% of the time. It's catching it when it first happens. If we're looking at the bank statement and somebody has paid their electric bill or their credit card bill with company funds, we catch it at the beginning, maybe a few months, rather than several years.

Another thing that I recommend is creating a bank account that is only for operating expenses. A book that kind of inspired this was actually the book, Profit First. He's not talking about fraud prevention at all. He's talking about cash management. But whenever I read this book, I thought, “Oh, this is a great fraud-prevention measure, especially for a small business, because you know how much your rent needs to be every month. You know how much all of these expenses should be every month.”

For us, payroll is our number one expense. After that, it's technology. I know how much that technology is every month. I can put that sum of money into a bank account and that's what my financial person can control. Because if that's short, then I will know immediately I have a problem.

Then the whole concept of separating out profit. Separating out your profit first, separate out your taxes, separate those things out into other bank accounts, and then the owner only has access to those accounts.

When money comes into your business, there are certain types of expenditures that are already spoken for, like I talked about—rent, payroll. All of your expenditures that you know you're going to have to pay, that you can reasonably estimate, that goes in one bank account.

The part that people steal is the extra, which is our profit. People are stealing profit. They're stealing the cash you should have available to pay your taxes. They're stealing the cash available that you should have to pay payroll taxes, all of those things.

If you can separate out those “extra funds,” which aren't really extra. If I'm running a business and I need profit to reinvest, I need profit to cash flow because there are always timing issues. If I want to improve equipment or improve something in my process, I have to have profit to do that. It's not actually extra, but that's the part they get stolen.

Once somebody has eaten through all of that profit when they shouldn't have had access to it, then I'm going to start finding and seeing these cash-flow issues. I'm going to be saying, “What is wrong with cash?” But we don't want to get to that point. We want to catch it when it happens.

Segregating out the funds that these are the bills that have to be paid, this is what is expected. Only giving the bookkeeper or whoever's handling financial information access to that bank account is my number one suggestion.

Is this the thing where the accounts should be at separate institutions or just that the bank only allows one specific user to move funds in and out of those accounts?

Right. All of mine are at the same bank account or the same banking institution, but I get to choose who has access to what. Sometimes, the bookkeeper doesn't even need access to actually be able to transfer funds. You can just give a read-only. Now there's the bill.com.

Bill.com sets things up where you can have approvers, so then your bookkeeper can handle, “OK, all of these things need to be paid.” But they can't actually send funds without the owner approving it. That's a really easy way to do that.

I actually use a local financial institution. Its not like there's a ton of bells and whistles. But even at the local level, they can help me get really granular about what can this individual have access to.

I suppose it also helps on the fraud side. If someone sees the account numbers of that cash account and is able to externally steal money, you've limited what they have access to as well.

Yes, which from that standpoint, I have a separate account for anything that's run through a payment processor. Of course, that gets moved over into the appropriate accounts. When somebody says, “Hey, I want to send a payment via wire or ACH,” I give them that account because there's never anything in it.

If there's a breach, you're not going to get a whole lot. Then if there's a breach, I'm not going to have to change where all my automatic payments come from. That's how I handle them.

Yeah. I've heard of people doing it both ways, that they have one account that is specific for incoming wire transfers and another account that is specifically for outgoing transfers. If something gets compromised, the risk is mitigated, even if it's just the issue of, “I have less people to contact because I have to change an account number.”

What are some of the craziest embezzlements you've seen? Because you talked about one where it worked up to a $200,000 transaction. I don't know if that was a real example or just illustrative. What are some of the crazy ones?

That is part of one. But the one I like to tell is there was this guy. He was working in an oil and gas company. I live in Oklahoma, so we have lots of oil and gas. He was working at this oil and gas company and he worked his way up. He'd been employed there about nine years.

He had a degree in finance, but he also was really good at running operations. He would run operations for all these different well sites where they were drilling. Then he had a lot of responsibility because he'd been there so long, everybody trusted him. If he needed a new piece of equipment or something out at a site, he had the authority to just take care of it and then move on.

The CFO at the time, he was going to retire. A new CFO came in, which was buddies. We're going to call him Bill because we actually have a game that's based on this case, so that will help me tell the story. We're going to call this guy Bill because that's his name in the game.

Bill had this friend that was a CPA. He said, “Hey, my company is hiring for a new CFO. Do you want to come in?” “Yeah, it's a great job.” The new CFO comes in and he starts seeing on the bank statement that there are all these withdrawals from the bank. He's like, “That's weird.”

Withdrawals on the bank—it just shows you the withdrawal slip. You can't see if it was for cash or cashier's check. You have to ask the bank for that information. We asked the bank for the supporting information. The bank sends it to him. The new CFO is like, “Gosh, BDW LLC. I think that's Bill's company. That's strange. OK.”

He goes month after month. He sees another one and it's like, BW and DW LLC. He's like, “I know that's Bill's company. What is this about?” He had some auditing experience and had done fraud trainings and stuff. He knew that this might be a fake vendor scheme. This just doesn't look right.

He went to the owners of the business and said, “Hey, I think Bill's very trusted employee is stealing money.” It turns out that Bill had created a whole bunch of fake vendors. By creating these fake vendors, they were all, like, with his initials or his family's initials and stuff. Because it was so generic, nobody was going to notice.

He would go to the bank. He had access to the bank account after a certain point where he could actually make withdrawals and get cashier's checks to pay people. Because whenever this company first started, especially in oil and gas, what they're paying vendors is such a large sum of money that until vendors get to know you, they will actually require that you pay with a cashier's check.

He kept using that practice, even though the company had been around. He kept using that practice to benefit himself. He would go to the bank, get a cashier's check to one of his fake LLCs, and then the former CFO would see this withdrawal and would say, “Hey, Bill, you need to come in and code this,” because he was a finance guy. Bill would say, “Oh, yeah, I'll come in and I'll code it.” He'd fixed it later.

That's how that ended up being caught because there were all of these unreconciled withdrawals. That was one of the ways he had a legitimate company that was doing business with his employer and with a business partner. He had actually set up another bank account that his business partner didn't know about and then he would just make payments to that bank account.

There were legitimate invoices for work and legitimate payments corresponding with those invoices. But then to that same company—we call it Serve Right Oil Field in the game. To Serve Right Oil Field, there were also payments, but they were going to a separate bank account that were for absolutely no work performed.

He's effectively defrauding two companies, in a way.

Yeah. His business partner had no idea that he was also stealing money with their legitimate business.

He was using his own legitimate business to launder money for himself.

Yes, that would be pretty accurate there. There are a bunch of fake vendors, the real vendor, but then we just call it fraudulent billing, making extra payments. Then he had access to the bank account. He could basically get a cashier's check for whatever he wanted. He also would just pay vendors directly.

Doing that, he bought cars, boats, trucks, and tractors. I think what makes this case interesting, I mean, it's pretty bold. He stole over $3 million doing this. I think we only looked back five years of his employment. He stole $3 million over this period of time. Clients always think if you've stolen $3 million, the money has to be somewhere. It's under a mattress somewhere or buried in the backyard. No, he spent all of it.

He was really into Chili Bowl race cars. They're this indoor racing thing. I just know around here, we have an event every year called the Chili Bowl. Anyway, it's indoor racing. He would sponsor all of these racers, and then he would buy race cars, and then he'd buy things that people could come and work on their race cars with him.

He never drove any of the race cars he bought. He just bought all this stuff and then his buddies would come and hang out with him all the time or hang out at these racing events. Then he bought really exclusive collector firearms. He never shot a firearm. He just bought it for his buddy.

We call this case in our game and also in the book The Case of the Man Cave, because he just kept buying all this stuff. If you're going to have all of these toys, you've got to have something to store this in.

On his company's dime, he built a metal building on his land—a $100,000 metal building. That was one of my favorite finds. I don't know why. But in the end, because he bought all these kinds of things, they were able to auction whatever existed still at the end. So they were able to collect about $900,000.

That was their piece. They got about a third back. He was charged with not paying taxes on that stolen money. He was charged with that and he actually received the maximum sentencing of three years in prison. He got out. It's probably been two years ago now.

I think some people will be comfortable going to jail for a year for a million dollars. I wouldn't.

I would not. I think it's not even the prison thing to me. It's really all the freedoms that I lose. You just don't get things back after you have a felony. That's usually my determinant in my entire life.

That's one of my favorite stories because he just really wanted to be everybody's friend. That's why he bought all of this stuff and would pay for all kinds of things for people.

It's interesting because most of the fraud cases I've heard of, it's paying gambling debts or things of that nature, that someone got in too deep with something and they're trying to bail himself out of it in the hopes that, “Well, at some point in the future, I'll be able to pay the company back.” But this sounds like the guy was just like, “No, I'm entitled to this money, and I'm going to spend it to all my friends and my family.”

Also being in Oklahoma, we have a lot of casinos here. That's what I had heard before I started my business, that most of these types of cases, they're stealing because of gambling or whatever. I've had maybe a couple since in the last 11 years.

The majority of my embezzlement cases are people who are addicted to shopping or feeling important. Gambling is not one of the top things for me. I don't know why. I seem to just attract the cases where people are addicted to shopping or narcissists.

Outside of the accounting aspect, some of these cases, were people suspicious before the accounting issue came to light?

No.

It was all discovered through the accounting. It wasn't like, “Gee, Suzie just drove up in a Lamborghini. Let’s dig into this.” It was, someone had less money in the bank account than they thought they should have and started looking.

Yeah. Oil and gas is interesting because it has its own market of what it pays people. Even employees will be paid premiums for what they're doing when oil is good and then they'll just lay everyone off when oil is not good. It's kind of a strange industry.

For this guy, he was getting paid really, really well when he was working here. I think people just assumed, like, “Oh, well, yeah, he's in oil and gas, he makes plenty of money.” No one knew. No one was suspicious at all. Oil prices were good at the time. There's plenty of money. No one knew until the new CFO came in and said, “This is weird.”

It wasn't like the receptionist drove up in the Lamborghini and everything.

No.

Oh, yeah, that's perfectly normal for our receptionist. It wasn't so far outside of the lifestyle of someone who was in that position might have.

Right. No, it wasn't. A lot of times in our behavior indicators, when we're talking about that in trainings, I think the most telling is when someone is management's favorite, but no employees want to work with the person. They're terrible to other employees, but management loves them.

I always see that as a higher risk than somebody driving up in a fancy car. Money is pretty accessible these days and being able to lease cars and things like that. To me, if it's their personal decision to live in a dumpy house and drive a Lamborghini, they can do that. That's not necessarily the best.

I can come up with a lot of reasons why someone might be driving up in a Lamborghini. The thing that seems consistent in every case is that, “Oh, man. The management just loves this person, trust this person.” I think it's part of the deception going on, as long as they keep management happy, but I don't think that as a human, they have that energy to also keep everyone else happy. The employees usually really hate working with them.

That seems to make sense because they benefit from the trust that they have from the ownership. There's no benefit to the trust of the rank and file.

Correct. Well said.

Is most of it on the smaller businesses, like friends and family are the ones doing the embezzlement? Or it's just across the board?

It's just whoever the owner has decided to trust. Sometimes that's family. I've had plenty that were family. They hire the brother's wife to do bookkeeping—that kind of thing—and she ends up having some sort of issue, and stealing money, and the brother didn't even know. There are plenty of those.

Also, in the case of Bill, he was not related to any of them, but he had worked with them for so long that they just trusted him and adopted him as their son.

He became family.

Yeah. I would say in a lot of these situations, that is the case. That's why the victim feels a lot of stuff after it happens, but just that betrayal of trust. If I had a dollar every time one of the victims said, “They went on vacation with us. They babysat our kids.” Just that betrayal, I think, is just the most emotionally charging through these events.

Ultimately, it sounds like, regardless of how much you like your accountant, if you have a single accountant or even a team, that you really do need to have a process in place to just monitor, not to assume or not that you think that people are doing bad things, but that's just part of, “This is part of my business practice that every couple of months, I do this to check for fraudulent transactions.”

Yes. If it's just standard, like, “This is just what I do. This is what I want to do as the owner.” Because at the end of the day, the owner is the one responsible for anything in those bank accounts, not the employee. The owner is responsible for making payroll at the end of the day. Yes, we can blame the bookkeeper, but at the end of the day, the buck stops with me.

I work my forensics, so that's where that stops. I can't tell you how many times we have people call that are either in a partnership, where a partner controls the money like a business partnership. Or they have a bookkeeper that's an employee that they say, “Yeah, I'm not on the bank accounts; they just always control it, and now I'm asking for the bank accounts and they won't give it to me.” “No, you're the owner. March down to the bank. Show them you're the owner, and get added to this bank account.”

I don't care if this person gets mad. It is your business. We were talking about this this week with a potential client, that you can have someone like us come in. We put together your sourcing use and things like that and identify some anomalies for you. You can do that.

If your bookkeeper gets mad, too bad. It is your right to check in. If you have a weird feeling, don't talk yourself out of it. Just check. That doesn't mean that you don't trust someone.  You're just making sure that everything you've been entrusted with, you're taking good care of.

If you have a weird feeling, don't talk yourself out of it. Just check. That doesn't mean that you don't trust someone. -Leah Wietholter Share on X

Probably even more so if your accountant gets defensive about you getting involved in your finances. That should be a red flag.

Right, and that doesn't necessarily mean that there's fraud, but there's at least negligence. They're just at least not doing their job. We get hired a lot of times when they're like, “They're just being weird, and I just want to check on this.” Then there's nothing there.

They haven't stolen anything, but they weren't doing collections because they just didn't want to call people, and so then they started writing it off. That's why you have no money. That actually happened. Just gut check. If something doesn't feel right, just check. It's your business. You have the right to do that.

I think it's a great place to look at. I do want to ask The Investigation Game. Where can people find that online? Because that seems the thing that families can play at home. It's not just like it's a CFO type of thing that it's whole widely adopted.

Yeah. We have a couple different options. Everything about Workman Forensics, about the Data Sleuth book, about The Investigation Game, about our podcast, is on our website, workmanforensics.com. There's a nice, clean menu up at the top identifying just those things.

We have lots of blog articles with free downloads and resources. We have a really nice YouTube page as well with lots of advice and group playlists, nice playlists, and stuff that, hopefully, people can find what they're looking for.

What's the complete title of the book?

It's called Data Sleuth: Using Data in Forensic Accounting Engagements and Fraud Investigations.

And the target audience is whom?

This was originally written for professionals who either do this kind of work—paralegals, attorneys, private investigators. I walk through the process of how to work a fraud investigation, and I include lots of stories. I think that if anybody's interested in just knowing, “OK, how could I do this in my business?,” you can apply it from this book.

That's awesome. Some entertainment value, but also some education value regardless of where you are on the participation level in this.

Correct, and if you don't really want to understand how the data part works, it's only like three chapters. You can just have somebody else read those parts and then skip over.

Hand that part off to the person you've designated as an investigator and just read the rest yourself.

That's right.

Leah, thank you so much for coming on the podcast today.

Thank you so much for having me.