Sub Contractor Fraud and the Use of Computer Forensics
McCann EI was contacted after a controller left a mid-sized company and the owner was concerned that embezzlement may have occurred during the tenure of the controller. The business, a commercial cleaner, had employed this controller for the past 15 years and she had access to all company records. Making issues even more complex, the company used hundreds of subcontractors and the controller had been the sole person responsible for subcontractor payments. This risk factor is worthy of note because the potential embezzlement came to light after it was learned that she had an extra-marital relationship with a key subcontractor for the last two years. When the owner looked at the total expense paid to subcontractors, the sub-contractor in question had received an atypical amount of the work and the average price per job was over 50% above the norm.
On the surface, the transactions looked questionable and the rumors of a relationship between the subcontractor and the controller were common knowledge. The controller had recently resigned and was still on talking terms with the owner. The owner had no reason to suspect the former controller. The subcontractor was still working for owner and it was believed that the former controller was now working directly for the subcontractor. The “tip” came from the new controller who noticed the payment discrepancy between the suspect subcontractor and the other subcontractors.
An initial review of the suspect subcontractor revealed a significant increase in jobs and payments in the prior 24 months. The 50% increase in the price per job totaled payments in the amount over $400,000.00. Complicating the issue was that the owner could not “prove” that the controller was involved or that she was guilty of anything beyond poor oversight.
McCann EI was called to examine the former controller’s computer to see if the she had been in communication with the suspect subcontractor. At first pass, the company provided an email program, Microsoft Exchange,that did not show email traffic between her and the known email of the subcontractor. However, upon review of deleted emails and calendar events, it became clear that they had been communicating and that a relationship had begun a few years back.
However, no communication was discovered regarding financial fraud between the parties on the company provided email program. What our investigators discovered was the use of a webmail program (in this case a Yahoo email account) that they had been using to communicate. Upon searching the hard drive of her computer, evidence of this account and details in the subject line were able to show that they had in fact been communicating about financial details.
With the evidence discovered, the client was able to seek civil action against the controller and her subcontractor boyfriend. Banking records showed that in the 36 months in question, the subcontractor had provided the former controller with kick-backs totaling roughly $100,000. This was half the amount of the overcharge to the client. If was only the use of computer forensic investigation that the client was able to obtain the proof of the embezzlement.
Note: The case listed above includes material changes in facts in order to not disclose the parties involved. The case may be a recreation of multiple cases or case studies.
