Reconstructing the crime scene—a case of internal card fraud.

A Harris County (TX) man used his company credit card to make personal gasoline purchases totaling more than $18,000 per a report by KTRK ABC Eyewitness News. Could this happen to your organization? What were the missing controls? The June 19 news story noted that the man, who was a truck driver for a northwest Harris County company, filled the gas tanks of family and friends between September 2013 and May 2014 in exchange for cash. 

  Do not become a victim of internal card fraud. Protect your organization by establishing the right controls. 

Do not become a victim of internal card fraud. Protect your organization by establishing the right controls. 

Getting Caught

The man’s boss became suspicious after noticing the average monthly fuel cost increase by as much as $4,000. Then his research revealed purchases of unleaded gas, but the company vehicles use diesel.

Per the 2014 Report to the Nations on Occupational Fraud and Abuse by the Association of Certified Fraud Examiners (ACFE), the median duration—the amount of time from when the fraud commenced until it was detected—for all schemes in their study was 18 months. The man’s boss beat the norm, but we are left wondering whether this was a fluke or the result of controls.

Recommended Controls

Clearly Defined Roles and Responsibilities

Managers fulfilling a reviewer/approver role are the first line of defense for detecting cardholder fraud. They need to understand the importance of the role and exactly what it entails. They should at least be spot-checking cardholders' receipts. It appears the man's boss was not doing so.

Mandated Training Beyond P&P

Do not limit manager training to P-Card policies and procedures. Train them on the red flag behaviors that might indicate fraud. According to the 2014 report by the ACFE, the top four are: living beyond one’s means, financial difficulties, unusually close association with a vendor/customer, and control issues (unwillingness to share duties).

Appropriate Spend Controls

Should the man in question have had lower spend limits? It’s a delicate balance. You do not want overly restrictive spend controls that cause legitimate transactions to be declined. However, you should regularly review the appropriateness of each cardholder’s limits.

Right Type of Card

Did the man have a P-Card or true Fleet Card? A Fleet Card that allows an organization to: 1) limit the gallons of fuel purchased and/or 2) specify the information a cardholder must enter at the point of purchase, such as vehicle mileage, could have helped deter the fraud altogether. See a Fleet Card success story...

Reports for Department Managers (Reviewers/Approvers)

Provide managers with a report of the purchasing history for his or her department, including comparisons between the current month and same month in previous years. This can help a manager more quickly identify out-of-norm spending activity.

In the gasoline fraud case, if the manager was trained to look for monthly fuel costs within a certain dollar range, he might have spotted the fraud even sooner. Also, because fuel costs can fluctuate widely, reporting should include the gallons of gas purchased each month.

Reports for the Program Manager

Each month, the P-Card program management team should be looking at spend by supplier (greatest to least) and by cardholder, comparing to the previous month and YTD. Define parameters for when research is warranted, such as a monthly change up or down by X% or more. Such reports also support your:

  • card usage goals by highlighting when card spend with a specific supplier suddenly drops (maybe a different payment method was used) and
  • strategic sourcing efforts (e.g., when YTD spend with a non-contract supplier reaches "X," you pursue a competitive bid)

Proactive data monitoring and analysis was used by only 35% of the victim organizations...

(per the ACFE report)

For more information about controls, visit the related webpage. See also a related blog post about procurement fraud and card misuse.

About the Author

Blog post author Lynn Larson, CPCP, is the founder of Recharged Education. With more than 15 years of Commercial Card experience, her mission is to make industry education readily accessible to all. Learn more

Subscribe to the Blog