Reconstructing the crime scene—a case of internal card fraud.

August 18, 2014 Lynn Larson

A Harris County (TX) man used his company credit card to make personal gasoline purchases totaling more than $18,000 per a report by KTRK ABC Eyewitness News. Could this happen to your organization? What were the missing controls? The June 19 news story noted that the man, who was a truck driver for a northwest Harris County company, filled the gas tanks of family and friends between September 2013 and May 2014 in exchange for cash.

Do not become a victim of internal card fraud. Protect your organization by establishing the right controls.

Getting Caught

The man’s boss became suspicious after noticing the average monthly fuel cost increase by as much as $4,000. Then his research revealed purchases of unleaded gas, but the company vehicles use diesel.

Per the 2014 Report to the Nations on Occupational Fraud and Abuse by the Association of Certified Fraud Examiners (ACFE), the median duration—the amount of time from when the fraud commenced until it was detected—for all schemes in their study was 18 months. The man’s boss beat the norm, but we are left wondering whether this was a fluke or the result of controls.

Recommended Controls

Clearly Defined Roles and Responsibilities

Managers fulfilling a reviewer/approver role are the first line of defense for detecting cardholder fraud. They need to understand the importance of the role and exactly what it entails. They should at least be spot-checking cardholders' receipts. It appears the man's boss was not doing so.

Mandated Training Beyond P&P

Do not limit manager training to P-Card policies and procedures. Train them on the red flag behaviors that might indicate fraud. According to the 2014 report by the ACFE, the top four are: living beyond one’s means, financial difficulties, unusually close association with a vendor/customer, and control issues (unwillingness to share duties).

Appropriate Spend Controls

Should the man in question have had lower spend limits? It’s a delicate balance. You do not want overly restrictive spend controls that cause legitimate transactions to be declined. However, you should regularly review the appropriateness of each cardholder’s limits.

Right Type of Card

Did the man have a P-Card or true Fleet Card? A Fleet Card that allows an organization to: 1) limit the gallons of fuel purchased and/or 2) specify the information a cardholder must enter at the point of purchase, such as vehicle mileage, could have helped deter the fraud altogether. See a Fleet Card success story...

Reports for Department Managers (Reviewers/Approvers)

Provide managers with a report of the purchasing history for his or her department, including comparisons between the current month and same month in previous years. This can help a manager more quickly identify out-of-norm spending activity.

In the gasoline fraud case, if the manager was trained to look for monthly fuel costs within a certain dollar range, he might have spotted the fraud even sooner. Also, because fuel costs can fluctuate widely, reporting should include the gallons of gas purchased each month.

Reports for the Program Manager

Each month, the P-Card program management team should be looking at spend by supplier (greatest to least) and by cardholder, comparing to the previous month and YTD. Define parameters for when research is warranted, such as a monthly change up or down by X% or more. Such reports also support your:

card usage goals by highlighting when card spend with a specific supplier suddenly drops (maybe a different payment method was used) and
strategic sourcing efforts (e.g., when YTD spend with a non-contract supplier reaches "X," you pursue a competitive bid)

Proactive data monitoring and analysis was used by only 35% of the victim organizations...

(per the ACFE report)

For more information about controls, visit the related webpage. See also a related blog post about procurement fraud and card misuse.

About the Author

Blog post author Lynn Larson, CPCP, is the founder of Recharged Education. With more than 15 years of Commercial Card experience, her mission is to make industry education readily accessible to all. Learn more…

Subscribe to the Blog

A relabeled fraud triangle targets organizations’ faults.

August 4, 2014 Lynn Larson

Donald Cressey’s “fraud triangle” theory pegs factors that collectively lead someone to commit occupational fraud. We can apply a similar model to an organization’s role in internal card fraud. Do the following characteristics fit your organization? Possessing all three is a sure sign of a weak control environment, but having even just one can increase the risk of fraud.

Ignorance

A lack of education about Commercial Card controls and fraud prevention/detection techniques can cause an organization to focus on the wrong things and overlook others; for example, establishing overly restrictive card controls (spend limits, MCC blocks), but not addressing separation of duties.

Reluctance

Rooted in organization culture, this trait can be exemplified various ways; for example, a reluctance to:

invest the time to learn and follow best practices
believe that long-time, trusted employees can (and do) commit fraud
consistently enforce program policies and procedures, regardless of job level

Comfort

While comfort is typically a good word, it can be problematic if an organization finds comfort in what it has always done, seeing no reason to change. An “implement and forget it” control strategy is never wise. What has worked in the past may prove to be ineffective now or in the future.

Avoiding the Triangle Trap

Hire the right program manager and utilize their expertise. Annually conduct a risk assessment to identify potential control gaps. Evaluate the effectiveness of your controls through audits. Keep pace with the changing nature of fraud.

Dial back your organization’s level of risk by avoiding traits that weaken the control environment.

“Most fraudsters work for their employers for years before they begin to steal. ”

— 2014 Report to the Nations on Occupational Fraud and Abuse by the Association of Certified Fraud Examiners

More Information

For more information on the three elements of Cressey’s fraud triangle (pressure, opportunity and rationalization), refer to the Association of Certified Fraud Examiners (ACFE). Also access their resource referenced above: 2014 Report to the Nations on Occupational Fraud and Abuse.

Next Blog Post

Reconstructing the crime scene—a case of internal card fraud.

About the Author

Subscribe to the Blog

Effectively on-board suppliers to avoid the re-board blues.

July 16, 2014 Lynn Larson

Fasten your seat belts. Convincing suppliers to accept P-Card or enroll in your Virtual Card program can be turbulent at times. To make the journey smoother, think 3-1-1. Three primary activities—preparation, execution and follow-up per each (one) supplier for the desired (one) type of card program, whether P-Card or Virtual Card. However, before going to the supplier level, your organization needs a clear flight plan in the form of a payment strategy that best fits its business and goals. Refer to the previous blog post on regaining a broad perspective.

Ready for Takeoff?

Take off smoothly and stay out of the turbulence with your supplier enrollment campaign.

Within your enrollment strategy, incorporate education for the supplier about the benefits of P-Cards or Virtual Cards and how, exactly, the purchase-to-pay (P2P) process will work. You do not want to on-board a supplier only to have that supplier drop out of the program later because they didn’t understand what it entails. Re-boarding a supplier can be tougher than the initial on-boarding.

Additional Strategies

At the IFO Fusion conference in May, supplier enrollment strategies were shared by Matthew Dragiff, Vice President, Product Development, AvantGard Payment Services, SunGard. His session pertained to Virtual Cards, but his tips also apply to P-Cards:

Understand the supplier/buyer relationship and determine the best approach or tone to take for each supplier. Will you simply offer, strongly encourage or mandate your card program?
Create customized communications (e.g., campaign letters) for each type of tone.
Once a supplier enrolls, do not keep sending a check payment. This is confusing to the supplier (and keeps your program in a holding pattern!).

If a supplier declines participation, document why. Plan to follow up again with the supplier at a designated time (e.g., in nine months) in case something changes. See more on the related webpage.

A Smooth Landing

Adding to Matthew’s tips, I suggest more follow up efforts with enrolled suppliers:

Adjust your AP system/supplier records accordingly to indicate the preferred payment type.
Monitor spend with enrolled suppliers to verify they remain on track. An air pocket drop in monthly spend with a particular supplier could indicate your organization reverted back to another payment method. I learned this lesson firsthand.

The Value of Monitoring Spend

During my time as a program manager, I discovered, through a P-Card spend-by-supplier report, that P-Card volume with a key supplier went from thousands of dollars per month to none. The cause was employee turnover. The new person started using a different P2P process. Her manager did not notice nor did AP, who processed the check request. It required some work to return the supplier to P-Card payments.

Supplier enrollment does not need to be painful, but you do need to prepare for the trip.