Last time around, we talked about how to organize financial data for an investigation. Let’s take those techniques and apply them to a specific type of investigation: embezzlement.

Embezzlement: How It Works

For our purposes, we are going to refer to embezzlement as a financial crime where somebody internal to an organization misappropriates money or goods that are entrusted in their care. That trust is what makes it such a unique monster.

Whereas the trust earned by your run-of-the-mill con man is tenuous and limited, many embezzlers are integral members of the organizations they steal from. The trust that the victim places in them is often absolute. Because of that, the monetary loss from these crimes tends to be very high and the emotional devastation rivals it. These are business crimes, but the emotions are very personal.

Accounting System vs. Bank Statements

In order for an embezzlement scheme to last for any length of time without being detected, there has to be some scheme to conceal it. That scheme typically involves manipulation of the accounting system. That’s the reason most embezzlers tend to be bookkeepers, managers, night-auditors, or somebody else with knowledge of and access to the accounting system.

At a later date, I will give you a crash course on accounting concepts for criminal investigations. But for today we are going to skip the accounting system and jump right to the bank statements.

Because bank statements are prepared by an uninvolved third party, they aren’t subject to manipulation like the accounting system is. And with sufficient cause and a court order you can get them without your suspect’s knowledge, giving you time to develop a case without interference from a desperate crook.

What You Need

For starters, you are going to need bank statements and copies of the fronts and backs of checks from all of your victim’s banks. You will also need statements from any credit cards, lines of credit, loans, or other credit accounts in their name. Since the victim most likely reported the crime, those records shouldn’t be hard to acquire.

Don’t rely on those records alone, if you can help it. Your suspect might have discarded anything incriminating from those records. If your victim will consent, get the records directly from the financial institutions they use.

Next, you are going to need the same records from your suspect. You can ask for their consent, but you will lose the element of surprise and they have the right to refuse. I suggest you examine the victim’s bank records first and see if they contain enough probable cause to subpoena or search warrant your suspect’s records. If there is embezzlement going on, most of the time you will find probable cause in the victim’s records.

Finding the Fraud

Since you learned last month how to enter all of that data into an Excel table, the next step is easy. Start combing through that data to find suspicious transactions. I like to start with the payee column.

In the bottom right corner of all of the header cells, there is a little arrow. Click on it, and you can filter that column down to only the information you want to see. Notice that the arrow in the Payee cell above has a weird funnel looking thing beside it? That’s because I filtered down to only transactions where MGM Grand Casino was the payee. That funnel shows up in the header of every column you have filtered.

Comb through the table to identify transactions that you will follow up on later. Credit card payments, mortgage payments, cash, casinos, bars, strip clubs, drug dealers, politicians—whatever seedy transaction you see that seems outside the scope of the business’ normal operations is worth following up on. Also use the Control + F keys to bring up a search box, and search for payments made to your suspect or their associates.

It can also be helpful to filter down the Amount column to search for even numbered transactions. Embezzlers don’t like math any more than we do, so you will often find your probable cause in the form of transactions that end in a lot of zeroes.

Lastly, you can change the format of the date column to show the specific day of the week. If your victim is a Monday through Friday company, it can be very interesting to see the electronic transactions that happen on Saturday or after hours.

The Next Steps

If there is embezzlement going on, the above analysis should have shaken loose a lot of evidence. Go back and review the source documents (checks, deposit slips, etc.) for all of the suspicious transactions you identified.

If any of those suspicious transactions can be traced to your suspect, you likely now have probable cause to get their financial records. As you will see when we get to it in a later column, once you have a suspect’s financial records you have their backside as well. A criminal who banks is a criminal who will get caught.

Happy hunting, until next time.