The Danger of Trusting Too Much

JOE BONK

Henry Olson — Hank, as he was known in the office — was originally assigned to work at Blizzard Insurance through a temp agency to help out during a busy time. Hank worked hard and had a positive attitude, and he seemed to like the work. When a position in the claims department at Blizzard opened up 18 months later, Hank applied for it and was hired. He kept several pictures of his wife and kids on his desk and seemed to be a dedicated family man. When having lunch with coworkers, he spoke of weekend visits to the soccer field or baseball diamond to watch his children play and of the importance of family. Oddly, Hank became quiet when the conversation turned to former jobs. He chastised those who lived in the past and would often say, “The future is so bright, I gotta wear shades!”

Blizzard Insurance had claim offices in many cities, including one in Hank's adopted hometown. With excellent brand recognition and superior customer service, Blizzard was the first choice of many consumers.

I wanted to work for a successful company and Blizzard fit the bill. I was asked to lead the team of ten that monitored payments issued by our claims employees. Given the volume of payments, the enormity of the process was a little overwhelming at first. Fortunately, my team was up to the challenge. The staff members got along well, and everyone readily shared their knowledge; we were always willing to help each other. My subordinates were located all over the country, but we kept in constant contact to share observations and learn from each other. We had different skill sets, which was helpful considering the specialization within the Blizzard Insurance's claims offices.

As I reviewed the processes in place, I was surprised at the manual nature of the monitoring procedures. During our first team meeting, we identified the need to improve our use of technology. We embarked on a long-term strategy to improve our efficiency by leveraging computers to help us identify unusual transactions. The core of this improvement was a database containing all payments issued by our claims department.

Blizzard Insurance's leadership was proud of its employees and trusted them. Management was confident that by identifying and developing good people, Blizzard would continue the legacy of success. I recall one meeting with the claims management team where we provided an assessment of our internal control processes. The report identified a number of weaknesses that could be exploited by our employees, if not addressed. The senior vice president of claims dismissed the report by saying in an offended tone, “Our employees are not stealing from us,” and then he walked out of the meeting. My team's work suggested there were clear signs of trouble, including one case involving almost $100,000. However, many in the organization believed that these were isolated instances rather than a pattern of behavior, and did nothing to address the situation.

A Single Suspicious Check

We had just concluded our weekly staff meeting, and it was almost lunchtime. The cafeteria got crowded at noon so I usually tried to get down by 11:45, right before the rush. I was just about to leave my desk when the phone rang. The call came from Ron, our newest employee. As the person responsible for monitoring one of our fastest-growing markets, Ron had strong knowledge of the claim-handling process but was often surprised by stories told by other analysts who had identified questionable behavior. Ron asked me if we could use our payment database to identify check disbursements containing certain names.

One of Blizzard's claims representatives in his local office had noticed a payment made on a file he was handling, but he had not issued it. The check was made out to Henry or Artie Olson — Artie was our customer, but Henry was not listed on the policy. I hadn't seen payment information like that before, as most of our checks containing two names used the word “and” rather than “or.” Ron told me that Hank Olson was an employee at his office and asked if I could identify all the payments made to him because he was curious to see if this was an isolated instance. I would typically create an ad hoc query, perform a cursory review of the results to ensure that the data I provided were consistent with the request and then send it for a more thorough review. I created a query based on Ron's request but was completely surprised by what I found.

The query identified 40 payments containing the name Henry Olson as a copayee. The other name changed often; there didn't appear to be a pattern to the copayees, but Henry appeared on all 40 checks. There also was no a pattern regarding who issued the checks; I saw at least ten different claims employees issuing them. I noticed something else interesting: The payments were issued for 18 consecutive months and then suddenly stopped. The amount of the disbursed checks exceeded $265,000.

I went to lunch with Rudy, one of the analysts who worked out of the office with me. Rudy had joined our department four years ago. He had a great understanding of technology and was enthusiastic about our work and in making a difference in a very large company. I told him about the case over lunch. We discussed possible explanations for the payments but discounted all but one — that Blizzard Insurance was the victim of an embezzlement scheme. We agreed that the checks to Henry Olson were a concern and felt additional work was needed.

Suspecting there was more to this story, I approached my leadership team. Our vice president, Mike, had joined the company about two years ago, while my immediate boss, Earl, had been with the company much longer. It seemed that everyone at Blizzard knew Earl. While Mike was relatively new to the company, by Blizzard standards, he quickly established an excellent reputation for his objective, firm-but-fair management style. As for Earl's style, he had one rule: Don't do anything to embarrass the department. To me, this meant I had to have facts to support my suspicions before bringing them up. Being almost right was not an option. Both Mike and Earl would provide any support we needed with senior management, but in return we had to ensure that we fully understood the information we analyzed. Based on the information known at the time, both Mike and Earl agreed that additional work was warranted. We had found what we believed to be a significant loss of funds, but we wanted to ensure that the loss wasn't even larger before confronting Hank.

Ron, Rudy and I had a conference call to discuss what we had identified and to develop our plan of action. We took a closer look at the payments made out to Henry Olson and noticed that the “other” payees came from all across the state. We could not identify a pattern in these customers; some had been insured by Blizzard for a long time, while others were not. However, one commonality was that all of the checks containing Henry's name were supplemental payments — that is, an initial disbursement was made to the insured only. The payment made out to “Henry or XXXX” was always made after the claim had seemingly been resolved. Also, none of the claim files mentioned Henry Olson until the payment was made. Next, we analyzed the endorsements and found that all of the checks were endorsed by Henry, never by the other payee. These facts led us to believe that the other person listed on the check most likely had no idea that another check had been issued on the claim. All of the checks were deposited into the same bank account.

It seemed that Henry had identified a significant opportunity and took full advantage of it. But we also wondered why the payments suddenly stopped. Did Henry become concerned that his scheme would be detected? We created a timeline to help us identify key events based on the facts. The payments to Henry had stopped right around the time that Hank was no longer a temp and had become employed by Blizzard. Could there be a connection? Maybe Hank didn't want to risk losing his new job? Or was there another explanation for the change in his strategy?

Climbing the Fraud Ladder

The team went back over the results of our initial investigation and discovered that the scheme was connected to customers who shared Henry's last name. We ran a query to identify the customers in Hank's state with the last name Olson. Every Olson who reported a claim in the 18 months before Hank was hired had a subsequent payment on which Henry was listed as a copayee. Faced with these facts, none of us believed that the embezzlement had simply stopped. Hank's scheme appeared to have resulted in a loss of $265,000 without detection; what would have made him cut off an undetected flow of easy money?

We theorized that, because Hank could only issue checks to himself based on the number of Olson customers who filed claims with Blizzard, perhaps he had grown frustrated with the limitations of his scheme. What if his frustration led him to find another way to embezzle funds? We didn't know what that scheme could be, but we were concerned that the Olson checks were the proverbial tip of the iceberg.

We went back to our timeline and saw that when Hank was hired by Blizzard, he was granted the authority to issue checks for up to $10,000 without needing management approval or a second signature. We created a query to identify all the checks Hank issued after he was hired. The number was significant — he had issued more than 6,000 payments worth more than $12 million since coming on board with Blizzard. Rudy, Ron and I dug into the details to see if there were any red flags lurking in the data.

We also obtained historic organizational charts for the office and noticed that Hank had been asked to serve as a liaison for vendors who provided repair services to our customers. Vendors would forward bills to him for review and payment, as warranted. Therefore, it made sense that he would issue a large number of checks to vendors. I referenced Blizzard's list of approved vendors and saw that Hank had made payments to all of them. In particular, he made a large number of payments to Stars Cleaning, a company that was well respected in the office — it received accolades from our customers for prompt and courteous service. However, in addition to the payments to Stars Cleaning, Hank issued more than 500 payments to Starz Cleaning — with a z, not an s. These might have been typographical errors; after all, the s and z are close to each other on the keyboard.

Rudy and Ron reviewed public records to see if we could find a company named Starz in the area. We checked with state agents, but they did not have a record for incorporation using that name. We checked the Internet for a website but did not find anything. There were no online reviews by customers. Starz appeared to be an anomalous company — there were dozens of firms that provided similar services, and Starz didn't advertise, have a website or register with the state. Despite this, Starz had received more than 500 payments from Blizzard Insurance.

We selected a few of the electronic claim files and dug into them to see if there was an explanation, and again we found a pattern. A customer would report a loss, and a Blizzard claims adjuster would inspect the claim. The customer then received a payment, and the file notes did not indicate that another firm had assisted in the cleanup. The files did not contain references to concerns about the quality of work or customer complaints. Nevertheless, a second payment was then issued to Starz, without an explanation.

In some files, the adjuster handling the claim questioned the Starz payment issued by Hank. The notes indicated that Hank said he had made an error, and the Starz payment belonged to another claim but had been mistakenly applied to the wrong claim. Hank thanked the adjuster for helping him find the payment and promised to move it to the correct file immediately. The adjusters were satisfied with this explanation; after all, mistakes can happen to anyone, and Hank had promised to correct it.

This is where our company's culture of trust worked against us. The staff members thought of each other as family, so the fact that Hank acknowledged his error and said he would fix it was sufficient for most people. However, Hank never moved the payments or offered further explanation. I had a sinking feeling as the pattern repeated itself with each file reviewed.

We discussed the possibility that the other adjusters could be involved in Hank's scheme, but the claims in question involved a wide array of other Blizzard staff members. Our theory was that Hank did not involve others in this scheme but took advantage of his positive reputation in the office to convince his coworkers that he would rectify the problems. The other claim representatives simply trusted Hank to do what he said he was going to do. The customer had been paid and any potential issue was an internal one.

The 500 payments to Starz issued by Hank exceeded $2.4 million, and they were all within a range of $3,000 to $9,900, which is highly unusual. Hank didn't seem interested in wasting his time with checks worth less than $3,000, but he didn't want to issue checks for $10,000 or more because they would require approval from his supervisor.

Next we obtained copies of the checks to Starz and Stars. The payments to Stars were deposited in a local bank account. The payments to Starz went into a different bank — the same account used to deposit the checks made payable to XXXX or Henry Olson. I also noticed that the endorsements on the Stars and Starz checks were different. A stamp with a restrictive endorsement was used by Stars, but Starz had handwritten endorsements. The evidence seemed overwhelming.

Surprise Interview

Our team arrived at Hank's local office to interview him on a Tuesday. Given the magnitude of the suspected embezzlement, Blizzard's leader of corporate security, Scott Walton, was going to conduct the interview. Gina Lon, the regional human resource manager, also attended. Scott and Gina were well versed in our findings and had copies of the checks and file documentation, along with a copy of Hank's personnel file, including his job application and most recent reviews. I accompanied them on the trip to take notes and provide additional insights based on Hank's explanation. We arrived at the office at 7:00 a.m., knowing that most of the staff started at 7:30, and set up in the conference room. Hank arrived at his usual time of 7:45, and his manager asked him to join us in the conference room.

This was the first time Scott, Gina and I had met Hank. He was taller and a bit older than I had imagined. He greeted us in a friendly manner and asked how he could help us. After exchanging the typical pleasantries, Scott told Hank that we were investigating some payments and that we hoped he could help us understand the reason that some checks had been issued. We started by asking Hank to state his full name. Interestingly, he gave us a different middle name from the one on his employment application. When Scott asked Hank to clarify the discrepancy, I noticed Hank's demeanor began to change. He started fidgeting and repeated the question as if he were buying time to formulate a response. Finally, he said he didn't know why his application had a different name.

Scott and Gina confirmed Hank's background and that he had been assigned to work at Blizzard by another company to provide extra help but was hired by Blizzard 18 months later. Gina showed Hank a copy of the code of conduct that each employee signs on an annual basis, and Hank confirmed that he had signed it.

Scott then laid out our concerns about several checks written to Henry Olson, and Hank denied knowledge of them. I was shocked when he continued to feign confusion, even after Scott showed him that all of the checks had ended up in the same bank account. He disputed that the endorsement was his but acknowledged that it was similar to his signature on the code of conduct. The mood in the room had gone from cordial to hostile as Scott referenced claim number after claim number where Henry Olson's name appeared on a check but had no connection to the claim.

Hank asked to take a break. We were somewhat surprised when he returned, given the contentious nature that the interview had taken on. We asked if he was familiar with Starz Cleaning Services, spelled with a z. Hank said he knew of Stars with an s and that it was a well-respected vendor. Scott showed him a check and asked why it was made out to Starz instead of Stars. Hank shrugged dismissively and said he must have made a typo. When Scott pointed out that there was no invoice from Stars in the file, Hank said it must have been misfiled. He stubbornly repeated the same explanation for the next ten checks that Scott showed him.

Finally when Scott showed him evidence that both the Henry Olson and the Starz checks had ended up in the same bank account he used for his paychecks, Hank stared down at the documents in silence. He stopped the charade and did not try to explain or offer excuses. He simply stood up, announced his resignation from the company and left the room. He walked over to his desk to get his car keys and left without saying a word to anyone.

Where Did It Go?

We then contacted the state's Department of Insurance, the Internal Revenue Service Criminal Investigation team, the Federal Bureau of Investigations and the U.S. Postal Inspection Service to discuss the case. Because the computers that processed Hank's illegal disbursements were located in another state, his actions led to federal charges.

During our investigation, we learned that Hank had never been married and did not have any children. The pictures on his desk were not his family; they were just part of his larger plan to earn his coworkers' trust so he could get away with embezzlement. We later learned that Hank used most of the funds he stole to open a nightclub. Rudy and I were curious enough to visit the club (before it was closed) and saw that Blizzard's money had gone to a number of high-end finishes, including a very large mahogany bar.

Faced with the overwhelming evidence, Hank pleaded guilty to one count of conducting a monetary transaction with criminally derived funds. He was sentenced to more than 80 months in prison and was ordered to pay $2.8 million in restitution.

About the Author

Joe Bonk, CFE, is a Certified Public Accountant and has worked on external and internal fraud risk management in various capacities for over 20 years. His work has been used to develop tools that help identify high-risk transactions that warrant further attention.