Back to Fact Sheets

Cash Frauds

What is occupational fraud?

Occupational fraud, or employee fraud, is fraud committed by an employee on an employer. They are more common and cause more financial loss to businesses than other third party frauds. As employees will continue to work at the business, they will generally try to hide these frauds permanently.

What are cash frauds?

Cash frauds are the misappropriation or theft of money in the form of cash or cheques. There are a number of forms of cash frauds, but two common ones are:

1. Skimming schemes (attacking the receipts process); and
2. Billing schemes (attacking the payments process).

These frauds attack the money and the business records at different points in the business system and in different ways. This paper contains details of these common frauds and an explanation of Lapping (one method of hiding skimming frauds).

What are the main differences between these frauds?

All cash frauds result in a loss of funds, but they differ in:

(1) the point in the business system where the money is taken (sales, debtor collection or the payments system); and
(2) what records are manipulated to hide the loss.

Who commits cash frauds?

Anyone with physical access to money can steal it. Employees with different areas of access to the business system may have to conduct the fraud in a particular way. For example, a payments clerk will usually not be able to misappropriate or skim a cash sale, as they would not have access to those monies. A salesperson should not be able to commit a payments fraud for the same reason. Employees will usually commit the types of frauds that attack the area of the business system that they can manipulate.

Theft of Cash

The most basic form of cash loss is a theft without attempting to hide the loss. Cash theft can occur at any point in the business system where cash is received, paid or accessible. The best control is doing as many transactions as possible without cash - limiting access to it. Credit card sales, electronic payments and cheque payments all limit the opportunity to steal cash.

Skimming Schemes

What is skimming?

Skimming is the theft of money (cash or cheques) before it is entered into the business records. The funds are "skimmed from the top" of the sales or collections. Skimming can occur at any point where cash enters the business system, but usually occurs:

1. at the point of a sale;
2. where debtors' receipts are received.

Does the money need to be converted?

Stolen cash does not require conversion to be useable. But skimmed cheques are made payable to the business and need to be cashed or banked (converted) in some useable form. That usually means cashing the cheque without having to deposit it, or endorsing the cheque to another entity and depositing it into a bank account. One solution is to replace cash stolen from another area with the stolen cheque. The banking in the area where the cash was taken will balance and the cheque need not be converted.

What is the difference between skimming sales and debtor's monies?

The main differences are the area where the fraud is done, and the method of hiding the theft. The actual theft is almost identical in both cases.

Skimming Sales

These frauds usually happen at the cash register or other points of sale. A stock item is sold to the customer, but the sale is not recorded and the receipt is stolen. The skimmed sale does not need to be hidden as the monies are stolen before they are recorded. According to the records, that sale never existed.

The only part of the fraud that may need to be hidden is the reduction of the stock - the item handed to the customer. Whether this is necessary will depend on the type of the business and the controls in place. Many business do not conduct regular stock takes, or have a perpetual inventory system. Reductions in stock may not be discovered for some time, if at all, and may not be traceable to any employee.

The full amount of the sale does not need to be skimmed. The sale may be recorded for a lesser amount - with a discount recorded for the difference. The amount of the discount is then skimmed. This variation of the fraud removes the need to hide the loss of the stock item sold as the records show a legitimate sale and the receipt of the recorded money.

Skimming Debtor's Receipts

Skimming of debtors receipts requires a slightly different approach as the sale has already been recorded in the business system. The monies are expected to be received from the debtor, so the theft itself has to be hidden. On the other hand, no loss of stock has to be hidden, as the actual sale was legitimate.

Generally the receipt is stolen before it is recorded, so banking records will not need to be adjusted. The major issue is hiding the missing monies in the debtor's ledger. The fraudster may be able to adjust the debtor's account to record the receipt and hide the fraud.

But if they cannot do so, they will have to hide the theft of the receipt some other way. The stolen monies are not recorded in the debtor's ledger. A receipt must be recorded by the time the next statement is issued to the debtor, or the debtor will ask why their payment is missing from their account.

The fraud can be hidden by a number of methods. The statement can be adjusted by the fraudster before it is sent to the debtor, or, a false statement can be created and sent. These are not permanent fixes. An entry needs to be made in the business records for the fraud to be properly hidden. The common way of covering this problem is by lapping.

Lapping

What is lapping?

Lapping is not a fraud itself. It is a way of using a new fraud to hide an old fraud. One fraud laps over another, just like waves lapping at a beach. If undiscovered, lapped frauds may continue indefinitely, though they do require constant maintenance.

Lapping can be used when the fraudster steals a debtor receipt. The receipt is not recorded against the debtor (if it were, the banking would not match the entries in the ledger). Before the next statement is sent to the debtor, an entry must be made recording the receipt. If the entry is not on the statement, the debtor ask questions and an investigation may begin.

How does lapping work?

Lapping is the committing of further frauds to cover the initial fraud. An amount needs to be credited against the original debtor to hide the theft of their receipt. The money needed to balance against the entry for debtor A is taken from a receipt from debtor B. That is, the monies from debtor B are recorded as being collected from debtor A, not debtor B. That hides the fraud with debtor A, but creates a new fraud with debtor B, and a new problem next month. At that time money from debtor C is used to solve the discrepancy with debtor B, and so on.

As the first fraud is resolved by creating a second, the current fraud is usually fairly new and there is always potential to cover that with another 'lap'.

Billing Schemes

What is a billing scheme?

Billing schemes attack the payments system of a business. All businesses have to pay creditors and the payments have to be authorized and verified, and cheques have to be drawn and signed. A billing fraud is designed to have the business make the fraudulent payment and record the payment as a legitimate expense.

How does a billing scheme work?

A billing scheme is based on the creation of a false invoice, and the authorization and payment of that invoice. All businesses have someone who signs cheques. This is usually a senior manager or the business owner. In some businesses, the person that signs the cheque may not be the person that authorizes or verifies the invoices for payment. Cheques may be drawn and signed based verification given by another employee.

This fraud is generally done by someone who can either authorize invoices or draw and sign cheques, or both. But where the employee who authorizes invoices does not give them due attention (rubber stamps invoices that are placed in front of them) anyone will be able to submit a false invoice and commit the fraud. With reasonable looking document, the invoice will often be authorized for payment.

The false invoice is verified, a cheque is drawn, and the payment is recorded in the records.

Where is the money paid?

The payment has to be made somewhere. The fraudster may create a business name and open a bank account in that name, so the cheques never have to be endorsed before banking. Alternatives are to produce a false invoice from a valid supplier and misdirect the payment before it gets to that supplier, or have the supplier as an accomplice.

Hiding the fraud

Because of the nature of the fraud, it does not need to be hidden. The payment is authorized and recorded in the books as a legitimate expense. The fraud should then remain hidden, unless someone investigates that particular payment.

FOR EXAMPLE

Example One

Mrs H works in the accounts receivable department of ABC company. Part of her responsibilities is to process debtor's monies received and prepare receipts for banking. Debtor P sends in a cheque for payment of their $1,000 debt. Mrs H steals this cheque and does not process the payment. Mrs H has to convert the cheque into cash, and does this by taking cash from the cash sales banking and replaces it with the cheque. The banking for sales equals the sales amount; and the debtor's banking equal the processed debtors. The fraud is hidden for interim period.

One month later, an entry will have to be made into Debtor P's account, or they will ask why their payment was not processed. Mrs H takes a cheque from debtor Q and processes it against debtor P to the amount of $1,000. Debtor P's account is now corrected, but the problem has passed to debtor Q's account. This process is repeated month after month by using lapping techniques.

Example Two

Mr F works for ABC. Part of his duties is to verify invoices that are received from suppliers, authorize them for payment and draw the cheques ready for signing. The cheques are then signed by the boss. Mr F notices that ABC pays amounts to various computer businesses to maintain and service ABC's computer system. Mr F registers a business name called XYZ Computers and opens a bank account. He then creates false invoices from XYZ. Mr F then authorizes the invoices and submits them for payment when the boss is busy, so the invoices are not examined carefully. The cheques are signed and banked into the account and available to Mr F.

LESSONS TO BE LEARNED

1. Cash in any form is vulnerable to fraud whenever it is handled by employees. The two major areas of attack are where cash sales are made or debtor's receipts are collected, but cash can be stolen wherever it is handled.

2. Thefts can be hidden by employees controlling the lapping of a series of frauds. Lapping can continue for extended periods and can eventually be wound down to hide the fraud entirely. Lapping requires constant maintenance and is most commonly uncovered by separating or rotating duties amongst employees.

3. Money may be stolen directly from the business's bank account by submitting false invoices and having those invoices authorized for payment. The payment need not be hidden as the business will consider it a legitimate payment. False invoices are usually created for the supply of services so that there are no goods expected to be received.

Disclaimer
The enclosed information is of necessity a brief overview and it is not intended that readers should rely wholly on the information contained herein. No warranty express or implied is given in respect of the information provided and accordingly no responsibility is taken by Worrells or any member of the firm for any loss resulting from any error or omission contained within this fact sheet.

Acknowledgment
The material in this Fact Sheet was sourced from various publications including those listed in the Reading List on the Fraud Awareness page on this website.

 Back to Fact Sheets

Last Updated: 13.3.2008