False invoices have been used for many years by employees to misappropriate funds from their employers; and it remains one of the most common types of frauds committed by employees in New Zealand. Despite the fact that it is not a new fraud, false invoicing continues to cost New Zealand businesses thousands of dollars each year.
How do employees commonly use false invoices to perpetrate fraud?
Employees use false invoices to defraud their employers by either:
•Creating an invoice for supposedly legitimate products or services that have never been delivered or carried out, then creating an invoice and submitting it for payment. The employee may work alone or they may work in collusion with a third party. Sometimes the latter occurs in what is known as a “pass-through” fraud - where an employee inserts their own intermediary company between a supplier of legitimate services and their employer. Payments are made for services but the employee’s intermediary company skims a percentage of the transactions.
•Re-submitting a legitimate vendor’s invoice for payment but using a bank account under the employee’s control. To carry out this fraud, the employee usually has to gain access to the employer’s accounting software whereby they are able to change the vendor’s bank account to one under the employee’s control to receive the payment. To avoid detection the employee will then change the bank account number back to the vendor’s once the payment has been made and then pay the legitimate invoice again to the real supplier’s bank account.
Recent media coverage of employees using false invoices to defraud their employers include:
•Jimmy Ming Miu, an IT Manager defrauded his employer, McKay Shipping, of more than $1 million over a 6 year period. Mr Miu raised false invoices for IT equipment from Avanti Systems and Avanti Systems Integration, companies that he had control of. The IT goods were never supplied, not required or hugely overpriced.
•Hemant Kumar Maharaj and Suresh Din, who defrauded the former North Shore City council of more than $829,000 over 10 years. Mr Maharaj was employed by the council and he arranged for Mr Din to submit invoices to him for payment for road and berm maintenance that was never completed. The Council paid the invoices into a bank account controlled by Mr Din, who split the profits with Mr Maharaj.
•Michael Swann and Kerry Harford defrauded the Otago District Health Board of almost $17 million over a six year period. Mr Swann was employed by the Otago DHB as an IT specialist. Through a company set up by Mr Harford, Sonnoford Solutions, Mr Swann invoiced his employer for IT-related services that were never provided.
•Vicky Lee Kyle abused her position as an accounts payable clerk in Hastings by creating and submitting false invoices for payment into her bank account. Ms Kyle had access to her employer’s accounting software, whereby she changed the payment details to her own, once the false invoices had been approved for payment. Ms Kyle defrauded her employer of $660,000 over a 6 year period.
•Colleen Margaret Gray, a 66 year old Principal of Mayfield Primary School in Auckland, defrauded the school of more than $30,000. Mrs Gray raised false invoices in the names of fictitious teachers and the payment was made to companies owned by her husband, Bruce Kenneth Gray.
How to spot a false invoice
False invoicing frauds are not particularly sophisticated but it is difficult to keep them going for a long period of time without detection. When an employee creates a false invoice (as opposed to re-submitting a legitimate invoice), many ‘red flags’ may be present, such as:
•The company name listed on the invoice is not a registered company;
•No physical address is listed (do not solely rely on email addresses);
•The contact information listed on the invoice may not be legitimate. i.e. the PO Box number or telephone number might not actually exist;
•Incorrect/invalid dates may be present, such as 31 February 2013 for example;
•Invalid GST numbers or incorrectly formatted GST numbers;
•The GST value on the invoice may be incorrectly calculated;
•Often a very brief description is listed that is insufficient to adequately detail the goods or services being invoiced, such as “services as requested” or “supply goods as requested”;
•Casual or sloppy grammar, spelling mistakes etc;
•No tax invoice details;
•No remittance details; and
•The invoice is created using Microsoft Word.
It is important to emphasise this this list is not exhaustive, rather it represents the more common attributes of false invoices that were presented by employees in fraud cases that Deloitte has investigated. If 1 or 2 of these attributes alone are present, it may not necessarily mean that the invoice is false, however it would be prudent for the employer to make further enquiries into the legitimacy of the invoice before making payment (such as by checking if the company exists by phoning the contact telephone number listed, or by checking the validity of the GST number; or by requesting further documentation to support the goods or services being invoiced).
Avoid becoming a victim
The best method for an employer to protect themselves against an employee submitting a false invoice for their own financial benefit is to ensure that adequate controls are in place.
Adequate controls, such as requiring a second person to authorise all changes to a vendor’s bank account, requiring adequate supporting documentation for all invoices, or reviewing invoices and making further enquiries if ‘red flags’ are present, will make it harder for the employee to submit false invoices or to alter the vendor’s bank account information. Having adequate controls in place will make it harder for an employee to commit false invoicing frauds against their employees. However, in the same way that you can only deter (and not completely stop) would-be burglars by having prevention mechanisms in place (such as an alarm system), an employee intent on committing fraud may will still find a way in despite having adequate controls in place.
If you would like to discuss false invoicing fraud, other employee frauds, or the controls to prevent employee frauds, please contact Barry Jordan.