In this episode, Toby Mathis, Esq., of Anderson Business Advisors, welcomes David Pelligrinelli, a professional asset recovery expert from ActiveIntel. They dive deep into the alarming reality of employee theft and embezzlement in businesses of all sizes. David explains the “fraud triangle” concept—opportunity, pressure, and justification—that enables employee theft, sharing real-world examples of trusted employees who stole hundreds of thousands of dollars from their employers. They discuss essential prevention strategies like having owners open all financial mail, requiring employees to take vacations so others can review their work, and implementing proper checks and balances. The conversation reveals sophisticated theft techniques, including ghost vendor schemes and credit card fraud, while emphasizing that even trusted employees can succumb to temptation when proper controls aren’t in place. David also shares fascinating stories about asset recovery investigations and explains how counter-investigation tactics can help those being investigated unfairly.
Highlights/Topics:
- Introduction to employee theft and embezzlement as a common business problem
- The “fraud triangle” concept: opportunity, pressure, and justification
- Best practices for preventing employee theft (opening mail, mandatory vacations)
- Ghost vendor schemes and sophisticated theft techniques
- Long-term financial impact of embezzlement on business profitability
- Examples of elaborate asset concealment by debtors
- Employee dishonesty insurance coverage options
- Counter-investigation tactics and illegal investigation methods
- Share this with business owners you know
Resources:
Email: [email protected]
Schedule Your FREE Consultation
Tax and Asset Protection Events
Full Episode Transcript:
Toby: Hey, guys. Toby Mathis here, and today we have a treat. This is one of my most interesting topics, and that is how to keep from getting ripped off by your employees. I’m going to call it how to stop employee theft and embezzlement in your business. Let’s just be real. It’s how we don’t get absolutely fleeced. Just had another client who lost over $800,000 due to unscrupulous accountants and bookkeepers in their business. I’m bringing on an expert, David Pelligrinelli.
David: Exactly. Correct. First try. Nice job.
Toby: What we’ve worked together in the past, and David is an expert in finding assets. I use him because he does just deep dive asset searches. I’m using him on an estate right now, just full disclaimer. I was like, he’s telling me some of his stories. I’m like, we got to put this in a YouTube and share it so people understand how common it is and how easy it is for employees to rip you off and how you can prevent it. First off, welcome, David.
David: Yeah. Glad to be here, Toby. Appreciate it. Hopefully you’re having a good morning.
Toby: Yeah, it’s always a good morning, especially when we get to talk about some of these stories. We’ve all heard of somebody, they got us for a million bucks, they got us for a hundred thousand, so and so, ripped off their employee. They were using the company credit card. What’s the reality? What are some rules of thumb that an employer can use to keep from getting ripped off? I’m sure this applies to all of us that we can use, even if we don’t have our own business. Just regular things that we can do so that we don’t get fleeced by someone who decides they’re going to steal our money.
David: Yeah. As an employer, as a business owner, large or small, you’re in a rare position of being probably the most highly capitalized, rich, or wealthy, whatever you want to call it, person or place that an employee knows about. They go to work every day. That’s the Fort Knox for them. It’s where all the money is. That’s where their payroll comes from, it’s where their income comes from.
They see numbers and income that’s bigger than numbers than they see anywhere else. Even if they’re a manager of a department, they see numbers flowing into their department, hundreds of thousands or millions of dollars. Even if they make a hundred thousand a year, it’s a multiple factor of what their income is. Sometimes it’s very tempting, especially when somebody has something in their life where they need money or they’re just greedy. Sometimes that’s why an employee will be tempted to look at it as a piggy bank and look to find ways to embezzle, steal, rob from the employer.
Toby: What are the rules of thumb? I actually clerked first, several different judges. I remember Microsoft, a case where they had, members of their accounting team had gotten seven figures. Nestle had one that was pretty massive. These were 30 years ago. I still remember going, whoa, these are great organizations with all sorts of safeguards, and somebody got them.
Over the years, I always tell people, it’s not the employees stealing, it’s just a matter of degree and whether you’re catching it. If you’re talking to a business owner, how are you going to explain it to them, and what are the things that they can do to stop this from happening?
David: Yeah, and that’s a good point. Any one of the frauds that you see in the news, big company, small company, government agency, even, 99% of the time, if you read the story, we can look back and see if a best practice, very simple best practice was used by that organization, it would not have happened. There are things that every company should be doing.
In fact, most of them are things that company probably intended to be doing to prevent fraud and whatever reason it didn’t happen. The reason why is first, let’s take a look at the reason these things happen, and it’s called what’s known as the Fraud Triangle. The fraud triangle is a convergence of three elements that a thief has to have in their life in order to steal money. It has to be the known or perceived opportunity to take the money. It has to be the financial pressure or some type of motivation to do it, and it has to be a justification. Let’s take a perfect example.
A bookkeeper in a company. This is a true story. We had an owner of a company come to us and say, look, our numbers are off, our KPIs don’t add up, our cost of sale’s too high. Just something’s wrong, we don’t know where it is. We did the investigation. What we found was, a bookkeeper was stealing money. How did they do it? They were using a company credit card to put personal expenses, and they got away with it.
How did this happen? We interviewed this person, the Fraud Triangle was in full effect. What had happened was this person had taken their credit card and went to the gas station to put gas in their car on the way home from work.
Once they got home, they realized they didn’t use their personal credit card. They had accidentally put the company credit card and the gas pump. They didn’t realize it at the time. They weren’t intending to steal. They were scared to death. She was petrified. She went back to work. She was so scared she didn’t say anything. She didn’t do anything.
A few weeks go by, the credit card bill comes in. She realizes she’s the only one that looks at it. Nobody else verifies it, so she didn’t say anything, but she didn’t steal more for months. Six months later, one of her children had a medical event where there was financial pressure in that family. They needed money for this hospital bill. She still didn’t steal even with the pressure because the third leg of that financial fraud triangle hadn’t kicked in yet, and that is justification. A person either has to invent, perceive, or be really affected by the justification saying, it’s okay for me to do this because of.
In her case, another employee in the company got a raise more than her and she felt she was entitled to the same money. She felt, well, it’s okay for me to steal because I’ve been passed over. Those are the three legs of the Fraud Triangle. In any theft, even Ponzi schemes, the person will have to have all those. The financial pressure, sometimes it’s just greed. They don’t have a debt, they just are greedy people. It has to have the ability to take the money, which sometimes people don’t even realize.
There has to be that justification. They can morally justify in terms of, the boss treated me badly, they were mean to me, the boss’ sleeping with a coworker and they get benefit, whatever the case is. Those are the three elements. If you eliminate any one of those, you can prevent 99% of the frauds from happening.
Toby: Sometimes the owner is a little bit absent-minded. Sometimes they’re just leaving the door open and the justification can be, well, they’re just dumb. They’re not putting checks in place. They should be punished. You can conjure this stuff up.
David: Yeah. It’s not so much dumb. A lot of times there’s efficiency, expediency in your daily workflow. The other thing is the person who steals is almost always a trusted employee. Every time we go to a CEO or CFO and say, here’s who’s stealing, here’s how much they stole, the first thing outta their mouth is always, impossible, it never could be that person, it was definitely not them, you’re mistaken, because they trusted that person. That’s part of the reason that it happens because you trust them and you stop doing the checks and balances.
For example, two best practices that can eliminate a large percentage of fraud in the company is, the owner should open all the financial mail, bank statements, credit card statements, loan statements. The owner should open it. The owner doesn’t want to open mail. They think that’s below their pay grade. But if you open it and look at it, even if you don’t even look at it, open it, take it out, put it back, and then hand it to the accountant, the accountant’s going to realize that they’re being overseen. Even if you really don’t look at it, it’s just perception.
The other best practice in many organizations, CFO, bookkeeper, accountant, whatever you have, everybody has to take a week of vacation, and somebody else has to do your job for that week or two weeks so that somebody else is looking at the books. Even if it’s just honest mistakes or errors, that’s the way to catch it because if you have a bookkeeper that never has anybody else doing their job, you’re going to have the temptation of them to say, I’m just going to do whatever I want.
Toby: We just had that, a major amount of embezzlement. It was because the girl that was doing it took a two-week vacation, somebody came in, and the numbers didn’t add up.
David: Yup. A lot of times, people who are stealing will be hesitant to actually take vacation. They say, no, I’m a dedicated employee, I don’t want to go on vacation, I’m going to stay here. That’s the reason why because they know that they’re going to be found out.
Toby: I’ve had experience with this with so many different clients. I always say that the check writer can’t be the bean counter. One of the things that gets people over and over again is you have the person who’s doing the accounting, just like your example. She’s the only one who knew, and that’s a lot of temptation. That’s like leaving your wallet on a sidewalk. In a perfect world, nobody would bend down, pick it up, and steal it. Maybe they’d pick it up, look it up, and bring it back to you and find your address. But if somebody has that temptation, you’re really leaving yourself exposed.
We’ve seen not just that, but I’ve seen it where they set up fake companies, and they would pay invoices. They’d do all sorts of this stuff. You had to have seen a ton of this. Can you give us some fun stories that you’ve seen?
David: Yeah. That whole fake company, we call it ghost vendors, where a smart, thief, embezzler will create a corporation that will be similar sounding in name to one of the actual vendors. We had a company that was a paint company that did commercial painting of commercial properties. They had three or four different paint suppliers they bought from. They’ve created a corporation that was very similar name to one of their legitimate suppliers. They would make up fake invoices that they would submit, and they would be the ones that would approve it.
In some cases, even another employee would approve it, but it looks right. The invoice looks like a company they’re familiar with. They sign off on the invoice, and they were stealing money. Now, here’s the thing, over the course of four years, they stole about $380,000. This was a $5 or $6 million company, so it was a significant amount but not a deal breaker. However, if you think about it, most companies operate on about a 20% to 30% profit margin, net profit. If you take away $300,000, that might be a third of your net profit or a half of it. Even if it wasn’t, think about what that company could have done with that money, invested in new equipment, employees, facilities, whatever. It’s more than just a loss of the money.
More importantly, if you leave that temptation open, even a normally honest person might eventually slip and fall into that temptation. You’re actually protecting more than your money. You’re protecting the integrity of that employee and the value of that employee. Usually when we tell a business owner, this employee’s a thief, they’re going to say, well, the hardest part is going to be replacing the person. The money is part of it, but that person’s a key person in the company.
Toby: You let them down the path of temptation sometimes.
David: Yeah. To finish that story, and I know you wanted to hear this, they had set up this fake company. They sent invoices. They deposited them into this corporate account. The way it was found is the address they use for that corporate registered agent was the same address that was on their payroll record. By cross-referencing it, it could be discovered. That’s another best practice, verify your vendor addresses versus your employee addresses. It even goes so far to maybe cross-reference with relatives of employees to see if they put it in their cousin’s name.
Toby: We get something else down here. I’m in Vegas. It wasn’t uncommon for people to write checks, and they would put a vendor name in QuickBooks or whatnot, but then the check was actually cash, or they would go and they would cash it at the casino. You could tell by, we would get the actual canceled check and look for driver’s license numbers on the back of it. If you see a driver’s license instead of a deposit, you’re always like, is somebody’s cashing it? It’s just silly.
I remember doing due diligence on a company that we were acquiring, and we found all these $500 checks. We’re like, there’s no such thing as a vendor like Comp USA charging us $500. There’s no way it’s an even number. You start pulling the checks. Lo and behold, they’re all cashed in the same driver’s license and the same name on the back, and it was one of the executives. It’s silly stuff like that, and you’d think you’re going to get caught. That went on for years before they got caught.
David: That’s a good point. A lot of times the thief won’t start right away. You say, well, leaving your wall on the sidewalk. The difference is the employee is somebody who’s a trusted person. They might value their job. Even if they have the opportunity, they find a wallet in the break room, they might not steal right away because they value their job, but over time they’re going to get comfortable. They’re going to see that you’re maybe getting sloppy. You’re not checking these things.
If you’re not checking them, they’re not going to look at it like you don’t trust some. They’re going to say, you’re not running a tight ship. Even if you have a valued, trusted employee, if you very reasonably and rationally say, look, we’re double checking your work, a good employee won’t take that personally as long as you do it in a respectful manner. That will keep them honest, it will keep them as a good employee, and it will keep you from losing a lot of money.
Toby: I’m going to say this to the folks that are watching. What are your crazy cases? I’m sure that if this video caught your attention, you’re probably like, I’ve seen some of this stuff. What are your crazy cases? Put them in the comments down below. I’m curious. David here is a professional asset recovery person. You do all the private investigating reports. That’s what your company does. What’s some other ones you’ve seen where you were like, that was pretty good, but we got you?
David: When it comes to assets, and this is less to do with corporate embezzlement but hidden assets. We’ve seen some very clever techniques used. This is why you can’t just use a database or just plug in numbers to find assets. We had a debtor, and both of these stories are debtors who are claiming poverty, claiming they don’t have any money to satisfy judgment. We were going through bank statements. It’s very tedious, it’s very boring work, and it’s related to something you said with an even number.
The person didn’t have a lot of money in their bank account, but we looked at every line item on their debit card and find out what it was. It was a line item for $32, even, at some store. They had a name like a marine sounding name. This is a state that had sales tax, so it’s very difficult to have something an even amount. We had one of our investigators contact that vendor and it was a store. It was a store in a marina, a boat marina in Florida.
We had the person look up the invoice. It was for a single bolt for $32. How is a bolt cost $32? It’s a clevis bolt. This clevis bolt was as big as my hand, as big as my forearm. What does it use for? Either large sailboats or yachts. Can you find out where this went to? Yeah. We put this slip number on the receipt because it was no tax, because it was part of the rental of the slip. There’s a yacht at this slip. That doesn’t prove that this debtor owned the yacht. Maybe it’s his buddies, and he bought them a bolt to help him out.
We did some more research, and we found the closing statement of that yacht in The Bahamas. We looked at the closing statement. The money was wire transferred. The wiring instructions came from an account in Colorado from the law firm that represented the debtor. We traced it back, and now we go back to the attorney we were working for. It goes back to that debtor and says, look, you signed a debtor’s examination saying you have no assets. We can prove that you have this yacht in your name. Either voluntarily give the money or we’ll give records to the court that you lied and also look to seize the yacht.
You have to go through and look at every little needle in a haystack, uncover stones to get it. That goes to your point of if you want to protect the assets and protect your privacy, think of all the ways that those records can leak out from privacy by a very small record. We had a guy that got caught because he had a Rolex that he was hiding from a bankruptcy trustee, a hundred thousand Rolex. He brought it to a repair shop to have it repaired under warranty, and that record now was public.
Toby: Boom. Now you can get it. It’s always the little minutia. This is going to cause everybody that’s out there trying to stay private doing illegal. There’s a way if they target you, and there’s a way if you know. Yes. Chances are that if they spend enough resources, they’re going to unravel something. The trick is they never see it in the first place.
Where that guy made his mistake was he was in a debtor’s exam. He should have done everything he could have not to be in a debtor’s exam. He should have settled his debts. He is not sitting there disclosing everything where then somebody who’s smart, like David here, could put his team on it and actually say, aha, you know, here’s the bolt, and now we tie it to an asset, and we can tie you to that asset, now we can show. Again, there’s also techniques that you can use to make it to where even if they do see it, they still can’t touch it.
David: Toby, I like something you said a few days ago when we were talking offline. Don’t get lazy, and make it hard for somebody to breach the privacy. Make it more expensive, more trouble than it’s worth. If somebody really wanted to find anything out, they could. If there was an axe murderer or terrorist, the federal government could put enough resources to find anything.
They could find fingernail you dropped on the sidewalk, but a normal civil, private sector research investigation is only going to go so far in research. If you want to value your privacy, you raise the threshold of cost, expense, time, and trouble so that it’s not worth it for them to breach your privacy. I thought that was a really good strategy that you described.
Toby: I appreciate that. We’ve seen it in practice. At the end of the day, you want to settle and get on with your life. You don’t want to be in protracted litigation of four or five years. I imagine that in just about every case, there was that opportunity for people. We’re talking about employees stealing and embezzling. There’s not going to be much. I remember having one where a gentleman was crediting back on a credit card. It was very difficult to figure out whose credit card it was. The company could see what was happening, and it happened over a long period of time.
David: Was it the same credit card every time?
Toby: It was six different credit cards.
David: Rotating, yup.
Toby: They were doing small amounts, and the accountants were looking at the reconciliation of the merchant account saying, oh, it’s pretty close. It’s off by a few hundred bucks. Okay, millions of dollars are flowing through. They’re like, maybe it’s a rounding error. They just weren’t being very precise. It wasn’t huge, but over a two year period, it was over a hundred grand.
It was just a little bit every day. They were constantly doing it. Once you could figure out the credit card, you couldn’t figure out a name on it. Most you could do is stop it, but it doesn’t solve the issue. We were able to figure out who it was through some other means. I don’t know exactly. Whenever you’re using private investigators, they’re just digging. They’re digging. I don’t know how they found it, but we found it was one individual.
The interesting thing was, it was the loss of that person. It was a trusted individual. The individual had the records and then it was, I want my money back. The businesses a lot of times are like, how do I do as little harm as possible? I need to keep operating. How do I get my money back? Sometimes they can’t. In this case, we got a hundred percent recovery because there’s the threat of jail time and doing things like that.
They had a gambling problem. They knew they had a problem. They’d already talked to their family. Their family stepped in. As soon as we caught them, it was like, here’s the money, we’ll pay back every nickel. They had an accounting, it matched. The guy didn’t do any time, probably should have but didn’t.
David: Another factor is if you’re a business owner, sometimes you don’t want to prosecute because it can create liability for your insurance. It can create liability for confidence in clients, confidence in other employees. Sometimes they’ll say, I don’t want to prosecute. They just want either the money back or some restitution. It’s a tricky thing, and that’s where it’s a business decision for that business owner.
Toby: You can insure for this, by the way, guys. You can get employee dishonesty. A lot of people don’t realize that there are policies out there. I would suggest that if you’re a business owner that you do. I’ve seen some pretty sad stories where one individual, he had key fobs, two accounts, key fobs. Employees set up a separate account. I would call him up to pretend like she was using the key fob to do a transaction, so he would see a wire or whatnot or a transfer.
She was just placating him. She had another account where everything was going, so he always thought he was in control of the account. One day he goes to access the account and there’s no money in it, and it should have had seven figures in it. She had depleted the entire account over that period of time because he thought he was in control simply because he had the key fob, and she could not do things.
Hey, I’m going to move $25,000, I’m going to pay this, or I’m going to do this transfer. He’d be like, okay, then how much is left in the account? We got $973,000. Okay, cool. He wasn’t checking it. It goes back to what you were saying. He wasn’t looking at the statements. By the time he caught on, it was empty. She had taken everything, and it was devastating to the company. They had bills, they had all sorts, he had taxes out.
David: Payroll, yup. It’s a big deal.
Toby: You have all this stuff, and it doesn’t get you off the hook just because somebody ripped you off. It could be fraudsters, it could be people putting these horrible computer programs on and extorting you, all those things. It’s still your responsibility to pay your payroll, it’s still your responsibility to pay your taxes.
David: That employee dishonesty is a good type of coverage you have in addition to being an investigator. I’m also a commercial insurance producer, so we do a lot of commercial insurance. That coverage is good, but you have to be very diligent on reporting. If you are aware of a condition that could let that happen, you have to report it early, otherwise your coverage may be invalidated.
Toby: The insurance company can require that you do things too. If it’s cybersecurity, they’re going to say, well, you have to take this course and this course. They’re not just going to pay it and say, you can go back to doing things in improper way or a way that leaves you exposed. They’re going to say, we’re going to close that door and we’ll cover it.
David: Make sure too, if you are a business owner and you have commercial insurance of any type, you may have a cyber coverage as an endorsement on your policy, but that’s a completely different type of coverage than a standalone cyber insurance policy. A standalone cyber policy is really good. It’ll give you active monitoring of your networks and a response team to where if you do have a breach, they’ll step in.
I also want to jump to one other subject too. It seems like your viewers on your channel are interested in privacy, protection, and ways that people will try to find things out about them. Another area of interest is counter investigation. What I mean by that is sometimes if a client of yours or one of your viewers is investigated and they find assets, it’s very likely that the method that the other person used to find the assets was illegal. Finding assets falls under a federal statute called the Gramm-Leach-Bliley Act. If the investigator or the person doing it breaches that law, first of all, the findings are not usable, and they could be subject to sanctions.
I’ll give you a good example. We tell all of our clients, all the attorneys we work for, if you’re in a lawsuit and we’re doing a search for you, tell your client to be on the lookout for certain activities, anything weird happening with your phone, your mail, your computer. We had a client come to us and said, look, I got this weird letter in the mail. They held up an envelope and it was a check. They got a check in the mail for $10 from the American rebate company with a letter saying, thanks for buying American, here’s a rebate check, our thanks for doing business with us. It was designed for them to sign it, deposit it in their account so that the other person could find out where they were banking. They would get the endorsement. That is illegal.
Even though it seems like it’s perfectly legitimate, Gramm-Leach-Bliley Act says you can’t make up any fake stories to get private information like a bank account. You can get bank accounts certain ways, but that one is not one of them. Many investigators don’t know that that’s illegal. That’s a very clear violation.
We did some tracing on the check where the account was from, traced back to California, but the PO box was registered to a private investigator in Miami, which is where the other party was. That investigator had been an expert witness for the attorney representing the other side. When it was presented, they had to basically pay attorney’s fees, they had to waive a lot of their discovery, and they settled the case because they had done that one small little thing. To be fair, the investigator didn’t know it was illegal. I believe him.
Toby: I didn’t know that was illegal. I’ve known people that have done that, in fact.
David: It’s an old school trick. It was popular in the seventies, eighties, nineties, but the GLB was updated in 1998 and it made that very specifically illegal.
Toby: He could have done it if he had said, hey, I would like you to send me some records. I’m going to send you a check to cover the FedEx because I’d like you to overnight it as opposed to do a US post.
David: Exactly because that’s a real story. You didn’t make up something fake. Yup. It’s a very small thing. Another one that people do is they’ll be a fake delivery driver and go to someone’s house. Hey, I have this package for you. To see in the house or to get somebody’s signature, if you make up something fake, it’s called pretexting, to get private information. That’s a crime. If you do pretexting to get something that’s public, just an easier way, that’s a different story. You have to be very careful and you have to know the ins and outs of GLB, the Fair Credit Reporting Act, all the different regulations at the state and federal level. Otherwise, it could blow your whole case out of the water.
Toby: I had no idea that that was a thing. That’s really interesting. If you’re out there and you’re being investigated, maybe you have an ex-spouse or something that’s just constantly harassing you, maybe it’s time that you reach out to David.
David: Find out what they’re doing because most of the time they’re doing at least one thing wrong.
Toby: What’s the remedy? It’s a pretty hard slap?
David: It depends. The client or their attorney would have to make a request or a petition to the court for sanctions, attorney’s fees, or to pay back your fees. At that point, now the court is going to start taking sides. Hey, you’re doing stuff that’s shady. Maybe now they’ll allow you to get more discovery or maybe waive some of the records that they already received. It’s subjective, but you can at least ask for a lot of stuff then.
Toby: That’s pretty wild. I had no idea that was rolling around out there. All right, we’re at about time. Why don’t we do this? David, I’ll put your contact information down below if somebody wants to reach out to you. I’ll say I’ve used David on multiple occasions for asset searches. I’m using him right now on an estate because the decedent, we don’t know everything that he has. I’m responsible for marshaling all the assets, so I’m like, hey, let’s go find anything and everything and make sure we have all the titled assets, do a deep dive, and make sure we know where all the accounts are. Of course, if you document that stuff for your errors, it’s a lot easier, but not everybody does it.
Also, if you’re trying to collect against somebody or if you just feel like it and you say, hey, you know what, I want a deep dive done on me to see what’s out there in the public, reach out to David and use them. David, I really appreciated having you. I love having expert scenarios come in. That’s helpful, some crazy stories. Like I said, like and subscribe, guys. Put your story down below in the comments. Love to hear them.
