An inside job

A business can be fatally wounded by fraud committed against it. Many find it surprising that frauds and criminal acts are frequently committed by trusted members of staff, often because of a lack of corporate oversight and the perception that it’s acceptable. However, Adam Bernstein says firms need to take preventative steps

It’s bad enough losing out to theft committed by customers and third-party criminals, but it can leave a particularly nasty taste in the mouth when those most trusted – staff – commit criminal acts against, or in the name of, the business that employs them.

According to Action Fraud, nearly one in five small businesses will have been defrauded at some point in their trading history, sometimes to the point of bringing the business to its knees. The coach sector has not been exempted from criminal activity.

Take the case of Padarn Bus Ltd reported by the Daily Post in March 2016, where two company directors were jailed for a combined eight years for orchestrating a ticketing fraud which saw them pocket around £800,000. John David Hulme was given six years with Darren Price, who informed the authorities of the fraud, given two years and three months. The fraud involved claiming extra concessionary fares and re-claiming more money than was owed.

Hulme started the fraud in July 2011 when Padarn was in a “dire financial situation.” However, in December 2012 he was arrested for an unrelated matter, but the fraud continued because he gave Price’s sister detailed information on how to continue, which was in turn passed on to her brother.

Price continued the scam until January 2014 when he confessed to the company’s accountant. By this time Hulme had dishonestly claimed £495,857 from Gwynedd council with Price claiming £318,798. When the fraud was uncovered the company went into liquidation with debts of £2.3m. [wlm_nonmember][…]

[/wlm_nonmember] [wlm_ismember] More recently, Colin Smart was convicted in February 2018 for stealing more than £700,000 from the Oxford Bus Company (CBW1331), following a Thames Valley Police investigation. Smart was convicted of one count of fraud by abuse of position, one count of theft by employee and one count of concealing or removing criminal property.

He had pleaded guilty to the fraud and theft offences at a previous hearing at Oxford Crown Court in October 2017, and pleaded guilty to the remaining offence in February. He was jailed for a total of four years.

At the time of the offences, Smart was a business analyst at the Oxford Bus Company. Between May 2011 and March 2017, he stole cash to the total value of £723,390 that had been collected from kerbside operators. He was one of the staff responsible for recording the money on to a computer system once it had been counted and manipulated the computer records to conceal the theft.

The money was deposited directly into his personal bank accounts and used for gambling online. His gambling losses outweighed his wins and he continued to fund his lifestyle, including expensive cars, by stealing from the company.

With the coach and bus sector on notice that it is just as vulnerable as other sectors, what steps can it take to protect itself?

What to be aware of

Clearly there are countless different ways that an employee can abuse trust. However, the main forms that firms should watch out for are:

• Procurement fraud: Fraud relating to company purchases of goods, services or works commissioned. Goods are invoiced but not delivered or are subject to inflated prices.
• Travel and subsistence fraud: Where employees claim for, say, food and mileage not incurred, or which is higher than receipts can show.
• Personnel management: Staff on sick leave but moonlighting elsewhere, misuse of company equipment and time for private purposes, or the use of false references and qualifications.
• Exploitation of assets and information: The passing of internal company information for personal gain.
• Payment fraud: The creation of fake accounts and invoices, the redirection of cheques and other payments, or the processing payments to the fraudulent individual.
• Receipt fraud: The theft of inbound monies or where records for monies owed are altered.
• False accounting: Changing records and accounts to misrepresent their true value, to enhance or alter their appearance, to gain funds from a bank, report overly high profits or to hide losses.

Preventative measures

While fraud is an ever-present risk – and a destructive one at that – firms can take preventative measures.

The first step is to proactively check on everyone that is employed by the business, especially where they have access to sensitive systems or the corporate bank account. Quite simply, employers need to know exactly who they are employing. References should be sought and followed up with calls; the matter shouldn’t be dropped until satisfactory answers are received. Everyone from the cleaner to members of the board, as well as contractors, should be subject to background checks.

At the very minimum it’s important to confirm an employee’s identity, date of birth, residential address, qualifications, employment history, criminal history, and financial background. The process can be undertaken as part of the statutory obligation to ensure that an employee has the legal right to work in the UK.

Another option is to ask for a current passport and drivers licence, birth and marriage certificates (if a married woman has changed her name), a recent bank or utility statement, certificates or reference numbers to check on qualifications, past P45 or P60s, as well as data from Disclosure and Barring Service.

Credit agency Experian offers background checks for those in the transport sector to enable employers to check on, for example, qualifications and experience. At the same time, by signing up with one of the credit reference agencies – Experian, Equifax or Callcredit – employers will be able to monitor if employee (or third party) activity has changed the financial status of the business.

Policies

Another large step that a firm can take to protect its position is to engender the ethos that fraud is not tolerated within the business. This starts at the top with everyone being able to see that the management plays by the same rules that employees have to follow. Policies and procedures need to be written, but they also need ‘buy-in’ from employees which requires consultation.

On joining, every employee should be given, among things, an anti-fraud policy. If a fraud should occur and the employee concerned is dismissed, the event and the consequences should be widely communicated to all staff as a deterrent. At the same time, clear opportunities (anonymous if necessary) should be established for concerns to be reported. The key is to remove the belief that criminal actions will go undetected.

It’s interesting to note that the forerunner of the Financial Conduct Authority (FCA), the Financial Services Authority, recommended that firms should protect themselves by requiring staff in financial functions take two weeks off to give the business time to see if any anomalies can be spotted during their absence. The FCA hasn’t gone this far, but its staff handbook alludes to the same.

Control access

As harsh as it sounds, firms need to strictly control access to their premises and systems. As soon as an employee leaves the business, their access to systems should be terminated immediately. Passwords should be changed, passes revoked and possession should be regained of company laptops and mobiles. It doesn’t hurt to regularly change passwords held and used by all employees, either.

Take action

If a faked history or worse, criminality, is suspected, it’s important to take good legal advice with a view to withdrawing any employment offer made (or dismissing the employee). The situation should be reported to the police or, in the case of illegal working, to the UK Border Agency, as well as to the recruitment agency if appropriate. Ignoring the issue will only shuffle the problem to another employer; it could also leave the firm open to claims from future employers who weren’t warned about the ‘rogue’ employee.

Check further

Processes need to be put in place so that no one person has sole control over cash recording or payment systems, chequebooks or the ability to singly authorise purchases over a given (low) value. Invoices should be checked to ensure that they are from genuine suppliers; unexpected requests to change bank accounts should be verified – every time; and suppliers should be informed in writing each time a payment is made.

It’s important to also prevent premium rate and international numbers from being dialled out on company phones (including mobiles). Premium rate fraud – also known as PBX or dial-through fraud – involves out of hours calls being made to particularly expensive numbers. Similarly, phone logs should be regularly checked for increased use or unusual call activity.

Lastly, firms should take steps to destroy any documents with sensitive information that may allow a fraudster to misuse the corporate identity for criminal gain. For paper, this means acquiring a fine cut cross shredder, while for data, firms should securely wipe computers (physically destroying hard drives and USB sticks) while factory resetting mobile devices.

At the same time, time spent signing up on Companies House and other agencies websites seeking out their online protections is worthwhile. Companies House, for example, offers the PROOF scheme in relation to the changing of official corporate details; it helps prevent the hijacking of a company.

To finish

Fraud is an unpleasant fact of life. However, those that make it harder for employees who are criminally minded will be much better off. By removing the opportunity they’ll remove the temptation.
[/wlm_ismember]