special agent andrew pappas
TRANSCRIPT
6/19/19
1
Special Agent Andrew Pappas, CPA, CFE
SBI Financial Crime Investigations
Financial Crimes Case Study
Financial Crimes:– Obtaining Property by False
Pretenses– Identity Theft– Forgeries– Cash structuring
State of North Carolina v. Roger Kornegay
6/19/19
2
3 Vacant, Oceanfront/Ocean view Lots in Topsail Beach & N. Topsail Beach, NC
•3 Valid General Warranty Deeds • 1 Michigan couple• 2 Raleigh couples
• All properties free of debt
• Michigan victim reports to NC Law Enforcement
6/19/19
3
“John Worley” hires local attorneys to prepare new deeds
3 properties conveyed to “John Worley”
6/19/19
4
“John Worley” advertises properties:
Newspaper & Online Advertisements- Raleigh News & Observer- For Sale by Owner Websites
“FSBO – Oceanfront Lot, N. Topsail Beach - $250,000 OBO. Call John 919-
397-7511”
6/19/19
5
June: Raleigh resident buys 1 Lot for $250,000
No RealtorsCash Purchase
Buyer & Seller Not Present at ClosingClaims of Cancer
6/19/19
6
June:$246,894.75 deposited to First
Citizens Bank Account belonging to
“John Worley”
July:$132,934.60 wired to same
account
6/19/19
7
Partnership between financial institutions and law enforcement
– Contact the bank – Provide a search warrant to the
bank– Conduct interview and review
records with bank personnel
Search Warrant for First Citizens Bank Records
Search warrant example
6/19/19
8
6/19/19
9
• John Worley:• Staff Member University of
Mississippi• Ole Miss Police Department
• Advised John Worley was the victim of identity & credit card theft the previous November
6/19/19
10
•Roger Glen Kornegay identified as suspect in Ole Miss/Worley theft
• Also suspect in ID/Credit Card Thefts from:• Mississippi State University• East Carolina University• University of Wilmington, NC• Jacksonville, NC• Lincoln, Nebraska
6/19/19
11
• Interviews w/ Karen Scalf (sister) & Kelvin Kornegay (brother)• Both identify the FCB Photos as
Roger Kornegay• Last known whereabouts McCook,
NE• Fugitive (USM Outstanding
Warrant)
• Interview w/ Lt. Gregory, East Carolina University Police Dept.
• Last known vehicle/stolen identities
• Search Warrant to State Farm Ins.• Arrested in Jacksonville, NC
6/19/19
12
•Assistance from NCDMV License & Theft
•Assistance from Colorado Bureau of Investigation
6/19/19
13
•Vehicle sold to Ben Mendoza•Seller “Kelvin Kornegay”•Purchased home in rural Colorado
using stolen identity•Dating Melanie Berg (Peyton, CO)
•Kornegay Arrest Photos
6/19/19
14
•Kornegay sentenced to Allenwood Federal Correctional Institution in White Deer, PA
•Extradited to NC
•2 Counts of Obtaining Property by False Pretenses > $100,000
•5 Counts of Forgery of Deeds•9 Warrants in other NC
Jurisdictions•Multiple warrants in Mississippi
& Nebraska
• NC Charges:
6/19/19
15
• Pled guilty to 5 counts of Obtaining Property by False Pretenses > $100,000 and Forgery of Deeds
• Active Sentence of 4 to 6 years• Extradited back to Allenwood
Federal Correction Institution
uBank RecordsuPhone TollsuMail CoveruPen RegisteruInformantsuSearch WarrantsuPublic RecordsuDMV RecordsuSAR DatauSocial Media
6/19/19
16
SBI Financial Crime Investigations Unit
• Specialized unit investigating white collar crimes including embezzlement, fraud, and corruption
• Based in Raleigh, Greensboro and Charlotte with statewide jurisdiction
• Special Agent in Charge, Assistant Special Agent in Charge, 5 Special Agents, and 1 Special Investigator
• Requirements for a Special Agent – Bachelor’s degree with 18 hours of accounting and 2 years experience
Aspects of the Job
• Interview victims, witnesses, and suspects• Prepare and execute search warrants• Review financial documentation relating to evidence of a crime and
prepare analysis• Prepare investigative report for the District Attorney, Federal
Prosecutor, Resource Prosecutor, or Special Prosecutions Section. • Testify before grand juries• Arrest suspects• Testify in criminal trials
6/19/19
17
Federal vs. State Prosecution of Financial Crimes• There is a general misconception that it is always preferable to
prosecute a case federally. That might be true in some investigations, such as public corruption and money laundering.
• The biggest advantage of investigating a case federally is the ability to use the federal grand jury to compel testimony and obtain records.
• However, as a general rule, a defendant who embezzles or fraudulently obtains $100,000 or more will receive more prison time in the state system (Class C felony).
Convictions
Berjoe Simplina OccenaW/M/DOB: 08/18/1968
Guilty: 4 counts Embezzlement > $100,000
Sentence: 73-100 months
Summary: Former employee of Mt. Olive Pickle Company
$1 million fraudulent billing scheme
6/19/19
18
Convictions
Laura Marino RiddickW/F/DOB: 11/06/1966
Guilty: 6 counts Embezzlement by Public Official > $100,000
Sentence: 60-84 months
Summary: Former elected Register of Deeds for Wake County
Paid back $926,615
Susan White GarciaW/F/DOB: 02/16/1971
Guilty: 5 counts Embezzlement > $100,000
Sentence: 180-252 months
Summary: Accounts Payable Manager for Big Rock Sports
$5 million scheme using company credit cards
Convictions
6/19/19
19
ConvictionsDana Shane Cope
W/M/DOB: 06/29/1969
Guilty: 2 counts Obtaining Property by False Pretenses > $100,000
Sentence: 58-82 months
Summary: SEANC Executive Director
$500,000 scheme using company credit cards
$165,000 paid back
ConvictionsKelvin Lawrence Ballentine
B/M/DOB: 04/17/1977
Guilty: Obtaining Property by False Pretenses > $100,000; Altering Court Records
Sentence: 44-62 months
Summary: Wake County Clerk’s Office
$961,000 scheme to defraud the Wake County Court System of Bond Forfeiture proceeds
6/19/19
20
Common Factors Involving Embezzlements
• Segregation of duties – limited or nonexistent in most cases• Internal controls – weak internal controls or noncompliance• Length of employment – usually employed for numerous
years• Trusted employee• Personal work habits – works long hours, does not want
assistance, eager to take on new duties, and reluctant to take vacation
Characteristics of Classic Embezzlers
• Usually work their crimes alone• Tend to be compulsive (gambling, abusing alcohol/drugs)• Spend money freely (their own and/or the company’s)• Rationalize their thefts by thinking they are merely
“borrowing”• Tend to repeat and escalate their crime• Exploit weaknesses in internal controls to cover up their
crimes• Have ready access on-the-job to cash or its equivalent
6/19/19
21
Why Do People Embezzle?
• Greed• Addiction
• Substance abuse• Gambling• Shopping
• Extra-marital affair• Low self-esteem• I’ve earned it
Organizational Red Flags
• No Communication of Expectations• Too Much Trust in Key Employees• Lack of Established Policies and Procedures• Lack of Attention to Detail• Changes in Organizational Structure• Tendency Toward Crisis Management
6/19/19
22
Financial Document Red Flags
• Missing Documents• Alteration of Documents• Excessive Number of Voided Documents• Documents Not Numerically Controlled• Questionable Handwriting or Authorization• Duplicate Payments• Unusual Billing Addresses or Arrangements• Address of Employee Same as Vendor• Fraudulent Invoice/Uncommon Vendor
Accountability and Control Red Flags
• Lack of Separation of Duties• Lack of Physical Security and/or Key Control• Weak Links in Chain of Controls and Accountability• Missing Independent Checks on Performance• Lax Management Style• Poor System Design• Inadequate Training
6/19/19
23
Embezzlement by Accounting Supervisor
• Clayton, North Carolina• Manufacturer of electrical products
for large retail construction• 50 Employees
• Business Name YearPCX Corporation 1996-1999Integrated Elec. Svcs. 1999-2002PCX Corporation 2002-Present
PCX Corporation
• Suspect: Karen Lynne Thornton• Accounting Supervisor ($52K a year)• Employee since 1996
• Worked for the 2 previous owners• Most knowledgeable person in the company• Reported directly to company GM
• A/R, A/P, reconciled bank statements, administrative duties, generate checks, access to online banking
• Did not handle deposits or payroll • No signature authority
Embezzlement by Accounting Supervisor
6/19/19
24
• Company Policy: All checks signed by GM• Larger than $5,000 required two signatures
• Thornton authorized to use company BofA Visa debit card for misc. expenses (break room supplies, etc.)
• June 2009: Company initiates 20% across the board pay cut
• September 2009: Outside source contacted company and stated Thornton was stealing from the company
Embezzlement by Accounting Supervisor
• Thornton admits to GM to using the business debit card for personal use (gas, groceries, etc.)
• Owners unable to verify unauthorized use of debit card (commingled personal vs. legitimate use at Wal-mart, Target, etc.)
• No loss can be determined by the company• Thornton terminated October 2009 due to her
admissions, despite being a valued and good employee with strong work performance
Embezzlement by Accounting Supervisor
6/19/19
25
•2 months after Thornton’s termination…
•PCX contacted by Bank of America and informed the business was longer making payments on its credit card• Card established in 1999 in name of PCX
Corporation• Owners of the company had no
knowledge of the BofA credit card
Embezzlement by Accounting Supervisor
• PCX Bank of America Credit Card• Unknown to and Unauthorized by Current
Owners• Established under previous owners (1999).• Credit Card statements sent to business initially,
later directed to Thornton’s home address• Used by Thornton for her personal use:
• Restaurants, Gas, Groceries, Clothes• Household bills, Utilities• Hotels, Vacations, GiftCertificates.com• Cash Advances
Embezzlement by Accounting Supervisor
6/19/19
26
• Initial review of bank statements showed $262,355.50 in unauthorized checks & withdrawals from business checking account
• Applied as payments to the unauthorized Credit Card• Investigation and further review showed an
additional $412,684.45 in unauthorized checks & withdrawals
• Total: $675,039.95 (from 2004 – 2009)
Embezzlement by Accounting Supervisor
• More than $100,000 passed through PayPal• Thornton “loaded” payments to one PayPal account (AOL email) by charging the “PCX” Credit
Card• Transferred the payments to a second PayPal account (Yahoo email)• Subsequently transferred the payments from there to her personal bank account
• False entries made to the company’s computer system to conceal theft
• Unauthorized payments fraudulently coded as if the payment was to a legitimate vender (Gen. Elec, etc.)
• Amounts consistent with normal payments to those vendors• Actual payee on the check/withdrawal was Bank of America
• No one reviewed the bank reconciliations
Embezzlement by Accounting Supervisor
6/19/19
27
Overview of Unauthorized Checks/Drafts from the PCX Corporation Checking Account
March 12, 2004 – September 18, 2009
Victim:
Unauthorized Company Checks
$412,684.45 Payments to unauthorized credit card used by Thornton (Suspect)
Restaurants, Gas, Groceries, Clothes
Household Bills, Utilities
Hotels, Vacations, GiftCertificates.com
Cash Advances
$262,355.50
$119,236.97
AOLPayPal
Yahoo!PayPal
$109,941.82 Transferred into Thornton’s Personal Checking Account
Credit Card Purchases:
Total Amount of Unauthorized Checks/Drafts = $675,039.95
Unauthorized Company
Drafts
• Karen Lynne Thornton, DOB: 6/06/1972
• Pled Guilty – August 2011• 6 felony counts of Obtaining
Property by False Pretenses• Received Active Prison
Sentence of 5 to 6 ½ years
• Paid $75,000 Restitution to PCX Corporation at time of plea
• $300,000 of loss recovered from insurance
Embezzlement by Accounting Supervisor