3 min
My First Encounter With the Secret Service
By: Daniel Shore
Most AP fraud isn't dramatic. It's slow and quiet. It's a personal electricity bill slipped into a stack of vendor invoices. It's a reimbursement that's a touch too high. It's small enough that nobody looks twice.
But I had one fraud incident that was decidedly different.
When the smoke cleared, two employees were arrested, having stolen several hundred thousand dollars from the company I worked for. And the investigators who showed up weren't from the local police. They weren't even FBI. They were Secret Service.
The investigators who showed up weren't from the local police. They weren't even FBI. They were Secret Service.
Most people don't realize this – I certainly did not – that the Secret Service has jurisdiction over wire fraud, check fraud, and financial crimes that cross state lines. When the scheme unraveled, it was the Secret Service that came knocking on our door.
Here's how it worked.
Most companies have "unclaimed property." This includes checks issued to vendors or employees that were never cashed. After a set period of time, the law requires that money to be turned over to the state. Before that happens, companies try to locate the rightful owners: sending forms, reaching out, giving people a chance to claim what they're owed. If someone responds, companies reissue the check.
Except one employee controlled two things they should never have controlled at the same time.
The first was check reissuance. When an unclaimed property form came back — when someone supposedly responded and said yes, I want my money — this person processed it. Reissued the check. Changed who it was payable to.
The second was positive pay approval. Positive pay is a fraud prevention tool: when your company issues a check, you send a file to the bank listing exactly who it's made out to and for how much. If a check comes through that doesn't match, the bank flags it for your approval. That approval sat with the same person.
So the scheme was sophisticated: Reissue a check made out to a co-conspirator. When the bank flags the name mismatch, approve it yourself. Collect the money. Repeat.
The money was never technically "missing." Every dollar had already been set aside in the books. It was accounted for, waiting to be claimed. When it finally got cashed, nothing in the financials looked unusual. No unexpected expense. No anomaly to trigger a review.
What eventually broke the case? It wasn't a financial discrepancy. It was a rate: The response rate on unclaimed property forms came back unusually high. Too many people were suddenly claiming their money. Luckily, someone noticed and looked more closely. And then everything unraveled.
The AP Worst Practice: One Person, Too Many Keys
We've all heard about the importance of diversification of our financial portfolios. The same goes for segregation of duties. It sounds like compliance jargon, but it's actually critical. It's just like diversifying a portfolio — you don't put all your money into one stock because if it fails, everything fails. Same principle here. You don't put all the keys into one person's hands because if they decide to abuse it, nothing stops them.
The person who can reissue a check should never be the same person who approves a positive pay exception. The person who processes unclaimed property responses should never control the bank approval that follows. These aren't complicated controls. They just require someone to ask: what happens if one person controls this entire chain?
Nobody had asked.
Good controls don't just catch bad actors. They protect good people too — from suspicion, from being set up, from being blamed for something that was never their fault. Safeguards should be designed not for compliance sake, but to assume the process will be abused and prevent that accordingly.
AP Worst Practices is part of an ongoing series from the AP Institute. See all of our content here.