The Paper Chase

By By James D. Quickstad, CPP

In 1992, the CEO of a California electronics manufacturer noticed that payments were being made to a consulting firm whose name he did not recognize. When the firm was investigated, security found a post office box, but no evidence of a legitimate business. Company officials suspected one of their own accountants of taking the money.

Through interviews with the accountant's business associates, investigators learned that he had taken several scuba diving trips to the Caribbean over the past year. On further review, security personnel discovered that the employee owned a condominium and had thousands of dollars in several bank accounts in the Caribbean. They asked the U.S. Customs Service for help.

During one of the accountant's subsequent trips to the Caribbean, Customs officials examined his scuba tanks and found one filled with $25,000 in cash. As it turned out, the employee had stolen an estimated $270,000 over eighteen months by making unauthorized payments to the bogus consulting firm and then cashing the checks himself.

The company recouped some of its losses by seizing and selling the $125,000 condominium. The money kept in the bank was more difficult to recover since several other creditors were claiming the funds.

The key to this case, as in most financial investigations, was the money trail. In following the money, the investigator should look for clues to misconduct, such as inconsistencies in the relationship of one type of business transaction to another. For example, if inventory is shrinking but sales aren't increasing, someone may be selling off product illegally through a side business. If the company is losing money in unexplained ways and an employee with access to funds seems to have increasing wealth, further investigation is warranted.

The financial investigator must also keep in mind that money can change form as smoothly as water turns to ice. It can be converted into merchandise or real estate, moved overseas, laundered through dummy corporations, or put in a relative's name. These endless permutations make following the money trail difficult but crucial.

While experts may eventually be called in to complete a complicated financial investigation, the security manager can lay important groundwork to help solve a case. To do so, the security manager should have a basic knowledge of company structures and accounting practices, including which documents are important and where they can be found.

An understanding of a company's structure--whether it is a corporation, partnership, or sole proprietorship--is fundamental to any financial investigation, because the structure affects how financial records are kept and how transactions can be traced.

In a sole proprietorship, for example, business transactions are fairly simple. Investigators simply subtract the company's business expenses from its revenues to determine how much money should be in the company's coffers. Business files are usually kept in the owner's office and are easily accessible.

In corporations and partnerships, however, the flow of money is more complex. Several people may oversee different records. The complex record keeping makes it easier to hide illegal money transfers.

Apart from the need for specialized knowledge, a financial investigation should be approached like any other case. The security manager is still trying to answer the same classic questions of who, what, when, where, and how. The difference is that in financial investigations some answers come in different forms, including business ledgers, inventory reports, sales receipts, check books, and bank records. The importance of documents should not, however, cause the investigator to overlook the more traditional sources of information, such as the personal one-on-one interviews that are so crucial to evidence gathering in any kind of investigation.


Anyone with knowledge of the crime or the records that help prove who may have committed the crime should be interviewed. The goal is to determine how money flows through the organization, who collects the bills, who deposits the money, and who has access to cash funds or other company assets.

Once a suspect has been identified, the investigator should develop a personal profile of the subject. The profile should include all maiden names, aliases, name changes, and former residences, as well as names of current and former spouses, close friends and relatives, college friends, and business associates. While this information may seem unimportant at first, all could constitute evidence.

The investigator should look for former company employees who may have lost jobs because the company went out of business. Investigators have solved numerous cases by locating the employee who was mad at the boss. They may know about the chief executive's mountain hideaway or the condo on the beach. Other people who may be looking for the suspect should also be interviewed. Landlords, creditors, and neighbors are great sources of information.

Investigators should study business or personal travel patterns, which can indicate the location of secret assets. It's also important to know about the subject's hobbies, former occupations, and longtime financial institutions. Public and private records can provide critical information about these and other matters.

Financial records.

Financial records reveal how much money may have been stolen. They also hold clues regarding who may have taken the funds. Financial records should be reviewed throughout the investigation, but they are most useful when the investigator has narrowed down the list of suspects. To do this effectively, investigators need to understand where records are kept and who to talk to for help in obtaining those records.

Banks keep checks and other records on microfilm for two to five years. Businesses and individuals keep financial records three to seven years or more for tax and other business purposes. Deposit slips, canceled checks, and loan files from banks and savings institutions can lead investigators to the source of money, other businesses, and collateral used to secure loans. Bank files also contain loan transactions, payment histories, and credit investigations of the subject.

They can lead to cosigners, business associates, and other banking relationships. Payment records for these loans help establish the source of funds. If a subject began making mortgage payments on a mountain cabin two months after the company lost $25,000, the investigator should look for a corresponding down payment or a large deposit into checking or savings accounts.

An often overlooked bank record is the safe deposit box entrance record. It can indicate a source of funds and can be matched with other records to determine patterns in financial transactions. If a subject visits his safe deposit box and the next day purchases a car or jewelry for his wife, a possible location of illegal money may have been identified.

Brokerage accounts are another source of evidence for investigators. Brokerage accounts may be held in the name of the broker, a street name, or in the name of nominees. A customer's monthly statement shows new purchases of stock and the balance in the subject's account as well as the date of the stock purchase. The investigator can use these to uncover hidden ownership of securities.

Also, checks used to purchase securities or the payout from the sale of securities can lead to associates, other bank or brokerage accounts, and net worth computations.

Some of these documents will be public records on file with local or state governments. Others are a company's private records and must be obtained through subpoenas or given up voluntarily by company representatives, such as accountants, bookkeepers, auditors, controllers, treasurers, shareholder relations, budget analysts, inventory managers, payroll staff, or purchasing personnel. Investigators should never access records illegally.

Public records. Public records form a large portion of the evidence collected in financial investigations. These can include business licenses, corporation name registrations, credit histories, loan applications, lawsuits, and even personal information about corporate executives that may help locate potential witnesses. These records should be searched in any states where the subject, his or her spouse, and close business associates have lived, worked, or traveled.

  • Business licenses. Liquor, medical, and other business licenses can provide the security manager with the address of a business along with the names of company officers and associates. These documents are usually kept at the appropriate state or local licensing or regulatory board. For example, a state board of realtors would have the licenses for real estate agents, while the state or county liquor commission would hold an establishment's liquor license records.
  • Corporate registration. In many states, corporations must file a corporate name registration with the secretary of state's office. This document provides the investigator with the date a company was established and the names of officers and associates.
  • Financial statements. In some states, such as California, a company's officers must file financial statements along with the corporate filings. This record gives the investigator the initial capitalization of the company along with the company finances, including executive salaries. This may be helpful when an investigator must know a suspect's annual income to determine whether he or she can afford the assets he or she has purchased. These statements are usually kept with the secretary of state's office.
  • Credit records. Public business credit and payment history records filed by companies show their revenues, size of the company, location of offices, officers' names, and, in some cases, salaries of company executives. They often list the bank where the company does business. These records can be obtained for a fee through the Dun and Bradstreet database. Public companies are required by law to file these records with Dun and Bradstreet, while private companies may do so voluntarily.
  • Loan applications. Security managers can identify a company's assets through loan applications that businesses must file under the Uniform Commercial Code whenever collateral is pledged in applying for a loan. These documents are normally filed with the secretary of state's office. Among other things, the application identifies the lending institution, the date of the loan, and the collateral. This information can help when a security manager must identify assets during an investigation. For example, a California insurance company recently decided not to file a lawsuit against a company after determining through the company's loan application that the business didn't have any assets that could be taken by the insurer.
  • Personal records. Personal records of corporate executives may also be useful in narrowing down an investigation or identifying witnesses with vital information. For example, marriage records reveal a spouse's name and a wife's maiden name. People often transfer property to a spouse, start a business with the spouse as an officer, or hide assets or illegal profits under a wife's maiden name. Some of the best information in financial cases is found in divorce files. These records not only list maiden names, addresses, and often social security numbers, but may also lead to tax return forms, bank account numbers, bank and mortgage loan papers, and final dispositions of property settlements. Marriage and divorce papers are usually held in civil courts or with city or county clerks. The information they provide may not seem important at first, but locating a former spouse who knows about the suspect's secret condominium in Mexico can help lead to a wealth of evidence.
  • Business name lists. Another helpful record search is the corporate business and fictitious business records index, which is usually located with a county clerk or registrar of deeds. In California, for example, all companies must obtain an operating license from the county registrar before opening for business. When the license is granted, the company's name is indexed in the county records along with its address and the names of the company's owners and associates. Many of the companies on this list are legitimate businesses, but there are cases when the index contains a front company. For example, a phony company may be on the list because its owner needed a county operating license to open a checking account or to obtain a loan. In addition, these records can also contain hidden businesses and other business associates. They also lead to addresses to check for assets and other names to search under for property.

There are many other records an investigator should obtain. Civil courts hold the records of people and companies that have brought lawsuits against each other. These files hold a treasure trove of financial information about a subject and his or her company. In addition, county records hold documents on mineral ownership, probate files for inheritance, and real property ownership.

Private records. Many financial and credit records are private and not readily obtainable. These include tax returns, most bank records, and financial documents for private businesses. The security professional needs a subpoena or search warrant to get these documents. These records should never be obtained illegally. Investigators should get legal advice before trying to obtain these documents.

Databases. Databases of public information, such as the types of records just discussed, are rapidly becoming an excellent investigative tool in tracing assets. They can save time and money by enabling investigators to access files that might otherwise have required trips to the country courthouse, state offices, or the local library.

Several private companies provide public records through their online database. By accessing these databases, a security manager can review mortgage records, real estate transactions, credit records, corporate officers, loan applications, motor vehicle records, and criminal and civil court cases from throughout the country. These providers charge a monthly subscription fee, usually between $25 and $50. They may also charge a separate search fee for specific records. Information Resource Systems Corporation of Los Angeles and CDB Infotek of Orange, California, are two fairly large online databases available to security managers. They make tracking people and assets across the country much easier and quicker. Most database providers advertise in security magazines. Some get mailing lists and offer their services by sending flyers and other promotional material to private investigators and security managers.

These online services do not contain records for every county, however. In some cases, the security manager may have to make the trip to the county courthouse and use its local database to search for certain records.

The investigator's objective is to construct a clear picture of the suspect's past and current financial status. That picture includes all legitimate sources of funds, living expenses, and known assets and liabilities (and resulting net worth).

Interviewing the suspect.

After collecting as much background information as possible, the investigator is ready to interview the suspect directly. The interview is usually carried out in the final stages of the investigation, giving the security professional time to thoroughly research the case. The background material gives the investigator an advantage over the target of the investigation, because it gives the security professional a reference point from which to judge whether the suspect is lying. For example, if the investigator knows that the suspect has property in Mexico, he or she has reason to question the suspect's claims of never having visited the country.

The security professional should know the answers to most of the questions that will be asked. The main purpose of the interview is to fill in any informational gaps and, if possible, to obtain a confession from the suspect.

When and if a subject is questioned, the investigator should not stop until all the evidence is collected. If the suspect starts talking, the investigator must be prepared to get everything down for the record. There may not be another chance.

When conducting the interview, the investigator should expect the suspect to claim to have received gifts, saved cash, inherited money, or converted an asset. Each of these assertions can be verified. The investigator must ultimately disprove these arguments to show that the subject could not legally have obtained the assets in question.

Financial investigations may seem complicated and intimidating, but they require many of the same skills security professionals use in checking out any crime: patience, an eye for detail, and a willingness to follow a few false leads. By coupling basic investigative and interviewing techniques with a knowledge of financial transactions and business records, the security manager can go a long way toward helping his or her organization find the perpetrator of a financial crime.



The Magazine — Past Issues


Beyond Print

SM Online

See all the latest links and resources that supplement the current issue of Security Management magazine.