Cerebra uncovered a multifaceted fraud case perpetrated by an employee with a gambling addiction

SITUATION  

Our client, a supplier to globally recognized textile brands in Turkey, reported suspicions regarding the activities of their administrative affairs officer. In the defense statement obtained in this context, the suspect admitted to irregularities in the sale of two company vehicles and falsifying with some offers and invoices. Our client requested Cerebra to investigate not only the confessed matters but also any possible irregular transactions in other areas under the employee’s responsibility and to determine the total loss. 

OUR SOLUTION 

Project-specific considerations 

After reaching an agreement with the client, a Cerebra team consisting of 2 fraud investigation specialists and 1 digital forensic expert began field investigation activities. On the first day of our work, images of potential evidence on the company computer and mobile phone of suspect were taken using forensic methods that ensure the integrity of the original data. 

In the early days of our work, all critical financial and operational data were obtained, and face-to-face meetings were held with company management, the finance department, and process owners to evaluate the findings.  

In our initial assessments, Cerebra identified the following challenges related to the environment where the suspicious transactions occurred:  

• The authority and responsibilities of the suspect were not clearly defined. 

• The transactions conducted by the suspect were quite complex as they involved all the company’s operations. 

• Some transactions were conducted via unofficial communication methods and notifications through WhatsApp. 

• It was suspected that the employee had sold some company assets improperly. However, identifying which assets were sold was challenging due to the lack of inventory counts and assignment of assets to the relevant personnel. 

• The communication with the customers and suppliers suspected of being in covert collusion with the suspect was solely managed by the suspect 

• Offers and invoices were falsified. This made it difficult to determine whether the documents were original or not. 

Methodology   

a) Corporate intelligence work: At the beginning of our work, we conducted intelligence on the suspect using our intelligence software. As a result of our investigation, we promptly discovered that the suspect has memberships on illegal gambling websites. This was confirmed when we examined the data on the mobile phone and computer detailed below. We found that the financial pressure from gambling was behind many of the suspect’s fraudulent actions. 

b) Examination of digital data from computer and mobile phone using forensic methods: After loading the copied digital data onto our forensic software, we performed an indexing process, allowing the data to be searchable by keywords. Thousands of documents in different formats were examined, considering the keywords and the case pattern. 

In these examinations, we identified that beyond the mentioned fraudulent vehicle sales, the perpetrator secretly collaborated with the company’s business partners to earn commissions through activities such as purchasing and maintenance/repair, sell scrap materials generated from production without the company’s knowledge, and misappropriate company credit cards to fund gambling. We uncovered the fraudulent activities with clear and undeniable evidence. 

c) Data acquisition and data analytics: We performed detailed analyses on the financial and operational data obtained, focusing on supplier concentration, seasonality, production outputs, the status of scrap materials, operational records, and segregation of authorities within the company.  

As a result of our investigation, the following were determined: 

• The suspect used his duties and authorities for personal gain. 

• The suspect secretly collaborated with the supplier providing personnel transportation services, incurring high costs and collecting commissions. 

• The suspect sold scrap materials generated from production without the company’s knowledge. 

• The suspect sold company vehicles, computers, and mobile phones without the company’s knowledge and used the money for gambling. 

• The suspect’s spouse, also a company employee, was involved in fraudulent activities, falsifying offers and invoices together. 

• The suspect borrowed various amounts of money from company employees. 

• By leveraging close relationships with third parties, the suspect arranged for fictitious invoices to be issued to the company for non-existent goods and services, using the ill-gotten gains for gambling. 

• The suspect made unauthorized cash withdrawals from company credit cards and used the money for gambling. 

Cerebra completed the entire investigation within five weeks without disrupting the company’s workflow and in confidentiality from the company employees. The financial loss identified as a result of the fraudulent activities was calculated to be approximately TRY 2.5 million. 

The findings identified as a result of the investigation were presented to the company management in a report with supporting evidence in a chronological flow. 

OUR IMPACT 

Based on Cerebra’s report, it was clearly demonstrated with conclusive evidence that the actual loss amount initially identified by the company management as 1.1 million TL, was actually TRY 2.5 million. 

Furthermore, following the findings in our report regarding the high-cost personnel transportation services, the same service was subsequently obtained at a cost that was 1.8 million TL lower.