The Thief Within: Law Firm Embezzlement Schemes | Part 2 | Cash Disbursement Schemes

By Craig L. Greene

This is the second of a three-part series discussing embezzlements within a law firm. Part one discussed how the accountant or bookkeeper could mishandle incoming cash receipts to commit fraud. This article discusses how an accountant or bookkeeper can mishandle outgoing cash disbursements to commit fraud. There are several fraudulent cash disbursement schemes that can take place within a law office. These schemes fall under two main categories – billing schemes and check tampering. It is possible for these schemes to go undetected if proper internal controls are not implemented.


Billing schemes are a common way for corrupt employees to embezzle funds from an unsuspecting firm. These schemes can take several forms including: shell company, non-accomplice vendor and personal purchase schemes. Knowing how they’re executed, and the red flags they display can help a firm be vigilant in protecting themselves.

Shell Company Schemes

A shell company is a business entity which most often has no physical presence, no employees and rarely generates any economic value; in essence, a fictitious company. In a law firm, a corrupt employee will form a fictitious shell company to send fraudulent invoices to the firm requesting payment for services. Typically, a shell company’s name will be initials such as ABC Corporation, or in a name that is very similar to a legitimate vendor. For example, Just in Time Court Reporting vs. JIT Court Reporters. They will also set up a bank account in the shell company’s name so that it can receive and deposit funds. Banks typically require a certificate of incorporation, D/B/A certificate, and/or partnership agreement. These documents can often be obtained for a small fee through the applicable state or county office. This legitimate document can provide important information in uncovering the perpetrator.

If the employee is an entrusted accountant or bookkeeper, it may be relatively simple for them to add vendors, or process invoices for payment. It is important to segregate duties within the accounting functions of the firm to make setting up fictitious vendor schemes more complex and less likely to occur. Even with proper segregation, it is still possible for a fraudulent shell company to exist.

The corrupt employee may collude with others, seeking assistance from a disgruntled or complacent individual within the accounting department. The accomplice(s) would possess the ability to approve new vendors, add new vendors into the firm’s vendor list, or process invoices. In return, the accomplice will receive a portion of the embezzled proceeds.

Once the shell company is set up within the firm’s system as a vendor, they are now able to generate and remit fraudulent invoices to the firm. As part of the firm’s vendor list, it will be processed by the bookkeeper. These invoices can be created on a personal computer, they do not have to be of professional quality to generate a fraudulent disbursement. Most often invoices will be sent for consulting services, since this is a relatively generic expense and not closely monitored.

Once the fraudulent invoice is processed, the corrupt employee will receive a check at their shell company’s address, then deposit it into the bank account set up in the shell company’s name. From here, it’s quite easy to make a cash withdrawal at the ATM and allocate the funds to his personal bank account.

There are red flags that a firm can watch for to thwart shell company schemes. First, it is important to analyze financial records for patterns. Since fraudulent invoices are processed just like legitimate ones, they will appear on the financial statements. When analyzed over a three to five year period, the firm may notice that their consulting or other obscure expense account has grown with no justifiable cause. Once the firm notices this unusual trend, they can dig deeper into the suspicious looking expense accounts. It may become obvious that a vendor the firm does not recognize is being paid for services they did not use. These are signs that the vendor is a shell company embezzling the firm’s funds. Other red flags include:

• Vendors that have only a post office box address.

• Vendor billings that occur more frequently than once a month.

• Vendor addresses that match employee addresses.

Non-Accomplice Vendor Schemes

In a non-accomplice vendor scheme, the vendor does not participate, and is unaware of the fraudulent activity. There are two ways a bookkeeper or corrupt employee can take advantage of the firm using legitimate vendor invoices. The first is called a pay and return scheme, and the second involves overbilling of non-accomplice vendor invoices.

In a pay and return scheme, an entrusted bookkeeper mishandles vendor invoice payments. He intentionally over pays invoices, double pays invoices, pays the wrong vendor for an invoice, or purchases excess goods from a vendor to later return. Without a segregation of duties, the corrupt employee can make one of these intentionally incorrect payments and then communicate with the vendor and request a refund or a returned check. The vendor then issues a refund check, or returns the firm’s check which the employee will intercept and deposit into their personal account.

Segregating duties can reduce such fraud. If the bookkeeper is responsible for processing the invoice and drafting the check, then a different person should be responsible for signing the check, ensuring the amount matches the invoice. A further step, is to have a separate employee handle returned or refunded amounts so that no one person has the opportunity to embezzle the funds.

The bookkeeper may also engage in overbilling a vendor by duplicating an already paid invoice and paying it again, or generating fake invoices from the vendor and paying them. Again, as with pay and return, the employee will intercept the refunded check to deposit into their personal account.

A major red flag in detecting this type of scheme is the double processing of the same vendor invoice. Th is scheme is best resolved through tighter internal controls. Make sure that original invoices are processed and that copies of the invoice are not resubmitted for processing. Th is can be a part of the computer system that checks invoice numbers and amounts that are being processed against numbers and amounts already processed.

Personal Purchases Schemes

The final billing scheme is one in which the deceitful employee embezzles funds by using them to purchase items for their personal consumption or use. Within a law firm, this may typically be conducted by employees who are tasked with stocking office and breakroom supplies, and by employees who are authorized to use the firm’s credit card.

The corrupt employee can place orders for breakroom supplies, for instance paper plates, and then increase the quantity after the purchase has been approved to take some home. This fraud can occur with a multitude of items. If authorized to make credit card purchases, they may be tempted to use the credit card to purchase personal items which can be shipped directly to their residence.

It is important to check purchase receipts for supplies and credit card statements carefully to ensure purchases are used within the firm or quantities are not excessive. It is important to detect this fraud early to ensure that the firm’s funds are not being used to purchase items for personal consumption or use.


Check tampering schemes are another widely used fraudulent cash disbursement method. This occurs when a corrupt employee embezzles funds by forging or altering checks drawn on a company account. There are several types of check tampering schemes – forged maker, forged endorser, altered payee and authorized maker. Detecting and preventing check tampering schemes is universal, regardless of the type of scheme taking place: a segregation of duties for check preparation, signature and delivery.

Forged Maker Scheme

In a forged maker scheme the culprit will forge an authorized signature on a company check. This usually involves a blank check. Obviously, to succeed they must be able to obtain a blank check. For this reason, they are typically employees tasked with accounts payable functions and whose regular duties already include preparing checks.

One way for the firm to safeguard against this is to keep checks locked in a restricted area unless they are being used for their intended purpose. Once checks are written, they are returned to their locked, restricted area. It is also important to track check number sequences for missing checks. It is also important for custody of unsigned checks to be maintained.

Forged Endorser Scheme

The endorser scheme involves forging the endorsing signature of the recipient of the check. In this scheme, the corrupt employee must intercept a check that was intended to pay a legitimate party. Then a forged endorsement is used to deposit the check into the corrupt employee’s personal account. It is possible that the check was written by someone who had no intention of committing fraud.

In order to minimize this scheme, it is important to understand how an interception may occur. Once checks are written and signed, protocols should be in place so they are immediately delivered to their intended recipient. A red flag to this type of scheme arises when a vendor voices complaint over unpaid invoices. These complaints should be investigated to their full extent.

Altered Payee Scheme

This scheme involves changing the payee of the check. As with forged endorser, this scheme involves intercepting a check that was intended to pay a legitimate party and altering it. Also like forged endorser, the person who wrote the check could have no knowledge or intention of the fraud being committed. The corrupt employee may also do a payee reversal, so that once the check is processed by the bank it will appear on the firm’s bank statement with the original intended payee’s name on it.

The easiest way to detect this is by preparing bank reconciliations and examining each check returned by the bank. Unless a payee reversal occurred, it will be obvious which checks cleared for which invoice based on the check number. If the payee does not match the vendor of the invoice that’s a red flag. If the corrupt employee somehow altered the payee name so that it would show on the bank statement with the original intended payee, it becomes important to investigate vendor complaints of unpaid invoices to their fullest extent to ensure the check was not stolen.

Authorized Maker Scheme

In this scheme, the perpetrator is someone that has check signing authority and writes checks to themselves, an accomplice or a shell company.

Authorized maker schemes are the hardest of check tampering schemes to detect. The best prevention is to require dual signature authorization.

Cash disbursement schemes can be devastating to a law firm regardless of the size. While the controls listed above certainly play a crucial role in detecting and preventing fraud, they are not perfect. It is beneficial to engage a well-trained and experienced fraud examiner, who is also a CPA to perform a fraud risk assessment. This can help ensure there are solid internal controls to detect and mitigate a fraud. An assessment can also determine who is putting the organization at risk, as well as the highest areas of risk. A firm that specializes in financial forensics and fraud investigationw can educate employees, while working with the management team to provide a transparent atmosphere where fraud risk is minimized.

Craig L. Greene is a founding partner of McGovern & Greene LLP a forensic accounting and litigation services consulting firm. He is a CPA, certified in fraud examination, financial forensics, corporate compliance and ethics and a master analyst in financial forensics. He works as a consultant and expert witness on complex financial matters including allegations of financial fraud, CPA malpractice, shareholder or partner disputes, and many other forensic accounting related matters. Craig is the former regional governor and president of the Greater Chicago chapter of the Association of Certified Fraud Examiners and an internationally recognized speaker on fraud and fraud examination. For more information, please visit