Chapter 18 Purchasing card fraud Analysis of purchasing card data Note on forensic analytic tests Concluding remarks Pages 425 to 453. Chapter reviews purchasing card fraud, the analysis of purchasing card data, general notes and general conclusions on the use of forensic analytic tests. Prepared by: Mark J. Nigrini Copyright © 2012 by Mark J. Nigrini. All rights reserved.

purchasing cards Charge card that allows an employee to conveniently buy goods and services. Cards have written rules and procedures Which items may be purchased, approval process, and reconciliation process Bank invoices the company every month Card gives an employee the opportunity to commit fraud. Page 426. The examples relate mainly to analyzing reported numbers on income tax returns. The guidelines have to be adapted to a FS environment.

frauds $80,000: Including EZ-Pass toll tags, expensive remote controlled helicopters, and a dog $150,000 in automobile, building, and home improvement supplies $30,000: computer, rings, purses, and clothing from Victoria's Secret, Calvin Klein, and others $630 charged for escort services down payment of a $10,000 sapphire ring for $2,400 at E-Z Pawn... Pages 426 to 429. Fraud examples.

frauds Page 430. Table 18.1. Frauds discovered. Note that the first amount is $642,000.

frauds ctd. Page 431. Table 18.2.

p-card professionals NAPCP provides services and guidance CPCP designation www.napcp.org They research p-card issues Survey showed that industry practice varied widely with respect to the % of transactions that were audited Pages 432 to 433.

p-card dashboard Pages 433 to 435. Figure 18.1. The summary page of an Excel dashboard that shows the dollar totals and the transaction totals for the preceding six months. Additional statistics regarding plastic cards, strategic cards, and ghost cards are provided. In the lower half of the screen the results ate shown graphically. The dashboard shows that plastic cards account for a little more that one-half of the spending.

data profile Pages 435 to 438. Figure 18.4. The data profile shows that there were approximately 95,000 transactions totaling $39 million. The total should be compared to the payments made to the card issuer. There are no credits. Might be because there is a field in the data table indicating whether the amount is a debit or credit that was deleted before the analysis. It might also be that cardholders aren't too interested in getting credits where credits are due. One-third of the charges are for amounts of $50.00 and under. There is one large invoice for $3,102,000. This amount was actually in Mexican pesos making the transaction worth about $250,000.

periodic graph Pages 437 to 438. Figure 18.5. The "$3,102,000" purchase was excluded from this graph. The graph shows that August and September had the largest transaction totals. The federal agency’s fiscal year ends on September 30th. The August/September spike suggests that employees are spending money that is "in the budget." The average monthly total is $3 million. The two spikes averaged $1.18 million which is significant.

first-two digits Pages 438 to 440. Figure 18.6. The first panel shows a large spike at 36. The number duplications show a count of 5,903 amounts in the $3.60 to $3.69 range. These transactions were almost all for FedEx charges and it seems that FedEx was used as the default mail carrier for all documents larger than a standard first class envelope. The test was also run on all purchases of $10 and higher. The second panel shows a reasonably good fit to Benford's Law. The MAD is 0.0015 which gives an acceptable conformity conclusion. There are spikes at 24 and 99.

summation Pages 440 to 441. Figure 18.7. There is a single record that is large when compared to the other numbers. The spike is at 31. This is the 3,102,000 pesos transaction. The expected sum for each digit combination was $433,077 ($38,976,906 / 90). The 25 sum is $2.456 million. There were eight transactions for about $24,500 and about 850 transactions for about $2,450 each summing to about $2,250,000.

last-two digits Pages 440 to 441. Figure 18.8. There is a large spike at 00 which is as expected. The 00 occurs in amounts such as $10.00 or $25.00. An interesting finding is the spike at 95. This was the result of 2,600 transactions with the cents amounts equal to 95 cents, as in $99.95

number duplications Pages 442 to 444. Figure 18.10. The results show four amounts, all below $4.00, in the first four positions. 99.9 percent of these amounts were for FedEx charges. While the charges might be wasteful they were presumably not fraudulent.

number duplications $2500 Pages 442 to 444. Figure 18.11. The large count of $2,500 purchases shows that this number has some real financial implications. A possible reason is that cardholders are splitting their purchases and the excessive count of $2,500 transactions includes partial payments for other larger purchases. Also of interest are the transactions for exactly $2,499.99 and the 42 transactions for exactly $2,499.00. There are also 21 other transactions in the $2,499.04 to $2,499.97 range. People think that they are the only ones that are capable of gaming the system.

largest subsets Pages 444 to 446. Figure 18.12. Figure shows the merchants with purchases of $200,000 or more. The name of the 3,102,000 MXN vendor has been deleted. The largest merchants are all suppliers of technology, scientific, or other business-related products. Some vendors, such as Buy.com also sell items that could be for home use. Internet purchases of home items are easier to detect because the electronic records are reasonably easily accessible.

same-same-same Pages 446 to 447. Figure 18.14. Test set up to identify (a) same cards, (b) same dates, (c) same merchants, and (d) same amounts. The two largest purchases (for $23,130 and $24,845) would merit special attention because they exceed the card limit, and are close to the limit for convenience checks. Also look at "Retail Debit Adjustment." The review showed that the four hotel payments for $2,500 we indeed a $10,000 deposit (to secure a conference venue) split into four payments of $2,500.

same-same-different Pages 446 to 448. Figure 18.15. Test set up to identify (a) different cards, (b) same dates, (c) same merchants, and (d) same amounts. The near-duplicates could be cleverly split purchases. Split purchases is a blatant and willful circumvention of internal controls, and a split purchase might just be a red flag for other fraudulent or wasteful or abusive acts. The most interesting near duplicate is the last match because it occurred one day before the end of the federal fiscal year-end, and it is the type of purchase (paper products) that cardholders use to spend "what's in the budget."

electronics purchases Pages 449 to 450. Figure 18.17.

p-card conclusions Tests would work well in a continuous monitoring environment Some tests run weekly, monthly, and quarterly Tests will detect large errors and changes Not effective for waste and abuse Special tests to detect personal purchases Cards give employees an opportunity to commit fraud Pages 449 to 451.

forensic analytics Analytics is only one part of the forensic investigations process Collect and analyze data at the start Don’t use incomplete or inaccurate data Make use of a subject matter expert Remember the legal environment FA is still an evolving discipline Pages 451 to 453.

summary Purchasing cards give employees opportunity GAO found many fraud cases Can use the high-level and the drill down tests in a continuous monitoring environment P-card analysis well-suited to a using a dashboard Tests can show split purchases and other control issues Tests can be run in Access or Excel Fraud is here to stay Forensic analytics is still evolving Review of the main points in the chapter.