SCENARIO
The CFO/Controller of a multi-million dollar HVAC Distributor caught red handed and fired. Within a few days of a call from their insurance company other issues started coming to the surface, the company learned that this former employee had set up numerous functions to bypass financial controls and was stealing from the company.
The HVAC company became suspicious of the CFO activity after their auto insurance company contacted them of policy changes. The contact came after the CFO had been in a minor accident and preceded to have the insurance company create a 1 million-dollar liability waver for him. Changes of these magnitude to the original police require ownership signatures. From this point, the case began unfolding and Guardian Forensics team was retain to investigate the matter. Owners of the company uncovered in addition to the insurance fraud, embezzlement in multiple forms.
CHALLENGE
Guardian principle consultant and digital forensics expert Alvey Matlock was flown to the east coast and provided an offsite office. From this location employees from multiple departments were scheduled for interviews and two years of financial records and credit card statements were provided for review. Additionally, Alvey was provided full administrative access to the HVAC company technology systems to conduct an IT security audit. Indications from the interviews and financial records uncovered the CFO was running multiple schemes from turning in invoices for cash and never purchasing the product or services, altering financial records in their mainframe system, buying alleged customer promotional merchandise and gift cards from best buy and selling the items on eBay, to shipping product from their warehouse to a second home in Arkansas. Evidence was also uncovered showing the CFO had been expensing personal vacations, travel expenses that even included his honeymoon. The IT audit resulted in findings showing the CFO had taken over administrative privileges to several key systems in the corporate network and client/server systems. This all occurred within less than two years of employment.
On the fifth day of the investigation the CFO was brought into a conference room where his digital devices were seized and preserved for forensics. Guardian provided guidance during the interview where the CFO confessed to a number of his criminal actions. All total the CFO stole over 150,000 in the last 6 to 8 months of his employment.
SOLUTION
During the interview Guardian was able to safely secure critical cell phone and laptop evidence. The mobile forensics provided the HVAC company additional insight to how the CFO was stealing and using the company funds for his personal lake house and other living expenses. Guardian Forensics was able to not only recover deleted information and analyze the relevant artifacts it helped prove the CFO criminal misconduct.
The forensic analysis revealed communications with other employees that proved a hostile work environment and how he intimidated his employees and gain administrative control over their financial other critical technology system.
Guardian’s vast experience in technology, digital forensics, interviewing suspects, and testifying and their understanding of the legal discovery process, understanding of the rules of evidence, as well as their ability to convey highly technical information in a manner that brings clarity to non-technical decision-makers, allowed the ownership to fully understand the activities and the impact that those activities had for the HVAC company.
RESULT
Guardian continued to support the investigation including working with local law enforcement. Copy of all the forensics images and reports were completed and turned over to the prosecutors where a criminal investigation began. A information technology security audit was also completed and worked with the company to remove the escalated security from both it onsite systems and their Cloud infrastructure hosting the company email and other important CRM systems.
The end result — Guardian expertise in digital forensics and information technology acted as the leadership in conducting a successful investigation. The investigation lead to a very serious white-collar crime being fully exposed and reported to law enforcement. The company is activity pursuing charges and recovery of damages that include fees for Guardian professional services provided during the investigation. Needless to say, the client, attorneys and their insurance company were very pleased with Guardian Forensics and helping them manage their internal Investigation.