The Embezzlement that Fell Into My Lap

I met Brandon Garnett at a police station. I was working with the police department to build out an identity theft investigation unit, and Garnett was referred to the unit because he claimed his business was a victim. To substantiate his claim, he produced bank statements showing unusual charges on his business bank account and credit card account; charges that included airline tickets, designer clothing stores, and high-end restaurants. We walked Garnett through the initial intake and quickly determined that, while a crime may have been committed against Garnett’s business, it was not identity theft.

At this point Garnett had too little evidence to get the police to investigate his situation, so I offered to help him build a case. The first thing we did was to lockdown his business and personal accounts so that no one but Garnett could access them or initiate transactions. Then we turned to the business’s books and records.

Fresh out of college, Garnett had started a company that sold and installed home entertainment systems, and five years later, business was booming. He had a gorgeous showroom in a prominent shopping district and three installation crews working across the metro-Denver area. Garnett’s business was on track to gross more than $550,000 in revenue for the year, but his cash flow position was awful. I had a hunch as to the problem, so I started by comparing gross revenue to accounts receivable.

As I suspected, the accounts receivable was growing at a rate that was inconsistent with the gross revenue (Figure 1). Looking at the comparison, it seemed as if there was no effort made to collect on receivables, and practically none of the aged receivables were ever written off. When I explained this chart to Garnett he was sure I had made a mistake. He insisted that his customers paid their bills on time. He even had the receipts and check copies to prove it. While Garnett did not have much of a knack for business, he was really good at keeping and organizing receipts and other transaction documents related to the business. With these records I was able to create a model of what accounts receivable should have looked like if all of the documented payments had been applied correctly (Figure 2).

This analysis confirmed my assumptions; someone had been using payments received from customers on credit to cover-up a misappropriation of assets. By being able to model what the receivables account should have looked like, we were able to see that not only were payments not being applied to customer accounts, but that a significant amount of cash was not being deposited in the business’s bank accounts.

When I explained the situation to Garnett, his immediate response was, “Damn it, Sylvia!” Right on cue, Sylvia stormed into Garnett’s office demanding to know why she could not access the business bank account.

Garnett met Sylvia Attwater when they were both students at the University of Colorado. They were friendly, hung out in the same circles, and would study together from time to time. After graduating, they went their separate ways; Garnett started his business, Attwater had two kids and a string of dead-end jobs.

One night Garnett found himself on Facebook when he came across a familiar face, Attwater. They connected on the app, traded messages, and planned to get together to catch up over drinks. When they meet up, it only took a little small talk and a few shots before Attwater was sharing about her tragic life over the past few years – including a few DUIs, her children’s absentee father, and a series of medical issues.

One thing lead to another, and Garnett ended up hiring Attwater as his bookkeeper and office manager, despite her lack of education, training, or experience. Attwater’s good looks and flirtatious manner made her a hit with fellow employees and customers alike. While Garnett frequently had to clean up the errors she made entering transactions into Quickbooks, it didn’t seem to bother him too much.

Unraveling Attwater’s schemes took some work. I started with the customer payments that were diverted. Almost as soon as she started working for Garnett she was stealing cash out of the weekly deposits. She hid the theft by lapping accounts receivable payments. Lapping is the process of applying a customer’s payment against another customer’s balance to cover up the original theft of the first customer’s payment. For instance, Customer A makes a payment of $100, but Attwater pockets the money instead of depositing it (leaving the receivable balance on the books). Customer B makes a payment of $125, and Attwater deposits $100 (applying the payment to Customer A’s receivables balance) and pockets the other $25 (leaving Customer B’s full receivable balance on the books). In a typically fraud this process goes on until the fraudster can no longer manage the complexity of applying the payments, or until customer complaints about unapplied payments prompt management to investigate the situation.

Attwater was unique in that she had figured out a system to let her manage the lapping of customer accounts indefinitely, but at the cost of limiting how much should could steal. Her greed quickly outpaced her capacity to steal cash from customer payments. Then she discovered Garnett’s business credit card. He kept it locked in the business’ safe in cases of emergencies, and quite frankly, Garnett had forgotten about it. Once Attwater realized it was there, she took the credit card and started using it as her own. In order to keep the card active, she would make the minimum monthly payments, and post random expenses or balance sheet transactions to the company’s books to record the expense.

Attwater’s cumulative thefts caused havoc with the business’ cash flow. When Garnett actually tried to use the emergence credit card to pay a vendor invoice, it was declined. That led to uncovering the suspicious transactions, and his trip to the police station to report the crime. After a thorough investigation, I determined that over a period of 29 months, Attwater stole at least $136,750. Garnett was understandably upset, and while he confronted Attwater about the theft, he refused to press charges. Even while his business was forced into bankruptcy, he did not want Attwater’s children to face the prospect of their mother going to prison.

Recently I received an email from one of the detectives I worked with at the police department in Colorado. They had arrested Attwater for identity theft, only her last name was now Garnett. After losing his business, Brandon Garnett went to work as the facilities manager for a small hospital in the area, and after marrying Attwater, got her a job in the administrative office. She promptly started opening credit card accounts using the personal identifiable information (i.e., Social Security numbers) of the hospital’s patients.

Some guys just never learn.