In the most recent episode of the ACFE’s podcast, Fraud Talk, Julia Johnson, CFE, Research Specialist at the ACFE, breaks down three recent case studies of frauds that were committed from behind bars. She explains how the schemes were perpetrated and what fraud examiners can learn from each case.
In this episode of the ACFE’s podcast, Fraud Talk, Julia Johnson, CFE, Research Specialist at the ACFE, breaks down three recent case studies of frauds that were committed from behind bars. She explains how the schemes were perpetrated and what fraud examiners can learn from each case.
Below is an excerpt from the full transcript of the discussion, which you can download in PDF form, or you can listen to the episode.
Courtney Howell: Hello, and welcome to this month’s episode of Fraud Talk. I’m Courtney Howell, the Community Manager at the ACFE. Today our guest is Julia Johnson. Julia is a Research Specialist here at the ACFE, and we have what I think is a very interesting topic to dig into. We’re going to be talking about three recent fraud schemes that were committed from prison. Yes, the fraudsters were operating from behind bars. First though, Julia, would you tell us a little bit about your role here at the ACFE, and also a little bit about your background?
Julia Johnson: As Courtney said, I’m Julia Johnson, and I work in the research department for the ACFE. I focus on accounting-related fraud and subjects related to that. So, I update training materials on that topic and write different articles on emerging frauds and different fraud stories in the news.
Before I started at the ACFE, I worked in public accounting as an auditor. And prior to that, I worked in law enforcement for a little bit.
CH: Awesome. All right. So, we’re going to go ahead and dig into our fraud schemes. So, the first one, let’s get into that one. It comes to us from Ohio. What was going on in this one, Julia?
JJ: This is actually a pretty interesting story. There were a couple inmates in Ohio that got caught for building two computers that they hid in the prison ceiling. These inmates had access to these computer parts through a program that they had at the prison where they would break down computers, old computers that people had donated to recycle. And they were given kind of lax supervision in this program, so during the times that they weren’t supervised, these prisoners would steal the parts from computers, build their own computers, and then they were able to connect these homemade prison computers to the network and access all sorts of sensitive information and even the internet. They were able to access this by using the stolen credentials of one of their supervisors, who was in charge of watching them.
When they were finally caught, the prosecutor’s office did a full investigation and checked out the hard drive and what was happening. They realized that these prisoners were able to issue passes to gain access to different areas within the prison that they normally would not have been allowed. They were able to access inmate records, which contained sentencing information, social security numbers, lots of sensitive information that you really don’t want anyone, including a prisoner, getting ahold of.
They researched how to commit tax refund fraud using just a few elements, like social security numbers, date of birth and bank account information. They also applied for debit and credit cards using other inmates’ identities. There was an app that they could also use to communicate with parties outside of jail.
They also loaded movies and other media on thumb drives that they would sell to other prisoners in exchange for items that they could buy at the commissary.
CH: So how did they steal the supervisor’s log in? How did they get ahold of that information?
JJ: During the investigation, the prosecutor’s office found one of the prisoners confessed to shoulder-surfing the supervisor, so just looking over his shoulder and seeing what he was typing, and the next day went in and used the same log in, and it worked just fine.
CH: Simple, yet effective.
JJ: Yes.
CH: Okay. So, they were committing, you said, false tax return fraud and then also credit card fraud?
JJ: Yes.
CH: They were stealing people’s identities. Did the other prisoners know they were using their identities? Or were they just stealing them from the records that they uncovered?
JJ: They stole one prisoner’s identity, and when he was questioned, he was not aware at all that this was happening. When they asked the prisoner who was doing the theft why [this other prisoner] was chosen, he said he picked this specific prisoner because he was young and had a long prison sentence, so he knew that he wasn’t going to get out for a long time and that he would probably get away with it.
CH: Interesting. What are some controls that were maybe lacking at the prison? How could they have prevented this or even just caught it sooner?
JJ: Yeah, I mean, there’s definitely a few things that could have been done to prevent this or catch it a lot sooner. One thing that they could have done is have proper oversight over the prisoners that were doing the work. The supervisor left them unattended for long periods of time, which gave them the opportunity to build these computers. So, I think proper supervision was definitely something that was lacking.
Another thing would be to maintain inventory records. So those computers that they were receiving, the donated computers, they should have been keeping inventory of the parts that were going in and out. They would have noticed that there was a lot more coming in than were coming out.
Also, a big one is to just protect your password. Know your surroundings. Update your password frequently so that if someone were to get ahold of it, it wouldn’t be there for too long.
CH: After they discovered that this was happening, how were they caught?
JJ: The prisoners were caught because the network system at the prison alerted the technical department that the internet usage had reached its maximum for the day. They thought it was kind of weird because it was using some credentials that didn’t work on the weekends, and this took place on a weekend. So that raised a red flag. They went to check it out and found these two computers in the ceiling.
They actually had two of the inmates take the computers down and put them in a supervisor’s office. So, the investigative process was not handled very well. I think they had the perpetrators taking them down. One thing that could have definitely been done to protect that is just putting specific policies and procedures in place for — I mean, obviously this isn’t a situation that you would have in a “code of conduct” type book — but just having specific procedures for handling suspected misconduct and things of that nature so that the investigative process can be as solid as it can be.