Chapter 5: Computer Fraud

An accounting information system grow more complex to meet the escalating needs for information,
companies face the growing risk that their systems may be compromised.

Surveys shows that;

 67% of companies had a security breach
 45% were targeted by organized crime
 60% reported financial losses

Natural and Political Disaster

• Threats: Fire or excessive heat, floods, earthquakes, landslide, hurricanes, war and attacks of
terrorists.
• These disasters affect many companies at the same
• Terrorist attacks on the World Trade Center in New York City and on the Federal Building
in Oklahoma City destroyed or disrupted all the systems in those buildings,
• A flood in Chicago destroyed or damaged 400 data processing center.
• A flood in Lowa, buried the city's computer under eight feet of water
• Hurricanes and earthquakes have destroyed numerous computer systems and severed
communication lines
• The US Defense Science Board prediction:
• Attacks on information systems will soon be widespread.
• Attacks can even come from foreign countries

Software errors and malfunction

 Threats: operating system crashes, hardware failures, power outages and fluctuations, and
undetected data transmission errors.

 Based on one study, economic losses due to these threat is estimated to be $60 billion a year.
 More than 60% of companies studied had significant software errors.
 A bug in Burger King's software resulted in a $4.334,33 debit card charge for four
hamburgers. The cashier accidentally keyed in the $4.33 twice, resulting in the
overcharge.

Unintentional Acts
 Threats: unintentional acts such as accidents or innocent errors and omissions,
 Unintentional acts caused by human carelessness:
 failure to follow established procedures,
 poorly trained or supervised personnel.
 Users lose or misplace data
 User accidentally erase or alter files, data, programs.
 Erroneous input,
 Using an incorrect version of a program or the wrong data files.
 Programmers make logic errors.
 This is considered the greatest risk to information systems and causes the greatest
 dollar losses.
 The Computing Technology Industry Association estimates that human errors cause 80% of
security problems
 Forrester Research estimates that employees unintentionally create legal, regulatory, or financial
risks in 25% of their outbound e-mails.

 Examples of unintentional acts:

 A data entry clerk at Mizuho Securities mistakenly keyed in a sale for 610,000 shares of J-Com
for 1 yen instead of the sale of 1 share for 610, 000 yen. The error cost the company $250
million.
 A programmer made a one-line-of-code error that priced all goods at Zappos, an online retailer, at
$49.95, including those items that are worth thousands of dollars. The change went into effect at
midnight, and by the time it was detected at 6:00 a.m., the company had lost $1.6 million on
goods sold far below cost.
Intentional Acts
 Threats: Act which is a deliberate destruction or harm to a system.
 Include:
 Sabotage
 Computer Fraud
 Misrepresentation, false use, or unauthorized disclosure of data
 Misappropriation of assets
 Financial statement fraud.
 Some examples of intentional acts:
 The Sobig virus that infected millions of computers shut down the train systems for six hours.
 The hacker group called Anonymous played Santa Claus one Christmas, hacked into
banks and sent over $1 million worth of virtual credit cards to people.
 Information systems are increasingly vulnerable to these attacks.

Here’s more . . .
 In a recent three year period, the number of networks that were compromise rose to 700%.
 Experts believe the actual number or incidents is six times higher than reported because
companies tend not to report security breaches.
 Symantec estimates the hackers attack computers more than 8.6 millions times per day.
 One computer-security company reported that in the cases of Chinese hackers, 94% of the
targeted companies didn't realize that their systems had been compromised until someone else told
them.
 The median number of days between intrusion and detection is 416.

The Sad Truth…

When the top cyber cop at the FBI was asked how the United States was doing in its attempt
to keep computer hackers from stealing data from corporate networks, he said, "Were not winning."

INTRODUCTION TO FRAUD
 Fraud is any and all means a person uses to gain an unfair advantage over another person,
 Fraudulent acts include:
 Lies/false statements uttered with an intention to deceive
 Suppression of the truth
 Tricks and cunning
 Violation of trust and confidence
 Results: injury or loss on the part of the victim.

Is it fraud?
 There must be a false representation, statements or a nondisclosure.
 There must be a material fact, a substantial factor in inducing someone to act.
 There must be intent to deceive.
 The Misrepresentation must have resulted in justifiable reliance causing someone to act.
 The deception must have caused injury or loss to the victim of the fraud.

Classification of FRAUD
 Criminal case
 Civil case
 the definition is the same for both cases.
 the difference is the burden of proof required
 Criminal case: beyond reasonable doubt
 Civil case: clear and convincing evidence

Financial Losses from Fraud

 Since fraudsters don't make journal entries to record their frauds, losses caused by fraudulent acts
are only estimates.
 The association of certified fraud examiners (ACFE) release the following reports on fraud for
year 2020.
Who?
 Former or current employees called knowledgeable insiders.
 An external party.

Knowledgeable Insiders
 More likely to commit fraud.
 Their understanding of the company's system and it's weaknesses enabled them to commit fraud.
 They can cover their tracks.

White Collar Criminals

 Fraud perpetrators are often referred to as white-collar criminals.
 The term is use to distinguish them from violent criminals.

Perpetuates of Fraud
Factor that characterized the perpetrators of Fraud:
 Position in the organization
 Gender
 Age
 Education
 Collusion

Financial Losses from Fraud

The actual cost of fraud is difficult to quantify for a number of reasons
 Not all frauds are detected
 Of that detected, not all are reported
 In many fraud cases, incomplete information is gathered
 Information is not properly reported to management or law enforcement.
 Often, organizations decide to take no civil or criminal action against the perpetrators
Categories of Occupational Fraud
 Assets Misappropriation
 Corruption
 Fraudulent Statements (Management Fraud)

 Assets Misappropriation
 Theft of company assets by employees.
 This is the most common fraud scheme.
 Let's look at some of the techniques used in this type of fraud.

Assets Misappropriation Techniques

 Skimming
 Stealing cash from the organization before it is recorded.
 An employee who accepts payment from a customer but did not record the sales.
 Cash larceny
 Stealing cash from the organization after it is recorded.
 Lapping is an example of this scheme.
 Billing Scheme
 Also known as vendor fraud.
 A false vendor is created by the perpetrator, then causes the organization to make
payments to such vendors.
 Billing scheme fraud:
 Shell company fraud - a false vendor is created, fraudsters manufactures false PO,
RR and invoices in the name of vendor and submits them to the accounting office for
payments.
 Pass through fraud - the same as shell company except a transaction really occur. The
fraudsters buy product from a vendor, (legal transaction). Then he sells the product
using the bogus vendor to the company at a much higher price.
 Pay and return scheme - this typically invoices a clerk with check writing authority
who pays a vendor twice for the same products(inventory or supplies) received.
 - The vendor recognizing that its customer made a double payment, issues a
reimbursement to the victim company, which the clerk intercepts and
cashes.
 Check tampering - involves forging or changing a check that the organization has
written to a legitimate payee.
 - A variation of this is an employee who steals blank check from the victim
company, makes them out to himself or an accomplice.
 Payroll fraud - is the distribution of fraudulent paychecks to existent and/or
nonexistent employees.
 Expense reimbursement frauds - are schemes in which an employee makes a claim
for reimbursement of fictitious or inflated business expenses.
 Theft of cash
 are schemes that involves the direct theft of cash on hand in the organization.
 An employee who makes false entries on a cash register, such as voiding a sale, to conceal
the fraudulent removal of cash.
 Non - cash fraud
 involves the theft or misuse of the victim organization non-cash assets.
 One example of this is a warehouse clerk who steals inventory from a warehouse or
storeroom.

 Corruption
 Bribery - involves giving, offering, soliciting, or receiving things of value to influence an official
in the performance of his or her lawful duties.
 Illegal gratuities - involves giving, receiving, offering, or soliciting something of value
because of an official act that has been taken.
 Economic extortion - is the use of force, threat (including economic sanctions) by an individual
or organization to obtain something of value
 Conflict of interest - occurs when an employee acts on behalf of a third party during discharge of
his duties or has self- interest in the activity being performed.
 Fraudulent Statements
Fraudulent financial reporting is the intentional or reckless conduct, whether by act or omission, that
results in materially misleading financial statements.

Financial statements are falsified to:

 Deceive investors and creditors.
 Cause a company stock price to rise
 Meet cash flow needs
 Hide company losses and problems.

Fraudulent statements
 Financial statements fraud is distinct from other types of fraud in that the individuals who commit
the fraud are not direct beneficiaries.
 The company is the direct beneficiaries
 The perpetrators are typically indirect beneficiaries.

Financial Statement Fraud

The following is seen as the possible problems associated with financial statements fraud.

 Lack of Auditor Independence

 Some auditing firms offer non-accounting services such as consulting.
 The risk is that the auditors will not bring to management attention problems they have seen
which they think will affect their consulting fees.
 Lack of Directors Independence
 Some directors are members of the board; a major customer of the organization; received a
personal loan from the organization, etc.
 This relationship reverses independence.
 Questionable Executive Compensation
 Executives are sometimes given a stock option compensation.
 Excessive use of short term stock options to compensate executives and directors may
result in short term thinking.
 Inappropriate Accounting Practices
 Inappropriate accounting practices is common to many financial statements fraud.
 WorldCom, (1 of the big 3) transfer one of their major current expense to capital accounts.
 The transfer resulted to deferred expense and higher income.

 Other Types of Fraud

 Intellectual Property Theft > Financial institution fraud
 Check and Credit cards fraud > Healthcare fraud
 Tax Fraud > Money Laundering
 Consumer Fraud > Insurance Fraud
 Securities Fraud > Bankruptcy Fraud
 Computer and Internet Fraud

The commitment of Fraud

The norms of committing fraudulent act:
 The fraud perpetrator must gain the trust or confidence of the person or company being
defrauded in order to commit and conceal the fraud.
 Instead of using a gun, knife, or physical force, fraudsters use weapons of deceit and
misinformation.

The Fraud Process

 Frauds tend to start as the result of a perceived need on the part of the employee and then escalate
from need to greed.
 Most fraudsters can't stop once they get started, and their frauds grow in size.
 The fraudsters often grow careless or overconfident over time.
 Fraudsters tend to spend what they steal. Very few save it.
 In time, the sheer magnitude of the frauds may lead to detection.
 The most significant contributing factor in most employee frauds is the absence of internal
controls and/or the failure to enforce existing controls.
The Fraudulent FR and the Auditors
 Fraudulent financial reporting is of great concern to independent auditors, because
undetected frauds lead to half of the lawsuits against auditors.
 In the US, a financial statement fraud led to the total closure of Arthur Andersen, a premiere
international public accounting firm.

Reducing the possibility of Fraudulent FR

National Commission on Fraudulent Financial Reporting (Treadway Commission)
recommendation:
 Establish an organizational environment that contributes to the integrity of the financial reporting
process.
 Identify and understand the factors that lead to fraudulent financial reporting.
 Assess the risk of fraudulent financial reporting within the company.
 Design and implement internal controls to provide reasonable assurance that fraudulent financial
reporting is prevented.

Research Findings
White collar criminals tend to mirrors the general public in:
 Education
 Age
 Religion
 Marriage
 Length of employment
 Psychological makeup

More findings …
 Perpetrators of computer fraud tend to be younger and possess more computer knowledge,
experience, and skills.
 Hackers and computer fraud perks tend to be more motivated by:
 Curiosity
 A quest for knowledge
 The desire to learn how things work
 The challenge of beating the system
 They may view their actions as a game rather than dishonest behavior.
 Another motivation may be to gain stature in the hacking community.
 Some see themselves as revolutionaries spreading a message of anarchy and freedom.
 But a growing number want to profit financially. To do so, they may sell data to:
 Spammers
 Organized crime
 Other hackers
 The intelligence community
 Some fraud perpetrators are disgruntled and unhappy with their jobs and are seeking revenge
against their employers.
 Others are regarded as ideal, hard working employees in positions of trust.
 Most have no prior criminal record.
 In other words, they were good people who did bad things.
Factors that Contribute to Fraud
Pressure - Motivation or Incentive to fraud
Rationalization - Justification of Dishonest Actions
Opportunity - The Knowledge and Ability to Carry out Fraud.

Pressure
 A pressure is a person's incentive or motivation for committing fraud.
 Three types of pressures that lead to misappropriations are shown in the Employee Pressure
Triangle Financial

Employee
Pressure
EmotionalLifestyle Triangle

Financial Pressure
 Financial pressures often motivate misappropriation frauds by employees.
 Examples of such pressures include living beyond one's means, heavy financial losses, or high
personal debt.
 Often, the perpetrator feels the pressure cannot be shared and believes fraud is the best way out of
a difficult situation.

Emotional Pressure
 Many employee frauds are motivated by greed.
 Some employees turn to fraud because they have strong feelings of resentment or believe
they have been treated unfairly.
 They may feel their pay is too low, their contributions are not appreciated, or the company is
taking advantage of them.

Lifestyle.
 The person may need funds to support a gambling habit or support a drug or alcohol addiction.
 One young woman embezzled funds because her boyfriend threatened to leave her if she did not
provide him the money he needed to support his gambling and drug addictions.

Table 5.2. Pressure that can lead to Employee Fraud

Financial EMOTIONAL LIFESTYLE
• Living beyond means • Greed • Support gambling habit
• High personal debt/expenses • Unrecognized performance • Drug or alcohol addiction
• “Inadequate” salary/income • Job dissatisfaction • Support sexual relationships
• Poor credit ratings • Fear of losing job • Family/peer pressure
• Heavy financial losses • Power or control
• Bad investments • Pride or ambition
• Tax avoidance • Beating the system
• Meet unreasonable • Frustration
quotas/goals • Non-conformity
• Envy, resentment
• Arrogance, dominance
• Non-rules oriented

Three types of organizational pressures that motivate management to misrepresent financial statements
are shown in the Financial Statement Pressure triangle.
Financial

FS
Pressure Triangle
Industry Conditions Management Characteristics
 A prevalent financial pressure is a need to meet or exceed earnings expectations to keep a
stock price from falling.
 Managers create significant pressure with unduly aggressive earnings forecasts or unrealistic
performance standards, incentive programs that motivate employees to falsify Financial results to
keep their jobs or to receive stock options and other incentive payments.
 Industry conditions such as new regulatory requirements or significant market saturation with
declining margins can motivate fraud.

Opportunity
 The condition or situation that allows a person or organization to commit and conceal a dishonest
act and convert it to personal gain.
 As shown in the Opportunity triangle, opportunity is the condition or situation, including one
personal abilities, that allows a perpetrator to do three things:
Commit

Opportunity Triangle
Conceal Convert

OPPORTUNITY
 Commit the fraud.
 The theft of assets is the most common type of misappropriation.
 Most instances of fraudulent financial reporting involve overstatements of assets or revenues,
understatements of liabilities, or failures to disclose information.
 Conceal the fraud.
 Concealing the fraud often takes more time and effort and leaves more evidence than
the actual theft or misrepresentation.
 To prevent detection when assets are stolen or financial statements are overstated, perpetrators
must keep the accounting equation in balance by inflating other assets or decreasing
liabilities or equity.
 Examples of concealment efforts:
 Charge a stolen asset to an expense account or to an account receivable that is about to
be written off.
 Create a ghost employee who receives an extra paycheck
 Lapping
 Convert the Proceeds
 Unless the target of the theft is cash, then the stolen goods must be converted to cash or some
form that is beneficial to the perpetrator.
 Checks can be converted through alterations, forged endorsements, etc
 Non-cash assets can be sold (online auctions are a favorite forum) or returned to
the company for cash.

If the fraud is a financial statement fraud, then the gains received may include;
 I got to keep my job
 The value of my stock or stock option rose.
 I got a raise, promotion, or bonus.
 I got power.

There are many opportunities that enable fraud. Some of the most common are:
 Lack of internal controls
 Failure to enforce controls (the most prevalent reason)
 Excessive trust in key employees
 Incompetent supervisory personnel
 Inattention to details
 Inadequate staff

Internal controls that may be lacking or UN-enforced include:

 Authorization procedures
 Clear lines of authority
 Adequate supervision
 Adequate documents and records
 A system to safeguard assets
 Independent checks on performance
 Separation of duties
One control feature that many companies lack is a background check on all potential employees.

Management may allow fraud by:

 Not getting involved in the design or enforcement of internal controls;
 Inattention or carelessness;
 Overriding controls; and/or
 Using their power to compel subordinates to carry out the fraud

Rationalization
 It is important to understand that fraudsters do not regard themselves as unprincipled.
 In general, they regard themselves as highly principled individuals.
 That view of themselves is important to them.
 The only way they can commit their frauds and maintain their self image as principled
individuals is to create rationalizations that recast their actions as “morally acceptable”
behaviors.
 These rationalizations takes many form, including:
 I was just borrowing the money.
 I wasn’t really hurting anyone. (corporation are often seen as non-persons, therefore crime
against them are not hurting “anyone”
 Everybody does it.
 I've worked hard for them for 35 years and been underpaid all that time. I wasn’t stealing; I
was only taking what was owned to me.
 I didn’t take it for my self. I needed it to pay my child's medical bills.
 Creators of worms and viruses often use rationalizations like:
 The malicious code helped expose security flaws, so I did a good service.
 It was an accident
 It was not my fault - just an experiment that went bad.
 It was the users fault because they didn’t keep their security up to date.
 If the code didn’t alter or delete any of their files, then whats the problem?

CONCLUSION
 Fraud occurs when:
 People have perceived, non-shareable pressures;
 The opportunity gateway is left open; and
 They can rationalize their actions to reduce the moral impact in their minds (i.e., they
have low integrity).
 Fraud is much less likely to occur when
 There is low pressure, low opportunity, and high integrity.
Computer Fraud
Any fraud that requires computer technology to perpetrate it. Examples include;
 Unauthorized theft, use, access, modification, copying, and destruction of software or data.
 Theft of money covered by altering computer records.
 Intent to illegally obtain information or tangible property illegally through the use of computers.
 Theft or destruction of computer hardware.
 Use or the conspiracy to use computer resources to commit a felony.

The rise of Computer Fraud -- it is estimated that computer fraud costs the United States somewhere
between $70 billion and $125 billion a year and still increasing.

In using a computer, fraud perpetrators can steal:

– More of something
– In less time
– With less effort
– They may also leave very little evidence, which can make these crimes more difficult to detect.

Computer systems are particularly vulnerable to computer crimes for several reasons:
– Company databases can be huge and access privileges can be difficult to create and enforce.
– Consequently, individuals can steal, destroy, or alter massive amounts of data in very little time.
– Organizations often want employees, customers, suppliers, and others to have access to their system
from inside the organization and without. This access also creates vulnerability.
– Computer programs only need to be altered once, and they will operate that way until:
• The system is no longer in use; or
• Someone notices.

Reasons: The Rise of Computer Fraud:

 Not everyone agrees on what constitutes computer fraud.
 Many instances of computer fraud go undetected.
 A high percentage of frauds in not reported.
 There are a growing number of competent computer users, and they are aided by easier access
to remote computers through the Internet and other data networks.
 Many networks are not secure.
 Internet sites offer step-by-step instruction on how to perpetrate computer fraud and abuse.
 Law enforcement cannot keep up with the growth of computer fraud. Because of lack of funding
and skilled staff, the FBI investigates only 1 in 15 computer crimes.
 The total value of losses is difficult to calculate.

Computer Fraud Classification

Frauds can be categorized according to the data processing model:
• Input
• Processor
• Computer instructions
• Stored data
• Output

 Input Fraud
 The simplest and most common way to commit a fraud is to alter computer input.
 Requires little computer skills.
 Perpetrator only need to understand how the system operates
 Can take a number of forms, including:
 Disbursement frauds – the perpetrator causes a company to:
 Pay too much for ordered goods; or
 Pay for goods never ordered.
 Inventory frauds
 The perpetrator enters data into the system to show that stolen inventory has been scrapped.
 Payroll frauds
 Perpetrators may enter data to:
 Increase their salaries
 Create a fictitious employee
  Retain a terminated employee on the records.
 In the latter two instances, the perpetrator intercepts and cashes the resulting paychecks.
 Cash receipt frauds
 The perpetrator hides the theft by falsifying system input.
 EXAMPLE: Cash of $200 is received. The perpetrator records a cash receipt of $150
and pockets the $50 difference.
 Fictitious refund fraud
 The perpetrator files for an undeserved refund, such as a tax refund.

 Processor Fraud
 Involves computer fraud committed through unauthorized system use.
 Includes theft of computer time and services.
 Incidents could involve employees:
 Surfing the Internet;
 Using the company computer to conduct personal business; or
 Using the company computer to conduct a competing business.

 Computer Instruction Fraud

 Involves computer fraud committed by tampering with the software that processes company data.
 May include:
 Modifying the software
 Making illegal copies
 Using it in an unauthorized manner
 Also might include developing a software program or module to carry out an unauthorized
activity.
 Computer instruction fraud used to be one of the least common types of frauds because it required
specialized knowledge about computer programming beyond the scope of most users.
 Today these frauds are more frequent--courtesy of web pages that instruct users on how to create
viruses and other schemes.

Data Fraud
 Involves:
 Altering or damaging a company’s data files; or
 Copying, using, or searching the data files without authorization.
 Theft of data to be sold to people outside the organization. (identity theft)
 In many cases, disgruntled employees have scrambled, altered, or destroyed data files.
 Theft of data often occurs so that perpetrators can sell the data.
 Most identity thefts occur when insiders in financial institutions, credit agencies, etc., steal and
sell financial information about individuals from their employer’s database.

Output Fraud
 Involves stealing or misusing system output.
 Unless properly safeguarded, screen output can easily be read from a remote location
using inexpensive electronic gear.
 Output is usually displayed on a screen or printed on paper./ Printed output can easily be copied
and sold to outsiders.
 This output is also subject to prying eyes and unauthorized copying.
 Fraud perpetrators can use computers and peripheral devices to create counterfeit outputs, such as
checks.

Specific Techniques
Perpetrators have devised many methods to commit computer fraud and abuses. These includes:
 Phishing
 Piggybacking
 Round-down technique
 Social engineering
 Software piracy
 Spamming
 Spyware
 Keystroke loggers
DETER AND DETECT
 Organizations must take every precaution to protect their information systems.
 Certain measures can significantly decrease the potential for fraud and any resulting losses.
 These measures include:
 Make fraud less likely to occur
 Create a culture that stresses integrity and commitment to ethical values and
competence.
 Adopt an organizational structure, management philosophy, operating style,
and appetite for risk that minimizes the likelihood of fraud.
 Require oversight from an active, involved, and independent audit committee.
 Assign authority and responsibility for business objectives to specific departments and
individuals, encourage initiative in solving problems, and hold them accountable for
achieving those objectives.
 Identify the events that lead to increased fraud risk, and take steps to prevent, avoid,
share, or accept that risk.
 Develop a comprehensive set of security policies to guide the design and
implementation of specific control procedures, and communicate them effectively
to company employees.
 Implement human resource policies for hiring, compensating, evaluating, counseling,
promoting, and discharging employees that send messages about the required level of
ethical behavior and integrity.
 Effectively supervise employees, including monitoring their performance and
correcting their errors.
 Train employees in integrity and ethical considerations, as well as security and fraud
prevention measures.
 Require annual employee vacations, periodically rotate duties of key employees, and
require signed confidentiality agreements.
 Implement formal and rigorous project development and acquisition controls, as well as
change management controls.
 Increase the penalty for committing fraud by prosecuting fraud perpetrators more
vigorously.

 Improve detection methods

 Create an audit trail so individual transactions can be traced through the system to the
financial statements and vice versa.
 Conduct periodic external and internal audits, as well as special network security audits.
 Install fraud detection software.
 Implement a fraud hotline
 Employ a computer security officer, as well as computer consultants and
forensic specialists as needed.
 Monitor system activities, including computer and network security efforts, usage and
error logs, and all malicious actions.
 Use intrusion detection systems to help automate the monitoring process.
 Reduce fraud losses
 Maintain adequate insurance.
 Develop comprehensive fraud contingency, disaster recovery, and business
continuity plans.
 Store backup copies of program and data files in a secure, off-site location.
 Use software to monitor system activity and recover from fraud