Special Agent Andrew Pappas

6/19/19

1

Special Agent Andrew Pappas, CPA, CFE

SBI Financial Crime Investigations

Financial Crimes Case Study

Financial Crimes:– Obtaining Property by False

Pretenses– Identity Theft– Forgeries– Cash structuring

State of North Carolina v. Roger Kornegay

6/19/19

2

3 Vacant, Oceanfront/Ocean view Lots in Topsail Beach & N. Topsail Beach, NC

•3 Valid General Warranty Deeds • 1 Michigan couple• 2 Raleigh couples

• All properties free of debt

• Michigan victim reports to NC Law Enforcement

6/19/19

3

“John Worley” hires local attorneys to prepare new deeds

3 properties conveyed to “John Worley”

6/19/19

4

“John Worley” advertises properties:

Newspaper & Online Advertisements- Raleigh News & Observer- For Sale by Owner Websites

“FSBO – Oceanfront Lot, N. Topsail Beach - $250,000 OBO. Call John 919-

397-7511”

6/19/19

5

June: Raleigh resident buys 1 Lot for $250,000

No RealtorsCash Purchase

Buyer & Seller Not Present at ClosingClaims of Cancer

6/19/19

6

June:$246,894.75 deposited to First

Citizens Bank Account belonging to

“John Worley”

July:$132,934.60 wired to same

account

6/19/19

7

Partnership between financial institutions and law enforcement

– Contact the bank – Provide a search warrant to the

bank– Conduct interview and review

records with bank personnel

Search Warrant for First Citizens Bank Records

Search warrant example

6/19/19

8

6/19/19

9

• John Worley:• Staff Member University of

Mississippi• Ole Miss Police Department

• Advised John Worley was the victim of identity & credit card theft the previous November

6/19/19

10

•Roger Glen Kornegay identified as suspect in Ole Miss/Worley theft

• Also suspect in ID/Credit Card Thefts from:• Mississippi State University• East Carolina University• University of Wilmington, NC• Jacksonville, NC• Lincoln, Nebraska

6/19/19

11

• Interviews w/ Karen Scalf (sister) & Kelvin Kornegay (brother)• Both identify the FCB Photos as

Roger Kornegay• Last known whereabouts McCook,

NE• Fugitive (USM Outstanding

Warrant)

• Interview w/ Lt. Gregory, East Carolina University Police Dept.

• Last known vehicle/stolen identities

• Search Warrant to State Farm Ins.• Arrested in Jacksonville, NC

6/19/19

12

•Assistance from NCDMV License & Theft

•Assistance from Colorado Bureau of Investigation

6/19/19

13

•Vehicle sold to Ben Mendoza•Seller “Kelvin Kornegay”•Purchased home in rural Colorado

using stolen identity•Dating Melanie Berg (Peyton, CO)

•Kornegay Arrest Photos

6/19/19

14

•Kornegay sentenced to Allenwood Federal Correctional Institution in White Deer, PA

•Extradited to NC

•2 Counts of Obtaining Property by False Pretenses > $100,000

•5 Counts of Forgery of Deeds•9 Warrants in other NC

Jurisdictions•Multiple warrants in Mississippi

& Nebraska

• NC Charges:

6/19/19

15

• Pled guilty to 5 counts of Obtaining Property by False Pretenses > $100,000 and Forgery of Deeds

• Active Sentence of 4 to 6 years• Extradited back to Allenwood

Federal Correction Institution

uBank RecordsuPhone TollsuMail CoveruPen RegisteruInformantsuSearch WarrantsuPublic RecordsuDMV RecordsuSAR DatauSocial Media

6/19/19

16

SBI Financial Crime Investigations Unit

• Specialized unit investigating white collar crimes including embezzlement, fraud, and corruption

• Based in Raleigh, Greensboro and Charlotte with statewide jurisdiction

• Special Agent in Charge, Assistant Special Agent in Charge, 5 Special Agents, and 1 Special Investigator

• Requirements for a Special Agent – Bachelor’s degree with 18 hours of accounting and 2 years experience

Aspects of the Job

• Interview victims, witnesses, and suspects• Prepare and execute search warrants• Review financial documentation relating to evidence of a crime and

prepare analysis• Prepare investigative report for the District Attorney, Federal

Prosecutor, Resource Prosecutor, or Special Prosecutions Section. • Testify before grand juries• Arrest suspects• Testify in criminal trials

6/19/19

17

Federal vs. State Prosecution of Financial Crimes• There is a general misconception that it is always preferable to

prosecute a case federally. That might be true in some investigations, such as public corruption and money laundering.

• The biggest advantage of investigating a case federally is the ability to use the federal grand jury to compel testimony and obtain records.

• However, as a general rule, a defendant who embezzles or fraudulently obtains $100,000 or more will receive more prison time in the state system (Class C felony).

Convictions

Berjoe Simplina OccenaW/M/DOB: 08/18/1968

Guilty: 4 counts Embezzlement > $100,000

Sentence: 73-100 months

Summary: Former employee of Mt. Olive Pickle Company

$1 million fraudulent billing scheme

6/19/19

18

Convictions

Laura Marino RiddickW/F/DOB: 11/06/1966

Guilty: 6 counts Embezzlement by Public Official > $100,000


Summary: Former elected Register of Deeds for Wake County

Paid back $926,615

Susan White GarciaW/F/DOB: 02/16/1971

Guilty: 5 counts Embezzlement > $100,000


Summary: Accounts Payable Manager for Big Rock Sports

$5 million scheme using company credit cards

Convictions

6/19/19

19

ConvictionsDana Shane Cope

W/M/DOB: 06/29/1969

Guilty: 2 counts Obtaining Property by False Pretenses > $100,000


Summary: SEANC Executive Director

$500,000 scheme using company credit cards

$165,000 paid back

ConvictionsKelvin Lawrence Ballentine

B/M/DOB: 04/17/1977

Guilty: Obtaining Property by False Pretenses > $100,000; Altering Court Records


Summary: Wake County Clerk’s Office

$961,000 scheme to defraud the Wake County Court System of Bond Forfeiture proceeds

6/19/19

20

Common Factors Involving Embezzlements

• Segregation of duties – limited or nonexistent in most cases• Internal controls – weak internal controls or noncompliance• Length of employment – usually employed for numerous

years• Trusted employee• Personal work habits – works long hours, does not want

assistance, eager to take on new duties, and reluctant to take vacation

Characteristics of Classic Embezzlers

• Usually work their crimes alone• Tend to be compulsive (gambling, abusing alcohol/drugs)• Spend money freely (their own and/or the company’s)• Rationalize their thefts by thinking they are merely

“borrowing”• Tend to repeat and escalate their crime• Exploit weaknesses in internal controls to cover up their

crimes• Have ready access on-the-job to cash or its equivalent

6/19/19

21

Why Do People Embezzle?

• Greed• Addiction

• Substance abuse• Gambling• Shopping

• Extra-marital affair• Low self-esteem• I’ve earned it

Organizational Red Flags

• No Communication of Expectations• Too Much Trust in Key Employees• Lack of Established Policies and Procedures• Lack of Attention to Detail• Changes in Organizational Structure• Tendency Toward Crisis Management

6/19/19

22

Financial Document Red Flags

• Missing Documents• Alteration of Documents• Excessive Number of Voided Documents• Documents Not Numerically Controlled• Questionable Handwriting or Authorization• Duplicate Payments• Unusual Billing Addresses or Arrangements• Address of Employee Same as Vendor• Fraudulent Invoice/Uncommon Vendor

Accountability and Control Red Flags

• Lack of Separation of Duties• Lack of Physical Security and/or Key Control• Weak Links in Chain of Controls and Accountability• Missing Independent Checks on Performance• Lax Management Style• Poor System Design• Inadequate Training

6/19/19

23

Embezzlement by Accounting Supervisor

• Clayton, North Carolina• Manufacturer of electrical products

for large retail construction• 50 Employees

• Business Name YearPCX Corporation 1996-1999Integrated Elec. Svcs. 1999-2002PCX Corporation 2002-Present

PCX Corporation

• Suspect: Karen Lynne Thornton• Accounting Supervisor ($52K a year)• Employee since 1996

• Worked for the 2 previous owners• Most knowledgeable person in the company• Reported directly to company GM

• A/R, A/P, reconciled bank statements, administrative duties, generate checks, access to online banking

• Did not handle deposits or payroll • No signature authority


6/19/19

24

• Company Policy: All checks signed by GM• Larger than $5,000 required two signatures

• Thornton authorized to use company BofA Visa debit card for misc. expenses (break room supplies, etc.)

• June 2009: Company initiates 20% across the board pay cut

• September 2009: Outside source contacted company and stated Thornton was stealing from the company


• Thornton admits to GM to using the business debit card for personal use (gas, groceries, etc.)

• Owners unable to verify unauthorized use of debit card (commingled personal vs. legitimate use at Wal-mart, Target, etc.)

• No loss can be determined by the company• Thornton terminated October 2009 due to her

admissions, despite being a valued and good employee with strong work performance


6/19/19

25

•2 months after Thornton’s termination…

•PCX contacted by Bank of America and informed the business was longer making payments on its credit card• Card established in 1999 in name of PCX

Corporation• Owners of the company had no

knowledge of the BofA credit card


• PCX Bank of America Credit Card• Unknown to and Unauthorized by Current

Owners• Established under previous owners (1999).• Credit Card statements sent to business initially,

later directed to Thornton’s home address• Used by Thornton for her personal use:

• Restaurants, Gas, Groceries, Clothes• Household bills, Utilities• Hotels, Vacations, GiftCertificates.com• Cash Advances


6/19/19

26

• Initial review of bank statements showed $262,355.50 in unauthorized checks & withdrawals from business checking account

• Applied as payments to the unauthorized Credit Card• Investigation and further review showed an

additional $412,684.45 in unauthorized checks & withdrawals

• Total: $675,039.95 (from 2004 – 2009)


• More than $100,000 passed through PayPal• Thornton “loaded” payments to one PayPal account (AOL email) by charging the “PCX” Credit

Card• Transferred the payments to a second PayPal account (Yahoo email)• Subsequently transferred the payments from there to her personal bank account

• False entries made to the company’s computer system to conceal theft

• Unauthorized payments fraudulently coded as if the payment was to a legitimate vender (Gen. Elec, etc.)

• Amounts consistent with normal payments to those vendors• Actual payee on the check/withdrawal was Bank of America

• No one reviewed the bank reconciliations


6/19/19

27

Overview of Unauthorized Checks/Drafts from the PCX Corporation Checking Account

March 12, 2004 – September 18, 2009

Victim:

Unauthorized Company Checks

$412,684.45 Payments to unauthorized credit card used by Thornton (Suspect)

Restaurants, Gas, Groceries, Clothes

Household Bills, Utilities

Hotels, Vacations, GiftCertificates.com

Cash Advances

$262,355.50

$119,236.97

AOLPayPal

Yahoo!PayPal

$109,941.82 Transferred into Thornton’s Personal Checking Account

Credit Card Purchases:

Total Amount of Unauthorized Checks/Drafts = $675,039.95

Unauthorized Company

Drafts

• Karen Lynne Thornton, DOB: 6/06/1972

• Pled Guilty – August 2011• 6 felony counts of Obtaining

Property by False Pretenses• Received Active Prison

Sentence of 5 to 6 ½ years

• Paid $75,000 Restitution to PCX Corporation at time of plea

• $300,000 of loss recovered from insurance


6/19/19

28

SBI Financial Crime Investigations

[email protected]

Special Agent Andrew Pappas

Documents

Transcript of Special Agent Andrew Pappas