Fraud investigations: Uncovering hidden financial accounts and assets

Persons engaged in fraud and illegal activity have long used several methods to hide ill-gotten assets. Today, forensic investigators have powerful new technological tools to track and uncover these assets. Some specialized techniques may require digital forensic specialists; however, more basic options are also effective. Whether the suspected fraudster is a business partner, an employee or some other related party, the process for uncovering hidden accounts tends to follow a similar path.

Let’s look at basic techniques first.

The first step is to build a financial profile for the person or entity in question. This process involves gathering and reviewing documents and records such as tax returns, bank statements, mobile payment account history, investment account statements, credit card statements, life insurance policies, paycheck stubs, real and personal property records, lien records and any other financial-related statements for the period of time during which questionable activity is suspected. As these documents are being compiled, build a master list comprised of all accounts identified, including owner’s names, authorized users, associated addresses or other account profile information. It is also advisable to identify potential email addresses, social media accounts and other web-based account information.

When analyzing these documents, keep the following tips in mind:

• For financial accounts identified, get the electronic statements directly from the source when possible. This helps ensure the integrity of the information. Also, if possible, obtain the information in electronic format so it can be ingested into various search and analysis tools.
• Tax returns provide information concerning wages, business income and investment income. They can identify the existence of both real and personal property and the possibility of foreign accounts or trusts. As tax returns reveal sources of income, tie them to specific accounts. For example, if interest income is listed on the return, but no account is identified, investigate to find an institution, account number and the related statements.
• If a business is uncovered, in addition to identifying all financial accounts related to that business, try to obtain the articles of organization and/or other ownership information for that business. This can help identify, among many things, parties involved in an illegal activity and other businesses a suspect is associated with, and it can even help identify any hidden assets.
• Investment accounts have long been a popular vehicle to transfer and/or launder illegal funds through the purchase and subsequent sale of financial products and commodities.
• Reviewing pay stubs from the relevant period cannot only identify multiple bank accounts, but it can also help identify and/or support any unusual spending behavior and other financial activity.
• Mobile payments through providers such as PayPal and Venmo have become increasingly popular and provide another avenue to divert funds and hide assets. The transaction history for these accounts should be obtained not only for this reason, but in addition, it provides a paper trail of both the origin and recipient of funds that could uncover hidden accounts or parties associated with a fraud or illegal activity.
• Depending on the jurisdiction (state, county, city) real property records including deeds, liens and other documents identifying ownership of assets are publicly available information. These records can be used to identify any assets not previously reported without the request of a subpoena.
• If a recent credit report can be obtained, it can be a useful document to help identify a large portion of these items in a consolidated format.

With all information gathered, the next step is a funds-tracing exercise to analyze deposits to, and withdrawals from, each of the identified accounts. Funds tracing may reveal even more accounts for which statements should be obtained and funds traced. Update the account master list to reflect any new accounts discovered and to record all deposits, withdrawals and other activity for each account. When conducting a funds tracing, remember the following:

• Develop a thorough list of the suspect’s family members and acquaintances, including names, aliases and addresses, and match those names against account statements and transactions to determine if any related parties received funds. Close attention should be paid to any financial transactions with the suspect’s parents, children, siblings, romantic partners and any of their respective businesses.
• Any unusual transfers or expenditures deserve special attention, as well as recurring deposits from a bank or brokerage in any amount. This could uncover dividend-paying stocks or interest-paying bonds.
• A review of canceled checks will not only tell to whom the checks were paid, but also to what account number and institution the check was deposited, which can lead to new hidden accounts. Again, pay special attention to checks to family members and acquaintances or for unusual activities or amounts.
• An analysis of ATM withdrawals or credit card cash advances, including aggregate amounts and the locations made, may indicate areas where the suspect is spending a large amount of time and possibly working to hide assets in secret accounts. Ask for explanations for any large cash withdrawals, whether through an ATM or in person.

Digital forensic analysis is another powerful tool for tracking down hidden assets. Whether it’s a work computer, personal computer, tablet or smart phone, any activity performed on the device can leave a trail of evidence. More sophisticated suspects may use encryption, wiping programs and private or remote web-browsing sessions to hide this evidence, but such steps on their own can help indicate fraud.

Digital forensic efforts to uncover hidden accounts focus on a variety of areas, including:

• Email contents—investigators can conduct keyword searches using names of suspected co-conspirators, romantic partners, family members, business dealings, business names, known code words or any other word or words that might be of interest to the investigator. They can also search for key information, such as new account setup forms, details or confirmations related to wire transfers, mobile payments, details of new business ventures or other case-specific information.
• Accounting or budgeting software programs—a suspect who is a business owner or key accounting employee may be keeping multiple sets of books. Even if deleted, these may be recovered via digital forensic analysis and lead to unknown accounts.
• Spreadsheets and other files—suspects often keep track of account numbers and other information in spreadsheets or other files.
• Browsing history—most internet browsers log information pertaining to website visits, as well as other internet activities, such as the completion of web-based forms and temporary internet files. A digital forensic specialist may uncover visits to bank or brokerage websites that may lead to unidentified accounts. Internet activity can also show information relating to online purchasing and payment activity, which could be useful in identifying expenditures and other potential assets.
• Metadata analysis—artifacts contained within documents (Word, Excel, PDFs), such as created and modified times, username and company name, can also help uncover fraud.
• Registry analysis—certain artifacts stored in the registry, such as USB connection information, network and login information also can help in an investigation.
• Mobile devices—forensic specialists can analyze call logs, SMS messaging, and in some cases, email and email attachments. In addition, users tend to use these devices to access and monitor various assets such as financial accounts, online payment, etc.
• Online social media activity, including Facebook, LinkedIn and other sites—an analysis of a suspect’s public profile and activity may uncover a hidden business or other interests, which may lead to other unknown accounts. In addition, people frequently post information and pictures of new assets (i.e., cars, boats, etc.) on social media sites. This can lead investigators to potential assets and also help with documenting large expenditures.

By forensically preserving the electronic evidence (computer hard drive, mobile device, etc.) a number of potential data sources might become available. Included in this forensically preserved data might be previously deleted files, multiple versions or iterations of files, indications of files and programs being accessed. All of these items could provide leads for additional sources of information or indications of the user accessing or deleting data.

While this is not exhaustive, it does provide a useful overview for tracking down hidden accounts. Keep in mind that accounts are not the only places where fraudulent gains can be hidden. However, a thorough search for, and careful analysis of, hidden accounts should be a central part of any fraud investigation.