Skimming Debtors Receipts – Cash Frauds

What is Occupational Fraud?

Occupational fraud is fraud committed by an employee on an employer in the course of their employment. They are more common and cause more financial loss to businesses than frauds committed by third parties. As employees will continue to work at the business, they will generally try to hide these frauds permanently, meaning that occupational fraud can be committed over an extended period of time.

What is the skimming of debtors?

Skimming is the theft of money received before it has been recorded in the books of the business as being received. Skimming debtors is the theft of money received from a debtor before the receipt has been recorded in the debtors ledger. The ‘debtors’ part is simply a description of what money is targeted (debtors collections) and the ‘skimming’ part is a description of when the attack takes place (before recording). A different fraud – usually a billing fraud – is necessary once the receipt has been recorded and banked.

Skimming frauds are never meant to be discovered. In some cases frauds do not need to be hidden, but this is not one of those cases. An amount due from a debtor is recorded in the business’s debtor’s ledger when the sale was made, and the business expects the amount to be collected within a certain time. The fraud will be discovered if it is not hidden as the business will eventually make demands on the debtor for the payment and the debtor will provide proof of payment.

Major Headings

Description of the Fraud

How is skimming done?
Hiding the Loss
Handling skimmed cheques

For Example
Lessons to be Learned
Prevention and Detection

Description of the Fraud

Skimming is an easy fraud to commit and may occur anywhere that money is received by the business. The two common places are where cash sales are made and where debtors are collected. Skimming these different receipts requires some different techniques: whether hiding missing stock from skimmed sales; hiding missing trade debtor receipts; or simply converting stolen cheques. This paper concentrates on skimming debtors receipts.

Because debtor’s receipts are stolen before they are recorded, the theft may go unnoticed for some limited time. This gives the employee some time to hide the theft.

There is a technique called Lapping that is used to hide the fraud. This is described below. There are also other ways that the dishonest employee may hide the fraud, but whether they can use these methods will depend on the authority that they have within the business system.

Sometimes the aim of the fraud is not to permanently keep the stolen monies, but to hold and invest the money for a short period – even a few days – return the original money and keep the interest earned. This can be profitable, but is usually only worthwhile when the amounts involved are large. A $10 million receipt invested on Friday afternoon to Monday morning may earn the fraudster $5,000 in interest – not a bad extra income – while the receipt may not be missed for that short period.

How is skimming done?

Skimming debtors can be as simple as taking money directly from the incoming mail. The payment has not have been recorded and no one else may even recall the receipt. It is more common to steal money before it has been recorded, but it is not necessary – money may be stolen after it has been recorded and before it is banked, but this is another type of fraud and requires a different way of hiding the fraud.

After the receipt has been recorded, the business knows that it has been received so the banking records will have to be manipulated to balance the banking and hide the theft. The debtor record is updated and the monies should be processed for banking. Any checks of the daily banking against the recorded receipts will highlight missing receipts. This, of course, assumes that the business actually has controls in place to verify these amounts. If they do not, the fraud can easily be done and has little chance of being discovered.

Manipulating the banking is not an issue if the theft occurs before the amount is recorded. If you don’t know that you had it in the first place, you don’t know that it should be banked and you don’t know you have lost it.

The theft, the actual skimming, is as easy as pocketing the money from the mail. Hiding the theft and converting it to a usable form is the more difficult part. The majority of receipts are likely to be made by cheque – cash would rarely be mailed. If a cheque is stolen, it will have to be converted to cash and this poses problems that are discussed below.

Hiding the Loss

Skimming debtors is more complicated than skimming sales as the original sale has been recorded and a debt appears in the debtor’s ledger. The business expects to receive that amount within a certain time frame.

Without hiding the theft, the amount due will be recorded as uncollected and someone will eventually try to collect it. The debtor will be contacted and the fraud will be discovered. So the theft must be hidden and how that is done may depend on what authority the fraudster has within the business. The more common ways of hiding the theft are:

(i) Placing an entry into the relevant debtor’s ledger to reduce their account by the amount stolen. These entries may record the actual receipt – as long as it is not going to show up on a banking list – a false discount, write-off, return etc. Any statement issued to the debtor must show the position as the debtor believes it and any entries that do not record a receipt of the money may be questioned by the debtor and cause further problems.

(ii) If the amount is stolen after it has been recorded in the debtor’s ledger, the employee will need to falsify the banking records to indicate that the amount has actually been banked. This can be difficult as the bank has the correct details (the actual banking) and reconciliation may discover any false entries.

(iii) Recording money received from a failed customer as received from the customer whose money has been stolen. This causes an inflated write-off on the failed customer’s account, but a loss is expected and the extra amount written off may not be noticed. It also allows the stolen money to be recorded against the other debtor.

(iv) Lapping the lost receipt from one debtor with a later debtor receipt.

Lapping is a common technique and is described below.

Handling skimmed cheques

Cheques can be skimmed easily, but converting the cheque adds a level of difficulty to the fraud. Cheques usually have to be presented at a bank and this creates a paper trail. Usually skimming cheques requires a bank account with a similar name to the victim business to be set up, or for the cheque to be falsely endorsed. But this also leaves a paper trail.

Some methods of handling skimmed cheques are:

(i) to forge an endorsement on the cheque to change the payee, but this leaves a trial to the employee’s account.(ii) to forge an alteration to the payee name on the cheque, but this leaves a trail that may be followed to the employee’s account.

(iii) to open an account with a similar name as the victim business. Opening accounts may be difficult, and there is always the paper trail and it is rarely worth opening a bank account for one stolen cheque.

(iv) replace cash received somewhere else in the business with the stolen cheque. The cheque will balance the banking in that other area. This means that two thefts must occur at about the same time, but only one needs to be hidden and it solves any conversion problems. Of course the cheque appearing in the other area may raise questions.


Lapping is not the fraud itself, it is a way of hiding a skimming fraud. It is done by using a second fraud to hide the first fraud. One fraud “laps” over another. If undiscovered, lapped frauds may continue indefinitely as they are constantly re-hidden and the older frauds rectified.

The fraudster steals a receipt before it is recorded. The receipt cannot be recorded as the banking will not match the entries in the debtor’s ledger. Before the next statement is issued to the debtor, an entry must be made for the receipt that was stolen, or the debtor will question the balance and someone will look into the matter. The receipt must be recorded somehow, but in a way that receipts match the banking.

If a false entry cannot be made in that debtor’s account, the statement may be adjusted before it is sent to the debtor, or a completely false statement can be sent. But these are not permanent fixes to the problem. An entry needs to be made in the debtor’s records showing the receipt.

Lapping hides the theft from the original debtor with monies stolen from another debtor. An amount received from debtor B is banked and recorded as if it had been received from debtor A. That solves the problem with debtor A, but creates a problem with debtor B. But there is now more time to fix that problem. At that later time, monies stolen from debtor C’s receipt will be used to solve the problem with debtor B, and so on.

As the first fraud is resolved by the second fraud (debtor A’s account looks fine), the current fraud is usually fairly new and there is always potential to cover that with another lap. The fraudster then looks for some other opportunity when the outstanding debt can be written off entirely (e.g. adjusting a failed company account). Juggling the amounts of specific receipts and amounts stolen may prove difficult.

For Example

ABC trades in a specialist industry and only produces a limited number of high value inventory items. These items were sold to a number of customers on credit and for substantial amounts. ABC is doing very well financially.
The entire accounts receivable area is controlled by Ms F. The number of transactions each month is not enough to require two people to record the sales, collection of debtors and bank the monies and perform bank reconciliations, even though the dollar values are high. ABC did not produce reports on sales and banking, and the conduct of the trade debtor’s ledger was left with Ms F – a trusted long time employee.
ABC received large payments on a regular basis from its customers. These were paid by cheque and sent to one location. The mail was opened by Ms F and some cheques removed. Ms F made entries in the debtor’s ledger recognizing the receipts (hiding the theft from the debtor) and ignored the differences between receipts recorded and the banking (hiding the theft from the company).
As the payments were cheques, they needed to be converted in a manner that would not raise suspicion. Ms F acted in collusion with the company’s external accountant. The stolen cheques were deposited into the accountant’s trust account and divided between the two fraudsters.
The possibility of the fraud was recognized when the external accountant was removed. The cheques could no longer be converted this way.
The accountant entered false journal entries into the financial statements, making adjustments for the missing funds. These adjustments were never questioned by ABC, as the directors did not have a great understanding of accounting and trusted the accountant and Ms F.

Lessons to be Learned

1. Money is vulnerable to fraud whenever it is handled by employees.

2. Attacks on receipts can occur at any point of the business cycle. The two major areas are: (a) where sales (cash or otherwise) are made; and (b) where debtor’s receipts are collected.

3. Businesses without proper controls and those that are too reliant upon one or a few employees handling money and recording transactions provide an opportunity for this fraud.

4. Thefts can be hidden by the lapping of a series individual frauds, each covering the last. Lapping is most easily uncovered by separating or rotating duties amongst employees, thus taking away the opportunity of the fraudster to continue with the scheme.

Prevention and Detection

Some things to look for

(i) Cash shortages when turnover and the debtor’s ledger balance are stable. This may be due to a number of legitimate reasons, but also to the theft of money.(ii) Unexplained journal entries in any debtor ledger accounts should raise suspicion, particularly when there are no documents explaining the entries. These may be used by fraudsters to adjust the individual ledger account to the correct amount.

(iii) Unexplained entries in the banking records may be used by fraudsters to balance cash records for banking purposes.

Some Basic Controls

(i) Separation or rotation of duties. These frauds are more likely when one person controls the entire debtors and receipt function. Many skimming frauds are uncovered when the dishonest employee is away from their job for a while due to illness, accident or enforced holiday, and is unable to continue with the lapping of frauds. This separation should be between:

(1) the person opening the mail and producing a list of receipts;
(2) the person preparing the banking records; and
(3) the person recording the transactions in the records.

(ii) Always have an independent person verify the amount of recorded receipts and the amount of banking. This forces a fraudster to actually hide any theft of money. If this check was not done, the fraudster could simply just record the receipt in the debtor’s ledger and withhold the cheque from the banking.

(iii) Reconcile the bank account with the banking records to verify that the money listed in the banking records was actually banked. If this is not done fraudsters could record the receipt in the banking information but not actually bank the money. The money may be skimmed after it has been recorded.

(iv) Require appropriate authority for writing off balances or making other adjusting entries.

(v) Periodically have debtors verify the entries – particularly the dates of payments – on their account. This may highlight delays between when amounts were sent by the debtor and recorded on their account. This may indicate lapping.

(vi) Check the recording of receipts in the debtor’s ledger against the names on cheques being deposited. If lapping is being used to hide frauds, the name on the check will not match the debtor being recorded with the receipt.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s