forensic accounting and fraud examination: case study - online pharmacy

The Online PharmacyFORENSIC ACCOUNTING AND FRAUD EXAMINATION, 2014

BRITTABOHLINGER.COM 1

FAFE, case study, 20141. This case involved more than 6, 000 affiliates (only 10 were prosecuted). How could data analytics have been used to detect fraud in this case?

The number of affiliates indicates the existence of a vast amount of electronic data as well as a substantial amount of paper copies, hence it can be assumed that a “big data” approach was required.

I will outlined the difference between data analytics and data forensics, discuss the various methodologies that had to be applied in order to obtain and analyse the data (once secured) and briefly touch upon Benford’s Law and suitable software packages. I will conclude by a short discussion of the benefit of a multi-dimensional (triangulation) approach.

The digital investigation involves the identification and examination of relevant digital data processed or stored by digital devices. In contrast, digital forensics involves the recovery and investigation of material on digital devices. It is vital to distinguish between these two areas as in the given case of such a vast fraudster network that operated predominantly online, a large number of digital devices may have been involved. Therefore, data analysts would need to engage the support of forensic data experts in order to ensure all secured data remained intact.


FAFE, case study, 2014Fraud Examiners would have looked at structured (e.g. operational data, financial data) as well as unstructured data (e.g. documents, interviews) and harnessed a number of methods:

- With the aim to investigate the entire population (i.e. 6000 affiliates and tens of thousands of clients – not just a sample) the analysis of data held in databases would have delivered key insights into the network.

- Data mining approaches such as combing databases (e.g. joined databases in SQL, Access databases, or complex macro-linked Excel spreadsheets) would have delivered patterns in marketing and business procedures. Among the expected findings are the locale of order, the frequency of order and payment history – all helpful in establishing red flags and potential concealment as well as patterns.


FAFE, case study, 2014- Calculating financial ratios (vertical and horizontal analysis, in SAS) would have delivered insight into turnover and potential deviations from ratios common in an offline pharmacy. Excessive quantities of inventory based on sales would have been useful to analyse. Statistical analysis (in SPSS), regression analysis and correlation analysis would have delivered further insights. Graphs and pivot tables depicting each physician’s approved prescriptions/sales would have been further useful in the data analysis and identification of patterns and red flags.

- One method applied by internal auditors and fraud examiners is Benford’s Law. The Law stipulates that naturally occurring numbers (e.g. death rates, financial transactions vs non-naturally occurring numbers such as customer account numbers or zip codes) are expected to display an occurrence frequency of digits 1 through 9 as the first digit. About 30 percent of naturally occurring numbers are expected to have 1 as leading digit – this finding should help the examiner to establish data manipulations and potentially fraudulent activities.


FAFE, case study, 2014The method can be easily applied in a spreadsheet by extracting the first number of a column (for instance, use COUNT and remember to convert a leading zero into the next higher number as zeros are not recognised by BL) and filtering by frequency (list by 1-9, calculate the frequency and calculate the log10 of each number).

[Quantitative] Data analysis should not be relied on as sole approach though. While data mining tools and software packages such as IDEA might help in making major progress, the analysis of unstructured data such as emails, user documents, HR files, social media activity would have delivered a more detailed understanding.

Using creativity and combining several data analysis techniques and tests, spanning the spectrum of quantitative and qualitative methodologies would have delivered the best possible outcome in this complex case of fraudulent online pharmaceutical activities.


FAFE, case study, 20142. Prosecutors were reluctant to prosecute. If you were an investigator, how could you have used data analytics to persuade the reluctant prosecutors to actually pursue a case like this?

At the time operating an online pharmacy was a new phenomenon, the experienced cybercrimes prosecutor was reluctant to assist with the investigation. The case provided a legal challenge and required creativity in so far as only similar laws (in other states) or related pieces of legislation could be drawn upon in order to fill the void and prosecute the fraudsters. Existing federal drug statutes pertaining to street drug dealers and international drug-trafficking organisations could have been applied.


FAFE, case study, 2014A strategy as to convincing the reluctant prosecution to pursue the case could have encompassed using the data identified and obtained as described above (answer to Q1) in the following ways:

◦ Educating the prosecution as to the potential damage and health risk to customers of the online pharmacy (e.g. lack of parental consent, lack of clarification as to pre-existing conditions such as diabetes, pregnancy etc, potential reputational damage to the sector – physicians and pharmacists etc). Evidence: (a) calculating an estimate of customers with existing conditions that were not considered/harmed, (b) conducting a thorough internet research, using advanced search strategies and BOOLEAN operators, in order to identify cached material, marketing material and further red flags.

Educating the prosecution as to the results from an initial data analysis (assuming that a warrant might be required to confiscate the data devices) – such as information collated from the internet, maps compiled that depicted the extent of the vast network of the e-commerce


FAFE, case study, 2014◦ Educating the prosecution as to the potential tax evasion and lack of revenue and how this damages the

legally operating health care sector/physicians and pharmacies. Evidence: (a) Calculation of financial rations and revenue estimations, (b) public records that prove paid taxes and evaded/estimated tax amounts.

◦ Educating the prosecution on the dimension of money laundering (further discussion of money laundering in the answer to Q4 below).

The above listed points should provide a compelling argument and convince the prosecution to deal with an issue that is hard to deal with due to its global nature. But existing legislation such as the [US] 1938 Food, Drug, and Cosmetic Act* and the [US] Controlled Substances Act 1984** should provide a framework for developing new suitable legal parameters in the given case. Evidence: textual analysis (see further details in answer to Q3) based on research and document analysis – potentially also requesting the support of academic staff at the local university (for instance).


FAFE, case study, 2014

Furthermore, it would be vital to highlight that courier services*** may become part of such a major scheme (conspiring and collecting fees from online pharmacies for delivery of illegal prescription drugs) and contribute to the points listed above. Evidence: calculate courier services and postal/shipping services based on total sales figures per month (structural data analysis based on joined databases).

References* http://www.fda.gov/AboutFDA/WhatWeDo/History/ProductRegulation/ucm132818.htm** http://www.fda.gov/RegulatoryInformation/Legislation/ucm148726.htm*** http://online.wsj.com/articles/fedexs-money-laundering-scheme-1408576786


http://www.fda.gov/AboutFDA/WhatWeDo/History/ProductRegulation/ucm132818.htm

http://www.fda.gov/RegulatoryInformation/Legislation/ucm148726.htm

http://online.wsj.com/articles/fedexs-money-laundering-scheme-1408576786

FAFE, case study, 2014Q3 Would the data analytics in this case be restricted to numbers only? Explain.

As outlined in answer to Q1 above, the data analysis should not be confined to structural data but must be extended to textual analysis which is suitable for unstructured data such as user documents, sales and marketing material, voice files, instant messages and interview transcripts.

Linguistic technologies may be operated based on weighted fraud indicators (e.g. fraud keywords) and scoring algorithms. The aim is to discover patterns, relationships indicative of fraudulent activities and even sentiment can help. For instance in the case of Enron’s CEO Ken Lay, it was discovered that his emotional tone changed in emails, it became increasingly derogatory, confused and angry in the stages close to the bankruptcy filing.


FAFE, case study, 2014Furthermore, visual analysis including heat maps, time-series charts, network diagramsdepicting the affiliates and geospatial analysis would be helpful. Textual analysis should be extended to smart phones (SMS), instant messaging, video calls, and voice messages.

It is important to remember that forensically sound copies of all data storage devices are made and that the integrity of digital evidence is not being violated (altered, destroyed, preservation). While data forensics may be able to restore deleted files, once overwritten, data cannot be recovered. The act of intentionally or neglectfully destroying documents relevant to the litigation is called spoliation - evidence will not be submitted unless authenticated.


FAFE, case study, 2014Q4 Among the ‘affiliate’ perpetrators (TPG staff, physicians, online pharmacies) who would have benefited the most with an off shore bank account? How would a Certified Fraud Examiner benefit from knowing this?

Money laundering has been defined as “the process by which a person takes illegally obtained money and conceals its existence, source, or location and then disguises that income to make it appear legitimate” (Kranacher et al).

Money, within this definition, encompasses “anything of value” (Kranacher et al.) and is not confined to cash but also applies to checks, stocks, bonds, gift cards, debit cards etc. The stages of money laundering are placing, layering, and integration. Placement, the initial stage, requires the perpetrator to place the money into the financial system, without being noticed. It is deemed the most difficult stage. Generally, there are 3 different types of placement:

1. Making cash deposits into the financial system preferably by breaking up larger cash amounts into smaller sums and placing them into various accounts (layering)

2. Placing structured deposits (i.e. not exceeding the limit of currently USD10000) and remaining unnoticed.

3. Placing the funds in an off-shore account that offers privacy and bank secrecy.


FAFE, case study, 2014In the case given, money laundering appears to be a by-product of an illegal activity - providing prescription and a medical examination was required but not or not adequately conducted.

In summary, in order to be charged with money laundering, the government must demonstrate that 4 aspects were fulfilled: the offender had committed a Specified Unlawful Act (SUA), s/he concealed the nature, source, location, ownership, or control of the proceeds of an SUA, attempted to avoid federal reporting requirements and attempted to evade taxes (c.f. Kranacher et al.)

Among the 6,000 affiliate perpetrators, the pharmacists and physicians appear to be the most vulnerable in terms of risk-taking. In Jibril’s case the state medical board’s decision to rescind the “license to practice medicine, effectively end[ed] his medical career”. In addition, incarceration and forfeiture of over USD1 million were imposed. Being aware of this combination of fear-inducing consequences of their wrong-doing, those physicians were expected to show a reasonable degree of willingness to cooperate and provide further valuable information.


FAFE, case study, 2014Apart from the pharmacists and physicians, the director of the online pharmacy, Jeffrey Stevens, who had grossed USD51 million in 18 months, would most likely have had off-shore accounts.

Knowing this, the fraud examiners could have conducted targeted searches and data analysisinto these individuals’ bank accounts and looked for red flags, for instance:

1. Investigate COD and credit card payment trails as key means of income.

2. Frequent re-transfers from off-shore locations into the perpetrators’ domestic account (as part of integration, i.e. the return of the money to the perpetrator)

3. Checking social media sites for display of excessive/above industry-level wealth, e.g. images of expensive holidays, purchase of a yacht, mansion, or even indication of travel to off-shore locations where cash may have been deposited (as part of integration, i.e. the )


FAFE, case study, 2014Moreover, searching public records as to ownership of real estate, directorship of potential shell firms (possibly listed under the partner’s or mother’s maiden name, perhaps at the home address) could have provided vital clues for the fraud examiners.

Finally, related drug manufacturers and wholesalers who had benefited from the run-up in manufacturing, distribution and financial activity could have equally engaged in some money laundering activity (see FedEx case mentioned in answer to Q3 above).

References:

FATF (2013) Money laundering and terrorist financing through trade in diamondshttp://www.fatf-gafi.org/media/fatf/documents/reports/ML-TF-through-trade-in-diamonds.pdf

FATF (2012) Operational Issues Financial Investigations Guidance, pp20-31http://www.fatf-gafi.org/media/fatf/documents/reports/Operational%20Issues_Financial%20investigations%20Guidance.pdf

Kranacher, Riley and Wells (2010) Forensic Accounting and Fraud Examination, pp88-103

Nigrini, Data Analysis Technology for the Audit Community, http://www.nigrini.com/


http://www.fatf-gafi.org/media/fatf/documents/reports/ML-TF-through-trade-in-diamonds.pdf

http://www.fatf-gafi.org/media/fatf/documents/reports/Operational Issues_Financial investigations Guidance.pdf

http://www.nigrini.com/

forensic accounting and fraud examination: case study - online pharmacy

Data & Analytics