Marmite and Vegemite are both made from spent brewer’s yeast. Marmite has been sold in Britain since 1902, and Vegemite came out of Melbourne twenty years later. I heard Steven Goodwin at Graebel use the pair recently to describe how people take to AI: you love one or you love the other, never both, and there is no middle ground where someone likes AI but doesn’t want to use it.

My first instinct was to argue. I’ve since come around to most of it, though maybe not for the reasons he’d give.

Nobody has a mild opinion about yeast extract

The spreads divide people because there’s no gentle version of them. You can’t taste a little Marmite the way you can taste a little mustard; the flavor shows up all at once, salty and bitter, and your reaction shows up with it. Marmite leaned into that for years with its “love it or hate it” advertising. The brand never tried to win the middle. It assumed there wasn’t one.

AI has the same problem, or the same gift, depending on where you stand. It isn’t a feature you switch on for one report and forget about. Using it properly means handing it part of your thinking and then checking what comes back, and that changes how the work feels from the inside. People who try it seriously tend to come out with a verdict. It is rarely “it’s fine.”

Two reasonable camps

The people who love it have accepted a trade. They’ll take a draft that is sometimes wrong in exchange for never staring at a blank screen again, and they’ve built the habit of checking. The occasional bad answer is a cost of doing business, much like a junior analyst’s first month on the team.

The people who hate it have looked at the same trade and priced it differently. Picture a controller at month-end. One confident wrong number in a reconciliation can cost her more than a year of saved keystrokes is worth, and her name is on the sign-off. Turning that deal down isn’t fear of technology. It’s arithmetic with different inputs.

Both camps are being rational. That’s probably why neither one moves.

Where the middle goes

Then there are the people who say they like AI in principle and just haven’t gotten around to using it. They exist. I don’t think they stay there long. “I like it, I just don’t use it” sounds like a position until you ask what would make them start, and the answer tends to be a set of conditions that never quite arrive. That’s a no with good manners.

And among the people who do love it, the split happens again, which is where the Vegemite half of his metaphor earns its place. My guess is that most Brits have never formed a real opinion about Vegemite, because the jar they grew up with settled the question before anyone asked. AI users seem to sort the same way. The finance team that got Copilot through its Microsoft agreement thinks of AI as Copilot, and the analyst who started on ChatGPT judges every other tool by how close it comes. Ask either of them to switch and watch the face they make.

What that does to an ERP rollout

If he’s right, a lot of change management is aimed at the wrong target. Rollout plans tend to assume a large persuadable middle that just needs one more demo. The binary says that middle is mostly people who have already decided, politely. The decision probably gets made the first time someone uses the tool on work that matters to them, and the launch email and the lunch-and-learn arrive after the verdict.

Which leaves the question of what that first real use should be, and who gets to choose it for the controller.

---

Credit to Steven Goodwin for the Marmite and Vegemite comparison.

My book, Gamifying the Enterprise: Game Mechanics for Continuous Proficiency, is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

The accounts payable system said the insurance company had refused to reimburse a repair. The insurance company had in fact sent a check, and the service manager had deposited it in his own bank account. Leon Arthur Keener, 55, of Hugo, Minnesota, worked for the company from 2011 to 2022 and pleaded guilty to one count of mail fraud in April 2024. Local news coverage reports a sentence of four years and three months in prison.

What happened

According to the U.S. Attorney's Office for the District of Minnesota, Keener embezzled $1,314,633 from his employer between 2015 and 2022. He was a service manager with managerial oversight of the financial operations at his location, and his authority included writing off repairs and creating purchase orders. The release calls the employer an interstate trucking company, and news coverage describes a truck dealer and repair shop.

The first scheme involved insurance. Insurance companies sent reimbursement checks for supplemental repairs. Keener wrote the repairs off as a loss, and the news account says he indicated in the accounts payable system that the insurer had refused reimbursement. Then he deposited the check into a personal account. The release puts the total at more than $562,000. To keep the checks coming to him and not to the office, he told employees to hand over any check from an insurer directly to him, bypassing administrative and accounting staff.

The second scheme was vendor payments. He generated and submitted false vendor payment requests, many of them payable to a shell company called CR Services, which he created and controlled. The release puts that total at $751,000. News coverage says the shell was added to the accounts payable system in 2012, before verified vendor identification was required.

The two pieces come to about $1,313,000, against a total of $1,314,633. The release doesn't say what accounts for the difference, and it doesn't say how the scheme was found.

Why the gap existed

A write-off is an accounting entry that says money won't be coming in. Nobody reviews a loss the way they review a payment. If the person who requested the repair can also write off the shortfall, the system has a record of a loss and no record of an insurer's check, because the check, as far as the sources show, never reached the books.

That is the point where the two halves of the fraud fit together. The write-off removed the receivable. The intercepted check made sure no one saw cash arrive. Without the second half, an insurer's payment could sit unmatched against a claim that somebody would eventually chase.

The vendor side is simpler. A vendor record created in 2012 doesn't get looked at again unless someone has a reason. The news account says Keener kept other employees out of the approval process. The sources don't say who, if anyone, reviewed the purchase orders he created, or whether the insurers' claim files were ever compared to what the company recorded.

Controls that would have caught it

Take write-offs out of the hands of the person who created the work. A write-off above a small threshold needs a second approver in finance, plus a document from the payer saying the claim was denied. Without that document it stays open.

Send payer checks to someone who doesn't run the department. Insurers pay to a lockbox or by electronic deposit, and anything that arrives in the mail is opened and logged by accounting staff, not routed to the manager who benefits from it. Tell the insurer where to send payment, in writing.

Revalidate the vendor master, old records included. Vendors added before a control existed get checked on a schedule against tax ID, address and bank account, and a vendor with one requester and one approver gets a second look. Creating a vendor and ordering from it should never sit with the same person.

An AI prompt example for ERP fraud detection

This case calls for queries about write-offs without support and about vendors that have only one person behind them. Against an ERP's accounts receivable, accounts payable and vendor master, a controller could run something like:

"For the last ten years, list every receivable write-off or adjustment coded as insurance denied, non-reimbursable or loss, grouped by the user who approved it, with the claim number and whether a payer remittance or denial document exists. Rank users by total written off."

A second query goes after the vendors:

"List all active vendors where one user requested or approved more than 90 percent of purchase orders and payments, with the date the vendor was created, whether the tax ID and bank account have been validated since, and any shared address, phone number or bank account with an employee record."

Neither query starts with a name. Both depend on the write-off reason and the claim number being stored as data, not typed into a memo field.

The pattern for this series

Part 12 hid the trail by deleting charges and Part 14 by deleting orders. This one hid the trail by writing it off. The release doesn't say what led to the investigation.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the District of Minnesota, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from that release and those reports. The release describes the employer as an interstate trucking company, while news coverage describes a truck dealer and repair shop, and this article does not name the company. The sentence reported here comes from news coverage, and I could not find the sentencing date or a restitution figure. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, District of Minnesota. Press release on the guilty plea of Leon Arthur Keener to embezzling from his employer, April 4, 2024. https://www.justice.gov/usao-mn/pr/hugo-man-pleads-guilty-embezzling-more-13-million-employer

FreightWaves. "Minnesota man pleads guilty to embezzling $1.3M from truck dealer." https://www.freightwaves.com/news/minnesota-man-pleads-guilty-to-embezzling-1-3m-from-truck-dealer

Yahoo News. "Hugo man sentenced to prison for stealing more than $1.3M from Inver Grove Heights employer for trips, cars and a boat." https://www.yahoo.com/news/hugo-man-sentenced-prison-stealing-180400772.html

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A staffing company's books held more than 2,000 fraudulent invoices, and some of the customer payments applied against them were the lending bank's own loan money coming back. Louis Lluberes founded the company in 1995 and was its CEO until March 2020. His brother Moises Lluberes was the CFO. Both pleaded guilty on February 15, 2024, to conspiracy to commit bank fraud and conspiracy to commit wire fraud, and a Manhattan federal judge sentenced them to prison on January 24, 2025, according to Law360. The sentences themselves were behind a paywall, so they aren't reported here.

What happened

According to the U.S. Attorney's Office for the Southern District of New York, the company lost significant business from major clients in about 2017. Around then the two defendants began recording what the release calls fictitious receivables, invoices that were not real, on the company's books. The indictment release counts more than 2,000 of them.

The invoices mattered because of how the company borrowed. A bank had given it a revolving line of credit, and the amount the company could draw depended on its eligible accounts receivable. The bank worked that out from weekly financial reports on sales and collections. More receivables meant more borrowing room, so the fake ones did exactly what they were meant to do. The company borrowed more than $500 million from the bank, and the plea release puts the losses to victims at more than $70 million.

Fake invoices age. A real customer pays, and an invoice that sits unpaid past the bank's cutoff stops counting toward the borrowing base. According to the indictment release, the brothers dealt with that by moving borrowed money through two shell companies and back into the company's collections account, where it was labeled as customer payments. The returned money was then applied to older receivables, the fictitious ones included, so they stayed current. The indictment release says about $129 million went from one of the shells to the collections account.

In May 2018 an investor group agreed to buy the company. The release says the brothers concealed the fraud during those negotiations. Louis Lluberes received about $11.3 million on the acquisition day and about $6.2 million after, at least $17.5 million in all, and transferred about $716,000 to his brother. Each brother agreed to restitution of $75,460,611, jointly and severally.

Why the gap existed

An accounts receivable ledger is a list of things customers owe. It does not know whether they owe them. If a person with enough access can post an invoice to a customer account, the ledger will age it, report it and include it in the numbers a lender sees, the same as any other.

The cash side is where the fraud was supposed to run out of road. A fake invoice never gets paid, and eventually the aging report shows it. Here the brothers paid it themselves with borrowed money that left the company and came back looking like a customer. The only tell was the payer, and only if someone looked at who was paying.

One defendant recorded most of the invoices, according to the indictment release. The sources don't say whether anyone besides the two of them could see the posting history. They also don't say what the bank checked beyond the weekly reports, or how the fraud was caught. The release says only that the FBI and prosecutors halted it.

Controls that would have caught it

Tie every invoice to the work behind it. For a staffing company, a real invoice has timesheets, and the timesheets have a person on the payroll. An invoice with no approved time records and no payroll cost is the easiest kind of fiction to test for. Other businesses have an equivalent, such as a shipment, a signed delivery or a contract milestone.

Match the payer to the customer. Cash receipts get compared to the customer master, and a payment from an account or a name that isn't the customer's stops at the door. So does a receipt from an entity the company paid in the last few weeks, because that is a circle and not a collection.

Keep invoicing and lending reports apart. The person who posts receivables doesn't also prepare the report that goes to the bank. A direct confirmation, where someone outside the company contacts a sample of customers about what they owe, is slow and old-fashioned, and a fictitious customer can't confirm a balance.

An AI prompt example for ERP fraud detection

This case calls for queries about support and about round trips. Against an ERP's accounts receivable, billing and cash application modules, an auditor or a lender's analyst could run something like:

"List all customer invoices from the last five years that have no approved time record or delivery record behind them, grouped by customer and by the user who created the invoice, with invoice age and whether it has been paid."

A second query goes after the cash:

"List cash receipts applied to open invoices where the paying account or remitter name does not match the customer master, or where the remitter received a payment from the company in the 30 days before the receipt. Include the age of the invoice at the time the cash was applied."

Neither query needs a suspect. The second depends on the receipt keeping the remitter's name and bank account, which not every cash application process does.

The pattern for this series

Part 17 had the government as the party short-changed. Here it was a bank and the people buying the company, and the report they relied on came out of the receivables ledger. Earlier parts of the series had fake invoices on the payables side. These were on the receivables side, and the brothers did not leave them to die. They paid them.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Attorney's Office for the Southern District of New York, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The press releases do not name the company, and this article does not either. Descriptions of how the scheme worked come from the indictment release and the plea release. This article reports guilty pleas and a sentencing that Law360 reported, but the prison terms were not available in the sources used. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Southern District of New York. Press release on the charges against the former CEO and CFO of a temporary staffing company, September 30, 2020. https://www.justice.gov/usao-sdny/pr/former-ceo-and-cfo-temporary-staffing-company-charged-manhattan-federal-court-scheme

United States Attorney's Office, Southern District of New York. Press release on the guilty pleas of the former CEO and CFO of a staffing company, February 15, 2024. https://www.justice.gov/usao-sdny/pr/former-ceo-and-cfo-staffing-company-plead-guilty-scheme-defraud-bank-and-investors

Law360. "Ex-Staffing Co. Execs Get Prison After Copping To $75M Fraud." January 24, 2025. https://www.law360.com/banking/articles/2288680/ex-staffing-co-execs-get-prison-after-copping-to-75m-fraud

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A Las Vegas cleaning company took taxes out of its employees' paychecks for eleven years and did not pay them over to the IRS. Deborah Meadows, 64, owned A to Z Employment Services LLC, which did carpet, upholstery and roadside cleaning in Nevada, and according to the Justice Department she controlled all of its financial matters. She pleaded guilty on February 12, 2026, to willful failure to account for and pay over trust fund taxes. Sentencing was set for May 21, 2026, and none of the sources used here report the outcome.

What happened

From the first quarter of 2010 through the fourth quarter of 2020, according to the Justice Department, Meadows withheld Social Security, Medicare and income taxes from employee wages. She did not pay them over, and she did not file the required quarterly employment tax returns. The loss to the government exceeded $1.2 million.

That is 44 quarters. Divide $1.2 million by 44 and you get about $27,000 a quarter, and since the release says "exceeding," the real figure is higher. The sources don't say how many employees were on the payroll, so there's no way to turn that into a figure per paycheck.

The concealment came later. After the grand jury began its investigation, the indictment says Meadows answered a subpoena with altered bank records and inaccurate tax records. The altered records showed that another company she owned, AZ-TEC Restoration LLC, had made tax payments to the IRS when it had not. She also provided inaccurate individual and employment tax returns showing taxes paid that she knew had never been paid.

The release says IRS Criminal Investigation led the case. It doesn't say what first drew the IRS's attention.

Why the gap existed

Payroll software does the withholding without being asked. It calculates the tax, deducts it from gross pay, prints the amount on the pay stub and credits a liability account. Everything up to that point is the system doing its job.

Paying the liability is a separate act. Someone has to move the money, and someone has to file the return that says they did. If nobody does, the liability account just keeps growing. Quarter after quarter the balance sits there, and that account is where this kind of failure shows up in plain numbers, if anyone looks.

This is also a case where internal controls have a built-in limit. The sources describe Meadows as owning the company and controlling all financial matters. When the owner is the person not paying, no second approver inside the company is going to stop it. The checks that matter sit outside. The tax authority and the bank hold records the owner can't edit, and an outside accountant can ask them for it.

Controls that would have caught it

Age the payroll tax liability accounts every period. Withholding gets paid on a schedule, so a liability balance that is still open after the deposit date has no good explanation. A growing balance on those accounts goes to someone other than the person who runs payroll.

Check payments against the tax authority's own records. An IRS account transcript shows what was actually received for each quarter, and nobody at the company can edit it. Someone outside payroll, an owner's accountant or an outside CPA, pulls it each quarter and ties it to the payroll register. Better still, a payroll provider that files and remits on the company's behalf leaves its own trail.

Get bank records straight from the bank. The altered bank records in this case were a response to a subpoena, which is late. A routine direct confirmation or a bank-fed statement feed, reviewed by someone outside the finance function, makes that kind of alteration much harder to do and much easier to see.

An AI prompt example for ERP fraud detection

This case calls for queries that compare what was withheld to what was paid. Against an ERP's payroll and general ledger modules, a controller or outside accountant could run something like:

"For each quarter in the last twelve years, list total federal income tax, Social Security and Medicare withheld per the payroll register, the total paid to the tax authority per the bank and cash records, and the difference. Flag every quarter where the difference is not zero."

A second query goes after the ledger itself:

"List all payroll tax liability accounts with a balance more than 90 days old and no payment against it, by tax type and quarter, with the user who last posted to each account."

The first query only works if payments to the tax authority are recorded somewhere the system can see them. In some ERPs they are not, which is a finding in itself.

The pattern for this series

Most of the recent cases in this series had an employer as the victim. Here the money withheld was never the company's, and the thing that went missing was a payment, not a record. The release doesn't say how the IRS first noticed.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Department of Justice, a public government source. All facts, figures, and quotations describing the case are sourced from those releases. This article reports a guilty plea; a sentencing outcome was not available in the sources used. The concealment details first appeared in the indictment release as allegations, and the plea release restates them. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

U.S. Department of Justice, Office of Public Affairs. Press release on the guilty plea of Deborah Meadows to employment tax crimes, February 12, 2026. https://www.justice.gov/opa/pr/cleaning-service-owner-pleads-guilty-employment-tax-crimes

U.S. Department of Justice, Office of Public Affairs. Press release on the indictment of Deborah Meadows for an employment tax scheme, January 10, 2025. https://www.justice.gov/opa/pr/cleaning-service-owner-charged-employment-tax-scheme-and-other-crimes

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

For about fifty months, a Long Island healthcare products distributor wired out money as customer refunds, and it landed in an account its own credit supervisor controlled. Tony Ream worked in the credit department of the Melville, New York company from 2019 and later became a credit supervisor. He pleaded guilty to wire fraud on September 25, 2025. Reporting on the case says he was sentenced on September 24, 2026, to 30 months in federal prison, with $1.6 million in restitution.

What happened

From about October 2020 through November 2024, according to the U.S. Attorney's Office for the Eastern District of New York, Ream sent wire transfers totaling approximately $1.6 million from the company's bank account to an account he controlled. Each transaction was recorded as a refund issued to a customer. The release says he took the money from customer refund accounts, and press coverage says some of those accounts were inactive.

A court filing in the case describes the sequence. Ream directed subordinates to initiate a refund. After the refund was initiated, he approved it and disbursed it to the account in his name. The release adds that he deceived employees he supervised "into taking steps that assisted him in carrying out his fraudulent scheme."

Divide $1.6 million by the fifty months from October 2020 through November 2024 and you get about $32,000 a month. Both the total and the period are approximate in the sources, so treat that as a ballpark. The sources don't say how many refunds there were, and they don't say how the scheme was found.

Why the gap existed

A refund is a payment, and nobody argues with a refund. The customer overpaid, or returned something, or has a credit sitting on the account. Somebody in credit is the right person to say so. Credit sits close to both the money going out and the explanation for it.

The court filing describes a clean division of labor. A subordinate initiates and the supervisor approves. The problem is that the approver was also the person steering the destination, and the subordinates didn't know what they were feeding. Two people touched each refund on paper. The second one was steering the money.

Inactive accounts make it worse. A customer who stopped ordering years ago isn't going to call and ask where the refund is. A credit balance that nobody has touched since 2019 is a balance that nobody will miss. The sources don't say whether anyone outside the credit department reviewed those balances.

Controls that would have caught it

Pay refunds only to a destination already on the customer record. A refund goes back to the payment method it came from, or to a bank account in the customer master that someone outside credit has verified. A destination that isn't on file stops the refund until it has been checked, whoever approves it.

Make the approver independent of the initiator's chain of command. A supervisor shouldn't approve refunds that his own team initiates, at least above a set amount. Better still, the approval comes from finance, and a sample of the supervisor's own approvals gets re-performed each month by someone else.

Review dormant credit balances outside the credit department. Customer accounts with no activity for twelve months and a credit balance go on a list that accounts payable or the controller owns. Refunding one needs the original payment, a customer request, and a second person.

An AI prompt example for ERP fraud detection

This case calls for queries about where refunds went and about accounts that were quiet. Against an ERP's accounts receivable and cash management modules, a controller could run something like:

"For the last five years, list every customer refund where the destination bank account holder name does not match the customer name or any bank account on the customer master. Include the user who initiated the refund, the user who approved it, and the amount."

A second query goes after the quiet accounts:

"List refunds issued on customer accounts that had no invoices or receipts in the previous twelve months, grouped by approver, and rank approvers by total value."

Neither query depends on knowing whose name to look for. Both depend on the refund record keeping a destination account in a field somebody can read.

The pattern for this series

Part 12 was a finance chief with the power to delete records. Here the supervisor didn't delete anything. He used the approval step as cover, and the people below him did the initiating. The release doesn't say what prompted the investigation or when the company first noticed.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Attorney's Office for the Eastern District of New York, a public government source, a court filing in the case, and contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The sentence reported here comes from news coverage, because I could not open the sentencing release itself. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Eastern District of New York. Press release on the indictment of Tony Ream for stealing from customer credit accounts. https://www.justice.gov/usao-edny/pr/manager-long-island-company-indicted-stealing-16-million-customer-credit-accounts

United States Attorney's Office, Eastern District of New York. Press release on the guilty plea of Tony Ream, September 25, 2025. https://www.justice.gov/usao-edny/pr/manager-long-island-company-pleads-guilty-wire-fraud-stealing-customer-credit-accounts

Becker's Dental Review. "Former credit supervisor sentenced to 30 months for embezzling $1.6M from dental supply company." https://www.beckersdental.com/?p=27271

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.