The Controller Who Forged Her Own Audit Trail: The Gilmore Construction Case

In February 2025, William Costa and a group of other men kidnapped Larry Gilmore, the owner of a Las Vegas construction company. Costa’s girlfriend worked for Gilmore as his financial controller. By then she had already taken more than twenty million dollars from the business he’d built, and the kidnapping was meant to get him to tell the IRS the money had been a gift. It didn’t work. Cynthia Marabella pleaded guilty that April to wire fraud and to a count covering monetary transactions in criminally derived property. She was sentenced in July to five years and ten months.

What happened

Her job put her in the spot that makes this case different from the rest of the series: she handled accounts payable and accounts receivable, and she was also the one who received incoming statements from the company’s banks and credit card providers. From January 2018 to February 2025, she and Costa ran the scheme through several channels at once. Bonus checks got duplicated, with the copies deposited into accounts the two of them controlled. Credit cards opened in other people’s names ran up charges that got quietly paid off with stolen funds, and fictitious invoices from merchant accounts got approved and paid the same way. The part that made all of it hold together, though, was simpler: when the books needed to match something external, Marabella just forged the external thing. Bank statements, accounting records, whatever a reviewer might check against, she produced herself.

Total take came to more than twenty-six million dollars over those seven years. Some of it went into a mansion in Henderson. Some went to high-end cars and private school tuition. Marabella also spent stolen money on handbags and jewelry, then resold them through an online consignment site, netting the two of them another $245,000 on top of everything else. By early 2025, investigators were closing in, and Costa’s answer was to have Gilmore kidnapped and pressured into calling the missing millions a gift. He was arrested that February, the same month the scheme is recorded as having ended.

Why the gap existed

Every case earlier in this series involved a control that never existed, or existed and never got enforced: a vendor nobody re-verified, a check nobody reconciled against the account that actually cashed it. Gilmore Construction breaks that pattern. Someone there, presumably Gilmore himself or whoever he trusted with the books, was looking at bank statements and accounting records on some regular basis. The fraud worked anyway, because Marabella was also the person producing those statements and records.

That’s the mechanism worth sitting with. Reconciliation only catches fraud if the document being reconciled against comes from somewhere the fraudster can’t reach. Hand the person committing the fraud control over the evidence a control depends on, and the control stops checking anything real. It ends up comparing her version of events to her other version of events.

Controls that would have caught it

Direct bank feeds. Bank statements need to reach whoever reviews them straight from the bank, not through the controller who also manages the books being reconciled against them. A live feed pulled directly from the bank’s system, or statements mailed to an address the controller can’t access, breaks the loop Marabella was running.

True separation of duties. This applies differently here than in the payroll and vendor cases earlier in the series. It’s not enough to separate who creates a payment from who approves it. Whoever reconciles the company’s internal records against outside evidence has to be someone other than the person who produced either side of that comparison. One person generating both halves of a reconciliation isn’t a control. It’s a formality.

Independent audits. An unannounced, periodic audit by someone outside the finance function, one that pulls bank data independently instead of accepting whatever gets handed over, would have surfaced the gap between what Gilmore Construction’s books said and what its actual balances were. Seven years is a long stretch for nobody to run that check even once.

An AI prompt example for ERP fraud detection

This pattern needs a different kind of query than the rest of the series, because the fraud specifically targeted the documents a human reviewer would trust. Against an ERP’s cash and bank reconciliation module, paired with a live bank feed rather than manually uploaded statements, a controller could run something like:

“Compare ending bank balances recorded in the reconciliation module against balances pulled directly from the bank’s API for the same statement period. Flag any discrepancy over $500.”

A second query targets the credit card piece specifically:

“List all corporate or company-linked credit cards opened in the last five years where the cardholder name doesn’t match an entry in the active employee or authorized-user list.”

Neither of these means anything if the comparison data comes from the same person, or the same manual upload process, as the first number. That’s the actual lesson of this case. A check only means something when at least one side of it sits outside the fraudster’s reach.

The pattern for this series

Every case in this series comes back to the same question: what did the system trust without re-checking, and who had access to make that trust look reasonable. Sometimes it’s a vendor record nobody revisits. Sometimes it’s a termination flag nobody enforces. This time it was the bank statement itself, and it took seven years, twenty-six million dollars, and eventually a kidnapping charge stacked on top of the fraud counts before anyone caught it. Nobody at Gilmore Construction ever pulled a bank statement from anywhere but Marabella’s own desk.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Attorney’s Office for the District of Nevada and the IRS Criminal Investigation division, both public government sources, along with contemporaneous news coverage of the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney’s Office, District of Nevada. “Henderson Woman Sentenced to Over Five Years in Prison for Embezzling Over $26 Million From Employer.” Press release, July 30, 2026. https://www.justice.gov/usao-nv/pr/henderson-woman-sentenced-over-five-years-prison-embezzling-over-26-million-employer

United States Attorney’s Office, District of Nevada. “Nevada Woman Pleads Guilty to Embezzling Over $26 Million From Employer.” Press release, April 24, 2026. https://www.justice.gov/usao-nv/pr/nevada-woman-pleads-guilty-embezzling-over-26-million-employer

Ritter, Katelyn. “Henderson woman pleads guilty to embezzling over $26 million from employer.” Las Vegas Review-Journal, April 25, 2026. https://www.reviewjournal.com/crime/courts/henderson-woman-pleads-guilty-to-embezzling-over-26m-from-employer-3792237/