ERP Fraud Files, Part 18: More Than 2,000 Fictitious Invoices and the Loan Money That Came Back as Customer Payments
A staffing company's books held more than 2,000 fraudulent invoices, and some of the customer payments applied against them were the lending bank's own loan money coming back. Louis Lluberes founded the company in 1995 and was its CEO until March 2020. His brother Moises Lluberes was the CFO. Both pleaded guilty on February 15, 2024, to conspiracy to commit bank fraud and conspiracy to commit wire fraud, and a Manhattan federal judge sentenced them to prison on January 24, 2025, according to Law360. The sentences themselves were behind a paywall, so they aren't reported here.
What happened
According to the U.S. Attorney's Office for the Southern District of New York, the company lost significant business from major clients in about 2017. Around then the two defendants began recording what the release calls fictitious receivables, invoices that were not real, on the company's books. The indictment release counts more than 2,000 of them.
The invoices mattered because of how the company borrowed. A bank had given it a revolving line of credit, and the amount the company could draw depended on its eligible accounts receivable. The bank worked that out from weekly financial reports on sales and collections. More receivables meant more borrowing room, so the fake ones did exactly what they were meant to do. The company borrowed more than $500 million from the bank, and the plea release puts the losses to victims at more than $70 million.
Fake invoices age. A real customer pays, and an invoice that sits unpaid past the bank's cutoff stops counting toward the borrowing base. According to the indictment release, the brothers dealt with that by moving borrowed money through two shell companies and back into the company's collections account, where it was labeled as customer payments. The returned money was then applied to older receivables, the fictitious ones included, so they stayed current. The indictment release says about $129 million went from one of the shells to the collections account.
In May 2018 an investor group agreed to buy the company. The release says the brothers concealed the fraud during those negotiations. Louis Lluberes received about $11.3 million on the acquisition day and about $6.2 million after, at least $17.5 million in all, and transferred about $716,000 to his brother. Each brother agreed to restitution of $75,460,611, jointly and severally.
Why the gap existed
An accounts receivable ledger is a list of things customers owe. It does not know whether they owe them. If a person with enough access can post an invoice to a customer account, the ledger will age it, report it and include it in the numbers a lender sees, the same as any other.
The cash side is where the fraud was supposed to run out of road. A fake invoice never gets paid, and eventually the aging report shows it. Here the brothers paid it themselves with borrowed money that left the company and came back looking like a customer. The only tell was the payer, and only if someone looked at who was paying.
One defendant recorded most of the invoices, according to the indictment release. The sources don't say whether anyone besides the two of them could see the posting history. They also don't say what the bank checked beyond the weekly reports, or how the fraud was caught. The release says only that the FBI and prosecutors halted it.
Controls that would have caught it
Tie every invoice to the work behind it. For a staffing company, a real invoice has timesheets, and the timesheets have a person on the payroll. An invoice with no approved time records and no payroll cost is the easiest kind of fiction to test for. Other businesses have an equivalent, such as a shipment, a signed delivery or a contract milestone.
Match the payer to the customer. Cash receipts get compared to the customer master, and a payment from an account or a name that isn't the customer's stops at the door. So does a receipt from an entity the company paid in the last few weeks, because that is a circle and not a collection.
Keep invoicing and lending reports apart. The person who posts receivables doesn't also prepare the report that goes to the bank. A direct confirmation, where someone outside the company contacts a sample of customers about what they owe, is slow and old-fashioned, and a fictitious customer can't confirm a balance.
An AI prompt example for ERP fraud detection
This case calls for queries about support and about round trips. Against an ERP's accounts receivable, billing and cash application modules, an auditor or a lender's analyst could run something like:
"List all customer invoices from the last five years that have no approved time record or delivery record behind them, grouped by customer and by the user who created the invoice, with invoice age and whether it has been paid."
A second query goes after the cash:
"List cash receipts applied to open invoices where the paying account or remitter name does not match the customer master, or where the remitter received a payment from the company in the 30 days before the receipt. Include the age of the invoice at the time the cash was applied."
Neither query needs a suspect. The second depends on the receipt keeping the remitter's name and bank account, which not every cash application process does.
The pattern for this series
Part 17 had the government as the party short-changed. Here it was a bank and the people buying the company, and the report they relied on came out of the receivables ledger. Earlier parts of the series had fake invoices on the payables side. These were on the receivables side, and the brothers did not leave them to die. They paid them.
Source disclaimer
The case details in this article are drawn from press releases published by the U.S. Attorney's Office for the Southern District of New York, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The press releases do not name the company, and this article does not either. Descriptions of how the scheme worked come from the indictment release and the plea release. This article reports guilty pleas and a sentencing that Law360 reported, but the prison terms were not available in the sources used. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.
References
United States Attorney's Office, Southern District of New York. Press release on the charges against the former CEO and CFO of a temporary staffing company, September 30, 2020. https://www.justice.gov/usao-sdny/pr/former-ceo-and-cfo-temporary-staffing-company-charged-manhattan-federal-court-scheme
United States Attorney's Office, Southern District of New York. Press release on the guilty pleas of the former CEO and CFO of a staffing company, February 15, 2024. https://www.justice.gov/usao-sdny/pr/former-ceo-and-cfo-staffing-company-plead-guilty-scheme-defraud-bank-and-investors
Law360. "Ex-Staffing Co. Execs Get Prison After Copping To $75M Fraud." January 24, 2025. https://www.law360.com/banking/articles/2288680/ex-staffing-co-execs-get-prison-after-copping-to-75m-fraud
More of my writing lives at A Tinkerers Notebook.
My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.
The AD&D365 configuration guides are at adnd365.com/start.
Connect with me on LinkedIn.
