ERP Fraud Files, Part 19: The Service Manager Who Wrote Off Insurance Claims as Denied and Deposited the Checks
The accounts payable system said the insurance company had refused to reimburse a repair. The insurance company had in fact sent a check, and the service manager had deposited it in his own bank account. Leon Arthur Keener, 55, of Hugo, Minnesota, worked for the company from 2011 to 2022 and pleaded guilty to one count of mail fraud in April 2024. Local news coverage reports a sentence of four years and three months in prison.
What happened
According to the U.S. Attorney's Office for the District of Minnesota, Keener embezzled $1,314,633 from his employer between 2015 and 2022. He was a service manager with managerial oversight of the financial operations at his location, and his authority included writing off repairs and creating purchase orders. The release calls the employer an interstate trucking company, and news coverage describes a truck dealer and repair shop.
The first scheme involved insurance. Insurance companies sent reimbursement checks for supplemental repairs. Keener wrote the repairs off as a loss, and the news account says he indicated in the accounts payable system that the insurer had refused reimbursement. Then he deposited the check into a personal account. The release puts the total at more than $562,000. To keep the checks coming to him and not to the office, he told employees to hand over any check from an insurer directly to him, bypassing administrative and accounting staff.
The second scheme was vendor payments. He generated and submitted false vendor payment requests, many of them payable to a shell company called CR Services, which he created and controlled. The release puts that total at $751,000. News coverage says the shell was added to the accounts payable system in 2012, before verified vendor identification was required.
The two pieces come to about $1,313,000, against a total of $1,314,633. The release doesn't say what accounts for the difference, and it doesn't say how the scheme was found.
Why the gap existed
A write-off is an accounting entry that says money won't be coming in. Nobody reviews a loss the way they review a payment. If the person who requested the repair can also write off the shortfall, the system has a record of a loss and no record of an insurer's check, because the check, as far as the sources show, never reached the books.
That is the point where the two halves of the fraud fit together. The write-off removed the receivable. The intercepted check made sure no one saw cash arrive. Without the second half, an insurer's payment could sit unmatched against a claim that somebody would eventually chase.
The vendor side is simpler. A vendor record created in 2012 doesn't get looked at again unless someone has a reason. The news account says Keener kept other employees out of the approval process. The sources don't say who, if anyone, reviewed the purchase orders he created, or whether the insurers' claim files were ever compared to what the company recorded.
Controls that would have caught it
Take write-offs out of the hands of the person who created the work. A write-off above a small threshold needs a second approver in finance, plus a document from the payer saying the claim was denied. Without that document it stays open.
Send payer checks to someone who doesn't run the department. Insurers pay to a lockbox or by electronic deposit, and anything that arrives in the mail is opened and logged by accounting staff, not routed to the manager who benefits from it. Tell the insurer where to send payment, in writing.
Revalidate the vendor master, old records included. Vendors added before a control existed get checked on a schedule against tax ID, address and bank account, and a vendor with one requester and one approver gets a second look. Creating a vendor and ordering from it should never sit with the same person.
An AI prompt example for ERP fraud detection
This case calls for queries about write-offs without support and about vendors that have only one person behind them. Against an ERP's accounts receivable, accounts payable and vendor master, a controller could run something like:
"For the last ten years, list every receivable write-off or adjustment coded as insurance denied, non-reimbursable or loss, grouped by the user who approved it, with the claim number and whether a payer remittance or denial document exists. Rank users by total written off."
A second query goes after the vendors:
"List all active vendors where one user requested or approved more than 90 percent of purchase orders and payments, with the date the vendor was created, whether the tax ID and bank account have been validated since, and any shared address, phone number or bank account with an employee record."
Neither query starts with a name. Both depend on the write-off reason and the claim number being stored as data, not typed into a memo field.
The pattern for this series
Part 12 hid the trail by deleting charges and Part 14 by deleting orders. This one hid the trail by writing it off. The release doesn't say what led to the investigation.
Source disclaimer
The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the District of Minnesota, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from that release and those reports. The release describes the employer as an interstate trucking company, while news coverage describes a truck dealer and repair shop, and this article does not name the company. The sentence reported here comes from news coverage, and I could not find the sentencing date or a restitution figure. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.
References
United States Attorney's Office, District of Minnesota. Press release on the guilty plea of Leon Arthur Keener to embezzling from his employer, April 4, 2024. https://www.justice.gov/usao-mn/pr/hugo-man-pleads-guilty-embezzling-more-13-million-employer
FreightWaves. "Minnesota man pleads guilty to embezzling $1.3M from truck dealer." https://www.freightwaves.com/news/minnesota-man-pleads-guilty-to-embezzling-1-3m-from-truck-dealer
Yahoo News. "Hugo man sentenced to prison for stealing more than $1.3M from Inver Grove Heights employer for trips, cars and a boat." https://www.yahoo.com/news/hugo-man-sentenced-prison-stealing-180400772.html
More of my writing lives at A Tinkerers Notebook.
My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.
The AD&D365 configuration guides are at adnd365.com/start.
Connect with me on LinkedIn.
