Marmite and Vegemite are both made from spent brewer’s yeast. Marmite has been sold in Britain since 1902, and Vegemite came out of Melbourne twenty years later. I heard Steven Goodwin at Graebel use the pair recently to describe how people take to AI: you love one or you love the other, never both, and there is no middle ground where someone likes AI but doesn’t want to use it.

My first instinct was to argue. I’ve since come around to most of it, though maybe not for the reasons he’d give.

Nobody has a mild opinion about yeast extract

The spreads divide people because there’s no gentle version of them. You can’t taste a little Marmite the way you can taste a little mustard; the flavor shows up all at once, salty and bitter, and your reaction shows up with it. Marmite leaned into that for years with its “love it or hate it” advertising. The brand never tried to win the middle. It assumed there wasn’t one.

AI has the same problem, or the same gift, depending on where you stand. It isn’t a feature you switch on for one report and forget about. Using it properly means handing it part of your thinking and then checking what comes back, and that changes how the work feels from the inside. People who try it seriously tend to come out with a verdict. It is rarely “it’s fine.”

Two reasonable camps

The people who love it have accepted a trade. They’ll take a draft that is sometimes wrong in exchange for never staring at a blank screen again, and they’ve built the habit of checking. The occasional bad answer is a cost of doing business, much like a junior analyst’s first month on the team.

The people who hate it have looked at the same trade and priced it differently. Picture a controller at month-end. One confident wrong number in a reconciliation can cost her more than a year of saved keystrokes is worth, and her name is on the sign-off. Turning that deal down isn’t fear of technology. It’s arithmetic with different inputs.

Both camps are being rational. That’s probably why neither one moves.

Where the middle goes

Then there are the people who say they like AI in principle and just haven’t gotten around to using it. They exist. I don’t think they stay there long. “I like it, I just don’t use it” sounds like a position until you ask what would make them start, and the answer tends to be a set of conditions that never quite arrive. That’s a no with good manners.

And among the people who do love it, the split happens again, which is where the Vegemite half of his metaphor earns its place. My guess is that most Brits have never formed a real opinion about Vegemite, because the jar they grew up with settled the question before anyone asked. AI users seem to sort the same way. The finance team that got Copilot through its Microsoft agreement thinks of AI as Copilot, and the analyst who started on ChatGPT judges every other tool by how close it comes. Ask either of them to switch and watch the face they make.

What that does to an ERP rollout

If he’s right, a lot of change management is aimed at the wrong target. Rollout plans tend to assume a large persuadable middle that just needs one more demo. The binary says that middle is mostly people who have already decided, politely. The decision probably gets made the first time someone uses the tool on work that matters to them, and the launch email and the lunch-and-learn arrive after the verdict.

Which leaves the question of what that first real use should be, and who gets to choose it for the controller.

---

Credit to Steven Goodwin for the Marmite and Vegemite comparison.

My book, Gamifying the Enterprise: Game Mechanics for Continuous Proficiency, is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

The accounts payable system said the insurance company had refused to reimburse a repair. The insurance company had in fact sent a check, and the service manager had deposited it in his own bank account. Leon Arthur Keener, 55, of Hugo, Minnesota, worked for the company from 2011 to 2022 and pleaded guilty to one count of mail fraud in April 2024. Local news coverage reports a sentence of four years and three months in prison.

What happened

According to the U.S. Attorney's Office for the District of Minnesota, Keener embezzled $1,314,633 from his employer between 2015 and 2022. He was a service manager with managerial oversight of the financial operations at his location, and his authority included writing off repairs and creating purchase orders. The release calls the employer an interstate trucking company, and news coverage describes a truck dealer and repair shop.

The first scheme involved insurance. Insurance companies sent reimbursement checks for supplemental repairs. Keener wrote the repairs off as a loss, and the news account says he indicated in the accounts payable system that the insurer had refused reimbursement. Then he deposited the check into a personal account. The release puts the total at more than $562,000. To keep the checks coming to him and not to the office, he told employees to hand over any check from an insurer directly to him, bypassing administrative and accounting staff.

The second scheme was vendor payments. He generated and submitted false vendor payment requests, many of them payable to a shell company called CR Services, which he created and controlled. The release puts that total at $751,000. News coverage says the shell was added to the accounts payable system in 2012, before verified vendor identification was required.

The two pieces come to about $1,313,000, against a total of $1,314,633. The release doesn't say what accounts for the difference, and it doesn't say how the scheme was found.

Why the gap existed

A write-off is an accounting entry that says money won't be coming in. Nobody reviews a loss the way they review a payment. If the person who requested the repair can also write off the shortfall, the system has a record of a loss and no record of an insurer's check, because the check, as far as the sources show, never reached the books.

That is the point where the two halves of the fraud fit together. The write-off removed the receivable. The intercepted check made sure no one saw cash arrive. Without the second half, an insurer's payment could sit unmatched against a claim that somebody would eventually chase.

The vendor side is simpler. A vendor record created in 2012 doesn't get looked at again unless someone has a reason. The news account says Keener kept other employees out of the approval process. The sources don't say who, if anyone, reviewed the purchase orders he created, or whether the insurers' claim files were ever compared to what the company recorded.

Controls that would have caught it

Take write-offs out of the hands of the person who created the work. A write-off above a small threshold needs a second approver in finance, plus a document from the payer saying the claim was denied. Without that document it stays open.

Send payer checks to someone who doesn't run the department. Insurers pay to a lockbox or by electronic deposit, and anything that arrives in the mail is opened and logged by accounting staff, not routed to the manager who benefits from it. Tell the insurer where to send payment, in writing.

Revalidate the vendor master, old records included. Vendors added before a control existed get checked on a schedule against tax ID, address and bank account, and a vendor with one requester and one approver gets a second look. Creating a vendor and ordering from it should never sit with the same person.

An AI prompt example for ERP fraud detection

This case calls for queries about write-offs without support and about vendors that have only one person behind them. Against an ERP's accounts receivable, accounts payable and vendor master, a controller could run something like:

"For the last ten years, list every receivable write-off or adjustment coded as insurance denied, non-reimbursable or loss, grouped by the user who approved it, with the claim number and whether a payer remittance or denial document exists. Rank users by total written off."

A second query goes after the vendors:

"List all active vendors where one user requested or approved more than 90 percent of purchase orders and payments, with the date the vendor was created, whether the tax ID and bank account have been validated since, and any shared address, phone number or bank account with an employee record."

Neither query starts with a name. Both depend on the write-off reason and the claim number being stored as data, not typed into a memo field.

The pattern for this series

Part 12 hid the trail by deleting charges and Part 14 by deleting orders. This one hid the trail by writing it off. The release doesn't say what led to the investigation.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the District of Minnesota, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from that release and those reports. The release describes the employer as an interstate trucking company, while news coverage describes a truck dealer and repair shop, and this article does not name the company. The sentence reported here comes from news coverage, and I could not find the sentencing date or a restitution figure. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, District of Minnesota. Press release on the guilty plea of Leon Arthur Keener to embezzling from his employer, April 4, 2024. https://www.justice.gov/usao-mn/pr/hugo-man-pleads-guilty-embezzling-more-13-million-employer

FreightWaves. "Minnesota man pleads guilty to embezzling $1.3M from truck dealer." https://www.freightwaves.com/news/minnesota-man-pleads-guilty-to-embezzling-1-3m-from-truck-dealer

Yahoo News. "Hugo man sentenced to prison for stealing more than $1.3M from Inver Grove Heights employer for trips, cars and a boat." https://www.yahoo.com/news/hugo-man-sentenced-prison-stealing-180400772.html

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A staffing company's books held more than 2,000 fraudulent invoices, and some of the customer payments applied against them were the lending bank's own loan money coming back. Louis Lluberes founded the company in 1995 and was its CEO until March 2020. His brother Moises Lluberes was the CFO. Both pleaded guilty on February 15, 2024, to conspiracy to commit bank fraud and conspiracy to commit wire fraud, and a Manhattan federal judge sentenced them to prison on January 24, 2025, according to Law360. The sentences themselves were behind a paywall, so they aren't reported here.

What happened

According to the U.S. Attorney's Office for the Southern District of New York, the company lost significant business from major clients in about 2017. Around then the two defendants began recording what the release calls fictitious receivables, invoices that were not real, on the company's books. The indictment release counts more than 2,000 of them.

The invoices mattered because of how the company borrowed. A bank had given it a revolving line of credit, and the amount the company could draw depended on its eligible accounts receivable. The bank worked that out from weekly financial reports on sales and collections. More receivables meant more borrowing room, so the fake ones did exactly what they were meant to do. The company borrowed more than $500 million from the bank, and the plea release puts the losses to victims at more than $70 million.

Fake invoices age. A real customer pays, and an invoice that sits unpaid past the bank's cutoff stops counting toward the borrowing base. According to the indictment release, the brothers dealt with that by moving borrowed money through two shell companies and back into the company's collections account, where it was labeled as customer payments. The returned money was then applied to older receivables, the fictitious ones included, so they stayed current. The indictment release says about $129 million went from one of the shells to the collections account.

In May 2018 an investor group agreed to buy the company. The release says the brothers concealed the fraud during those negotiations. Louis Lluberes received about $11.3 million on the acquisition day and about $6.2 million after, at least $17.5 million in all, and transferred about $716,000 to his brother. Each brother agreed to restitution of $75,460,611, jointly and severally.

Why the gap existed

An accounts receivable ledger is a list of things customers owe. It does not know whether they owe them. If a person with enough access can post an invoice to a customer account, the ledger will age it, report it and include it in the numbers a lender sees, the same as any other.

The cash side is where the fraud was supposed to run out of road. A fake invoice never gets paid, and eventually the aging report shows it. Here the brothers paid it themselves with borrowed money that left the company and came back looking like a customer. The only tell was the payer, and only if someone looked at who was paying.

One defendant recorded most of the invoices, according to the indictment release. The sources don't say whether anyone besides the two of them could see the posting history. They also don't say what the bank checked beyond the weekly reports, or how the fraud was caught. The release says only that the FBI and prosecutors halted it.

Controls that would have caught it

Tie every invoice to the work behind it. For a staffing company, a real invoice has timesheets, and the timesheets have a person on the payroll. An invoice with no approved time records and no payroll cost is the easiest kind of fiction to test for. Other businesses have an equivalent, such as a shipment, a signed delivery or a contract milestone.

Match the payer to the customer. Cash receipts get compared to the customer master, and a payment from an account or a name that isn't the customer's stops at the door. So does a receipt from an entity the company paid in the last few weeks, because that is a circle and not a collection.

Keep invoicing and lending reports apart. The person who posts receivables doesn't also prepare the report that goes to the bank. A direct confirmation, where someone outside the company contacts a sample of customers about what they owe, is slow and old-fashioned, and a fictitious customer can't confirm a balance.

An AI prompt example for ERP fraud detection

This case calls for queries about support and about round trips. Against an ERP's accounts receivable, billing and cash application modules, an auditor or a lender's analyst could run something like:

"List all customer invoices from the last five years that have no approved time record or delivery record behind them, grouped by customer and by the user who created the invoice, with invoice age and whether it has been paid."

A second query goes after the cash:

"List cash receipts applied to open invoices where the paying account or remitter name does not match the customer master, or where the remitter received a payment from the company in the 30 days before the receipt. Include the age of the invoice at the time the cash was applied."

Neither query needs a suspect. The second depends on the receipt keeping the remitter's name and bank account, which not every cash application process does.

The pattern for this series

Part 17 had the government as the party short-changed. Here it was a bank and the people buying the company, and the report they relied on came out of the receivables ledger. Earlier parts of the series had fake invoices on the payables side. These were on the receivables side, and the brothers did not leave them to die. They paid them.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Attorney's Office for the Southern District of New York, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The press releases do not name the company, and this article does not either. Descriptions of how the scheme worked come from the indictment release and the plea release. This article reports guilty pleas and a sentencing that Law360 reported, but the prison terms were not available in the sources used. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Southern District of New York. Press release on the charges against the former CEO and CFO of a temporary staffing company, September 30, 2020. https://www.justice.gov/usao-sdny/pr/former-ceo-and-cfo-temporary-staffing-company-charged-manhattan-federal-court-scheme

United States Attorney's Office, Southern District of New York. Press release on the guilty pleas of the former CEO and CFO of a staffing company, February 15, 2024. https://www.justice.gov/usao-sdny/pr/former-ceo-and-cfo-staffing-company-plead-guilty-scheme-defraud-bank-and-investors

Law360. "Ex-Staffing Co. Execs Get Prison After Copping To $75M Fraud." January 24, 2025. https://www.law360.com/banking/articles/2288680/ex-staffing-co-execs-get-prison-after-copping-to-75m-fraud

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A Las Vegas cleaning company took taxes out of its employees' paychecks for eleven years and did not pay them over to the IRS. Deborah Meadows, 64, owned A to Z Employment Services LLC, which did carpet, upholstery and roadside cleaning in Nevada, and according to the Justice Department she controlled all of its financial matters. She pleaded guilty on February 12, 2026, to willful failure to account for and pay over trust fund taxes. Sentencing was set for May 21, 2026, and none of the sources used here report the outcome.

What happened

From the first quarter of 2010 through the fourth quarter of 2020, according to the Justice Department, Meadows withheld Social Security, Medicare and income taxes from employee wages. She did not pay them over, and she did not file the required quarterly employment tax returns. The loss to the government exceeded $1.2 million.

That is 44 quarters. Divide $1.2 million by 44 and you get about $27,000 a quarter, and since the release says "exceeding," the real figure is higher. The sources don't say how many employees were on the payroll, so there's no way to turn that into a figure per paycheck.

The concealment came later. After the grand jury began its investigation, the indictment says Meadows answered a subpoena with altered bank records and inaccurate tax records. The altered records showed that another company she owned, AZ-TEC Restoration LLC, had made tax payments to the IRS when it had not. She also provided inaccurate individual and employment tax returns showing taxes paid that she knew had never been paid.

The release says IRS Criminal Investigation led the case. It doesn't say what first drew the IRS's attention.

Why the gap existed

Payroll software does the withholding without being asked. It calculates the tax, deducts it from gross pay, prints the amount on the pay stub and credits a liability account. Everything up to that point is the system doing its job.

Paying the liability is a separate act. Someone has to move the money, and someone has to file the return that says they did. If nobody does, the liability account just keeps growing. Quarter after quarter the balance sits there, and that account is where this kind of failure shows up in plain numbers, if anyone looks.

This is also a case where internal controls have a built-in limit. The sources describe Meadows as owning the company and controlling all financial matters. When the owner is the person not paying, no second approver inside the company is going to stop it. The checks that matter sit outside. The tax authority and the bank hold records the owner can't edit, and an outside accountant can ask them for it.

Controls that would have caught it

Age the payroll tax liability accounts every period. Withholding gets paid on a schedule, so a liability balance that is still open after the deposit date has no good explanation. A growing balance on those accounts goes to someone other than the person who runs payroll.

Check payments against the tax authority's own records. An IRS account transcript shows what was actually received for each quarter, and nobody at the company can edit it. Someone outside payroll, an owner's accountant or an outside CPA, pulls it each quarter and ties it to the payroll register. Better still, a payroll provider that files and remits on the company's behalf leaves its own trail.

Get bank records straight from the bank. The altered bank records in this case were a response to a subpoena, which is late. A routine direct confirmation or a bank-fed statement feed, reviewed by someone outside the finance function, makes that kind of alteration much harder to do and much easier to see.

An AI prompt example for ERP fraud detection

This case calls for queries that compare what was withheld to what was paid. Against an ERP's payroll and general ledger modules, a controller or outside accountant could run something like:

"For each quarter in the last twelve years, list total federal income tax, Social Security and Medicare withheld per the payroll register, the total paid to the tax authority per the bank and cash records, and the difference. Flag every quarter where the difference is not zero."

A second query goes after the ledger itself:

"List all payroll tax liability accounts with a balance more than 90 days old and no payment against it, by tax type and quarter, with the user who last posted to each account."

The first query only works if payments to the tax authority are recorded somewhere the system can see them. In some ERPs they are not, which is a finding in itself.

The pattern for this series

Most of the recent cases in this series had an employer as the victim. Here the money withheld was never the company's, and the thing that went missing was a payment, not a record. The release doesn't say how the IRS first noticed.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Department of Justice, a public government source. All facts, figures, and quotations describing the case are sourced from those releases. This article reports a guilty plea; a sentencing outcome was not available in the sources used. The concealment details first appeared in the indictment release as allegations, and the plea release restates them. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

U.S. Department of Justice, Office of Public Affairs. Press release on the guilty plea of Deborah Meadows to employment tax crimes, February 12, 2026. https://www.justice.gov/opa/pr/cleaning-service-owner-pleads-guilty-employment-tax-crimes

U.S. Department of Justice, Office of Public Affairs. Press release on the indictment of Deborah Meadows for an employment tax scheme, January 10, 2025. https://www.justice.gov/opa/pr/cleaning-service-owner-charged-employment-tax-scheme-and-other-crimes

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

For about fifty months, a Long Island healthcare products distributor wired out money as customer refunds, and it landed in an account its own credit supervisor controlled. Tony Ream worked in the credit department of the Melville, New York company from 2019 and later became a credit supervisor. He pleaded guilty to wire fraud on September 25, 2025. Reporting on the case says he was sentenced on September 24, 2026, to 30 months in federal prison, with $1.6 million in restitution.

What happened

From about October 2020 through November 2024, according to the U.S. Attorney's Office for the Eastern District of New York, Ream sent wire transfers totaling approximately $1.6 million from the company's bank account to an account he controlled. Each transaction was recorded as a refund issued to a customer. The release says he took the money from customer refund accounts, and press coverage says some of those accounts were inactive.

A court filing in the case describes the sequence. Ream directed subordinates to initiate a refund. After the refund was initiated, he approved it and disbursed it to the account in his name. The release adds that he deceived employees he supervised "into taking steps that assisted him in carrying out his fraudulent scheme."

Divide $1.6 million by the fifty months from October 2020 through November 2024 and you get about $32,000 a month. Both the total and the period are approximate in the sources, so treat that as a ballpark. The sources don't say how many refunds there were, and they don't say how the scheme was found.

Why the gap existed

A refund is a payment, and nobody argues with a refund. The customer overpaid, or returned something, or has a credit sitting on the account. Somebody in credit is the right person to say so. Credit sits close to both the money going out and the explanation for it.

The court filing describes a clean division of labor. A subordinate initiates and the supervisor approves. The problem is that the approver was also the person steering the destination, and the subordinates didn't know what they were feeding. Two people touched each refund on paper. The second one was steering the money.

Inactive accounts make it worse. A customer who stopped ordering years ago isn't going to call and ask where the refund is. A credit balance that nobody has touched since 2019 is a balance that nobody will miss. The sources don't say whether anyone outside the credit department reviewed those balances.

Controls that would have caught it

Pay refunds only to a destination already on the customer record. A refund goes back to the payment method it came from, or to a bank account in the customer master that someone outside credit has verified. A destination that isn't on file stops the refund until it has been checked, whoever approves it.

Make the approver independent of the initiator's chain of command. A supervisor shouldn't approve refunds that his own team initiates, at least above a set amount. Better still, the approval comes from finance, and a sample of the supervisor's own approvals gets re-performed each month by someone else.

Review dormant credit balances outside the credit department. Customer accounts with no activity for twelve months and a credit balance go on a list that accounts payable or the controller owns. Refunding one needs the original payment, a customer request, and a second person.

An AI prompt example for ERP fraud detection

This case calls for queries about where refunds went and about accounts that were quiet. Against an ERP's accounts receivable and cash management modules, a controller could run something like:

"For the last five years, list every customer refund where the destination bank account holder name does not match the customer name or any bank account on the customer master. Include the user who initiated the refund, the user who approved it, and the amount."

A second query goes after the quiet accounts:

"List refunds issued on customer accounts that had no invoices or receipts in the previous twelve months, grouped by approver, and rank approvers by total value."

Neither query depends on knowing whose name to look for. Both depend on the refund record keeping a destination account in a field somebody can read.

The pattern for this series

Part 12 was a finance chief with the power to delete records. Here the supervisor didn't delete anything. He used the approval step as cover, and the people below him did the initiating. The release doesn't say what prompted the investigation or when the company first noticed.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Attorney's Office for the Eastern District of New York, a public government source, a court filing in the case, and contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The sentence reported here comes from news coverage, because I could not open the sentencing release itself. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Eastern District of New York. Press release on the indictment of Tony Ream for stealing from customer credit accounts. https://www.justice.gov/usao-edny/pr/manager-long-island-company-indicted-stealing-16-million-customer-credit-accounts

United States Attorney's Office, Eastern District of New York. Press release on the guilty plea of Tony Ream, September 25, 2025. https://www.justice.gov/usao-edny/pr/manager-long-island-company-pleads-guilty-wire-fraud-stealing-customer-credit-accounts

Becker's Dental Review. "Former credit supervisor sentenced to 30 months for embezzling $1.6M from dental supply company." https://www.beckersdental.com/?p=27271

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A backhoe and dump truck business billed an industrial explosives company on 373 invoices between 2016 and 2023, and the invoices were either inflated or for work nobody did. Barry Anderson, 68, of Findlay, Ohio, a 20-plus-year employee of the company, pleaded guilty on April 17, 2026, to conspiracy to commit mail fraud and to mail fraud. The U.S. Attorney's Office for the Northern District of Ohio announced the plea on April 20. No sentencing date had been set.

What happened

According to the release, Anderson worked with Gregory Shuey, who owned the backhoe and dump truck business. Anderson "directed the business owner either to greatly inflate the invoices or create fake invoices for services that were never performed." Then Anderson paid them on behalf of his employer.

Shuey deposited the checks into an account he controlled and gave Anderson a 50 percent cut of the money. The employer paid about $2,432,844 in fraudulent invoices to Shuey's business. Divide that by 373 and you get roughly $6,522 an invoice, assuming all 373 were paid. Small enough to sail through most approval limits.

There is a second scheme. From 2014 to 2023, Anderson was linked to 34 invoices seeking rental payments from his employer, about $954,330 in all, or roughly $28,069 each. He caused the employer to enter the lease agreements "under false pretenses by concealing the fact that he and his confederates were benefitting financially from the deals."

The headline figure is $3.7 million. The two amounts above add up to $3,387,174, and the release also says Anderson embezzled approximately $400,000 through the invoice scheme. It doesn't reconcile these. The release doesn't name the employer or say how the scheme was found.

Why the gap existed

An invoice from a real vendor, for a service, approved by a manager with authority to approve it, is the most normal document in accounts payable. Nothing about it looks wrong. What was wrong was the relationship behind it, and no field in a vendor record holds that.

The release says Anderson paid the invoices on his employer's behalf. It doesn't say who asked for the work or who confirmed it was done. Services leave nothing in a warehouse to count. A dump truck hauled something, or didn't, and the only evidence is whoever signs.

The lease side has the same shape. The fact that mattered was who stood behind the landlord. The sources don't say how the employer checked ownership of the properties, or whether anybody did.

Controls that would have caught it

Separate the person who requests a service from the person who approves payment for it. For a vendor billing above a set annual total, a second approver in finance or procurement confirms there was a work order, and a completion record from someone who saw the work or can check it independently.

Benchmark service rates and watch one vendor's volume. A single small vendor sending 373 invoices to one manager is a pattern. Compare rates per hour or per load against other vendors and against the same vendor's other customers where the data exists, and flag the ones that sit well above.

Disclose and verify who owns the landlord. Before the company signs or renews a lease, whoever negotiated it attests in writing to any financial interest, and someone outside the business line checks the owner against public property and business records. Then repeat the check on a schedule, because ownership changes.

An AI prompt example for ERP fraud detection

This case calls for queries on approval concentration and on who is behind a payee. Against an ERP's accounts payable and vendor master, a controller could run something like:

"For the last ten years, list each vendor where more than 80 percent of invoice value was approved by one user, and rank them by total paid. Include the average invoice amount and the count of invoices with no matching work order or completion record."

A second query goes after the lease and landlord side:

"List all recurring rent and lease payees, with the bank account holder name, registered address and any shared address, phone number or bank account with an employee record or with another vendor."

Neither query proves anything. Both build a short list for a person to go and ask about, and the second only works if somebody has kept the vendor master clean.

The pattern for this series

Part 11 was about an approver with a conflict of interest. This one is the same problem with a real vendor in the middle, which makes it harder to see. The release doesn't say what prompted the investigation.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Northern District of Ohio, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. This article reports a guilty plea; a sentencing outcome was not available in the sources used. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Northern District of Ohio. "Ohio Man Pleads Guilty to Role in $3.7M Embezzlement Scheme." Press release, April 20, 2026. https://www.justice.gov/usao-ndoh/pr/ohio-man-pleads-guilty-role-37m-embezzlement-scheme

Cleveland 19 News. "Findlay man pleads guilty in $3.7M embezzlement scheme." April 20, 2026. https://www.cleveland19.com/2026/04/20/findlay-man-pleads-guilty-37m-embezzlement-scheme/

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A Home Depot gift card sales associate stole 8,325 physical gift cards with a combined value of $4,085,043. Felecia Ingram, 53, of Covington, Georgia, had worked for the company since 2008. She pleaded guilty to access device fraud on May 1, 2025, and the U.S. Attorney's Office for the Northern District of Georgia announced her sentence on February 26, 2026: three years and one month in prison.

What happened

From March 2020 through July 2021, according to the release, Ingram used her network access credentials to activate the stolen cards by creating false orders for them. News coverage says the orders made the cards look like they were meant for corporate events. After the cards were live, she deleted the false orders.

That is seventeen months. Divide the card value by the card count and each one averaged about $491.

The release says Home Depot found the fraud when its gift card team spotted a discrepancy in the gift card ledger balances. It does not say when the discrepancy first appeared, or how long it sat there.

Restitution came to $3,946,776, which is $138,267 below the face value of the cards. The release doesn't explain the gap.

Why the gap existed

Activating a gift card creates spendable value. That makes it a payment, whatever the system calls it. In this case the thing that triggered the activation was an order, and an order is a document an associate with the right access can create.

The deletion is what made it work. A false order sitting in the system next to an activated card is a question somebody can ask. A false order that has been removed leaves a card with value on it and nothing behind it. Nobody knows what to look up.

The sources describe the access in one phrase, network access credentials, and say nothing about what else those credentials allowed. They also don't say whether anyone approved the orders or whether activation waited on payment. If it did neither, the ledger was the only check left, and the ledger caught it.

Controls that would have caught it

Activation tied to a settled payment. A card shouldn't go live until payment has cleared against the order, or until a second person has approved a corporate order on the record. An order that creates value without settled payment should sit in a queue, not turn on a card.

No deleting orders that activated stored value. Cancel or void them, keep the original, and require a reason and a second approver. Whoever can create the order should not be the person who can remove it.

Physical stock counted against activations. Inactive cards are inventory, serial numbers included. A regular count of the cards on the shelf, compared to the cards sold and the cards activated on approved orders, turns a missing box into a number.

An AI prompt example for ERP fraud detection

This case calls for queries about activation, not about transactions after the fact. Against an ERP's order management and stored-value ledger, a controller could run something like:

"List all orders from the last three years that activated stored-value cards where no payment settled against the order, or where the order was later cancelled or deleted, grouped by the user who created it."

A second query goes after the stock:

"For each day, compare the count and face value of gift cards activated against cards sold at registers and cards on approved bulk orders, and flag any day where activations exceed both."

Neither query depends on knowing who to suspect. Both depend on the system keeping a record of deleted orders. In some systems that is a setting somebody has to turn on.

The pattern for this series

Part 12 was a CFO deleting credit card charges. This was an associate deleting orders. The release doesn't say how long the discrepancy had been in the ledger before the gift card team saw it.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Northern District of Georgia, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Northern District of Georgia. Press release on the sentencing of Felecia Ingram for stealing gift cards from The Home Depot, February 26, 2026. https://www.justice.gov/usao-ndga/pr/former-home-depot-associate-sentenced-federal-prison-stealing-more-4-million-company

The Covington News. "Covington woman sentenced to prison after stealing $4 million in gift cards from Home Depot." https://www.covnews.com/news/crime/covington-woman-sentenced-to-prison-after-stealing-4-million-in-gift-cards-from-home-depot/

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

Mandy Urban made more than 245 transfers out of her employer's bank accounts and into accounts she controlled, $1,115,344.73 in all. She was a senior staff accountant at a Charlotte company from January 2019 to June 2022. She pleaded guilty to wire fraud in March 2024 and was sentenced in February 2026 to 41 months in prison followed by two years of supervised release.

What happened

Her job covered a lot of ground. According to the U.S. Attorney's Office, she maintained the company's general ledger and prepared its financial statements. She also reconciled the accounts, bank statements included.

Divide $1,115,344.73 by 245 and you get about $4,552. The release says "more than" 245 transfers, so the real average sits lower. Then, in the release's words, she "falsified the company's books and records to conceal the scheme."

The release also lists two Florida convictions. In 2015 she was sentenced to five years of supervised probation for grand theft of about $135,000. In June 2022 she was sentenced to two years in prison for a different scheme to defraud. June 2022 is also the month her employment at the Charlotte company ends in the release's timeline. It does not say how that employment ended, or whether the two are connected.

Why the gap existed

In a company where the controls work, the ledger, the financial statements built from it, and the bank reconciliation check one another. Here one person held all of them. The release doesn't mention anyone else reviewing her work.

A bank transfer to an account that belongs to no vendor and no employee is a detectable event, provided something compares outgoing destinations to the master files. More than 245 of them is a pattern, however small each one was.

The 2015 conviction predates her start date by four years. It was public record on her first day. The release doesn't say whether anyone looked.

Controls that would have caught it

Keep bank reconciliation away from whoever posts to the ledger. The person who reconciles the cash accounts should not be able to post to them, and should work from statements that come straight from the bank. Preparing the financial statements is a different job again, which belongs to a different person where headcount allows and to an outside reviewer where it doesn't.

Match every outgoing transfer destination to the master files. A transfer needs a payee that exists in the vendor or employee records, with the account approved by someone other than the person releasing the payment. A new destination account should trigger a notification, not pass as a quiet setup step.

Screen finance hires, and rescreen them, with the results held outside finance. Anyone with bank access or ledger rights gets a background check before the first day and again at set intervals, within whatever the law allows where the company operates. The results go to HR or ownership.

An AI prompt example for ERP fraud detection

This case calls for one query about destinations and one about who did what. Against an ERP's cash management and general ledger modules, an auditor could run something like:

"List all outgoing bank transfers over the last four years where the destination account does not match a bank account on any vendor, employee, or customer record."

A second query goes after the overlap in duties:

"List every user who both posted journal entries to a cash account and completed the bank reconciliation for that same account, by period."

Neither query needs a suspect. Both need the master files to be current, which is its own project.

The pattern for this series

Parts 5, 7, 10 and 12 each had one person who kept the books and could edit them. Urban makes five. What is new here is a theft conviction on record four years before the first day of work. Part 12 raised the question of whether anyone knew about an earlier theft, and this release is just as quiet.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Western District of North Carolina, a public government source. All facts, figures, and quotations describing the case are sourced from that release. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Western District of North Carolina. Press release on the sentencing of Mandy Deann Urban for embezzling from her employer, February 2026. https://www.justice.gov/usao-wdnc/pr/twice-convicted-accountant-sentenced-embezzling-more-11-million-employer

---

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

More than 3,800 company credit card charges were deleted from an expense-reporting system, and the person who deleted them was the chief financial officer. Tina Feuerstein, 53, of Hanover, Pennsylvania, ran finance at a Pennsylvania subsidiary of a Chicago-area company. A federal jury in Chicago convicted her on April 9, 2026, of eight counts of wire fraud after a four-day trial. Sentencing was set for August 26, 2026, and none of the sources used here report the outcome.

What happened

Prosecutors say Feuerstein used a company credit card for personal spending over roughly five years, more than $1 million in all, much of it on luxury furniture and designer clothing. The charges were the easy part. A card issuer bills what it bills. The hard part was the paper trail inside her own company, so she deleted the charges from the expense-reporting system and falsified entries in the general ledger to cover what was left.

Then she prepared consolidated financial statements that, according to the government, misrepresented the company's expenses. Those statements went up to the owners.

Evidence at trial also showed that she had previously embezzled more than $250,000 from another employer.

Why the gap existed

Most earlier cases in this series involved someone getting past a control or around one. This one is simpler. The person responsible for the books also had the ability to remove records from the system that was supposed to check spending against them. Deleting a charge from an expense report doesn't change what the card issuer billed. It changes what the company sees, and if the only record management reads is one she could edit, her edits are the record.

A subsidiary makes that worse in a particular way. Consolidated statements travel upward to owners who rely on the finance function to tell them what happened, and at this company the finance function was her. The sources don't say who, if anyone, reviewed her own card activity.

They also don't say whether anyone at the subsidiary or its parent knew about the earlier theft when she was hired.

Controls that would have caught it

Delete rights removed from anyone who holds a card or posts to the ledger. An expense line that has to come out gets voided or reversed, with the original preserved, a reason code, and a second person's approval. Under that rule, 3,800 deletions would have left 3,800 reversals to look at.

Card issuer statements reconciled by someone outside accounting. The issuer's monthly statement is the one document she couldn't edit. Match it line by line against the expense system and the ledger, and chase every charge that has no counterpart.

Review of the CFO's own spending by someone above the CFO. Whoever approves the finance head's card activity can't report to the finance head. At a subsidiary that probably means the parent's controller or the owner's finance team.

An AI prompt example for ERP fraud detection

This case calls for a query about what is missing, not what is there. Against an ERP's expense management and general ledger modules, paired with the card issuer's transaction feed, a controller or auditor could run something like:

"Compare every transaction on the corporate card issuer's feed against the expense reporting system and the general ledger for the last six years. List each issuer charge that has no matching record, or whose matching record was deleted or voided."

A second query goes after the people with delete access:

"List all deleted or voided expense lines by the user who deleted them, and flag any user who deleted lines on a card assigned to that same user."

Neither asks anyone to guess at motive. Both ask the system to show what used to be there.

The pattern for this series

Part 5 was a controller forging bank statements. Part 7 was a payroll manager keeping separate general ledgers. Part 10 was a bookkeeper editing the school's accounting files. This is the fourth time in the series that the person keeping the books could also edit them, and here the owners upstream read the consolidated version.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Northern District of Illinois, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. This article reports a jury verdict; a sentencing outcome was not available in the sources used. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Northern District of Illinois. "Former CFO of Chicago-Area Company's Subsidiary Convicted of Embezzlement." Press release, April 2026. https://www.justice.gov/usao-ndil/pr/former-cfo-chicago-area-companys-subsidiary-convicted-embezzlement

CFO Dive. "Ex-CFO embezzled $1M for luxury purchases, Chicago jury finds." https://www.cfodive.com/news/ex-cfo-embezzled-1m-luxury-purchases-chicago-jury-finds/818232/

Patch. "CFO Embezzled $1M From Employer To Buy Designer Clothes, Chicago Jury Finds." https://patch.com/illinois/chicago/cfo-embezzled-1m-employer-buy-designer-clothes-chicago-jury-finds