For about fifty months, a Long Island healthcare products distributor wired out money as customer refunds, and it landed in an account its own credit supervisor controlled. Tony Ream worked in the credit department of the Melville, New York company from 2019 and later became a credit supervisor. He pleaded guilty to wire fraud on September 25, 2025. Reporting on the case says he was sentenced on September 24, 2026, to 30 months in federal prison, with $1.6 million in restitution.

What happened

From about October 2020 through November 2024, according to the U.S. Attorney's Office for the Eastern District of New York, Ream sent wire transfers totaling approximately $1.6 million from the company's bank account to an account he controlled. Each transaction was recorded as a refund issued to a customer. The release says he took the money from customer refund accounts, and press coverage says some of those accounts were inactive.

A court filing in the case describes the sequence. Ream directed subordinates to initiate a refund. After the refund was initiated, he approved it and disbursed it to the account in his name. The release adds that he deceived employees he supervised "into taking steps that assisted him in carrying out his fraudulent scheme."

Divide $1.6 million by the fifty months from October 2020 through November 2024 and you get about $32,000 a month. Both the total and the period are approximate in the sources, so treat that as a ballpark. The sources don't say how many refunds there were, and they don't say how the scheme was found.

Why the gap existed

A refund is a payment, and nobody argues with a refund. The customer overpaid, or returned something, or has a credit sitting on the account. Somebody in credit is the right person to say so. Credit sits close to both the money going out and the explanation for it.

The court filing describes a clean division of labor. A subordinate initiates and the supervisor approves. The problem is that the approver was also the person steering the destination, and the subordinates didn't know what they were feeding. Two people touched each refund on paper. The second one was steering the money.

Inactive accounts make it worse. A customer who stopped ordering years ago isn't going to call and ask where the refund is. A credit balance that nobody has touched since 2019 is a balance that nobody will miss. The sources don't say whether anyone outside the credit department reviewed those balances.

Controls that would have caught it

Pay refunds only to a destination already on the customer record. A refund goes back to the payment method it came from, or to a bank account in the customer master that someone outside credit has verified. A destination that isn't on file stops the refund until it has been checked, whoever approves it.

Make the approver independent of the initiator's chain of command. A supervisor shouldn't approve refunds that his own team initiates, at least above a set amount. Better still, the approval comes from finance, and a sample of the supervisor's own approvals gets re-performed each month by someone else.

Review dormant credit balances outside the credit department. Customer accounts with no activity for twelve months and a credit balance go on a list that accounts payable or the controller owns. Refunding one needs the original payment, a customer request, and a second person.

An AI prompt example for ERP fraud detection

This case calls for queries about where refunds went and about accounts that were quiet. Against an ERP's accounts receivable and cash management modules, a controller could run something like:

"For the last five years, list every customer refund where the destination bank account holder name does not match the customer name or any bank account on the customer master. Include the user who initiated the refund, the user who approved it, and the amount."

A second query goes after the quiet accounts:

"List refunds issued on customer accounts that had no invoices or receipts in the previous twelve months, grouped by approver, and rank approvers by total value."

Neither query depends on knowing whose name to look for. Both depend on the refund record keeping a destination account in a field somebody can read.

The pattern for this series

Part 12 was a finance chief with the power to delete records. Here the supervisor didn't delete anything. He used the approval step as cover, and the people below him did the initiating. The release doesn't say what prompted the investigation or when the company first noticed.

Source disclaimer

The case details in this article are drawn from press releases published by the U.S. Attorney's Office for the Eastern District of New York, a public government source, a court filing in the case, and contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The sentence reported here comes from news coverage, because I could not open the sentencing release itself. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Eastern District of New York. Press release on the indictment of Tony Ream for stealing from customer credit accounts. https://www.justice.gov/usao-edny/pr/manager-long-island-company-indicted-stealing-16-million-customer-credit-accounts

United States Attorney's Office, Eastern District of New York. Press release on the guilty plea of Tony Ream, September 25, 2025. https://www.justice.gov/usao-edny/pr/manager-long-island-company-pleads-guilty-wire-fraud-stealing-customer-credit-accounts

Becker's Dental Review. "Former credit supervisor sentenced to 30 months for embezzling $1.6M from dental supply company." https://www.beckersdental.com/?p=27271

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A backhoe and dump truck business billed an industrial explosives company on 373 invoices between 2016 and 2023, and the invoices were either inflated or for work nobody did. Barry Anderson, 68, of Findlay, Ohio, a 20-plus-year employee of the company, pleaded guilty on April 17, 2026, to conspiracy to commit mail fraud and to mail fraud. The U.S. Attorney's Office for the Northern District of Ohio announced the plea on April 20. No sentencing date had been set.

What happened

According to the release, Anderson worked with Gregory Shuey, who owned the backhoe and dump truck business. Anderson "directed the business owner either to greatly inflate the invoices or create fake invoices for services that were never performed." Then Anderson paid them on behalf of his employer.

Shuey deposited the checks into an account he controlled and gave Anderson a 50 percent cut of the money. The employer paid about $2,432,844 in fraudulent invoices to Shuey's business. Divide that by 373 and you get roughly $6,522 an invoice, assuming all 373 were paid. Small enough to sail through most approval limits.

There is a second scheme. From 2014 to 2023, Anderson was linked to 34 invoices seeking rental payments from his employer, about $954,330 in all, or roughly $28,069 each. He caused the employer to enter the lease agreements "under false pretenses by concealing the fact that he and his confederates were benefitting financially from the deals."

The headline figure is $3.7 million. The two amounts above add up to $3,387,174, and the release also says Anderson embezzled approximately $400,000 through the invoice scheme. It doesn't reconcile these. The release doesn't name the employer or say how the scheme was found.

Why the gap existed

An invoice from a real vendor, for a service, approved by a manager with authority to approve it, is the most normal document in accounts payable. Nothing about it looks wrong. What was wrong was the relationship behind it, and no field in a vendor record holds that.

The release says Anderson paid the invoices on his employer's behalf. It doesn't say who asked for the work or who confirmed it was done. Services leave nothing in a warehouse to count. A dump truck hauled something, or didn't, and the only evidence is whoever signs.

The lease side has the same shape. The fact that mattered was who stood behind the landlord. The sources don't say how the employer checked ownership of the properties, or whether anybody did.

Controls that would have caught it

Separate the person who requests a service from the person who approves payment for it. For a vendor billing above a set annual total, a second approver in finance or procurement confirms there was a work order, and a completion record from someone who saw the work or can check it independently.

Benchmark service rates and watch one vendor's volume. A single small vendor sending 373 invoices to one manager is a pattern. Compare rates per hour or per load against other vendors and against the same vendor's other customers where the data exists, and flag the ones that sit well above.

Disclose and verify who owns the landlord. Before the company signs or renews a lease, whoever negotiated it attests in writing to any financial interest, and someone outside the business line checks the owner against public property and business records. Then repeat the check on a schedule, because ownership changes.

An AI prompt example for ERP fraud detection

This case calls for queries on approval concentration and on who is behind a payee. Against an ERP's accounts payable and vendor master, a controller could run something like:

"For the last ten years, list each vendor where more than 80 percent of invoice value was approved by one user, and rank them by total paid. Include the average invoice amount and the count of invoices with no matching work order or completion record."

A second query goes after the lease and landlord side:

"List all recurring rent and lease payees, with the bank account holder name, registered address and any shared address, phone number or bank account with an employee record or with another vendor."

Neither query proves anything. Both build a short list for a person to go and ask about, and the second only works if somebody has kept the vendor master clean.

The pattern for this series

Part 11 was about an approver with a conflict of interest. This one is the same problem with a real vendor in the middle, which makes it harder to see. The release doesn't say what prompted the investigation.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Northern District of Ohio, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. This article reports a guilty plea; a sentencing outcome was not available in the sources used. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Northern District of Ohio. "Ohio Man Pleads Guilty to Role in $3.7M Embezzlement Scheme." Press release, April 20, 2026. https://www.justice.gov/usao-ndoh/pr/ohio-man-pleads-guilty-role-37m-embezzlement-scheme

Cleveland 19 News. "Findlay man pleads guilty in $3.7M embezzlement scheme." April 20, 2026. https://www.cleveland19.com/2026/04/20/findlay-man-pleads-guilty-37m-embezzlement-scheme/

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

A Home Depot gift card sales associate stole 8,325 physical gift cards with a combined value of $4,085,043. Felecia Ingram, 53, of Covington, Georgia, had worked for the company since 2008. She pleaded guilty to access device fraud on May 1, 2025, and the U.S. Attorney's Office for the Northern District of Georgia announced her sentence on February 26, 2026: three years and one month in prison.

What happened

From March 2020 through July 2021, according to the release, Ingram used her network access credentials to activate the stolen cards by creating false orders for them. News coverage says the orders made the cards look like they were meant for corporate events. After the cards were live, she deleted the false orders.

That is seventeen months. Divide the card value by the card count and each one averaged about $491.

The release says Home Depot found the fraud when its gift card team spotted a discrepancy in the gift card ledger balances. It does not say when the discrepancy first appeared, or how long it sat there.

Restitution came to $3,946,776, which is $138,267 below the face value of the cards. The release doesn't explain the gap.

Why the gap existed

Activating a gift card creates spendable value. That makes it a payment, whatever the system calls it. In this case the thing that triggered the activation was an order, and an order is a document an associate with the right access can create.

The deletion is what made it work. A false order sitting in the system next to an activated card is a question somebody can ask. A false order that has been removed leaves a card with value on it and nothing behind it. Nobody knows what to look up.

The sources describe the access in one phrase, network access credentials, and say nothing about what else those credentials allowed. They also don't say whether anyone approved the orders or whether activation waited on payment. If it did neither, the ledger was the only check left, and the ledger caught it.

Controls that would have caught it

Activation tied to a settled payment. A card shouldn't go live until payment has cleared against the order, or until a second person has approved a corporate order on the record. An order that creates value without settled payment should sit in a queue, not turn on a card.

No deleting orders that activated stored value. Cancel or void them, keep the original, and require a reason and a second approver. Whoever can create the order should not be the person who can remove it.

Physical stock counted against activations. Inactive cards are inventory, serial numbers included. A regular count of the cards on the shelf, compared to the cards sold and the cards activated on approved orders, turns a missing box into a number.

An AI prompt example for ERP fraud detection

This case calls for queries about activation, not about transactions after the fact. Against an ERP's order management and stored-value ledger, a controller could run something like:

"List all orders from the last three years that activated stored-value cards where no payment settled against the order, or where the order was later cancelled or deleted, grouped by the user who created it."

A second query goes after the stock:

"For each day, compare the count and face value of gift cards activated against cards sold at registers and cards on approved bulk orders, and flag any day where activations exceed both."

Neither query depends on knowing who to suspect. Both depend on the system keeping a record of deleted orders. In some systems that is a setting somebody has to turn on.

The pattern for this series

Part 12 was a CFO deleting credit card charges. This was an associate deleting orders. The release doesn't say how long the discrepancy had been in the ledger before the gift card team saw it.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Northern District of Georgia, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Northern District of Georgia. Press release on the sentencing of Felecia Ingram for stealing gift cards from The Home Depot, February 26, 2026. https://www.justice.gov/usao-ndga/pr/former-home-depot-associate-sentenced-federal-prison-stealing-more-4-million-company

The Covington News. "Covington woman sentenced to prison after stealing $4 million in gift cards from Home Depot." https://www.covnews.com/news/crime/covington-woman-sentenced-to-prison-after-stealing-4-million-in-gift-cards-from-home-depot/

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

Mandy Urban made more than 245 transfers out of her employer's bank accounts and into accounts she controlled, $1,115,344.73 in all. She was a senior staff accountant at a Charlotte company from January 2019 to June 2022. She pleaded guilty to wire fraud in March 2024 and was sentenced in February 2026 to 41 months in prison followed by two years of supervised release.

What happened

Her job covered a lot of ground. According to the U.S. Attorney's Office, she maintained the company's general ledger and prepared its financial statements. She also reconciled the accounts, bank statements included.

Divide $1,115,344.73 by 245 and you get about $4,552. The release says "more than" 245 transfers, so the real average sits lower. Then, in the release's words, she "falsified the company's books and records to conceal the scheme."

The release also lists two Florida convictions. In 2015 she was sentenced to five years of supervised probation for grand theft of about $135,000. In June 2022 she was sentenced to two years in prison for a different scheme to defraud. June 2022 is also the month her employment at the Charlotte company ends in the release's timeline. It does not say how that employment ended, or whether the two are connected.

Why the gap existed

In a company where the controls work, the ledger, the financial statements built from it, and the bank reconciliation check one another. Here one person held all of them. The release doesn't mention anyone else reviewing her work.

A bank transfer to an account that belongs to no vendor and no employee is a detectable event, provided something compares outgoing destinations to the master files. More than 245 of them is a pattern, however small each one was.

The 2015 conviction predates her start date by four years. It was public record on her first day. The release doesn't say whether anyone looked.

Controls that would have caught it

Keep bank reconciliation away from whoever posts to the ledger. The person who reconciles the cash accounts should not be able to post to them, and should work from statements that come straight from the bank. Preparing the financial statements is a different job again, which belongs to a different person where headcount allows and to an outside reviewer where it doesn't.

Match every outgoing transfer destination to the master files. A transfer needs a payee that exists in the vendor or employee records, with the account approved by someone other than the person releasing the payment. A new destination account should trigger a notification, not pass as a quiet setup step.

Screen finance hires, and rescreen them, with the results held outside finance. Anyone with bank access or ledger rights gets a background check before the first day and again at set intervals, within whatever the law allows where the company operates. The results go to HR or ownership.

An AI prompt example for ERP fraud detection

This case calls for one query about destinations and one about who did what. Against an ERP's cash management and general ledger modules, an auditor could run something like:

"List all outgoing bank transfers over the last four years where the destination account does not match a bank account on any vendor, employee, or customer record."

A second query goes after the overlap in duties:

"List every user who both posted journal entries to a cash account and completed the bank reconciliation for that same account, by period."

Neither query needs a suspect. Both need the master files to be current, which is its own project.

The pattern for this series

Parts 5, 7, 10 and 12 each had one person who kept the books and could edit them. Urban makes five. What is new here is a theft conviction on record four years before the first day of work. Part 12 raised the question of whether anyone knew about an earlier theft, and this release is just as quiet.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Western District of North Carolina, a public government source. All facts, figures, and quotations describing the case are sourced from that release. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Western District of North Carolina. Press release on the sentencing of Mandy Deann Urban for embezzling from her employer, February 2026. https://www.justice.gov/usao-wdnc/pr/twice-convicted-accountant-sentenced-embezzling-more-11-million-employer

More of my writing lives at A Tinkerers Notebook.

My book Gamifying the Enterprise: Game Mechanics for Continuous Proficiency is on Amazon. All my books are on my Amazon author page.

The AD&D365 configuration guides are at adnd365.com/start.

Connect with me on LinkedIn.

More than 3,800 company credit card charges were deleted from an expense-reporting system, and the person who deleted them was the chief financial officer. Tina Feuerstein, 53, of Hanover, Pennsylvania, ran finance at a Pennsylvania subsidiary of a Chicago-area company. A federal jury in Chicago convicted her on April 9, 2026, of eight counts of wire fraud after a four-day trial. Sentencing was set for August 26, 2026, and none of the sources used here report the outcome.

What happened

Prosecutors say Feuerstein used a company credit card for personal spending over roughly five years, more than $1 million in all, much of it on luxury furniture and designer clothing. The charges were the easy part. A card issuer bills what it bills. The hard part was the paper trail inside her own company, so she deleted the charges from the expense-reporting system and falsified entries in the general ledger to cover what was left.

Then she prepared consolidated financial statements that, according to the government, misrepresented the company's expenses. Those statements went up to the owners.

Evidence at trial also showed that she had previously embezzled more than $250,000 from another employer.

Why the gap existed

Most earlier cases in this series involved someone getting past a control or around one. This one is simpler. The person responsible for the books also had the ability to remove records from the system that was supposed to check spending against them. Deleting a charge from an expense report doesn't change what the card issuer billed. It changes what the company sees, and if the only record management reads is one she could edit, her edits are the record.

A subsidiary makes that worse in a particular way. Consolidated statements travel upward to owners who rely on the finance function to tell them what happened, and at this company the finance function was her. The sources don't say who, if anyone, reviewed her own card activity.

They also don't say whether anyone at the subsidiary or its parent knew about the earlier theft when she was hired.

Controls that would have caught it

Delete rights removed from anyone who holds a card or posts to the ledger. An expense line that has to come out gets voided or reversed, with the original preserved, a reason code, and a second person's approval. Under that rule, 3,800 deletions would have left 3,800 reversals to look at.

Card issuer statements reconciled by someone outside accounting. The issuer's monthly statement is the one document she couldn't edit. Match it line by line against the expense system and the ledger, and chase every charge that has no counterpart.

Review of the CFO's own spending by someone above the CFO. Whoever approves the finance head's card activity can't report to the finance head. At a subsidiary that probably means the parent's controller or the owner's finance team.

An AI prompt example for ERP fraud detection

This case calls for a query about what is missing, not what is there. Against an ERP's expense management and general ledger modules, paired with the card issuer's transaction feed, a controller or auditor could run something like:

"Compare every transaction on the corporate card issuer's feed against the expense reporting system and the general ledger for the last six years. List each issuer charge that has no matching record, or whose matching record was deleted or voided."

A second query goes after the people with delete access:

"List all deleted or voided expense lines by the user who deleted them, and flag any user who deleted lines on a card assigned to that same user."

Neither asks anyone to guess at motive. Both ask the system to show what used to be there.

The pattern for this series

Part 5 was a controller forging bank statements. Part 7 was a payroll manager keeping separate general ledgers. Part 10 was a bookkeeper editing the school's accounting files. This is the fourth time in the series that the person keeping the books could also edit them, and here the owners upstream read the consolidated version.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Northern District of Illinois, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. This article reports a jury verdict; a sentencing outcome was not available in the sources used. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Northern District of Illinois. "Former CFO of Chicago-Area Company's Subsidiary Convicted of Embezzlement." Press release, April 2026. https://www.justice.gov/usao-ndil/pr/former-cfo-chicago-area-companys-subsidiary-convicted-embezzlement

CFO Dive. "Ex-CFO embezzled $1M for luxury purchases, Chicago jury finds." https://www.cfodive.com/news/ex-cfo-embezzled-1m-luxury-purchases-chicago-jury-finds/818232/

Patch. "CFO Embezzled $1M From Employer To Buy Designer Clothes, Chicago Jury Finds." https://patch.com/illinois/chicago/cfo-embezzled-1m-employer-buy-designer-clothes-chicago-jury-finds

Mark Angarola ran as the global account general manager for an IT services firm supporting a financial institution's operations. For nine years, from roughly May 2010 through February 2019, he arranged for a subcontractor to employ people who did little or no real work for the account he managed, among them his wife, his college roommate, and several friends. He was sentenced in December 2025 to 38 months in prison. The total loss came to more than $8.3 million, with restitution ordered at $9,023,444.96 and forfeiture at $2,679,445.26.

What happened

Angarola had authority to approve invoices from a subcontractor working under his account, and he used that authority to get his own people onto the subcontractor's books. According to prosecutors, he arranged for the subcontractor to hire his wife, a college roommate, and other friends and family, then signed off on timesheets and invoices representing work they hadn't performed. Running alongside the ghost-employee scheme was a second one: expense claims. He submitted and got reimbursed for restaurant meals, hotels, transportation, cruises, and visits to gentlemen's clubs, all disguised as legitimate business costs tied to the account.

He also failed to report the income from either scheme on his taxes for four years, and filed no returns at all for two of those years, a detail that cost the IRS an additional $668,000 and tends to be the thread that eventually gets pulled when investigators start reconstructing what someone actually earned against what they reported.

Why the gap existed

Most of this series has involved someone defeating a control that existed on paper but failed in practice. This case barely had a control to defeat. Angarola held unilateral approval authority over the subcontractor relationship he was simultaneously using to employ his own friends and family. Nobody else at the contractor needed to sign off on who that subcontractor hired, what they were paid, or whether the work billed against the account actually happened.

Ghost employees are a particular kind of fraud because the fictitious worker usually exists somewhere on paper: a name, a timesheet, an invoice line. What's missing is the labor behind it, and that absence is invisible to a system that only checks whether an invoice matches a purchase order and a contract rate. An ERP comparing an invoice against an approved subcontract agreement will clear a bill for forty hours of work at the agreed rate every time, whether or not anyone actually sat at a desk and did the work.

The expense fraud exploited a related blind spot. Expense reports get approved against policy limits and receipt requirements, not against whether the trip or the meal served any legitimate business purpose tied to results anyone can point to. A cruise or a night at a club can be coded as client entertainment and sail through an approval workflow that only checks for a receipt and a dollar threshold, especially when the approver and the person submitting the expense are effectively the same authority.

Controls that would have caught it

Independent verification of subcontractor labor against deliverables. Invoiced hours need to trace to work product, a deployed fix, a completed task, a meeting record, something beyond a timesheet the subcontractor itself generated. A review process that spot-checks a sample of billed hours against actual deliverables would have surfaced names that never produced anything to show for nine years of billing.

A hard prohibition on approving invoices tied to your own personal relationships. Anyone with invoice or timesheet approval authority over a vendor or subcontractor needs to disclose personal relationships with anyone on that vendor's payroll, and approval needs to shift to someone outside that relationship entirely. This is a conflict-of-interest control more than a financial one, but it's the control that actually would have stopped this specific scheme at the source.

Expense review tied to business outcome, not just policy compliance. An expense approval process built only to check receipts and dollar limits will approve almost anything coded correctly. Periodic review that asks what business result a given expense produced, tied back to a specific deliverable or client interaction, catches spending that's procedurally compliant and substantively fictitious.

An AI prompt example for ERP fraud detection

This case needs queries that look past procedural compliance toward whether billed labor and expenses correspond to anything real. Against a vendor management and accounts payable module, someone could run something like:

"List all subcontractor employees billed against this account for the last five years, cross-referenced against any family or personal relationship disclosures on file for the approving employee."

A second query targets the expense side:

"Flag all expense reimbursements coded as client entertainment or business travel where the approving manager and the submitting employee are the same person, or where no corresponding client meeting or deliverable is logged in the account record."

Neither query requires suspecting anyone by name. It requires treating an approval authority held by one person over their own account as something that needs a second set of eyes, which is the specific thing nobody built into this relationship for nine years.

The pattern for this series

Nearly every case in this series comes down to someone holding both ends of a transaction that's supposed to have two separate hands on it. Sometimes that's a payment and its approval. Sometimes it's a ledger and the records used to check it. Here it was an entire subcontractor relationship, employment and billing and approval all resting with one person, for the better part of a decade.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Southern District of New York, a public government source, along with contemporaneous news and IRS Criminal Investigation reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Southern District of New York. "Tech Company Executive Sentenced To Prison For Multimillion-Dollar Embezzlement Scheme And Tax Evasion." Press release, December 2025. https://www.justice.gov/usao-sdny/pr/tech-company-executive-sentenced-prison-multimillion-dollar-embezzlement-scheme-and

Internal Revenue Service Criminal Investigation. "Tech company executive sentenced to prison for multimillion-dollar embezzlement scheme and tax evasion." https://www.irs.gov/compliance/criminal-investigation/tech-company-executive-sentenced-to-prison-for-multimillion-dollar-embezzlement-scheme-and-tax-evasion

Hoodline. "Former Tech Executive Sentenced to 38 Months for Multimillion-Dollar Embezzlement and Tax Evasion." https://hoodline.com/2025/12/former-tech-executive-sentenced-to-38-months-for-multimillion-dollar-embezzlement-and-tax-evasion/

Alysa Dietz Gisser was the bookkeeper and accountant for a small Austin nonprofit school serving children with learning disabilities and special needs. Starting around 2018, she had parents send tuition payments to a PayPal account she controlled, one she had renamed to match the school's own name. She was sentenced in 2026 to 33 months in federal prison and ordered to pay $1,318,684.34 in restitution, on top of a money judgment of just over a million dollars.

What happened

The mechanism here doesn't involve the school's ERP or accounting system at all, at least not at the point of theft. Gisser controlled a PayPal account tied to her own consulting business and renamed it to read like the school's official payment account. Parents paying tuition, enrollment fees, or other charges had no reason to look twice at a payment destination that displayed the school's name. The money went to Gisser instead of the school, every time, for roughly three years.

Making the accounting records lie was the second half of the scheme and the harder one to pull off cleanly. Gisser modified the school's internal accounting files to show tuition payments as received in full, which meant the school's own books looked healthy while the actual bank balance wasn't. Prosecutors also found she'd underreported her income by $863,963.32 over the same period, the kind of detail that only comes out once investigators start pulling bank records rather than trusting what's on a ledger.

Why the gap existed

Every case earlier in this series involved a weakness somewhere inside the ERP itself: a vendor record, a payroll deduction, a reconciliation process. This one starts outside the system entirely, at the moment a parent decides where to send a tuition check, before any of it ever touches an accounts receivable module. That's a genuinely different kind of control gap, because the fraud doesn't need to defeat anything built into the software. It only needs the payment to go to the wrong place before the ERP ever has a chance to record it accurately.

The accounting-side cover-up is where this case rejoins the pattern the rest of the series has been tracking. A small nonprofit school with one bookkeeper handling both the collection of tuition and the recording of whether it arrived has no separation between those two functions. Gisser could misdirect a payment and then personally update the system of record to say the misdirected payment had actually come in. Nobody cross-checked the accounting entries against anything outside her control, so the entries simply became the truth as far as the school's own books were concerned.

A school serving a small number of families, where tuition often gets paid in installments through whatever channel is most convenient for a parent, is a specific kind of soft target. There's no large accounts receivable department running standardized collection. There's a bookkeeper who parents call directly when they have a billing question, and that same person decides what the books say happened.

Controls that would have caught it

Payment channel verification independent of the bookkeeper. Any payment destination, whether a bank account, a PayPal account, or any other external channel, needs to be registered and verified by someone other than the person who manages day-to-day accounting. A new or renamed payment account should trigger a notification outside the bookkeeper's own control, not just appear quietly in the payment flow.

Reconciliation against an external source, not the bookkeeper's own entries. The school's accounting files said tuition had been received. The actual PayPal and bank records would have said otherwise, if anyone had been comparing the two. A reconciliation process that pulls transaction data directly from the payment processor, rather than accepting whatever the bookkeeper enters, closes this specific gap.

A published, unchanging payment destination communicated directly to families. Parents had no independent way to confirm the PayPal account they were paying actually belonged to the school. A payment portal or published account reference maintained outside the bookkeeper's reach, ideally confirmed through a second channel like a board member or a separate administrator, removes the opportunity to substitute a lookalike destination in the first place.

An AI prompt example for ERP fraud detection

This case needs a query aimed at the gap between recorded revenue and verified incoming payments, which most small organizations never build because the volume seems too low to justify it. Against an accounts receivable module paired with payment processor records, someone could run something like:

"Compare all tuition or payment records marked as received in the accounting system against the corresponding settlement records from the payment processor for the same period, and flag any entries with no matching external transaction."

A second query targets the payee-impersonation angle directly:

"List all payment account names or identifiers associated with the organization's name that were created or modified in the last five years, along with the account holder of record for each."

Neither query assumes anyone inside the organization knew something was wrong. Both assume the organization's own books are not sufficient evidence of what actually happened, which is the specific lesson this case keeps offering.

The pattern for this series

Most of the cases in this series involve someone finding a weak point built into the ERP itself. This one is a reminder that a control gap doesn't need to live inside the system at all. It can sit one step upstream, at the moment money chooses a destination, with the ERP only ever seeing the version of events the fraudster chose to type in afterward.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Western District of Texas, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Western District of Texas. "Former Austin School Bookkeeper Sentenced for Embezzling Over $1M." Press release, 2026. https://www.justice.gov/usao-wdtx/pr/former-austin-school-bookkeeper-sentenced-embezzling-over-1m

Fox 7 Austin. "Former Austin private school bookkeeper embezzled $1M for home pool, mortgage." https://www.fox7austin.com/news/former-austin-private-school-bookkeeper-embezzled-1m-home-pool-mortgage

KXAN. "DOJ: Leander woman embezzles over $1M from Austin school." https://www.kxan.com/news/crime/doj-leander-woman-embezzles-over-1m-from-austin-school/

Weston Goldstein spent eight years buying Apple products with a Big Ten Network company credit card and reselling them on eBay, on Mercari, and through a reseller in Pennsylvania. He was 48 when he was sentenced in July 2026 to 28 months in federal prison. The total came to just over $4 million in purchases, and he only recovered about $1.1 million reselling them, a margin that tells you plenty about how this kind of scheme actually spends its money.

What happened

Goldstein was BTN's senior director of engineering, a role that came with procurement authority for electronic equipment the network's technical operations actually needed. From January 2016 through August 2023, he used company cards and the network's normal purchasing process to buy Apple hardware, then moved the physical products out through consumer resale channels instead of into BTN's equipment inventory. Prosecutors put the total at $4,008,719.91 in purchases. He pocketed roughly $1,100,000 from reselling them, spent about $630,000 of that on restaurants, merchandise, and automotive costs, and sent close to $470,000 to someone he later claimed was extorting him over an online relationship.

The pandemic made the scheme easier, not harder. Prosecutors said Goldstein used COVID-19 as cover, ramping up purchases while BTN's oversight was thinner than usual with fewer people physically checking equipment against what was actually arriving. Near the end of his run, someone at BTN told him directly to stop buying equipment. He kept buying it anyway, for months, until the scheme finally came apart in 2023.

Why the gap existed

Every case in this series involves a transaction type that skated past scrutiny for reasons specific to that transaction type. This one is almost embarrassingly simple by comparison: nobody was checking whether the equipment Goldstein bought ever showed up where equipment is supposed to show up. A purchase order for a hundred iPhones or a stack of MacBooks looks completely ordinary on a procurement ledger for a technical operations department at a sports television network. The ledger has no way of knowing, on its own, whether those devices landed on a shelf in a studio or in a box headed to a reseller in Pennsylvania.

That's the structural weakness procurement fraud exploits and the one this series hasn't covered yet. Every prior case involved money moving somewhere it shouldn't, a fictitious vendor, a duplicated check, a garnishment nobody verified. This one involved money moving exactly where it was supposed to go, to Apple, for real products, at real prices. The theft happened one step downstream of the transaction, at the point where a physical object either enters the company's actual inventory or quietly doesn't. An ERP can validate a purchase order against a budget and a vendor record all day long. It can't tell you whether the box got opened in the server room or on a stranger's kitchen table.

The instruction to stop buying is the part that should sting a little. Somebody at BTN noticed something enough to tell Goldstein directly to cease equipment purchases, and he ignored it for months with no apparent consequence until the whole thing collapsed. A verbal instruction with no system-level enforcement behind it isn't a control. It's a suggestion that happens to have been spoken out loud.

Controls that would have caught it

Receiving reconciliation against purchase records. Every purchase order for physical equipment needs a matching receiving record confirming the item actually arrived and was logged into inventory, generated by someone other than the person who requested the purchase. A purchase with no corresponding receipt entry after a reasonable window should flag automatically, not wait for an annual audit to notice.

Asset tagging tied to serial numbers. Apple hardware ships with serial numbers that can be tracked from purchase through deployment. An asset management process that requires every purchased device to be tagged and assigned to a location or an employee closes the exact gap Goldstein used, because a device that never gets tagged is a device that never got where it was supposed to go.

System-enforced purchasing holds. When someone in authority tells an employee to stop making a category of purchase, that instruction needs to become a system-level block on the purchasing card or the procurement workflow, not a conversation that relies on the employee's compliance. Goldstein kept buying equipment for months after being told to stop because nothing in BTN's ERP actually prevented it.

An AI prompt example for ERP fraud detection

This case calls for a query that compares the procurement side of an ERP against the asset management side, something most fraud detection effort skips because the two modules often get reviewed by different people entirely. Against a combined procurement and fixed-asset module, a controller could run something like:

"List all equipment purchases over the last five years where no corresponding asset tag, receiving record, or inventory entry exists within 60 days of the purchase date."

A second query targets the override problem directly:

"Flag any purchasing card transactions made by an employee after that employee received a documented instruction to cease purchases in that category, cross-referenced against internal communications or procurement holds on file."

Neither query requires guessing at what Goldstein did with the products once he had them. It requires treating a purchase as unfinished business until something confirms the thing that got bought actually exists somewhere the company can see it.

The pattern for this series

This series keeps circling back to the same idea from a new angle: a transaction that looks completely ordinary at the point it's recorded and only becomes fraud a step or two downstream, in a place the ERP was never asked to look. Payroll deductions, bank reconciliations, IT asset disposals, and now equipment purchases all share that property. The record of the transaction was accurate. Apple got paid the right amount for real products. What happened to those products afterward was the part nobody's system was built to track.

Source disclaimer

The case details in this article are drawn from a press release published by the U.S. Attorney's Office for the Northern District of Illinois, a public government source, along with contemporaneous news reporting on the same case. All facts, figures, and quotations describing the case are sourced from those releases and reports. The analysis of the control gap, the proposed detection controls, and the AI prompt examples are original commentary and are not part of the source material.

References

United States Attorney's Office, Northern District of Illinois. "Employee Who Fraudulently Embezzled Approximately $4 Million From Big Ten Network Sentenced." Press release, July 2026. https://www.justice.gov/usao-ndil/pr/employee-who-fraudulently-embezzled-approximately-4-million-big-ten-network-sentenced

WGN-TV. "Big Ten Network director gets 28 months for stealing $4M." https://wgntv.com/news/chicago-news/big-ten-network-director-gets-28-months-for-stealing-4m/

Patch. "Employee Who Embezzled $4M From Big Ten Network Gets 28 Months, Must Repay It All." https://patch.com/illinois/tinleypark/employee-who-embezzled-4m-big-ten-network-gets-28-months-must-repay-it-all