There are all kinds of bad actors who target small businesses like HVAC contractors. Sometimes it’s a slick-talking con artist with a can’t-lose investment opportunity that seems too good to be true. Sometimes it’s the employee doing the books — the one who never takes a day off and seems too good to be true.

It’s not a question of if a contractor will encounter a fraudster, but when. Business owners need to be aware of this — to watch for and plan for how to deal with fraud if it happens. And if it happens, it can prove costly. It can also go undetected for long periods of time. Insurance firm Hiscox surveyed CFOs, controllers, and accountants who have worked at a company where embezzlement has occurred. Thirty-nine percent of respondents experienced two or more cases of embezzlement during their careers, showing just how common it is. Seventy percent of these schemes lasted for more than a year.

“Among contractors, I’ve seen everything from theft of equipment and tools, to complex financial schemes involving phony vendors and customers,” said Doug Karpp, Hiscox’s head of executive risks and cyber in the U.S.

At one Ohio HVAC firm, an employee embezzled $1,141,533 over the course of a decade. The former controller fraudulently added income to his weekly pay from May 2008 through September 2017. He was sentenced to two years in state prison for the theft.

NEVER TAKES TIME OFF

Small businesses are especially vulnerable to fraud due to fewer controls. An HVAC contractor likely can dedicate only one employee to handling the books. This provides an opportunity for embezzlement as well as other types of fraud, such as vendor kickbacks.

One would think a fraudster would keep a low profile, but that’s often not the case, said Mason Wilder, research specialist with the Association of Certified Fraud Examiners (ACFE). One common sign of fraud is employees living beyond their means. They might have an explanation, such as a recent inheritance, but it should raise concerns. It helps to have insight into employees’ lives. Gambling problems and shopping addictions, for example, are drivers of embezzlement.

Karpp said embezzlers are often extravagant, egotistical risk-takers. They feel they are owed more than they are receiving. At the same time, Karpp describes many embezzlers as intelligent, curious, diligent, and ambitious. Fraudsters aren’t bad employees. Many times, they seem like the best employees, never missing a day of work. That is actually one of the biggest warning signs.

“You might think somebody who never takes a vacation is really committed and a really hard worker,” Wilder said. “But they may not want to leave because they don’t want anybody else to see what they are doing.”

KNOW THE BOOKS

Embezzlers often know the books better than anyone in the office. They know how to time their theft and where to hide the evidence. At one HVAC manufacturer and distributor, a credit and collection supervisor directed customer refunds and third-party payments to her personal accounts and then concealed the transactions as bad debt. This cost the company and its customers more than $100,000.

Click chart to enlarge

ACCOUNTING FOR THE ACCOUNTANTS: The people who handle money are the most likely to steal it.

Wilder recommends contractors require all employees take some time off during the year as a way to prevent fraud. No single person should handle all financial duties, and someone unwilling to share duties should raise suspicions. That said, embezzlers don’t always work alone. In many cases, Karpp said, they work with somebody else — and sometimes, there are multiple parties involved.

This is why business owners must institute a system of checks and balances in order to avoid falling victim to fraud. Karpp said this should include a review of all bank statements and cancelled checks by someone other than the bookkeeper. More than one person should see every transaction. Businesses should perform background checks on all employees (especially those who handle money), as allowed by law.

Click chart to enlarge

HIGH FLYERS: One red flag that could signal fradulent behavior is employees who live beyond their means without a logical explanation.

Having corporate bank statements delivered to an owner at his or her home address can be a good way to spot anomalies before the fraudster covers them up, Karpp said. Wilder said only the owner should sign checks. An automated signature or giving an employee legal authority to sign checks creates opportunities for embezzlement.

Of course, owners themselves embezzle if they use company funds for personal purchases. In these cases, they are stealing from the employees or their partners. Wilder said an annual outside audit is always a wise business policy.

EXTERNAL THREATS

Not all bad actors that threaten a business are sitting at a nearby desk, of course. Some walk in the door offering high-reward, no-risk investments. In other cases, it’s a vendor that overbills, which is why a business owner always needs to go over every invoice before it gets paid, Wilder said. Then there are business scams, such as one that recently occurred in Georgia.

An HVAC contractor there contacted his local Better Business Bureau (BBB) about an outfit called the National Heating, Ventilation and Air Conditioning Association. Rather than being a legitimate trade group, this was an extortion racket that threatened to disparage the firm online if they didn’t join and pay dues. The BBB reports that NHVAC is really a group called Organization Management Co., headquartered on the Caribbean island of Nevis.

The internet provides plenty of opportunities for fraud. One scam involves a copycat website of a legitimate business, such as an HVAC contractor. The goal is collecting money or data from unsuspecting consumers, said Laura Blankenship, director of marketing for the BBB serving Eastern Michigan and the Upper Peninsula. Blankenship said it’s important for contractors to maintain an active digital footprint and register with companies such as the BBB, Angie’s List, and HomeAdvisor.

Another online threat comes from direct cyberfraud, such as phishing. These are attempts to either access valuable data or simply steal money via email misrepresentation. Blankenship said her BBB branch received one such email recently informing them that the supervisor, who was actually out of town, ran into an emergency and needed funds. Nobody at Blankenship’s office fell for it, but it does show how much information scam artists can have on a targeted business.

STAY UP TO DATE

There are flat-out cyberattacks that hold a company’s computer system for ransom. Other hackers pillage data. This creates an ever-more-costly problem for victims, because many states now hold companies accountable for the theft of consumer data. Wilder said most hacks can be prevented by keeping software updated. Software providers stop providing security updates at some point, such as Microsoft’s recent announcement that it will no longer provide them for Windows 7, the platform it released in 2009.

Contractors need to keep themselves up to date as well, Blankenship said. They need to pay attention to announcements about scams from sources such as the BBB, the FTC, and even their state attorneys general. She said one source is BBB.org/scamtracker. Contractors can also set up alerts that gather stories from various news sources.

What to do if a business becomes a victim or fraud, either internal or external? First, it’s a lot harder for a business to respond to fraud than an individual. It’s much harder to freeze accounts, for example. BBB recommends contacting the bank right away to set up credit monitoring. Wilder said businesses must determine if the fraud is ongoing and take steps such as suspending suspected employees. Then, they should consider hiring a certified fraud investigator.

If there is employee theft, Karpp said the business owner needs to press charges no matter the employee’s level of seniority or any other factors.

“This sends a message to other employees that embezzlement is taken seriously,” Karpp said. “Everyone in a company should understand that if they steal, they’ll be prosecuted.”

Businesses can purchase insurance to cover losses from fraud. Crime and fidelity insurance can include protection against embezzlement, employee theft of property, fraud committed against customers’ accounts, erroneous transfer of funds (accidentally transferring funds to the wrong account), cyberdeception, and theft by independent contractors.

Karpp, whose firm sells this type of insurance, said only a small fraction of embezzled funds are recovered in most cases, and restitution is rarely made. The challenge for contractors comes from dedicating valuable resources to fraud prevention. Insurance costs money, and reviewing the books takes time.

“Small businesses are just hustling and worrying about getting the jobs done that they have on their books and getting more lined up,” Wilder said.

But the costs of not taking these steps can be much, much higher.

See more articles from this issue here!