The largest Russian transportation company (hereinafter referred to as the “Company”) suffered losses resulting from the unauthorized wire transfer of 90 million rubles to the bank account of an outside company. The Company requested FLSAP services, seeking an opportunity to recover the above amount and to obtain assistance in court proceedings.
Step 1. Analysis of the register of the Company’s contracting parties showed that the name of the outside company is almost identical to the name of the approved supplier of the Company. During the investigation it was found out that the banking details of the “mirror” company had been entered by a Company employee into the registration card of the approved contracting party.
Step 2. Analysis of the list of users having authorized access to the accounting and operating systems of the Company as well as the log of changes in their entries helped to identify the name of the Company’s employee who made changes in the above banking details. As a result, another Company’s employee who was responsible for final acceptance of payments was led into error, paying no attention to the slight difference in the name of the company – recipient of the transferred funds.
Step 3. Recovery of the image data from the hard drive of the corporate computer of the employee whose name was identified in Step 2 and examination of his emails by using the key search words helped to identify other persons involved.
Step 4. Assistance provided to the client in initiating criminal proceedings and subsequent inquiry of the investigating authorities helped to find out who received the funds in the amount of 90 million rubles from the account of the “mirror” company.
Step 5. Analysis of the affiliation of the people who received the above funds and the Company’s employees revealed the existence of kinship in about 60%. This fact as well as the findings obtained in Step 3 made it possible to reclaim, through legal proceedings, the part of funds that had not been redeemed by the end recipients (i.e. 30 million rubles out of 90 million rubles).
Step 6. About 80% of the remaining 60 million rubles were shared between two individuals who withdrew the money shortly after it had been credited to their accounts. The collected and analyzed information about the most frequently visited destinations during foreign business trips of the above individuals showed that one of them visited regularly Great Britain. Therefore, the assumption was made regarding the existence of assets, which could be purchased in Great Britain by the above individual through the Company’s funds.
Step 7. The proof of the existing assets owned by the above individual and cooperation with British colleagues made it possible to reclaim the stolen money of the Company from the unlawful possession.
THE TOTAL OUTCOME OF THE PROVIDED FLSAP SERVICES WAS THE COMPANY’S RECOVERY OF 62 MILLION RUBLES OUT OF 90 MILLION RUBLES.
