AIA Times Magazine

How Fraud Is Built, Hidden, and Found

The call came from a supplier who had never been paid. According to the company’s ledger, he had been paid in full, eleven times over eighteen months. The money had left the account every time. It just had never reached him. What follows is an illustrative composite, not a single real case. It is assembled from patterns that investigators meet again and again. Call the person at its centre Rakul, a senior accounts payable manager with eleven years at the company. He was trusted, punctual and the first to volunteer at year-end. By every visible measure, he was exactly the colleague an organisation hopes to have. His fraud did not begin with the first false payment. It began years earlier, in a place no audit program tests: a private problem.

Case OverviewHow Alleged Manipulation of Transactions, Supplier Records, Payroll, and Digital Identity Reveals Important Lessons for Auditors. In January 2026, according to the U.S. Department of Justice (DOJ), the defendants sought reimbursement for expenses associated with a supposed work trip to Las Vegas in December 2025. The DOJ alleges that no such trip had taken place. When the parent company requested photographs, the defendants allegedly arranged a later trip to Las Vegas and photographed scenes with Christmas trees to make the images appear as though they had been taken in December. The detail is striking, but the underlying issue is serious: supporting evidence can appear convincing without proving that the activity it represents actually occurred.

One email. One convincing story. One click that could expose an entire organisation. An email arrives on a busy morning from your bank, asking you to verify your account, or a supplier shares an updated invoice. Or your manager requests a confidential file before an important meeting. Everything looks familiar. The sender’s name seems right. You have dozens of tasks waiting, so you act without giving it much thought. But Wait! What if the sender is an impostor? Welcome to phishing, a form of social engineering in which attackers disguise themselves as trusted people or organisations to trick recipients into revealing sensitive information, clicking malicious links, opening harmful attachments, or authorising fraudulent actions.

Lalitha Satheesh,Lalitha Satheesh, M.Com., CA, CS, CFE, CIA, CISA, CRMA, is a Managing Director at Accenture with over 25 years of experience in audit, internal controls, fraud risk, compliance, governance, and risk management. A proud AIA achiever, she shares her insights in this edition of AIA Times on why fraud persists despite established controls and how organisations can strengthen fraud risk management and prevention. A control can be well-designed but poorly executed. It can also be performed consistently yet fail to address the underlying risk because the design itself is inadequate. Effective controls require three things: right design, reliable execution, and demonstrable outcomes.