Misappropriation of Funds

A subject with access to a billing system or indirect access to a billing system misuses their access to create fraudulent invoices, causing payments to be diverted to themselves, a business they own, or a third party.

The subject generates falsified internal work orders to simulate legitimate business activity, enabling unauthorized payments, resource allocation, or personal financial gain. These work orders are typically entered into official systems (e.g., procurement, HR, or service management platforms) and may reference real vendors or fictitious entities created by the subject.

Unlike invoice fraud, which occurs at the point of payment, this behavior targets the earlier procedural layer, embedding false tasks, contracts, or justifications into the organization’s internal operations. It is often used to pre-authorize expenditures or create documentation trails that appear procedurally valid.

Work order fabrication may be episodic or sustained, and is especially difficult to detect in high-trust environments or when the subject holds procurement authority. The behavior may surface during internal audits, budget discrepancies, or when a pattern of unusually consistent approvals is noticed across unrelated departments or timeframes.

A subject that self reports hours worked, and/or is eligible to claim overtime or an individual responsible for reporting such working time may falsify time records or make false representations to a working time system to cause payment or time in lieu for unperformed work.

A subject submits, alters, duplicates, or knowingly misrepresents an expense claim to obtain reimbursement for costs that were not legitimately incurred for an authorized organizational purpose. This may include fabricated receipts, inflated amounts, duplicate submissions, personal purchases presented as business expenses, false mileage or subsistence claims, and expenses already reimbursed through another channel.

The infringement may involve a single material claim or a repeated pattern of lower-value claims designed to remain below approval or audit thresholds.

A subject abuses authorized access to create, approve, increase, duplicate, or redirect a refund without a legitimate business basis or required authorization.

The subject may issue the refund to themselves, a friend, family member, associate, colluding customer, or another external party. This may involve refunding a transaction that did not occur, issuing a refund where the goods or services remain valid, refunding more than the original amount, processing the same refund multiple times, or redirecting the proceeds to a payment method or account controlled by an unauthorized recipient.

The subject may conceal the infringement by creating fictitious customer complaints, manipulating return or cancellation records, using unrelated customer accounts, bypassing approval thresholds, dividing the value across multiple refunds, or recording false reasons for the transaction.

A subject with access to sensitive or confidential information may decide to use that information to trade the company's stock or other securities (like bonds or stock options) based on significant, nonpublic information about the company.

A subject deliberately manipulates, inflates, or misrepresents performance-related data to increase personal compensation, such as commission, bonuses, or incentive payments. This behavior typically involves falsifying sales attribution, prematurely recognizing revenue, misreporting deal status, or exploiting weaknesses in performance tracking systems.

Unlike traditional fraud involving direct financial system access, this technique operates upstream, targeting the integrity of business metrics that drive compensation decisions. The subject may act alone or in coordination with others, leveraging gaps in oversight, delayed reconciliation processes, or cultural tolerance for aggressive performance reporting.

A subject abuses authorized access to create, issue, increase, transfer, or redeem value-bearing instruments or account-based benefits without a legitimate business purpose or required approval.

Redeemable value may include gift cards, promotional codes, vouchers, account credits, loyalty balances, refund credits, service credits, or similar benefits that can be exchanged for goods, services, discounts, or financial advantage.

The subject may direct the value to themselves, friends, family members, associates, colluding customers, or other external parties. The value may be provided without payment, sold, exchanged, or otherwise used for personal or third-party gain.

The subject may conceal the activity by using fictitious justifications, linking issuance to unrelated customer records, splitting value across multiple low-value transactions, remaining below approval thresholds, or repeatedly reissuing credits or codes.

A subject may misuse a corporate credit for their own benefit by making purchases that are not aligned with the intended purpose of the card or by failing to follow the policies and procedures governing its use.

A subject with access to a billing system or indirect access to a billing system misuses their access to modify existing invoices, causing payments to be diverted to themselves, a business they own, or a third party.

The subject creates, obtains, or distributes prepaid debit cards as a mechanism for transferring or accessing misappropriated funds without direct attribution. The subject may load funds onto prepaid cards, often issued under false names, expired identities, or third-party aliases.

These cards may be used by the subject personally, handed off to co-conspirators, or leveraged to launder proceeds through ATM withdrawals, retail purchases, or online transfers. Their use enables dissociation from formal banking records and introduces delay or obfuscation in financial forensics.

A subject misuses their direct or indirect access to dishonestly redirect funds to an account they control or to a third party.