Search and restore

Asset recovery in the digital age

By Robert Tie, CFE, CFP




Finding and returning fraud proceeds to victims is a complex profession in great demand. But it's gotten harder as more asset trails lead deep into massive electronic datasets. To save time and money, CFEs are adding new "e-discovery" tools to their traditional array of asset recovery techniques. Speaking from the front lines, three CFEs tell how they provide state-of-the-art services to meet client needs.

Neither the author nor the ACFE and employees necessarily endorse the products mentioned in this article or have any relationship with the companies that produce them. — ed.

In New York, a pension administrator embezzles $42 million from the funds she manages and squanders it on fine jewelry, designer clothes and thoroughbred horses. In California, two realtors defraud a client of $120,000 and try to fool investigators by transferring the stolen funds to their daughter. And in an African nation where median income is scant, a potentate's son plunders the national treasury for more than $100 million to buy a private jet, mansions in Paris and Malibu, and Michael Jackson's "Bad" tour glove and fedora.

Some thieves serve time for their crimes, but most of the wounds they inflict never heal. As the ACFE notes in its 2012 Report to the Nations on Occupational Fraud and Abuse, fewer than half of fraud victims recover any of their losses. Those more fortunate can thank the professionals in private practice and government who — through both innovative and conventional methods — track down and return misappropriated assets to their rightful owners.

As such practitioners know, the arenas and opponents vary, but the investigative challenge doesn't: A clever, remorseless fraudster has stolen and hidden your client's property; your job is to dig it out and bring it back before it disappears forever. In some cases you work directly with the client; in others you assist prosecutors or clients' attorneys who depend on your special expertise. In each instance much is at stake, time is of the essence, and your expense budget is tight. If you're a veteran in this field, overcoming challenges is your forte. But you bring a lot more to the table than enthusiasm.

"It takes a wide range of skills and knowledge to perform this service well," said David Zweighaft, CFE, CPA, managing partner of DsZ Forensic Accounting and Consulting Services LLC in New York City., N.Y. "At a minimum that means solid competence in basic accounting and finance, familiarity with applicable laws and how attorneys work and experience in managing large, diverse bodies of paper and electronic evidence."


David Zweighaft,


In December 2009, federal prosecutors filed embezzlement charges against Melissa G. King, the third-party administrator of the employee benefit funds of Local 147 of the Laborers' International Union of North America, also known as the "sandhogs'" union. Its members dig New York's subway and water tunnels. In September 2010, the U. S. Attorney's Office for the Southern District of New York engaged Zweighaft and his staff of financial analysts, investigators and forensic computer specialists.

"Teamwork is essential on a case of this magnitude. So we set up a 'war room' and brainstormed on whiteboards until we had a workable game plan," Zweighaft recalled of the engagement's initial stages. "Our immediate objectives were to identify known assets and find out whether there were others we weren't aware of. That information would come from the document classes we targeted: bank, credit card, brokerage and pension statements, correspondence relating to King and the union accounts she managed, checks, cash receipts and disbursements, wire transfers, deposits, debit and credit memos, expense receipts and more. Then we devised a classification framework to help us manage and interpret that information when it came in."

And not a moment too soon. While Zweighaft and his associates prepared for action, federal prosecutors' subpoenas turned up 350,000 electronic documents they shared with Zweighaft's team, who sorted and analyzed them for clues to where King had spent or stashed the loot. What they found was evidence of a wire and bank fraud scheme more brazen than intelligent.

"There were few if any levels of separation between King and money she stole," Zweighaft said. "She felt it belonged to her and openly spent well beyond her means. For example, she bought several show horses — one in Europe — and entered them in competitions around the U.S. with logistical support from Air Equine ['You take them around the ring; we take them around the world.']."

As Zweighaft had anticipated, the real challenge in this case was to quickly and accurately interpret the staggering amount of electronic information prosecutors shared with him.

"We tamed this digital tiger on time and within budget," Zweighaft said. "But it would have been much slower and harder without the right software. We used kCura's Relativity, a litigation support tool [screen shot No. 1 below]; IDEA data mining software [screen shots No. 2 and No. 3 below]; and Excel pivot tables [screen shot No. 4 below]." 



Screen shot No. 1: A blank template of kCura's Relativity, a litigation support tool.
Click on image for a higher-resolution version.

Screen shot No. 2: Some of Melissa King's individual American Express
transactions as imported to IDEA.
 Click on image for a higher-resolution version. 

Screen shot No. 3: Some of Melissa King's American Express
transactions summarized in IDEA. 
Click on image for a
higher-resolution version.


 Screen shot No. 4: Some of Melissa King's 
American Express transactions imported 
to an Excel pivot table. Click on image for a
higher-resolution version.


Screen shot No. 1 above shows a blank document review form from the Relativity application. Zweighaft, working with RVM — a litigation support vendor — used this and other forms in the application to perform computer-assisted review, a type of aggregate document analysis (discussed further under the subheading, "E-DISCOVERY: A NEW WAY TO PRACTICE LAW," below).

First, Zweighaft assembled and fed into Relativity a representative selection of documents that might contain information he sought about certain subjects and individuals. Then, using this Relativity form, he thoroughly examined each of them. If, for example, he was looking at a bank statement (that would appear in the blank left side of screen shot No. 1), the kCura form displayed its entire contents. Based on search terms Zweighft had specified earlier [e.g., "King Care" (the name of King's firm), "mortgage," "horse," "transfer," etc.], Relativity also color-coded every instance of each such term present in that message. For example, it highlighted each instance of "King Care" in blue, each instance of "mortgage," "horse" or "transfer" in other colors and so on.

Zweighaft also customized and used "review" check boxes on the form's right side to indicate whether each document contained information relevant to his search (i.e., "Responsive" or "Not Responsive"), whether one or another form of legal privilege prevented disclosure of the document and whether the document addressed any of certain issues he had earlier indicated were important, e.g., embezzlement, bank fraud or wire fraud, etc.

After Zweighaft had evaluated several thousand such documents, those he had coded as responsive but not privileged constituted a group of the kinds of documents that deserved manual scrutiny. Zweighaft next instructed Relativity to evaluate all 350,000 electronic documents to discover the ones that matched those he had coded as worthy of individual analysis. Then, guided by that seed set of documents Zweighaft had identified, Relativity independently culled matches from among the hundreds of thousands of documents prosecutors had subpoenaed. In this way, Relativity saved much time and money by greatly reducing the number of documents Zweighaft had to manually review.

Screen shot No. 2 presents individual American Express transactions that Zweighaft exported into IDEA before commencing that phase of his analysis. In screen shot No. 3, Zweighaft has grouped individual transactions by King and her family in IDEA first by expense type (i.e., business or personal) and then by cardholder, reducing the amount of data he had to interpret while following the money.

Screen shot No. 4 presents an alternative valuable view of the data in screen shot No. 3. Here, Zweighaft used an Excel pivot table to re-group IDEA's expense-and-cardholder view into a view by cardholder and, within that, by expense type. (Excel users can quickly create and modify pivot tables to summarize the contents of hundreds or thousands of individual cells. See "Pivot Table Report 101.") These varied perspectives helped Zweighaft to further eliminate data that neither advanced nor refuted the fraud theory he conceived to guide his asset recovery analysis.

Ultimately, Zweighaft's recovery team determined that King had spent most of the whopping $42 million that she'd stolen. On average, each sandhog lost more than $50,000 in savings, forcing many to continue their arduous and dangerous work well past retirement age. And yet, despite all the harm King caused, a merciful judge — out of consideration for her medical and family problems — in June sentenced her to only six years in prison, rather than the maximum term of eight years.

The court also ruled that King must forfeit all her assets, including her $2 million home, as well as all union funds she had transferred to her family. According to Zweighaft's summary report and other information available at press time, this could result in the recovery of approximately $13 million. King had spent at least $1 million on jewelry, transferred at least $10.5 million into her bank and securities accounts, funneled $900,000 into the mortgage on her home and transferred at least $600,000 into a trust for her children.

After the seizure — and, where necessary, auction — of these assets, the court will order the transfer of the proceeds into a restitution fund for distribution among King's victims. Both they and she will spend the next several years paying for her crime.


"We've seen a technological revolution over the last 10 to 20 years," said Stephanie Giammarco, CFE, CPA, CITP, a partner and e-discovery leader with BDO Consulting in New York. "But until recently that had not greatly affected the legal profession. Now e-discovery is transforming the way people practice law. Today's robust tools have caused a paradigm shift that minimizes the need to manually examine every document during discovery in, for example, legal proceedings or an investigation to recover assets lost through fraud."

Not surprisingly, an often confusing vocabulary accompanies the new applications. For example, two commonly used terms — predictive coding and computer-assisted coding (or review) — refer to generally the same e-discovery process. So most people — aside from software engineers, vendors and marketers — use the terms interchangeably.

Hoping to clarify such matters in proceedings before him, U.S. Magistrate Judge Andrew J. Peck wrote in a 2011 article ("Search Forward," Law Technology News, Oct. 2011; subscription required) that the current hot topic is "computer-assisted coding, often generically called 'predictive coding.' " And, in a groundbreaking Feb. 24, 2012, opinion on a suit (Monique Da Silva Moore, et al. v. Publicis Groupe & MSL Group) brought in the Southern District of New York, Judge Peck wrote:

"By computer-assisted coding, I mean tools (different vendors use different names) that use sophisticated algorithms to enable the computer to determine relevance, based on interaction with (i.e., training by) a human reviewer.

"Unlike manual review, where the review is done by the most junior staff, computer-assisted coding involves a senior partner (or [small] team) who review and code a 'seed set' of documents. The computer identifies properties of those documents that it uses to code other documents. As the senior reviewer continues to code more sample documents, the computer predicts the reviewer's coding. (Or, the computer codes some documents and asks the senior reviewer for feedback.)

"When the system's predictions and the reviewer's coding sufficiently coincide, the system has learned enough to make confident predictions for the remaining documents. Typically, the senior lawyer (or team) needs to review only a few thousand documents to train the computer."

For her part, Giammarco noted the Electronic Discovery Reference Model as an objective and up-to-date source of information on e-discovery. Established in 2006 to address the lack of standards and guidelines, it provides a common, public-domain framework for e-discovery products and services.

Some law firms and other entities might be unaware of such information resources but eager to obtain the cost- and time-saving benefits of e-discovery. So they might enter service agreements before fully understanding how vendor products and user support can help fill their specific needs.

"As a CFE, I understand what my clients need in a fraud-related investigation or litigation, and I make sure they are aware how e-discovery tools might help meet those needs," Giammarco said. The first step, she said, is to perform a cost-benefit analysis. "If my client seeks $100,000 in a civil suit, and it would cost $40,000 to discover the necessary evidence, they might want to settle and call it a day. E-discovery doesn't make economic sense in every case."

Giammarco emphasized, though, that the deciding factors in a fraud examination might not be immediately clear. For example, if a company suspected an employee of embezzlement, e-discovery might validate the company's understanding as well as uncover additional schemes, participants or other information relevant to the investigation. And, when e-discovery is warranted, the CFE should be fully prepared to advise a client on the kind of provider to consider engaging.

"To do that, you need a good sense of the overall size, availability and contents of all relevant paper and electronic documents, information on what discovery, if any, the client has performed so far, and an understanding of the client's technology infrastructure and operating environment," Giammarco said. Once you have that information, she added, you can help the client interview providers whose capabilities potentially meet the client's needs, budget and timetable.

Giammarco recommended posing these questions to potential providers:
  • What types of data collection, processing and hosting software do you use?
  • How long have you provided e-discovery services? To what kinds of clients? Do you offer references?
  • How many reviewers can your application serve simultaneously?
  • What technology and business credentials do your project managers hold?
  • For larger engagements, including those related to government inquiries, does your team include staff experienced at interacting with regulators and law enforcement agencies, such as the U.S. Department of Justice, or in providing testimony?
  • And, where appropriate, does your staff have foreign language experts? What experience does your team have in international, multilingual engagements?
"There are a lot of great e-discovery providers out there," Giammarco said. "But to help your clients find the ones that can meet their needs, you have to do your homework. Ask a lot of questions, and make sure you get clear answers before making any recommendations. The most wonderful and powerful application won't help your clients if it doesn't really match their needs."


David Wall, J.D.,
David Wall, J.D., CFE, CPA, PI, is senior manager at Singer Lewak LLP, an accounting services firm headquartered in Los Angeles.

"I recover assets from various kinds of people," he said. "Some are thieves, like the married couple who had defrauded a person to whom they had sold land. The victim had sued in civil court, and won a $280,000 fraud judgment against the sellers, who said they had no money left. So I investigated."

Armed with a subpoena, Wall checked their bank accounts and found they had issued themselves two cashier's checks — one for about $95,000, the other for about $25,000. Clearly, the fraudsters didn't want to pay any part of the judgment. Six months later, the checks were about to expire, and the perpetrators had to act. When the checks cleared, Wall examined the endorsement and found the $120,000 had gone to a woman whose name until then hadn't come up in the case. She was the fraudsters' 19-year-old daughter. On behalf of his client, Wall promptly filed suit against her for return of the money.

"She maintained she had already given the money back to her parents," Wall said. "But that money wasn't hers to give back; it belonged to my client."

So Wall told her that if she didn't pay his client $120,000, there would be a judgment against her in that amount.

"Think it over," he told the young woman. "Do you want to be able to take out a student loan? Rent an apartment? Get a car loan? Buy a home? You won't be able to do any of those things with a $120,000 judgment hanging over your head. And, in the state of California, that civil judgment — unless discharged — is valid for the entirety of your natural life.

"Neither she nor her crooked parents liked that," Wall said. "They all cried. But my client was the victim, and his recovery was paramount. Finally, the parents capitulated and paid back everything they had stolen. They couldn't throw their baby under the bus.

"When you're dealing with thieves, remember that they don't voluntarily participate in the civil litigation process," he said. "You've got to grab them, find a soft spot and attack it, or you'll never get anything."

Wall said generally there are three avenues to asset recovery. The first is to seek funds or property that the fraudster has hidden somewhere in his name or in a shell account. The second, as in the case above, is to put pressure on parties closely connected to the fraudster, such as relatives and business associates. The third — under a vicarious liability theory — is to go after deep-pocketed parties, such as banks or insurers, who had notice or should have been aware of the fraud but didn't prevent, deter or report it. Whether an asset recovery team uses one or all of these approaches, discovery will be necessary, and CFEs can play several roles in that process, he said. Examples include drafting discovery plans, crafting subpoenas and identifying subjects to serve them on and helping counsel compose deposition questions that get information needed to advance the recovery plan.

"CFEs who are investigators can use extra-judicial methods to obtain information," Wall noted. "That's vital to any successful recovery case. Take, for example, discovery in a civil action. If you put a subpoena on a bank, the defendant will receive a copy, alerting him that you're looking at his accounts. At that point, the jig is up. He'll take the money out of the bank that same day."

But if the CFE investigator gets a lead on where the fraudster has money or property without alerting the fraudster, the attorney who is also working for the client can get a writ of execution, Wall said. If there's already a judgment entered in the matter, the attorney can have the bank account seized before the fraudster knows what's happening. Even if there's no litigation pending, the attorney can go into court and get a provisional remedy to lock up any property the CFE has found through a quiet investigation. 

"Your goals," Wall said, "should be to use every advantage and exploit every weakness."


The above cases offer a glimpse into the skilled practice of a difficult and highly valued profession. As the digital age speeds ahead, thieves are finding new ways to steal and hide assets. But increasing cooperation among local, national and international law enforcement agencies and regulators is making it harder to hide assets at home or abroad. Likewise, CFEs who specialize in asset recovery are fighting fraud with a blend of traditional investigative methods, the latest technology and teamwork. Whether you're an asset recovery veteran or eager to enter this practice niche, a growing variety of professional educational resources and networking opportunities is available to help you meet your clients' needs.

Sidebar 1:

All in the family

The Republic of Equatorial Guinea's coat of arms bears the inscription "Undidade, Paz, Justicia" (In Portuguese: "Unity, Peace, Justice"). But these words matter little to the tiny West African nation's nominally elected ruling family. A former Portuguese and Spanish colony, its economy burgeoned after the 1996 discovery of large oil reserves made it sub-Saharan Africa's third-largest petroleum producer.

Since then, President Teodoro Obiang Nguema Mbasogo — who in 1979 deposed and executed his uncle, the country's first president — has ruled with a possessive iron fist. Together with his son, Vice President Teodoro Nguema Mangue, Obiang absorbs most of the country's soaring energy revenue into his family's enormous, illegitimate personal fortune. In stark contrast, the vast majority of Equatorial Guineans struggle to survive on per capita incomes that are among the world's lowest.

To hide the family's ill-gotten gains, Nguema bought real and personal property in Europe and America. But the sheer number and ostentation of his acquisitions soon attracted global attention. Human Rights Watch, Transparency International and other observers issued widely publicized reports on this brazen theft of a nation's resources and concealment of its proceeds abroad.

Put on notice that Nguema was committing serious cross-border offenses, foreign authorities filed money-laundering and other corruption charges against him. In the U.S., an ongoing investigation by Immigration and Customs Enforcement (ICE) has led to a June 2012 Department of Justice (DOJ) civil forfeiture complaint targeting more than $70 million in Nguema's U.S.-situated assets, including a $38 million Gulfstream jet, a $30 million mansion in Malibu, Calif. and $1.8 million worth of singer Michael Jackson memorabilia.

According to the complaint, Nguema used his position and influence to make himself and others near-exclusive beneficiaries of the extraction and sale of his nation's natural resources. In this way, he amassed a personal fortune of more than $100 million despite earning only five figures as a government official. The complaint also states that Nguema's assets are subject to forfeiture under U.S. Code section 981 because they're traceable to "specified unlawful activity," which according to U.S.C. section 1956, includes "misappropriation, theft of public funds by or for the benefit of a public official."

In France, magistrates ordered the seizure of Nguema's six-floor, $100 million Paris mansion and its opulent contents. They also issued a warrant for his arrest on suspicion of buying the house with the proceeds of embezzlements in his home country. By staying outside the reach of those who would jail him, however, Nguema continues to enjoy his freedom — but not his overseas baubles; the asset recovery pressure is on and won't lessen.

U.S. Assistant Attorney General Lanny Breuer said, "While [Nguema]'s people struggled, he lived the high life. ... Through our Kleptocracy Initiative [a DOJ asset recovery program], we are sending the message loud and clear: The United States will not be a hiding place for the ill-gotten riches of the world's corrupt leaders." The initiative's goal is to return such funds to the people of each nation they were stolen from.

The challenge is daunting. A study by the United Nations and World Bank said as much as $1.6 trillion in criminal proceeds crosses international borders each year.

Encouragingly, DOJ's Tax Division has succeeded in making it harder to hide assets in Switzerland. Under agreements with that country's government and largest bank, the IRS now receives information on U.S. taxpayers' no-longer-anonymous Swiss bank accounts. So Alpine financial institutions aren't the tax havens they once were. But fraudsters needn't worry — cheap and legal Wyoming shell companies are only a few mouse clicks away. (See "No name? No problem!" at bottom.)

Sidebar 2:

Interested in asset recovery? Here are some resources.

  1. ACFE course: Making Crime Pay.
  2. ACFE course: Recovering the Proceeds of Fraud.
  3. ACFE course: Working with Attorneys in Fraud Examinations.
  4. ACFE Fraud Examiners Manual, Locating Hidden Assets, pp. 3.849 ff.
  5. ACFE seminar: Tracing and Recovering Fraud Losses.
  6. e-Discovery publications, The Sedona Conference.
  7. Electronic Discovery Reference Model.
  8. "Managing Discovery of Electronic Information: A Pocket Guide for Judges," Federal Judicial Center, 2012.
  9. "Money laundering, 21st century-style, part 2 of 2," by Robert Tie, CFE, CFP, Fraud Magazine, July/August 2012, re: Foreign Account Tax Compliance Act (FATCA).
  10. "How to Take a Financial Pulse: Is That Deadbeat Really Broke?" by Robert Tie, CFE, CFP, Fraud Magazine, Special to the Web, September 2011.

Sidebar 3:

Things to do Monday morning

  • Experiment with pivot tables and other powerful analytical tools you might already own.
  • Explore e-discovery 
  • applications and their role in asset recovery investigations and litigation.
  • Review and stay current on federal, state and international laws governing asset recovery.
  • Develop an understanding of legal procedure and how CFEs work with lawyers.
  • Participate in social media forums dedicated to sharing information on asset recovery.
Sidebar 4:

No name? No Problem!

If a 2011 World Bank report is any guide, law enforcement agencies have their hands full trying to locate and repatriate misappropriated assets.

According to "The Puppet Masters: How the Corrupt Use Legal Structures to Hide Stolen Assets and What to Do About It," many jurisdictions' ambiguous and lax definitions of beneficial ownership hinder domestic and international efforts to trace and recover criminal proceeds. In five recommendations, the report presented a roadmap for improvements:
  1. The information available at company registries should be improved and made more easily accessible.
  2. Steps should be taken to ensure that service providers collect beneficial ownership information and allow access to it.
  3. All beneficial ownership information should be available within the same jurisdiction.
  4. Bearer shares should be abolished.
  5. Investigative capacity should be strengthened.
Likewise, "Money Laundering Using Trust and Company Service Providers," a 2010 report by the Group of Seven (G-7)'s Financial Action Task Force, told of a case in which a foreign law enforcement agency asked Immigration and Customs Enforcement (ICE) for information about two companies registered in Wyoming.

According to the report, ICE found that both companies were shells legally incorporated under Wyoming's permissive laws. Documentation accompanying goods imported to the inquiring foreign countries listed only the address of the Wyoming incorporating agent. Because Wyoming doesn't require identification of beneficial owners at the time of incorporation, ICE was unable to obtain the requested information.

To close this oversight gap, Senators Carl Levin (D-Mich.) and Chuck Grassley (R-Iowa) in 2008 introduced and have since reintroduced a still-unsuccessful bill, the Incorporation Transparency and Law Enforcement Assistance Act, which would require states to obtain at the time of incorporation the names of all beneficial owners of the entity being formed. The proposed legislation wouldn't require states to verify such data, but it would impose penalties on persons who submit false information and would enable law enforcement agencies to obtain owners' names by subpoena or summons. Under current laws, Levin's office wrote, states form almost two million corporations and limited liability companies each year without seeking information on the identity of their owners.

For their part, trust and company service providers in Wyoming are doing their legal best to outdo competitors in similarly laissez-faire Delaware and Nevada. On its website one such provider boasts:

"Wyoming has no requirement for the names of shareholders to be filed with the state. It asks only for a simple 'Annual Report' which requires disclosure of only those assets located within the state of Wyoming and the name of one person, usually the one who submits the report."

Under those lax provisions, a fraudster can confidently shelter stolen assets in relatively plain view. Even the best investigator can't detect the beneficial ownership link. That's because the tiny Wyoming entity that owns an asset would be suspicious only in the unlikely event that its connection to the thief is exposed.

Robert Tie, CFE, CFP, is a contributing editor with Fraud Magazine and a New York business writer. 

Read more insight and discuss this article in the ACFE's LinkedIn group.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on or ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be emailed to