Facebooking fraudsters

Many social media users post info on sites that could expose fraud. And investigators are turning to Facebook and the like to see who’s showing off their ill-gotten gains.

About two years ago in Ontario, five individuals allegedly sustained severe injuries in a car crash. All of them submitted claims to their respective insurance companies — for a total exceeding $1.5 million.

The Discovery Group of Investigators Ltd., in Brampton, Ont., was brought in by one of the insurance companies to investigate the legitimacy of the claims. The first thing investigator Anthony D’Orazio did was a quick Google search on the name of the claimant, which eventually took him to a Facebook page, which ultimately led to a social club. There he found a photo of the claimant — and photos of the other claimants, who had told their insurance companies that the group of three passengers in one car didn’t know any of the passengers in the other.

“Right there, we could have had grounds to throw out the claim,” says D’Orazio. But things got juicier as his team searched a database his company had built up over the years with histories of known fraudsters, online and social media material, and electronic transcripts of newspaper articles. “We were able to establish that there was a cell of about 20 participants who were defrauding on multiple levels,” D’Orazio says.

This ring operated as a pyramid in which players who had committed earlier frauds, and whose names had started to circulate, moved up higher in the pyramid to become invisible and to mastermind fraud schemes that newer recruits in the ring performed. “They were really organized at what they were doing,” says D’Orazio.


Social media and the Internet have become major tools for unearthing material that helps uncover fraud in many areas. Fraudulent insurance claims form the bulk of these investigations, but they can include corporate fraud, drug dealing, Ponzi schemes, terrorism financing, marital infidelity, even checking on the possibly troubled history of the fellow who is proposing to marry a couple’s daughter. In one such case, D’Orazio explains, he found Facebook postings of the son-in-law-to-be having a good time in Las Vegas, which led investigators to discover the man’s narcotics and gambling problems. “The marriage did not take place as far as I know,” says D’Orazio.

“I’ve been practising in this area since 2008 and I’ve always relied on social media and the Internet for all the files that are submitted to me,” says Jason Frost, who works at law firm Hughes Amys LLP in Toronto. “They are incredibly powerful tools for us. I don’t necessarily do it to uncover fraud. It’s surprising the amount of info that is accessible; you never know what’s going to come back.”

Anna Maria Cicirello, senior manager at KPMG Forensic Inc., has been systematically using social media since 2009 to peer into the lives of the people her work requires her to investigate. “I wouldn’t use social media material as my primary material in a case, but it’s a very good corroborative source. It helps me understand the network of friends and acquaintances around people, who they have worked with, their lifestyle, and finally to see if all that is congruent with what my client is telling me. I use social media as an interview preparation tool.”

Having John Smith tell you that he definitely doesn’t know Joe Blow, yet finding out on Facebook that he was recently at a barbecue with him, indicates how much trust you can put in anything he later tells you. Sometimes, it’s not John Smith’s Facebook page that directly reveals that barbecue, but a photo of the event posted on his nephew’s Facebook page.


A number of general traits characterize fraudsters. Sniffing around social media will reveal more material on fraudsters who are under 40 than on those 60-plus, simply because younger people are more active social media users. But there are many exceptions. “Everybody’s connected in one way or other; everybody has a digital footprint, some public, some private,” D’Orazio says. Even people in their 80s will likely be mentioned somewhere by name — in a website or blog, for example — and from there can be connected to their children, spouse, friends and collaborators, some of whom may have photos of them and some biographical material on their Facebook page. This can all become grist for an investigator’s mill.

Most fraudsters are not professionals, especially in the insurance world. The majority are ordinary people who send in a dubious claim and then forget about it, like the man who was receiving disability claims and posted a Kijiji advertisement to sell his big TV. “I got him to slip up,” Frost says, “and admit that he could lift and carry a 50-pound TV while at the same time he had chiropractic opinions saying that he couldn’t lift 10 pounds.”

Fraudsters exhibit a number of recurring characteristics, says Cicirello. They have often set themselves up in a trap of “excessive spending habits, addictions and family problems, and they view corporations and institutions as a personal ATM machine,” she says.

There is also another streak many fraudsters share, especially the amateurs: vanity. They can’t help sharing photos and information with their “friends” that directly contradicts what they assert in an insurance claim. In a case D’Orazio investigated, an individual who claimed he had sustained a brain injury in an accident was posting on Facebook and Twitter that he was beating all the Nintendo games put at his disposal by the hospital where he was convalescing. “That’s an incredible achievement for someone with a brain injury,” D’Orazio says.

Some fraudsters even brag on social media about events that reveal the fraud they are perpetrating. A young man in England, who was suing his municipality because he had supposedly broken his finger by falling in a pothole, had posted a picture of his injury on Facebook, gloating that it had happened while brawling with another fellow.

Even professional fraudsters, who would normally be very careful about any trail they might leave in the virtual world, can slip up, says David Malamed, forensic accounting partner at Grant Thornton LLP, in Toronto (and CPA Magazine’s Fraud columnist). “What I see is the carelessness, or lack of understanding of the reach that social media now has. And it’s the downfall of fraudsters. It’s especially ironic when fraudsters use social media as a tool for fraud, not thinking that it can be used against them.”


Until a fraud is detected, social media is not of much use. But once it is suspected, social media can be a powerful weapon in exposing and thwarting it. In one major case where a company was missing $750,000 and the suspected fraudster was nowhere to be found, Cicirello was able to track him down through the Internet and social media and discovered that he was advertising garage sales and attempting to sell his house. She succeeded in having a court order freeze the individual’s assets, thereby halting the sale of the house. “We had already established through accounting books that the money was missing,” she says. “Facebook confirmed that this person was a flight risk and we needed these pronouncements to secure the assets.”

However, there are some limits to the way social media can be used to snare a fraudster. For example, an investigator would never contact a suspect directly, always going through the suspect’s lawyer to establish any link. And Cicirello would never lure a suspect into a trap by trying to pass herself off as a Facebook friend. “It’s OK for law enforcement to do that,” she says, “but we follow other standards. So I don’t hold myself out to be someone I’m not. However, I could try to get someone to befriend me. You set up a page and encourage people to come over with funny pictures or clever discussions.” She will also make contact with individuals who are Facebook friends of the suspect (of course, Internet friends, not close friends) and ask them to report anything unusual on this person’s Facebook postings.

Forensic accountants and investigators also have access to a constantly growing digital toolbox to help them unearth Internet and social media material: products such as Geofeedia, Echosec, Internet Evidence Finder and Internet Archive Wayback Machine. For example, Geofeedia is a software package that can monitor all social media traffic happening in a certain location. By setting up a grid of five square kilometres around a suspect’s house, for example, D’Orazio can pick up all social media exchanges involving the suspect. All this conversation can reveal the suspect’s contacts, friends and family and agenda as well as any unusual moves, etc. With Wayback Machine, D’Orazio can see precisely what a website looked like in, say, September 1997.

Accountants, of course, play an important role in detecting fraud simply by performing their regular bookkeeping and auditing tasks. In this role, the Internet and social media are not very helpful to them. But there is one key activity, notes Malamed, where these tools can be of great service: prevention.

It is an area where accountants need to be diligent. One anecdote eloquently drives the point home. A manager in a company claimed that a building needed its balconies renovated and he used forged signatures of specialists to request money for repairs. All the financial supervisors in the chain of responsibility confidently signed off. And the money disappeared. “The most interesting aspect of this story is not that money was lost or that so many people were blinded,” says Malamed, “but that the building had no balconies. Just a quick check on Google Earth or MapQuest would have revealed that the balconies didn’t exist.”

The goal is not to systematically perform Internet and social media investigations on every single invoice request, says Malamed. But where there is any doubt, a quick Google search, a superficial look into sites such as Kijiji and Craigslist or looking up a person’s Facebook page could help spot the first steps of a fraudster’s trail.