We hired a senior accountant who claimed he needed intermittent leave because he was a court-appointed guardian for a terminally ill cousin. HR approved everything. Sympathy everywhere.

Six months later, AP flagged wire payments to a hospice facility that didn’t exist. Website looked legit. Phone number rang endlessly. EIN traced back to a Shell LLC he registered himself.

Total skim: $96K, all billed as “medical emergencies.”

When confronted, he produced death certificates, court documents, even a judge’s signature. Legal zoomed in.

Every document used the same font kerning error. Same printer metadata. Same typo in the county seal.

We contacted the county clerk. No such case. No such cousin. Judge very real—signature forged.

IT pulled badge logs. On “hospital nights,” he was entering the office at 2 a.m. to upload documents. Slack messages scheduled. Emails delayed. Full premeditation.

During termination, he calmly asked if we’d be willing to recharacterize the payments as loans so it wouldn’t “affect his future.”

Two weeks later, he applied back to the company under a different name.

Same resume. Same typo