Asset misappropriations are by far the most common of all occupational frauds. There are three major categories of asset misappropriation schemes. Cash receipts schemes are discussed in this section, fraudulent disbursements of cash are addressed in the next section, and the following section covers schemes involving the theft of inventory and other noncash assets.

Cash is the focal point of most accounting entries. Cash, both on deposit in banks and on hand as petty cash, can be misappropriated through many different schemes. These schemes can be either on-book or off-book, depending on where they occur.

Cash receipts schemes fall into two categories: skimming and larceny. The difference in the two types of fraud depends completely on when the cash is stolen. Cash larceny is the theft of money that has already appeared on a victim organisation’s books, while skimming is the theft of cash that has not yet been recorded in the accounting system. The way in which an employee extracts the cash might be exactly the same for a cash larceny or skimming scheme.


Skimming is the removal of cash from a victim entity prior to its entry in an accounting system. Employees who skim from their companies steal sales or receivables before they are recorded in the company books. Skimming schemes are known as off-book frauds, meaning money is stolen before it is recorded in the victim organisation’s accounts. This aspect of skimming schemes means they leave no direct audit trail. Because the stolen funds are never recorded, the victim organisation might not be aware that the cash was ever received. Consequently, it can be difficult to detect that the money has been stolen. This is the primary advantage of a skimming scheme to the fraudster.

Skimming is one of the most common forms of occupational fraud. It can occur at any point where cash enters a business, so almost anyone who deals with the process of receiving cash might be in a position to skim money. This includes salespeople, tellers, waitpersons, and others who receive cash directly from customers.

In addition, many skimming schemes are perpetrated by employees whose duties include receiving and logging payments made by customers through the mail. These employees slip cheques out of the incoming mail instead of posting those cheques to the proper revenue or receivables accounts. Those who deal directly with customers or who handle customer payments are obviously the most likely candidates to skim funds.

Sales Skimming

The most basic skimming scheme occurs when an employee sells goods or services to a customer and collects the customer’s payment, but makes no record of the sale. The employee simply pockets the money received from the customer instead of turning it over to his employer.

Consider one of the simplest and most common sales transactions: a sale of goods at the cash register. In a normal transaction, a customer purchases an item and an employee enters the sale on the register. The register log reflects that the sale has been made and shows that a certain amount of cash (the purchase price of the item) should have been placed in the register. By comparing the register log to the amount of money on hand, it might be possible to detect thefts. For instance, if there were $500 worth of sales recorded on a particular register on a given day, but only $400 cash in the register, it would be obvious that someone had stolen $100 (assuming no beginning cash balance).

RELATED:  Cash Larceny - Part 1

If the employee is skimming money, however, it will be impossible to detect theft simply by comparing the register log to the cash drawer. Returning to the example in the previous paragraph, assume that an employee wants to make off with $100. Throughout the course of the day, there is $500 worth of sales at his register; one sale is for $100. When the $100 sale is made, the employee does not record the transaction on his register. The customer pays $100 and takes the merchandise home, but instead of placing the money in the cash drawer, the employee pockets it. To create the appearance that the sale is being entered in the register, the employee might ring a “no sale” or some other noncash transaction. Since the employee did not record the sale, at the end of the day the register log will only reflect $400 in sales. There will be $400 on hand in the register ($500 in total sales minus the $100 that the employee stole), so the register will balance. Thus by not recording the sale the employee is able to steal money without the missing funds appearing on the books. Of course, the theft will show up indirectly in the company’s records as inventory shrinkage. But the books will provide no direct evidence of the theft.

Flowchart: Unrecorded Sales 


The most difficult part in skimming at the register is that the employee must commit the overt act of taking money. If the employee takes the customer’s money and shoves it into his pocket without entering the transaction on the register, the customer will probably suspect that something is wrong and might report the conduct to another employee or a manager. It is also possible that a manager, a fellow employee, or a surveillance camera will spot the illegal conduct. Therefore, it is often desirable for a perpetrator to act as though he is properly recording a transaction while he skims sales.

Register Manipulation

Some employees might ring a “no sale” or other noncash transaction to mask the theft of sales. The false transaction is entered on the register so that it appears that a sale is being rung up. The perpetrator opens the register drawer and pretends to place the cash he has just received in the drawer, but in reality he pockets it. To the casual observer, it looks as though the sale is being properly recorded.

Some employees might also rig their registers so that a sale can be entered on the register keys, but will not appear on the register logs. The employee can then safely skim the sale. Anyone observing the employee will see the sale entered, the cash drawer open, etc., yet the register log will not reflect the transaction.

RELATED:  Cash Larceny - Part 3


A service station employee hid stolen gasoline sales by simply lifting the ribbon from the printer on his register. He collected and pocketed the sales, which were not recorded on the register log. The fraudster would then roll back the tape to the point where the next transaction should appear and replace the ribbon. The next transaction would be printed without leaving any blank space on the tape, apparently leaving no trace of the fraud.

When the ribbon is removed from the register, the result is a blank space on the register log where the skimmed sale should have been printed. Unusual gaps between transactions on a register log might mean that someone is skimming sales.

Fraudsters will often manually roll back the tape when they replace the ribbon on their registers so that there is no gap between transactions. Most register transactions, however, are sequentially numbered. If a transaction has been omitted from the register log, the result is a break in the sequence. For instance, if an employee skimmed sale #155, then the register log would only show transactions #153, #154, #156, #157, and so on. The missing transaction numbers, omitted because the ribbon was lifted when the transactions took place, would indicate fraud.

Skimming During Nonbusiness Hours

Another way to skim unrecorded sales is to conduct sales during nonbusiness hours. For instance, some employees will open stores on weekends or after hours without the owners’ knowledge. They can pocket the proceeds of all sales made during these times because the owners have no idea that their stores are even open for business.


A manager of a retail facility went to work two hours early every day, opening his store at 8:00 a.m. instead of 10:00 a.m., and pocketed all the sales made during those two hours. He rang up sales on the register as if it was business as usual, but then removed the register log and all the cash he had accumulated. The manager then started from scratch at 10:00 as if the store was just opening. The tape was destroyed so there was no record of the before- hours revenue.

To this point, skimming has been discussed in the context of cash register transactions, but skimming does not have to occur at a register. Some of the most costly skimming schemes are perpetrated by employees who work at remote locations or without close supervision. This can include on-site sales persons who do not deal with registers, independent salesmen who operate off-site, and employees who work at branches or satellite offices. These employees have a high level of autonomy in their jobs, which often translates into poor supervision and, in turn, fraud.

RELATED:  Cash Skimming – Part 3

Skimming of Off-Site Sales

Several industries rely on remote salespersons to generate revenue. The fact that these employees are largely unsupervised puts them in a good position to skim revenues. For example, consider the apartment rental industry, where apartment managers handle the day- to-day operations without much oversight. A common scheme is for an on-site employee to identify the tenants who pay in currency and remove them from the books. This causes a particular apartment to appear as vacant on the records when, in fact, it is occupied. The manager can skim the rental payments from the “vacant” unit, and the revenue will never be missed. As long as no one physically checks the apartment, the perpetrator can continue skimming indefinitely.

Another rental-skimming scheme occurs when apartments are rented out but no lease is signed. On the books, the apartment will still appear to be vacant, even though there are tenants on the premises. The perpetrator can skim the rental payments from these tenants without fear that they will show up as past due in the company records. Sometimes the employees in these schemes work in conjunction with the renters and give a “special rate” to these people. In return, the renters’ payments are made directly to the employee and any complaints or maintenance requests are directed only to that employee so the tenant’s presence in the apartment remains hidden.

Instead of skimming rent, some property managers focus on less predictable forms of revenue like application fees and late fees. Ownership might know when rent is due and how many apartments are occupied, but often there is no control in place to track the number of people who fill out rental applications or how many tenants pay their rent a day or two late. Property managers can make thousands of dollars by skimming these small payments.

Off-site skimming is by no means limited to the apartment rental industry. The schemes described previously can easily translate into any arena where those who generate or collect revenues operate in an independent fashion. A prime example is the insurance agent who sells policies to customers, and then neglects to file the policies with the carrier. Most customers do not want to file claims on a policy, especially early in the term, for fear that their premiums will rise. Knowing this, the agent keeps all documentation on the policies instead of turning it over to the carrier. The agent is able to skim the customer’s payments because the carrier does not know the policy exists. The customer continues to make his payments, thinking that he is insured when in fact the policy is a ruse.

Cash Skimming – Part 1

Leave a Reply

Your email address will not be published. Required fields are marked *