In fraudulent disbursement schemes, an employee makes a distribution of company funds for a dishonest purpose. Examples of fraudulent disbursements include forging company cheques, the submission of false invoices, doctoring timecards, and so forth. On their face, the fraudulent disbursements do not appear any different from valid disbursements of cash. In many cases, the fraudster “tricks” the victim company into remitting payment. For instance, when an employee runs a bogus invoice through the accounts payable system, the victim organisation cuts a cheque for the bad invoice right along with all the legitimate payments it makes. The perpetrator has taken money from his employer in such a way that it appears to be a normal disbursement of cash. Someone might notice the fraud based on the amount, recipient, or destination of the payment, but the method of payment is legitimate.

Fraudulent disbursements at the cash register are different from the other schemes that often take place at the register, such as skimming and cash larceny. When cash is stolen as part of a register disbursement scheme, the removal of the cash is recorded.

There are two basic register disbursements schemes: false refunds and false voids. While the schemes are largely similar, there are a few differences between the two that merit discussing them separately.

False Refunds

A refund is processed at the register when a customer returns an item of merchandise that was purchased from the store. The transaction that is entered on the register indicates that the merchandise is being replaced in the store’s inventory and the purchase price is being returned to the customer. In other words, a refund shows cash being disbursed from the register to the customer. (See the “False Refunds” flowchart that follows.)

False Refunds – Chart

False refunds

Fictitious Refunds

In a fictitious refund scheme, an employee processes a transaction as if a customer were returning merchandise, even though there is no actual return. Then the employee takes cash from the register in the amount of the false return. The customer might or might not be aware of the scheme taking place.

For instance, if an employee processes a fictitious return for a $100 pair of shoes, he removes $100 from the register. Two things result from this fraudulent transaction. First, the register log indicates that the shoes were returned, so the disbursement appears to be legitimate. The register log balances with the amount of cash in the register, because the money that was taken by the fraudster is supposed to have been removed and given to a customer as a refund.

The second repercussion is that a debit is made to the inventory system showing that the merchandise has been returned to the inventory. Since the transaction is fictitious, no merchandise is actually returned. The result is that the company’s inventory balance on the books is overstated by the amount of the excess refund.


A manager created $5,500 worth of false returns, resulting in a large shortage in the company’s inventory. He was able to carry on his scheme for several months, however, because (1) inventory was not counted regularly and (2) the perpetrator, a manager, was one of the people who performed inventory counts.

Overstated Refunds

Rather than create an entirely fictitious refund, some employees merely overstate the amount of a legitimate refund and steal the excess money. For example, if a customer returns $100 worth of merchandise, the employee might ring up a $200 return. The employee gives the customer $100 in return for the merchandise and then pockets the remaining $100. This will result in shrinkage of $100 worth of inventory.

Credit Card Refunds

When purchases are made with a credit card rather than cash, refunds appear as credits to the customer’s credit card rather than as cash disbursements. Some dishonest employees process false refunds on credit card sales in lieu of processing a normal cash transaction. One benefit of the credit card method is that the perpetrator does not have to physically take cash from the register and carry it out of the store. By processing the refunds to a credit card account, a perpetrator reaps a financial gain and avoids the potential embarrassment of being caught red-handed taking cash.

RELATED:  Cheque Tampering Frauds - Part 1

In a typical credit card refund scheme, the perpetrator rings up a refund on a credit card sale even though the merchandise is not actually being returned. The employee credits his own credit card number rather than the customer’s. The result is that the item’s cost is credited to the perpetrator’s credit card account.

A more creative and wide-ranging application of the credit card refund scheme occurs when employees process refunds to other people’s accounts and receive a portion of the refund as a kickback in return. Suppose a person is $100 short on the rent. That person goes to the retail store where his friend is a teller and has the teller process a credit of $150 to his account. The “customer” then goes to an ATM and withdraws $150 in cash. He pays $50 to the teller and keeps $100 for himself.

Refund schemes are more difficult to perpetrate in many high-tech retail stores where the cash registers have anti-fraud controls that require the refund to be made to the original credit card used for the purchase or that only allow for refunds in the form of a store credit for the current value of the item purchased.

False Voids

Fictitious voids are similar to refund schemes in that they make fraudulent disbursements from the register appear to be legitimate. When a sale is voided on a register, a copy of the customer’s receipt is usually attached to a void slip, along with the signature or initials of a manager indicating that the transaction has been approved. (See the “False Voids” flowchart that follows.) To process a false void, the first thing the perpetrator needs is the customer’s copy of the sales receipt. Typically, when an employee sets about processing a fictitious void, he simply withholds the customer’s receipt at the time of the sale. In many cases, customers do not notice that they are not given a receipt.

With the customer’s copy of the receipt in hand, the culprit rings a voided sale. Whatever money the customer paid for the item is removed from the register as though it is being returned to a customer. The copy of the customer’s receipt is attached to the void slip to verify the transaction’s authenticity.

Before the voided sale will be perceived as valid, a manager generally must approve the transaction. In many instances, the manager in question simply neglects to verify the voided sale’s authenticity. A number of managers will sign almost anything presented to them and thus leave themselves vulnerable to voided sales schemes. It is not a coincidence that the perpetrators of these crimes present their void slips to managers who are lackadaisical about authorising them. These kinds of managers are generally targeted by the fraudsters and are essential to the schemes’ success.

Chart : False Voids

False voids


An employee processed fraudulent voids, kept customer receipts, and presented them to her supervisors for review at the end of her shift, long after the alleged transactions had taken place. Her supervisors approved the voided sales and the accounts receivable department failed to notice the excessive number of voided sales processed by this employee.

Obviously, not all managers give rubber-stamp approval to voided sales. Some employees must therefore take other routes to get their voided sales “approved.” In most of these cases, the perpetrator simply forges his supervisor’s authorisation on the fraudulent void

RELATED:  Cheque Tampering Frauds – Part 2

slips. It is also possible that managers will conspire with register employees and approve false voids in return for a share of the proceeds from the scheme.

Concealing Register Disbursement Schemes

As has already been discussed, two things happen when a false refund or void is entered into the register. The first is that the employee committing the fraud removes cash from the register, and the second is that the item allegedly being returned is debited back into the perpetual inventory. Of course, there really is no merchandise being returned. This leads to inventory shrinkage, a situation in which there is less inventory actually on hand than the perpetual inventory records reflect. A certain amount of shrinkage is expected in any retail industry, but too much of it raises concerns of fraud. It is therefore in the perpetrator’s best interest to conceal the appearance of shrinkage on the books.

Inventory is essentially accounted for by a two-step process. The first part of the process is the perpetual inventory, which is a running tabulation of how much inventory should be on hand. When a sale of merchandise is made, the perpetual inventory is credited to remove this merchandise from the records. The amount of merchandise that should be on hand is reduced. (Conversely, when merchandise is returned, the perpetual inventory is debited.) Periodically, someone from the company takes a physical count of the inventory, going through the stockroom or warehouse and counting the amount of inventory that is actually on hand. The two figures are then compared to see if there is a discrepancy between the perpetual inventory (what should be on hand) and the physical inventory (what is on hand).

In register disbursement schemes, shrinkage is often concealed by overstating inventory during the physical count, especially if taking inventory is one of the perpetrator’s duties. The perpetrator simply overstates the amount of inventory on hand so it matches the perpetual inventory. For a more detailed analysis of methods used to conceal inventory shrinkage, please see the “Asset Misappropriation: Inventory and Other Assets” chapter.

Small Disbursements

Another way for employees to avoid detection in a refund scheme is to keep the sizes of the disbursements low. Many companies set limits below which management review of a refund is not required. Where this is the case, employees simply process copious numbers of refunds that are small enough that they do not have to be reviewed.


An employee created over 1,000 false refunds, all under the review limit of $15. He was eventually caught because he began processing refunds before store hours and another employee noticed that refunds were appearing on the system before the store opened. Nevertheless, the man made off with over $11,000 of his employer’s money before his scheme was detected.

Destroying Records

One final means of concealing a register scheme is to destroy all records of the transaction. Most concealment methods are concerned with keeping management from realising that fraud has occurred. When an employee resorts to destroying records, however, he typically has conceded that management will discover his theft. The purpose of destroying records is usually to prevent management from determining who the thief is.

Detection of Register Disbursement Schemes

Fictitious Refunds or Voided Sales

Fictitious refunds or voided sales can often be detected when closely examining the documentation submitted with the cash receipts.

  • One detection method is to evaluate the refunds or discounts given by each cashier orsalesperson. This analysis might point out that a single employee or group of employees has a higher incidence of refunds or discounts than others. Further examination is then necessary to determine if the refunds are appropriate and properly documented.
  • Signs in the register area asking customers to ask for and examine their receipts employ the customer as part of the internal control system. This helps ensure that the cashier or salesperson is properly accounting for the sale and prevents employees from using customer receipts as support for false void or refunds.
  • Random service calls to customers who have returned merchandise or voided sales can be used to verify the legitimacy of transactions.
RELATED:  Cheque Tampering Frauds – Part 2

Review and Analysis of Decreases in Gross Sales and/or Increases in Returns and


Analysing the relationship between sales, cost of sales, and the returns and allowances can detect inappropriate refunds and discounts. If a large cash fraud is suspected, a thorough review of these accounts might enlighten the examiner as to the suspected fraud’s magnitude. An analysis of refunds and returns and allowances with the actual flow of inventory might reveal some fraud schemes. The refund should cause an entry to inventory, even if it is damaged inventory. Likewise, a return will cause a corresponding entry to an inventory account. There should be a linear relationship between sales and returns and allowances over a relevant range. Any change in this relationship might point to a fraud scheme unless there is another valid explanation such as a change in the manufacturing process, change in product line, or change in price.

Register Disbursement Scheme Red Flags

  • There is inappropriate employee separation of duties. For example, register counting and reconciling should not be done by the cashier.
  • Cashiers have access to the control keys that are necessary for refunds and voids rather than supervisors.
  • The register employee has authority to void his own transactions.
  • Register refunds are not methodically reviewed.
  • Multiple cashiers operate from a single cash drawer without separate access codes.
  • Personal cheques from the cashier are found in his register.
  • Voided transactions are not properly documented or approved by a supervisor.
  • Voided cash receipt forms (manual systems) or supporting documents for voided transactions (cash register systems) are not retained on file.
  • There are missing or obviously altered register logs.
  • There are gaps in the sequence of transactions on the register log.
  • An inordinate number of refunds, voids, or no-sales appear on the register records.
  • Inventory totals appear forced.
  •  There are multiple refunds or voids for amounts just under the review limit.

Prevention of Register Disbursement Schemes

  • Review the segregation of duties of key employees who staff the register as well as the duties of their supervisors.
  • As cash is received ensure that the employees responsible for completing these important tasks are informed of their responsibilities and properly supervised.
  • Ensure that an employee other than the register worker is responsible for preparing register count sheets and reconciling them with register totals.
  • Make sure that complete register documentation and cash are delivered to the appropriate personnel in a timely manner.
  • Be aware that cash thefts are sometimes revealed by customers who have paid money on an account and have not received credit or have been credited for an amount that does not agree with the payment they have made. Complaints and inquiries are also received frequently from banks.
  • Closely monitor access to the register and keep access codes secure.
  • Analyse the quantity of refunds to detect multiple small refunds.
  • Communicate and adhere to the company policy of performing unannounced cash counts.
  • Maintain the presence of a manager or supervisor near the area of the cash register as a deterrent to theft.
  • Review supporting documents for voided and refunded transactions for propriety (i.e., legitimacy and approvals).
  • Review the numerical sequence and completeness of cash register logs.

Fraudulent Cash Disbursements

One thought on “Fraudulent Cash Disbursements

  • May 14, 2017 at 3:16 pm

    Thank you for this very informative write ups, I would like to ask if you have sample policy on fraud for non profit organization. I am confuse what to include in the content of the said policy. Thank you hope to hear you soon.


Leave a Reply

Your email address will not be published. Required fields are marked *