Controlling Vendor Master Data To Block Fraudulent Payees

A former Mars Wrigley executive based in Connecticut, 58?year?old Paul Steed of Stamford, admitted to running a long?running fraud and tax evasion scheme through which he stole more than $28M from the candy maker throughout roughly a decade.

He pled guilty in federal court in Bridgeport to fraud and tax charges and agreed to pay back about $28.4M to Mars, along with roughly $10M in unpaid taxes to the Internal Revenue Service.

Steed worked remotely for Mars Wrigley, a Mars, Inc. subsidiary, from about 2011 to 2023 and ultimately served as global price risk manager for the company's global cocoa business, a role that gave him access to financial flows tied to complex commodity and trade programs.

Prosecutors and regulators say he used that access to devise multiple schemes beginning around 2013, using shell companies he controlled to intercept money that should have gone to Mars. The centerpiece of the fraud involved creating a company called MCNA LLC, named to resemble Mars Chocolate North America, and instructing counterparties to send payments to MCNA as if it were a legitimate Mars entity.

One major stream of stolen funds came from the U.S. Department of Agriculture's Sugar?Containing Products Re?Export Program, where Steed handled Mars Wrigley's participation and allegedly directed sugar refineries buying re?export credits from Mars to pay MCNA instead of Mars.

Authorities say more than $26M of the stolen money ultimately flowed into MCNA's bank accounts through this and related diversions.

In a separate maneuver, Steed allegedly ensured that dividends from a financial services company in which Mars held a stake were routed to MCNA, and he eventually arranged the sale of Mars's entire shareholding in that firm, personally capturing more than $11M from the proceeds.

Investigators describe an additional scheme, running from 2013 to 2020, in which Steed used another company he owned, Ibera LLC, to submit invoices to Mars for services that were never provided, causing Mars to pay Ibera more than 700,000 dollars.

Across all of these schemes, federal authorities say Steed failed to report the illicit income properly, leading to the parallel tax charges and the large tax restitution obligation. The Internal Revenue Service and Justice Department emphasize that the tax loss, pegged at about $10M, reflects years of unreported or falsely reported income tied to the embezzled funds.

Law enforcement agencies seized more than $18M from Steed's bank accounts and are moving to confiscate assets purchased with the stolen money, including a home in Greenwich, Connecticut that investigators allege was bought using about $2.3M in diverted funds. Prosecutors also say he sent around $2M to Argentina, where he has family connections and owns a ranch, suggesting that a portion of the proceeds was moved offshore.

Source: https://www.fox61.com/article/news/crime/former-mars-chocolate-employee-connecticut-admits-stealing-28-million-from-company/520-c8b7575f-4966-4361-bfa5-d3caa772ce72

Commentary

In the above matter, the accused created a shell corporation that appeared to be like his employer. Organizations can reduce the risk of paying look?alike or seemingly related entities by tightening how vendors are identified, approved, and maintained in core systems.

Robust vendor onboarding should require independent verification of legal name, tax identification, beneficial ownership, and banking details against trusted external sources rather than relying on information supplied by a single employee or contact.

Centralized vendor master data, with clear rules on who can create or modify vendor records and mandatory reviews of any new entity whose name or acronym closely resembles an existing supplier or internal affiliate, makes it harder for shell or copycat companies to be treated as legitimate payees.

Periodic analytics of vendor files and payment history, looking for near?duplicate names, shared bank accounts or overlapping addresses, adds a protective layer that can reveal entities that appear related but are in fact independent fronts.

On the payment side, organizations benefit from strict end?to?end matching and out?of?band verification when bank or remittance details change or when payments are directed to a new entity that claims to be part of an existing group.

Invoice and payment instructions that request funds be sent to a different legal name or account than is on file for the known supplier should trigger mandatory callbacks using verified contact information, not the numbers or emails on the invoice or change notice.

Automating three?way, or at least two?way, matching between purchase orders, goods receipts and invoices, coupled with multi?level authorization for new vendors and for any payment exceptions, helps ensure no single person can both establish a related?sounding entity and route money to it unnoticed.

The final takeaway is that it is important to train finance, procurement, and operations staff to recognize red flags of shell companies. Emphasize personal accountability for vendor changes to strengthen the culture of skepticism that is essential for stopping fraudulent "related" entities before any funds leave the organization.

Finally, your opinion is important to us. Please complete the opinion survey:

Product

Articles

Guarding Against Internal Crypto Crimes: Strategies For Organizational Resilience

We review how internal controls, transparent governance, and risk assessments can help organizations prevent internal crime and embezzlement in crypto operations.

Controlling Vendor Master Data To Block Fraudulent Payees

We comment on how organizations can design and enforce stronger vendor, data, and payment controls to prevent funds being misdirected to entities that appear related, but are not.

Are Workers Less Attached To Their Jobs? You Make The Call

Gallup research claims workers are not engaged at work and have dubbed it the "Great Detachment". What do you think?

Beyond The Click: Building Employee Vigilance To Prevent Phishing Attacks

We explore proactive security behaviors critical to reducing phishing attacks and forming a frontline defense to protect organizational data and systems.

Reasonable Accommodation And Addressing Depression In Healthcare Settings?

We examine an EEOC charge of retaliation and provide healthcare organizations with guidance to help meet ADA obligations for employees experiencing depression.?