[HN Gopher] CEO of Cyber Fraud Startup NS8 Arrested by FBI, Faci...
       ___________________________________________________________________
        
       CEO of Cyber Fraud Startup NS8 Arrested by FBI, Facing Fraud
       Charges
        
       Author : prostoalex
       Score  : 200 points
       Date   : 2020-09-18 15:34 UTC (7 hours ago)
        
 (HTM) web link (www.forbes.com)
 (TXT) w3m dump (www.forbes.com)
        
       | tdons wrote:
       | An auditor was fooled while he was _in the room watching_ while
       | the ceo downloaded bank account statements (pages 10 /11 of
       | https://www.justice.gov/usao-sdny/press-release/file/1317641...):
       | d. As  part  of  its  due  diligence  process,  the  Audit  Firm
       | had an employee          (the "Auditor") conduct a physical site
       | visit at NS8's offices in Las Vegas,          Nevada.  The
       | Auditor was directed by a more senior Audit Firm employee to have
       | someone from NS8 log in to the online portal for each NS8 bank
       | account, display          the current account balance, and
       | download monthly bank statements for fiscal          year 2019.
       | e. Based  on  my  interview  with  a  member  of  the  NS8
       | finance department          ("Finance Employee-1"), I have
       | learned, among other things, that on or about          March 11,
       | 2020, Finance Employee-1 and ROGAS met with the Auditor in
       | ROGAS's          office.  The purpose of that meeting was for
       | ROGAS and Finance Employee-1 each          to log into the online
       | portals for the bank accounts to which they had access
       | (for ROGAS, the Revenue Bank Account) and download monthly
       | account statements          for the Auditor.  During that
       | meeting, Finance Employee-1 logged into the online
       | portal for the Expense Bank Account -- to which  Finance
       | Employee-1  had  access          -- and  downloaded  monthly
       | account statements.  Finance Employee-1 understood          that
       | ROGAS was doing the same for the Revenue Bank Account during the
       | meeting.              f. Late in the evening on or about March
       | 11, 2020, the Auditor  emailed  another          employee  as
       | follows:    "Attached  please  find the bank statements and
       | screenshots that I observed [Finance Employee-1] and Adam [ROGAS]
       | download this          afternoon."  Attached to  that  email,
       | among  other things,  were  the          Fraudulent  Bank
       | Statements for the Revenue Bank Account for the period from
       | January 2019 through February 2020.
        
         | pge wrote:
         | Thanks for the link - interesting reading. It looks like he
         | modified the PDFs from the bank which is pretty sneaky, since
         | most people assume PDFs are inviolable (this topic has come up
         | on HN before). In my experience, auto-generated PDFs from
         | reporting systems are fairly easy to manipulate (for the
         | record, I have only done so for automated data extraction, not
         | to change the document!).
        
       | garysahota93 wrote:
       | This irony is what exactly what I needed on a Friday.
        
       | codegeek wrote:
       | Innocent before proven Guilty but I have to say seeing all these
       | CEOs being charged with Fraud is why there has been so much noise
       | against Capitalism as a whole and CEOs get a bad rep by default.
       | There are so many of us (working our butts off in the background
       | without public stunts/investors etc) and then these idiots spoil
       | it. Being a small bootstrapped CEO myself, I am always concerned
       | about being as honest as possible with our customers and then you
       | have guys that are doing crazy shit. Funny thing is they mostly
       | get away with it too. Sad world.
        
       | legerdemain wrote:
       | Interesting. They reached out to me on TripleByte last year:
       | remote position, rather high cash comp for a startup, and no
       | coding or whiteboarding as part of the onsite!
        
         | drchickensalad wrote:
         | Yeah I saw them super active on triplebyte and angel.co a-list.
         | I got pretty far into the interview; lucky I dodged a huge
         | bullet!
        
         | whycombagator wrote:
         | They were on SO (Stack Overflow) jobs too, one of the postings
         | was for up to $250k remote IIRC. It was for a principal
         | engineer position with experience in java & k8s. Their lower
         | engineering titles on SO jobs were decent salaries too (mid-
         | late 100s I think).
        
       | donor20 wrote:
       | This is a bit of an interesting and somewhat unusual situation.
       | 
       | In most cases, your finance team (internally) will be the one to
       | pick up on the fact that stuff doesn't make sense.
       | 
       | They won't be able to tie the invoices to subsequent payment to
       | get an accounts receivable schedule to show who still owes what.
       | 
       | They won't be able to get the stripe reports / merchant clearing
       | disbursement reports to agree to the GL clearing accounts.
       | 
       | It's also rare for the CEO to have the only access to bank
       | statements. Fraud risks are often higher in finance team, as they
       | are the ones who catch problems elsewhere, but can be hard to
       | catch problems with them.
       | 
       | This make me wonder how experienced the startups accounting team
       | was.
        
       | neallindsay wrote:
       | Ah-it was supposed to be an anti-fraud startup, not a fraud
       | startup.
        
         | redisman wrote:
         | Common mistake
        
       | throwawayYeah wrote:
       | TNot surprising. he co-lead on this deal was the company I work
       | for (insurance). This doesn t surprised me as our VC arm sometime
       | is ego driven. Being a strategic VC they have to follow the gut
       | feeling of board member with limited due diligence. We often
       | worry with teamates about the VC arm investment (Serie B into Iot
       | backed in blockchain jewelery kind of deal). The team also like
       | to take famous SV investor content and republish it internally as
       | own. this bit us a few time when a C suit tweet a congratulating
       | message on great content from our firm like 'software is eating
       | the world'. The irony here is that we are an insurance company,
       | we should know how to prevent fraud...
        
       | pstoica wrote:
       | Ex-employee here. Adam Rogas is a pathological liar and sociopath
       | who dragged this out for years. I don't know how multiple audits
       | failed to raise red flags over multiple $999,999.99 fake Stripe
       | payouts. He literally inserted millions every few lines that
       | didn't match up with the data around it. They never asked anyone
       | else to produce the same report. Everyone involved should never
       | be responsible for this amount of money again (looking at you,
       | Lightspeed).
       | 
       | If your CEO is actively siloing all financial and customer
       | information, your entire company needs to speak up and get on the
       | same page. Don't let this happen to you.
        
         | pstoica wrote:
         | Anyway folx, don't invest in a "hot startup" you've never heard
         | of.
        
           | elliekelly wrote:
           | Do you know when the company/Rogas first came under
           | investigation?
        
             | pstoica wrote:
             | The SEC tried investigating since December 2019, possibly
             | earlier. Again, public information.
        
         | wakeywakeywakey wrote:
         | Why did you choose not to blow the whistle?
        
           | pstoica wrote:
           | I didn't have all the information that's coming out now.
           | People tried. Read the article. The last investment was
           | finalized days after someone raised concerns after realizing
           | we didn't contact 70% of our customers.
        
             | wakeywakeywakey wrote:
             | The details of your post go beyond those mentioned in the
             | article. Could you provide additional links?
        
               | pstoica wrote:
               | I was someone at the bottom of the totem pole who tried
               | to do my job and ask what questions I could. I certainly
               | noticed a lack of analytics or basic
               | traffic/revenue/customer data. Retroactively, it was
               | obvious that this was essentially a fake job, but I
               | couldn't piece this together and there wasn't enough
               | company-wide transparency.
               | 
               | The fake financial statements were publicly released:
               | https://www.justice.gov/usao-sdny/press-
               | release/file/1317641...
        
               | edm0nd wrote:
               | How much were you being paid a year to do basically
               | nothing?
        
               | pstoica wrote:
               | Decent salary, but that's not the point. I'm distraught
               | to realize I spent 5 months on nothing, and it's not
               | something I'm proud to have or explain on my CV. It's
               | cruel how much money these people throw away, but we were
               | misled into thinking it was real. I wouldn't have taken
               | this position to support such a scumbag.
        
               | edm0nd wrote:
               | Man/Gal, that sucks! Keep your head up <3
        
               | CatShitTodd wrote:
               | What is cruel is I am having to file bankruptcy because
               | of this.
        
               | lmeyerov wrote:
               | That is super tough and stressing, sorry!
               | 
               | FWIW, I would wait on returning _any_ money (or saying
               | anything at all, really) + talk to a lawyer with
               | experience in bankruptcy (their 's + yours).
               | 
               | My guess is you can keep all/most of the $. They were
               | fraudulent to you + the company is now evaporating.
               | Sounds like you still need to pivot, but at least you can
               | do so with $ in the bank and no black marks.
        
               | NationalPark wrote:
               | Were you an investor?
        
               | CatShitTodd wrote:
               | No, not an investor. Without giving a way too much, we
               | are a company in the technology space. They paid us a fee
               | per user. They paid us fees based on these fake numbers
               | of users that they submitted to their investors. Which
               | means they essentially over paid us what is a lot of
               | money for our small company. We made business decisions
               | around that money in the past and for the future. Now it
               | looks like that not only will we get no more money, but
               | they also want like 90% of what they paid us back.
        
               | [deleted]
        
               | caymanjim wrote:
               | Not sure if you're being serious, but if you were an
               | early investor, isn't it on you to make sure the business
               | is legit? Anyone can be misled by a fraudster, but some
               | responsibility lies with the VCs and angel investors
               | throwing money at these companies and enabling this sort
               | of thing to happen.
        
               | CatShitTodd wrote:
               | No, not an investor. Without giving a way too much, we
               | are a company in the technology space. They paid us a fee
               | per user. They paid us fees based on these fake numbers
               | of users that they submitted to their investors. Which
               | means they essentially over paid us what is a lot of
               | money for our small company. We made business decisions
               | around that money in the past and for the future. Now it
               | looks like that not only will we get no more money, but
               | they also want like 90% of what they paid us back.
        
               | phyalow wrote:
               | Sorry to hear that. I dont know what the contract says,
               | but I would be inclined to lawyer up and tell them to get
               | stuffed RE the repayments.
        
           | pjc50 wrote:
           | Why would you? Even if you've got all your ducks in a row
           | you've made yourself a target for media attention and
           | lawsuits.
        
             | libria wrote:
             | Why not? Anonymously demanding moral action from others
             | makes me righteous and costs me nothing. =)
        
         | tomashertus wrote:
         | And how was the quality of product? Was it something
         | breathtaking that it attracted $157.9M in funding?
        
           | pstoica wrote:
           | Hell no, a $400 million valuation made no sense, but he kept
           | feeding us these lies.
        
       | dboreham wrote:
       | Hmm. The bank statements seen by the finance dept. came from the
       | CEO??? How do the "finance dept" not know that's an indication of
       | fraud??
        
       | threetimesy wrote:
       | Same thing the former CEO of HeadSpin has reportedly done.
        
       | joering2 wrote:
       | Sounds like a witch hunt. Big corpo tries to get rid of
       | competitor. And once again government destroyed someones life.
       | Now that he cannot do his part anymore its so easy to proof he
       | deceived investors because well he doesn't have any numbers to
       | show si yeah he was lying. And besides, who didn't flex a slide
       | or two to show future numbers how they hoped it will look instead
       | of honest truth. If thats the case then DOJ has to come and knock
       | at door of every Hacker News user, or any IT person in that
       | matter.
        
         | JumpCrisscross wrote:
         | > _its so easy to proof he deceived investors because well he
         | doesn't have any numbers to show_
         | 
         | There is a _huge_ difference between saying  "we're killing it"
         | while you're hustling, highlighting bookings because your
         | revenues suck, sending invoices early to bring up revenue, on
         | one hand, and forging bank statements. The former move from
         | almost expected to borderline behaviour. The last is simply
         | fraud.
        
         | pstoica wrote:
         | This is simply not the case. Adam lied to everyone's face for
         | years. Read the documents and financial statements if you think
         | this is just a little "flex" every couple of slides.
        
         | teej wrote:
         | Citation(s) needed
        
         | caust1c wrote:
         | Take your libertarian dreams to international waters.
         | Regulation exists to create opportunity, not destroy it. Unless
         | you have facts to back up your claims, don't spread
         | misinformation.
        
         | servercobra wrote:
         | I don't think every startup CEO is falsifying bank statements
         | to show millions more in income to their own finance department
         | and investors than they actually have.
        
           | joering2 wrote:
           | We simply don't know that. That's what DOJ accuses him of -
           | now we need to wait to hear his side of the story (and his
           | lawyers), unless of course you believe in USA everyone is
           | guilty without being proven of committing said crime?
        
             | ViViDboarder wrote:
             | A court has an obligation to do that, a random person on
             | the internet has no such obligation.
             | 
             | Eventually it will be decided by a handful of random
             | people's opinions based on the evidence put forth. For
        
         | clint wrote:
         | Most people would call that "lying", "unethical", and probably
         | "stupid."
        
         | liability wrote:
         | > _And besides, who didn't flex a slide or two to show future
         | numbers how they hoped it will look instead of honest truth. If
         | thats the case then DOJ has to come and knock at door of every
         | Hacker News user, or any IT person in that matter._
         | 
         | Unethical people commonly state their belief that everybody
         | else does as they do. This is self-delusion meant to assuage
         | feelings of guilt.
         | 
         | Hence the proverb (which I understand to exist in numerous
         | languages): A thief thinks every man steals.
        
       | dyeje wrote:
       | Huh, I interviewed with these folks a few years ago. The
       | interview process was quite odd, guess I dodged a bullet.
        
         | bredren wrote:
         | How was it odd?
        
       | tehwebguy wrote:
       | Now do WeWork
        
       | jedberg wrote:
       | > It seems ironic that the co-founder of a company designed to
       | prevent online fraud would engage in fraudulent activity himself
       | 
       | I don't find that ironic at all. Having worked in the security
       | space for a long time, it seems like the best people in the
       | business are the ones who would be great at committing the crimes
       | if not for their own morality.
       | 
       | Someone with a weak sense of morals could easily turn to evil.
        
         | sloshnmosh wrote:
         | Agreed.
         | 
         | It reminds me of all those bogus security/antivirus apps on the
         | Google Play store that harvest more user data than any virus
         | ever could.
        
         | heartbeats wrote:
         | Well, it _is_ a cyber fraud startup. They didn 't lie about
         | that.
        
           | jessaustin wrote:
           | Reminiscent of Jesse's advice to Walt about a " _criminal_
           | lawyer ".
        
             | dane-pgp wrote:
             | Also reminiscent of the aptly named company "Fraud
             | Guarantee":
             | 
             | https://www.law360.com/articles/1311477/giuliani-allies-
             | char...
        
         | mhh__ wrote:
         | Frank Abagnale has worked for the FBI for 40 years now. He
         | still has an Ego, but he has turned down several offers of
         | pardons for his past crimes and is now very much on the light
         | side of the force.
         | 
         | https://youtu.be/vsMydMDi3rI
        
         | qaq wrote:
         | "Having worked in the security space for a long time, it seems
         | like the best people in the business are the ones who would be
         | great at committing the crimes if not for their own morality."
         | Well and truth be told none would know so maybe they are doing
         | it ?
        
         | alchemism wrote:
         | One of Terry Pratchett's Discworld novels features a thief
         | being deliberately put in charge of the Royal Mint.
         | 
         | https://en.wikipedia.org/wiki/Making_Money
        
       | AdmiralAsshat wrote:
       | I feel sorry for any CEO who actually steps down to spend more
       | time with his/her family. That explanation has now more or less
       | been completely co-opted by "Our CEO got caught in an
       | embarrassing scandal and they need to fade from the public eye
       | for a bit." I now assume that anyone who gives that reason on
       | their way out must have done something terrible that is yet or
       | about to come to light.
        
         | heavyset_go wrote:
         | The reason that euphemism flies is because of the truth behind
         | it: people regularly make life changes to prioritize family
         | life. The other 99.9% of people who cite this reason for change
         | will drown out the minority that use it as a euphemism for
         | getting caught doing bad things.
        
         | WrtCdEvrydy wrote:
         | LOL, if I ever make it at that level, my explanation for
         | wanting to spend more time with my family will be "wanting to
         | spend time with hookers"
        
           | pengaru wrote:
           | Most of the value hookers bring to the table is not having to
           | spend time with them to get what you want.
           | 
           | Your comment makes little to no sense.
        
           | mandelbrotwurst wrote:
           | When you've invested that much into something you're not very
           | likely to suddenly decide to make that sort of strategic
           | blunder for giggles.
        
             | odshoifsdhfs wrote:
             | You must really not know me (or a lot of people).
        
               | marcinzm wrote:
               | The people who would say something like that are also
               | unlikely to not say something long enough to get to such
               | a position.
        
         | draw_down wrote:
         | I never feel sorry for CEOs.
        
         | gkoberger wrote:
         | A lot of CEOs step down with no drama! I think most people only
         | think "scandal" when there's already a related scandal... I
         | can't think of any CEOs/execs who have stepped down with
         | suspicion without any other indicators of a scandal.
        
         | jedberg wrote:
         | This recently came up when Kellyanne Conway stepped down. She
         | said it was to spend more time with her family, no one believed
         | her, but all evidence points to it really truly being the case.
         | Her husband also stepped down from his job and her daughter
         | stopped tweeting about how much she hates her parents.
        
           | gameswithgo wrote:
           | I am not sure she ever liked working for trump. It is weird
           | that she chose to anyway.
        
           | pfraze wrote:
           | That's a bit of a unique case; they had very publicly visible
           | family issues.
        
             | jedberg wrote:
             | Exactly, that's the only reason anyone believes her at all.
             | If not for their very public issues, I don't think anyone
             | would have believed her.
        
               | paxys wrote:
               | If the issues hadn't been made pubic she wouldn't have
               | stepped down at all.
        
         | pfraze wrote:
         | It's like Thiel's point about how monopolies always talk about
         | the open market and small fish talk about being a monopoly. In
         | this case, if you're actually stepping down to spend time with
         | family, you say "I'm looking for my next challenge."
        
           | csours wrote:
           | Our company recently had two executives leave to "pursue
           | other opportunities". I saw an announcement from another
           | company about one of them, but not the other one. I wonder if
           | they are "spending more time with their family"
        
       | billyhoffman wrote:
       | Being an executive at a (substantially smaller) SaaS startup I
       | have no idea how having up to 90% of your revenue be fabricated
       | could happen without others knowing:
       | 
       | - where are the contracts corresponding to revenue? Yeah they are
       | SaaS focused on SMB but this is a financial product, there will
       | be contracts, NDAs, etc
       | 
       | - if the majority of the customers are fake there is such little
       | load on the system. How does engineering not figure that out?
       | 
       | - How does no one see an insanely low COGs when paying the cloud
       | services bills, or the lack of allocated resources when looking
       | in the management interfaces?
       | 
       | - Even saas Products with supposedly a no touch sales process
       | still have sales people and sales engineers for key accounts.
       | What are all the sales people doing if they're not running
       | trials?
       | 
       | - let's say he hid all of this by having tens of thousands of $10
       | a month customers. How does your VP of sales not get totally
       | freaked out that the overwhelming majority of revenue is coming
       | from no touch sales? If that's the case that radically changes
       | your growth and go to market strategies. The entire go-to- market
       | team should be wondering what is going on? Same with product
       | management. Your roadmap would be completely different with a
       | long tail of extremely low revenue customers.
       | 
       | - how does sales/client success not notice that no one is
       | expanding? How they aren't talking to small customers about
       | expansions?
       | 
       | - How does no one notice a complete lack of analytics or actions
       | being generated by all the supposed customers?
       | 
       | - product management is going to want to get feedback from all of
       | these customers. They're going to be looking in analytics tools
       | or session replay tools like fullstory. They're going to look at
       | the accounts and users and do outreach to emails asking for
       | meetings. Aren't they going to notice all of those people are
       | fake?
       | 
       | - support/client success is going to have insanely high customer
       | to support person ratios. Where are all the support tickets for
       | that many customers?
       | 
       | - Managing cash flow would be very hard. Finance is going to see
       | all this revenue coming in and want to scale. The VCs are going
       | to want to see money being spent on marketing activities etc. to
       | further the growth. If there's no corresponding revenue being
       | spent to acquire customers but tons of revenue coming in that's a
       | giant red flag
        
         | WrtCdEvrydy wrote:
         | Because the larger startups are driven by people who know
         | financial engineering... this guy got caught because the money
         | stopped (due to layoffs).
         | 
         | Noone gives a shit when they're getting paid.
        
           | squashua667 wrote:
           | Nope. He got caught when it was discovered that the "customer
           | revenue" bank account was being manipulated to look like tens
           | of millions were in there when it was more like tens of
           | thousands.
           | 
           | The other bank account had tens of millions in there thanks
           | to the investment money.
           | 
           | The layoffs came once the board faced the truth of the matter
           | and Adam Rogas suddenly resigned.
        
             | WrtCdEvrydy wrote:
             | Okay, if that's the order, then yeah, someone should have
             | said something.
        
               | solumos wrote:
               | My guess is that anyone who ended up "saying something"
               | to the CEO was either quieted by lies or forced out of
               | the business.
        
         | CatShitTodd wrote:
         | > How does no one see an insanely low COGs when paying the
         | cloud services bills, or the lack of allocated resources when
         | looking in the management interfaces?
         | 
         | Big data and a flawed system. They sell a service that is based
         | off of using integrations. If you stop paying for the
         | integrations, you should stop receiving the service. That in
         | turn hurts their level of service offerings.
         | 
         | To be of any value, they have to monitor a ton of transnational
         | data. So even if you quit paying, they still monitored your
         | data and their modules were flawed that is still showed their
         | acceptance score if you stopped paying.
        
         | pge wrote:
         | Where was the board during this whole time? I have trouble
         | understanding how a board allows a management team to operate
         | in such a way that controls aren't in place (eg basic
         | segregation of duties in finance) that would prevent or at
         | minimum reveal this kind of behavior. The board should be
         | seeing enough information that most of the flags you highlight
         | should be visible to them. Not to mention, clearly the company
         | was never audited. Regular audits should be standard practice
         | for any company of that size. In any case, it will be
         | interesting to see what consequences there are for board
         | members that appear to have failed in their basic
         | responsibilities.
        
           | lancewiggs wrote:
           | Yes - this is the directors' fault. As a director you have n
           | obligation to ensure everything is ok, and for issues of this
           | magnitude it's clear that the directors were bamboozled. at
           | our firm we insist on access to the financial system (e.g.
           | Xero) whenever we have a directorship. It's hard to fake
           | results, at least to this level, when we can see down to the
           | level of individual invoices.
        
           | solumos wrote:
           | > Regular audits should be standard practice for any company
           | of that size.
           | 
           | The company was audited twice, but the auditors tied the
           | fraudulent bank statements to the fraudulent financial
           | statements (woops).
           | 
           | > In any case, it will be interesting to see what
           | consequences there are for board members that appear to have
           | failed in their basic responsibilities.
           | 
           | Full cooperation with the SEC can get you a long way,
           | especially if you're one of the victims of fraud.
        
             | pge wrote:
             | Are you sure they were audited? I havent seen that in the
             | material released so far, only that an auditor was engaged
             | for due diligence, which was fairly cursory, not anywhere
             | near an actual audit. Typically an audit would involve a
             | direct verification of bank balances from the bank. In
             | addition, an audit would typically directly verify customer
             | contracts and make sure big deposits tied out to contracts
             | and invoices. An audit would also have flagged the lack of
             | segregation of duties as a major risk factor (though that
             | should have been obvious to any board member). As a side
             | note, I also wonder if Rogas was fastidious enough to
             | ensure the GAAP financial statements all tied out with the
             | fraudulent numbers.
             | 
             | I guess if an audit couldn't catch this, you have the wrong
             | auditor. This is exactly what audits are for.
        
               | [deleted]
        
               | solumos wrote:
               | You're correct, my understanding of "full audit" vs "due
               | diligence" was off.
        
               | billyhoffman wrote:
               | Read the DOJ filing, linked in a comment below. The
               | auditor physically sent a person on site whose job was to
               | watch the financial people log into the banks web
               | interface, verify the balance, and print bank statements
               | for the last 12 months, all in front of the auditor. The
               | passage doesn't make it clear why the auditor didn't
               | watch the ceo pull the records for the accounts
               | receivables account
               | 
               | Update: filing Is here: https://www.justice.gov/usao-
               | sdny/press-release/file/1317641...
               | 
               | Relevant Passage: "As part of its due diligence process,
               | the Audit Firm had an employee (the "Auditor") conduct a
               | physical site visit at NS8's offices in Las Vegas,
               | Nevada. The Auditor was directed by a more senior Audit
               | Firm employee to have someone from NS8 log in to the
               | online portal for each NS8 bank account, display the
               | current account balance, and download monthly bank
               | statements for fiscal year 2019."
               | 
               | "Based on my interview with a member of the NS8 finance
               | department ("Finance Employee-1"), I have learned, among
               | other things, that on or about March 11, 2020, Finance
               | Employee-1 and ROGAS met with the Auditor in ROGAS's
               | office. The purpose of that meeting was for ROGAS and
               | Finance Employee-1 each to log into the online portals
               | for the bank accounts to which they had access (for
               | ROGAS, the Revenue Bank Account) and download monthly
               | account statements for the Auditor. During that meeting,
               | Finance Employee- 1 logged into the online portal for the
               | Expense Bank Account -- to which Finance Employee-1 had
               | access -- and downloaded monthly account statements.
               | Finance Employee-1 understood that ROGAS was doing the
               | same for the Revenue Bank Account during the meeting"
        
         | dustingetz wrote:
         | _It is difficult to get a man to understand something when his
         | salary depends upon his not understanding it._
        
         | PragmaticPulp wrote:
         | None of it makes sense in the context of a well-run business
         | with proper executives in place. That's because these frauds
         | don't operate like a well-run business.
         | 
         | Usually, the upper management teams are extremely lean. The
         | business is broken up into different silos such that few people
         | can see the big picture. Each is led to believe they are a tiny
         | fraction of the overall revenue, giving them the impression
         | that the bulk of the company's revenue must come from another
         | department where they have no visibility. As a bonus, this
         | motivates siloed teams to feel like they need to catchup to the
         | rest of the company, when in reality they might be the main
         | driver of it. It helps to have separate offices and a culture
         | of secrecy to prevent people from comparing notes.
         | 
         | The CEO positions himself as a controlling, micromanaging
         | individual at the center of everything. This makes it possible
         | for the CEO to intercept financials and other crucial numbers
         | en route to people who might catch on.
         | 
         | The rest of the management staff might be filled with people
         | too inexperienced to recognize that something is wrong. They
         | might think the CEO is doing them a favor by giving them a
         | golden opportunity to advance their career into an executive
         | position at a rocket ship startup. They don't know what they're
         | doing, but they think it's okay because the CEO has taken them
         | under his wing.
         | 
         | At scale it becomes difficult to do this without at least a few
         | people being complicit, though. A fraudster usually has several
         | close associates who can be trusted to be in on the fraud or at
         | least look the other way for a while.
        
           | Uhhrrr wrote:
           | Fun thought experiment: are there businesses where this
           | structure is beneficial, or is it always a red flag?
        
             | smabie wrote:
             | In the past, traders were siloed and no individual trader
             | would have access to the total positions of all the traders
             | on the floor. Some firms still operate this way, though
             | it's more common for trading operations to be broken up
             | into "pods" or teams of traders and analysts.
             | 
             | The industry has largely moved away from this structure for
             | a variety of reasons. One of the problems is that traders
             | start to try and undermine each other, since the only thing
             | that matters is your personal pnl. Another problem is that
             | traders can unknowingly all pile into the same investments,
             | resulting in massive risk. This is part of the reason why
             | the Great Recession was so bad.
        
           | csours wrote:
           | This reminds me of why traders are required to take vacation
           | - it may be the only time their scams are unraveled.
           | 
           | https://www.newsday.com/business/columnists/help-wanted-
           | carr...
        
             | nvr219 wrote:
             | When done right the vacation is sprung on them without
             | notice. In reality they usually know when their vacation is
             | coming so they can alert their cohorts.
        
               | dmurray wrote:
               | The idea is everyone must take vacation (sometimes X+
               | consecutive days each year), not just the people you
               | suspect of running scams.
               | 
               | Giving all of your employees two weeks unannounced
               | vacation at random times is a disruptive way to run a
               | company. It's certainly innovative but I wouldn't say
               | it's HR "done right".
        
               | ghaff wrote:
               | You have to take at least half you annual vacation
               | starting tomorrow. Have fun!
               | 
               | Yeah. That doesn't work. Forcing the same thing in a
               | scheduled way may be a bit of an imposition but isn't
               | unreasonable in general.
        
           | hn_throwaway_21 wrote:
           | Bingo! I worked in the upper management team of an early
           | stage startup where the CEO was lying through his teeth to
           | investors as well as employees. There were only three people
           | at the top level. He was a super charismatic guy and a great
           | story teller. No one thought he was lying until it came time
           | to raise the next round and the lead investor from seed round
           | ran due diligence to find booked revenue was no where close
           | to what CEO had been claiming.
        
             | HappyDreamer wrote:
             | > No one thought he was lying until ...
             | 
             | I wonder what happened after that? Could he continue
             | working as if nothing special, just failing to raise money?
        
           | [deleted]
        
           | liability wrote:
           | Sometimes tribal/"team sport" group dynamics keep employees
           | inline too. Executives can foster an _" us against the
           | world"_ mentality that blinds workers to that which is
           | obvious to everybody else. When in this mindset, people have
           | the ability to ignore even the most damning evidence.
           | 
           | Here's an example: When Enron's CEO verbally attacked wall
           | street analyst Richard Grubman for questioning Enron's
           | accounting practices, Enron employees thought this was
           | hilarious and adopted the insult as a sort of inside joke.
           | They didn't consider Richard Grubman's position, they just
           | took delight in 'their team' dunking on 'opposing team.'
        
             | rapnie wrote:
             | This is massively scalable. There are examples, but I do
             | not want to get political.
        
           | amorroxic wrote:
           | Agree, this being a cyber-fraud company I believe one could
           | keep a team busy for a long time focusing on building secure
           | systems rather than operating them to the point where no-one
           | gets to see what's actually being stored within. The paper
           | trail though I'm still puzzled about, he couldn't have acted
           | alone.
        
         | tempsy wrote:
         | Have you seen $GSX, a publicly traded $20B stock on Nasdaq that
         | claims it's growing faster than early Google or Facebook and
         | has been the subject of 5-6 short seller reports and an ongoing
         | SEC investigation?
        
           | dmix wrote:
           | Seems like the main research company that exposed GSX has
           | made a business out of exposing Chinese public companies
           | 
           | https://grizzlyreports.com/research/
           | 
           | Some interesting stuff here.
           | 
           | The company of course refuted the research with some vague
           | stuff about APIs having encryption so the data would be
           | wrong. This was back in June and the stock seems to be still
           | going along strong...
           | http://gsx.investorroom.com/2020-06-03-GSX-Refutes-
           | Grizzly-R...
        
             | fakedang wrote:
             | Muddy Waters got a report on GSX too.
        
           | anoraca wrote:
           | PE ratio of over 500... oof
        
         | squashua667 wrote:
         | - where are the contracts corresponding to revenue? Yeah they
         | are an SMB SaaS but this is financial, there will be contracts,
         | NDAs, etc
         | 
         | SMB, especially the small end of SMB, does not often have
         | contracts. It's more subscription based. That said, there were
         | 2 versions of the software running at NS8. One was the original
         | software that Adam Rogas and a co-founder created early on.
         | That version was rather "opaque" and reported growing customer
         | numbers every month. The newer version of the software was
         | controlled by the product dev team but still reliant on the
         | original software in some key areas. Basically, everything was
         | obfuscated well enough to confuse everyone to the point where
         | answers of, "it's a limitation of the original software" were
         | taken at face value.
         | 
         | - if the customers are fake there is no load on the system. How
         | does engineering not figure that out?
         | 
         | There were real customers and the customer growth was
         | happening, especially in 2020. The problem is that the customer
         | base and growth was nowhere near what Adam Rogas was cooking up
         | on the backend.
         | 
         | - How does no one see an insanely low COGs when paying the
         | cloud services bills, or the lack of allocated resources when
         | looking in the management interfaces?
         | 
         | COGs and other bills were kept relatively high. It's also why
         | the company hired 200+ people, to make the story all the more
         | believable.
         | 
         | - How does no one notice a complete lack of analytics or
         | actions being generated by all the supposed customers?
         | 
         | Again, real numbers were difficult to gather for excuses given
         | repeatedly by Adam Rogas and others charged with providing
         | those numbers. I'm not saying that others were complicit in the
         | scam, but that they were (at least) being fed the same excuses
         | the rest were. Investments were never made to bring visibility
         | to the customer metrics. Was this a red flag? Yes, but then why
         | are investors giving NS8 so much money? It's hindsight 20/20.
         | 
         | - Managing cash flow would be very hard. Finance is going to
         | see all this revenue coming in and want to scale. The VCs are
         | going to want to see money being spent on marketing activities
         | etc. to further the growth. If there's no corresponding revenue
         | being spent to acquire customers but tons of revenue coming in
         | that's a giant red flag
         | 
         | Right, so plenty of money was being spent across the board.
         | There were 2 bank accounts according to the DOJ and SEC
         | complaints. The account for "customer revenue" was solely
         | controlled by Adam Rogas. The other account held the investment
         | funds that paid all the bills. Is this super shady? Yep. And it
         | seems there was an NS8 whistleblower who kicked off the initial
         | SEC investigation and then the FBI getting involved as well.
        
           | acruns wrote:
           | "if the customers are fake there is no load on the system.
           | How does engineering not figure that out?
           | 
           | There were real customers and the customer growth was
           | happening, especially in 2020. The problem is that the
           | customer base and growth was nowhere near what Adam Rogas was
           | cooking up on the backend."
           | 
           | This doesn't really answer the question. The article states
           | 40-90% of customers were fictional, as a cloud architect I
           | would have to design based on the number of customers ++ and
           | of course I would setup monitoring and alerting with auto
           | scaling and it would be blatantly obvious that my utilization
           | was not going up and that would turn into an engineering
           | investigation.
           | 
           | Would it leed me to the idea that most of our customers were
           | fake? probably not. They might not even request additional
           | capacity, but as a architect that would lead me to ask
           | questions. For example after an announcement or company
           | meeting where they announce the number of new customers, I
           | would wonder wtf? How is it that we haven't added any more
           | capacity for all these new customers?
           | 
           | I would see some red flags and I would like to think I would
           | be smart enough to start looking for something new but I
           | haven't been in such a situation thankfully.
           | 
           | It's difficult to read about 200 ppl being laid off and the
           | impact on them and thier family all bc of one stupid, greedy
           | person.
        
             | solumos wrote:
             | > For example after an announcement or company meeting
             | where they announce the number of new customers
             | 
             | Nothing like this ever happened, AFAICT
             | 
             | > I would see some red flags and I would like to think I
             | would be smart enough to start looking for something new
             | but I haven't been in such a situation thankfully.
             | 
             | "Brazen fraud" is not where Occam's Razor leads in this
             | case. "Transparency growing pains" seems much more likely.
             | Specifically - if working for this company I would raise
             | concerns that there aren't KPIs being regularly tracked
             | across all functions. I'm sure it's possible that some of
             | the newly hired senior management was working on this.
        
           | billyhoffman wrote:
           | Obviously something terribly shady is going on here. I'm not
           | disagreeing with you, I just don't understand how any
           | director level position, let alone an executive, wouldn't be
           | able to see serious irregularities if such a significant
           | percentage of revenue was phony. There are just way too many
           | knock-on effects when the overwhelming majority of your
           | customers aren't real, aren't paying you, and aren't putting
           | any load or impact on any of your other systems (technical or
           | otherwise). That is some bullshit clown shoes management
           | across the entire company right there
           | 
           | And the CEO or others saying "oh yeah you can't see all those
           | customers and growth because they're in this old legacy
           | system that doesn't report it" is an insane excuse to buy.
           | Holy shit you mean to tell us that the majority of our most
           | important revenue is coming from a legacy systems that we
           | have zero insight into? And it's continuing to grow? Why
           | aren't those people on the new system?
           | 
           | > "customer revenue" account controlled solely by the CEO
           | 
           | I cannot fathom a VP of Finance, let alone an outside
           | accounting firm, that would be OK with this arrangement of
           | accounts.
           | 
           | Edit: To be clear I'm not trying to blame the victims. This
           | is a terrible loss to all the employees who have been pouring
           | so much of their efforts into the company. I just am having a
           | hard time understanding how such a thing could happen. Maybe
           | I've just been blessed to work in extremely transparent
           | organizations.
        
             | squashua667 wrote:
             | >> "customer revenue" account controlled solely by the CEO
             | 
             | > I cannot fathom a VP of Finance, let alone an outside
             | accounting firm, that would be OK with this arrangement of
             | accounts.
             | 
             | Right? Then again, EY audited everything and gave those
             | fake bank statements the "thumbs up" as part of the last
             | round of funding and due diligence on the part of the
             | investors. Crazy.
        
               | toomuchtodo wrote:
               | Wasn't EY also the firm who audited Wirecard? Why is
               | anyone taking their audits seriously?
               | 
               | https://markets.businessinsider.com/news/stocks/ey-
               | chairman-...
        
               | ev1 wrote:
               | EY were also the ones that audited and passed WoSign and
               | StartCom SSL CA's that were fraudulently issuing bad
               | certs and violating CAB regulations.
        
             | pstoica wrote:
             | We can't fathom it either!
        
         | letstryagain2 wrote:
         | You can fake everything. And most people don't expect this.
         | 
         | Wirecard opened a fake Bank Branch from a Philippines Bank in
         | Singapore, had the EY guys walk in there and "verify" the
         | Billion dollar balance on the computer screen.
        
         | stickfigure wrote:
         | How would engineering know what the CEO is telling investors?
         | 
         | I once had a (majority-share) cofounder CEO who, when the
         | company hit success, became extremely controlling with the
         | books and investor relationships. There was no way for the rest
         | of the cofounders - let alone engineering - to know what was
         | actually going on or what the true state of health of the
         | company was. I (and the other cofounders, and the senior
         | engineering staff) walked away. Big life lesson.
         | 
         | With lazy enough investors, it wouldn't surprise me that a
         | CEO/owner could compartmentalize enough information that the
         | employees and investors might have totally different
         | understandings. The CFO would be suspect, though.
        
           | HappyDreamer wrote:
           | > I (and the other cofounders, and the senior engineering
           | staff) walked away
           | 
           | I wonder what happened after that, how did you leaving affect
           | the company
        
         | IncRnd wrote:
         | People see what they expect to see. This could be accomplished
         | by lying at every step of the way and by fabricating audit
         | results. It lasts until it doesn't, and that's apparently what
         | happened here.
        
         | duxup wrote:
         | Reminds me of DC Solar, and they claimed to make physical
         | products...
         | 
         | You'd think some folks working from there would wonder "Hey,
         | does anyone KNOW anyone else working at the other factories,
         | because we're only making X per day..."?
        
       | rmason wrote:
       | If you're a VC firm shouldn't the amount of due diligence you do
       | increase with the amount of money you're investing? Or was their
       | investigating capacity so poor that it's a miracle they weren't
       | cheated before?
       | 
       | Or are there other startups they've invested in that just haven't
       | been found out yet? If I was one of their LP's I'd be asking some
       | hard questions.
        
         | heartbeats wrote:
         | No, it should decrease. If you're a gazillion dollars deep,
         | your best incentive is to cover up the fraud and try to dump it
         | on someone else.
        
       | rococode wrote:
       | Have VCs started skimping on DD because problems come up so
       | rarely? Lightspeed (who led the last round for these guys) isn't
       | a no-name firm, they invested in Snap, GrubHub, Telegram, etc.
       | Surely they have the experience to find out gigantic major
       | problems like this? This feels like something that should've come
       | up in diligence before they sent them 120 million bucks... There
       | are so many places it could've shown up or at least been hidden
       | in a way that should've raised some flags.
        
         | elliekelly wrote:
         | What's absolutely stunning to me is the (former) CEO quote in
         | the article says the company was under SEC investigation for
         | fraud as early as November of last year. And given that the DOJ
         | complaint alleges the fraud occurred between January
         | 2019-February 2020 I would be inclined to believe it. (Fraud
         | doesn't tend to just stop of it's own accord.)
         | 
         | So was the investigation disclosed to Lightspeed and they
         | decided to invest anyway? Who on earth would invest with
         | someone currently under investigation for a scheme to defraud
         | investors? And if it wasn't disclosed, why not? Did that not
         | come up at all during due diligence?
        
         | teej wrote:
         | I've heard this as a rumor, yes.
        
         | WrtCdEvrydy wrote:
         | This is because who pays for Due Diligence... if you are paying
         | you can influence it. I'd love for there to be a firm that did
         | a 50/50 escrow for DD.
        
           | billyhoffman wrote:
           | The VC firm pays for their own DD. Certainly if they are
           | leading the round.
           | 
           | Initial meeting-> NDA -> some due diligence -> letter of
           | intent/term sheet (depending on the transaction) -> 30-45
           | days of very deep due diligence.
        
         | marcinzm wrote:
         | Based on other comments, NS8 was audited by Ernst-Young and
         | passed. So they had an expert do an audit and find no issues.
        
           | everybodyknows wrote:
           | >Ernst-Young
           | 
           | Wirecard's long-time auditor!
        
       | Andrew_nenakhov wrote:
       | To catch a criminal, one must think like a criminal.
        
       ___________________________________________________________________
       (page generated 2020-09-18 23:00 UTC)