The Villa on the Office Laptop

01The situation

His salary was modest. His villa was not, and the cash ledger behind it was on his office laptop.

A long-serving manager owned the relationship with customers who claimed service-level credits. After a customer queried settlement figures, the company found credit notes and meeting minutes it had never approved. The manager had already left. The company needed to know how far it went and where the money ended up.

02How it worked

1. 01The manager fabricated credit notes and meeting minutes, granting customers discounts and settlements outside his authority.
2. 02Customer-side representatives benefited and part of the value came back to him as commission.
3. 03Kickbacks reached his spouse's account disguised as consultancy and lecture fees, as vendor advances and loans, and as fees from a family consultancy.
4. 04Cash was deposited into joint accounts over many years, and income documents were fabricated on the office computer to make it look earned.
5. 05Related finding: a consultancy run by his siblings built its entire client list from the company's customers using data he sent from his work mailbox, then represented those customers in claims against the company.
6. 06The proceeds funded a villa, largely in cash, a luxury car and other property.

03The challenge

Reconstruct fifteen years of disguised income across a family, separate legitimate earnings from proceeds, and quantify the benefit, with only an office computer and a case file to start from.

04Our approach

1. Workstream 01

   Digital forensics

   Recovered deleted email and working files from the office computer.

2. Workstream 02

   Source and application of funds

   A year-by-year model of the family's income and assets across twelve years.

3. Workstream 03

   Corporate and related-party mapping

   Family entities, their filings and their client base over a decade.

4. Workstream 04

   Asset searches

   Properties and vehicles held by the family.

5. Workstream 05

   Income verification

   Independently tested the income sources claimed on the documents.

05What we found & did

• Vendor kickbacks were routed into the spouse's account.
• Commission was disguised as fabricated lecture and consultancy income.
• Customer data was leaked to a family consultancy that then claimed against the company.
• Assets were disproportionate to known income.
• A private business was run on company time and systems.
• Years of cash deposits and unexplained credits matched the pattern of the arrangement.

06The impact

07Lessons for your business

The controls that would have stopped this, or caught it sooner:

• Separate claim assessment from settlement approval; issue credit notes through finance only.
• Collect declarations of relatives' businesses in the customer ecosystem.
• Alert on bulk customer data leaving by email.
• Screen claims consultants against employees' related parties.
• Monitor lifestyle for long-tenured relationship owners.