How Fake Invoices Cost Citi $400 Million
Consider the three-way match; it’s an accounting term, and, as is the case with most every word in the glossary of Finance and Accounting terms, its meaning and practical use haven’t been clearly spelled out. So it’s only natural to ask: What Exactly is a Three-Way Match? and Why Should I Even Care?
Nothing will answer these questions better than the invoice scandal that rocked Citigroup’s subsidiary in Mexico in 2014. Here’s a 2 minute video that explains why the fourth largest bank in North America fell victim to textbook invoice fraud.
It all came to light in early 2014 when Citi issued a press release acknowledging that it had lowered its net income from $13.9 Billion to $13.7 Billion. From the towering offices of the US Securities and Exchange Commission (SEC) in New York City, where Citi filed its report, the reason behind the fairly substantial (and sudden) adjustment may have seemed remote, yet very very familiar.
There are three characters in the story: Banamex (a financial services company that Citi acquired in 2001), Pemex (a Mexican state-owned oil company) and OSA (an oil services company that was also based in Mexico).
OSA was contracted by Pemex for certain oil-related services. Pemex had an Accounts Receivable agreement with Banamex. What that agreement meant — essentially — was that every time OSA provided a service to Pemex, Banamex footed the bill. And Pemex would pay off Banamex at a later date.
Put simply, this is how the arrangement worked:
- OSA provides a service to Pemex, and then sends Pemex an invoice.
- Pemex does not pay the invoice, but keeps it for record-keeping.
- OSA sends the same invoice to Banamex. Banamex pays the invoice.
- A few months pass.
- Pemex calls up the invoice that it earlier received from OSA. Then, it pays Banamex.
On paper, this procedure seemed to work out great — it certainly was of a piece with the nifty and multilayered arrangements common in the world of accounting jargon and global finance.
Everything was going well till OSA was put on the dock by the Mexican government for some questionable business practices. The news, one imagines, must have led to a collective gasp in Banamex’ offices. After the news broke, Banamex frantically called Pemex.
And that’s when things really took a nightmarish turn. To their shock, both Banamex and Pemex realized that OSA had been billing Banamex without providing any services to Pemex.
Let’s put this even more simply: In one corner, you have Banamex, which believes it is paying OSA for services rendered to Pemex. In the other corner, you have Pemex, which hasn’t received any of these services; and in the third corner of this triangle, you have OSA which is probably laughing its way to the bank having had the better of a national oil company and one of the largest banks in the world.
How did OSA do this?
It’s frighteningly simple (and generally most forms of invoice fraud typically are). At some point in dealing with Pemex and Banamex, OSA must have realized that Banamex and Pemex exist in silos, and do not really talk to each other. So, it started making up invoices for services that it seemingly performed (but didn’t actually perform) for Pemex. It did not send these invoices to Pemex because that would have raised a red flag. Instead, it started sending these invoices directly to Banamex.
Banamex paid all of these invoices. This isn’t surprising because Banamex probably received far too many invoices and it was hardly practical for Banamex to call up Pemex to check if the invoice it received was legitimate (which is to say that the invoice for a service that was rendered to Pemex.)
By the time the news about OSA broke, it realized that it had paid $400 Million to OSA for invoices that had been fake and concocted.
The lingering question, however, is how could a “Too Big To Fail” financial giant like Citi fall victim to a fraud that was so easy to engineer?
In reality, though, far too many companies — irrespective of size and location — have paid fake invoices. And they are almost always too late to realize it.
And that’s why the Three-Way Match is so crucially important. Now let’s try to understand how a Three-Way Match could have potentially averted the Citi fiasco.
A three-way match is called a three-way match because there are three things involved in the match:
A company needs something — either a product or service. When that something is delivered successfully, the company gets a packing slip from the supplier.
Once the Purchasing Manager is notified that something is needed, he makes a purchase order — this document includes specifications like quantity, price and other relevant details. Once a vendor receives the purchase order, he is required, by law, to fulfill it and, in accordance with the terms and details explained in the purchase order.
The Accounts Payable (AP) department, which receives the invoice from the vendor and makes the payment.
A three-way match is made when AP is able to establish that the invoice, purchase order and the packing slip match down to the smallest details. In other words, the three-way match lets AP determine that the price, quantity and other details in the invoice issued by the vendor are precisely those that were listed in the purchase order, and are similarly reflected in the order that is finally received by the company.
Without these four certainties, AP cannot possibly have the peace of mind to actually go ahead and pay the invoice issued by the vendor.
In Citi’s case, Banamex, in all probability, wouldn’t have paid those invoices because the first thing it would have done after receiving an invoice from OSA would be to check for the invoice’s corresponding purchase order. When it wouldn’t have found one, it would have realized that the invoice was either incorrectly or fraudulently sent.
In practice, AP can’t do a three-way match every time it receives an invoice. Imagine calling up the Purchasing Manager to read out the purchase order so you can determine if it checks out with your invoice, then making a dozen calls and enquiries to determine who received the order and then irritating them with a long line of questioning — Was the order received at all? Was it received in good condition? Was it received in its entirety? Was anything broken?
Management pundits, B-School professors and, not to mention startup employees, have a term for these time-consuming, and, ultimately, frustrating and deadening activities: non-valued added tasks.
These tasks don’t add any value because they take time away from the employee’s core job function, besides dulling their enthusiasm and stifling their creativity. And needles to say, ultimately, such symptoms can turn even the most vibrant and exciting teams rudderless and stagnant.
Understandably, most companies can’t altogether be blamed for sidestepping this process, or using a half-baked version of a Three-Way Match that is hardly foolproof, and, therefore, hardly effective.
Perhaps, the greatest irony here is that these needling outcomes are entirely avoidable — if only they knew.
Are you having trouble managing you company’s spending? Procurify is helping hundreds of companies improve their bottom lines by giving them complete visibility and control over their spend. Book Your Free Consultation Today.
