CEO of Cyber Fraud Startup NS8 Arrested by FBI, Facing Fraud Charges

- where are the contracts corresponding to revenue? Yeah they are SaaS focused on SMB but this is a financial product, there will be contracts, NDAs, etc

- if the majority of the customers are fake there is such little load on the system. How does engineering not figure that out?

- How does no one see an insanely low COGs when paying the cloud services bills, or the lack of allocated resources when looking in the management interfaces?

- Even saas Products with supposedly a no touch sales process still have sales people and sales engineers for key accounts. What are all the sales people doing if they’re not running trials?

- let’s say he hid all of this by having tens of thousands of $10 a month customers. How does your VP of sales not get totally freaked out that the overwhelming majority of revenue is coming from no touch sales? If that’s the case that radically changes your growth and go to market strategies. The entire go-to- market team should be wondering what is going on? Same with product management. Your roadmap would be completely different with a long tail of extremely low revenue customers.

- how does sales/client success not notice that no one is expanding? How they aren’t talking to small customers about expansions?

- How does no one notice a complete lack of analytics or actions being generated by all the supposed customers?

- product management is going to want to get feedback from all of these customers. They’re going to be looking in analytics tools or session replay tools like fullstory. They’re going to look at the accounts and users and do outreach to emails asking for meetings. Aren’t they going to notice all of those people are fake?

- support/client success is going to have insanely high customer to support person ratios. Where are all the support tickets for that many customers?

- Managing cash flow would be very hard. Finance is going to see all this revenue coming in and want to scale. The VCs are going to want to see money being spent on marketing activities etc. to further the growth. If there’s no corresponding revenue being spent to acquire customers but tons of revenue coming in that’s a giant red flag

  d. As  part  of  its  due  diligence  process,  the  Audit  Firm had an employee
     (the “Auditor”) conduct a physical site visit at NS8’s offices in Las Vegas,
     Nevada.  The Auditor was directed by a more senior Audit Firm employee to have
     someone from NS8 log in to the online portal for each NS8 bank account, display
     the current account balance, and download monthly bank statements for fiscal
     year 2019.
  
  e. Based  on  my  interview  with  a  member  of  the  NS8 finance department
     (“Finance Employee-1”), I have learned, among other things, that on or about
     March 11, 2020, Finance Employee-1 and ROGAS met with the Auditor in ROGAS’s
     office.  The purpose of that meeting was for ROGAS and Finance Employee-1 each
     to log into the online portals for the bank accounts to which they had access
     (for ROGAS, the Revenue Bank Account) and download monthly account statements
     for the Auditor.  During that meeting, Finance Employee-1 logged into the online
     portal for the Expense Bank Account -- to which  Finance Employee-1  had  access
     -- and  downloaded  monthly  account statements.  Finance Employee-1 understood
     that ROGAS was doing the same for the Revenue Bank Account during the meeting.
  
  f. Late in the evening on or about March 11, 2020, the Auditor  emailed  another
     employee  as  follows:    “Attached  please  find the bank statements and
     screenshots that I observed [Finance Employee-1] and Adam [ROGAS] download this
     afternoon.”  Attached to  that  email,  among  other things,  were  the
     Fraudulent  Bank  Statements for the Revenue Bank Account for the period from
     January 2019 through February 2020.

I don't find that ironic at all. Having worked in the security space for a long time, it seems like the best people in the business are the ones who would be great at committing the crimes if not for their own morality.

Someone with a weak sense of morals could easily turn to evil.

If your CEO is actively siloing all financial and customer information, your entire company needs to speak up and get on the same page. Don't let this happen to you.

In most cases, your finance team (internally) will be the one to pick up on the fact that stuff doesn't make sense.

They won't be able to tie the invoices to subsequent payment to get an accounts receivable schedule to show who still owes what.

They won't be able to get the stripe reports / merchant clearing disbursement reports to agree to the GL clearing accounts.

It's also rare for the CEO to have the only access to bank statements. Fraud risks are often higher in finance team, as they are the ones who catch problems elsewhere, but can be hard to catch problems with them.

This make me wonder how experienced the startups accounting team was.

Or are there other startups they've invested in that just haven't been found out yet? If I was one of their LP's I'd be asking some hard questions.

https://www.ns8.com/en-us

It seems to me like this company's base value proposition, that is, for any company's monetary transactions with customers, give that transaction a risk assessment score based on whatever data about the customer is available.

That, in its simplest, most elemenatary, most basic form, is a good value proposition.

Companies would find value in software which could deliver that proposition (a related idea that comes to mind is if PayPal decoupled their fraud prevention software, and sold that software to businesses separately, then that software would deliver an equivalent value).

So the base value proposition of this company (assuming their software actually works) -- is a valid one.

What seems to have done this company in, however, (if the article is to be believed) is accounting fraud, which may have been preceeded by lack of customers, lack of revenue or expected revenue.

It's always an interesting question to me (correlation vs. causation-wise) if lack of sales triggers accounting fraud, or if accounting fraud just sort of happens on its own...

You know, here's an idea for the FBI or other related investigative agencies -- you could, based on previous cases, create a list of "risk factors", each of which would count towards an overall "risk score" -- of something being seriously wrong at a company.

Such factors would include, but not be limited to: How much debt a company has to investors, how much revenue is it making relative to that debt, what is its growth rate, what is the age of the CEO, what industry is it in, etc., etc.

Grab all of that data, from all companies, run it through a machine learning algorithm, get a "risk score" for each and every company, then if you have nothing better to do (free time between other investigations), start investigating the companies with the highest "risk scores". <g>

You know, you might call it "Cyber Fraud Detection Software" -- for large companies... <g>

Then if that works well in the U.S. -- give the software (for free!) to all other countries!

Also, the same set of ideas and Machine Learning -- could be used to track wasteful government spending (foreign and domestic), or wasteful spending of so-called charitable organizations...

The possibilities are truly endless!