Hacker News Reader

None of it makes sense in the context of a well-run business with proper executives in place. That’s because these frauds don’t operate like a well-run business.

Usually, the upper management teams are extremely lean. The business is broken up into different silos such that few people can see the big picture. Each is led to believe they are a tiny fraction of the overall revenue, giving them the impression that the bulk of the company’s revenue must come from another department where they have no visibility. As a bonus, this motivates siloed teams to feel like they need to catchup to the rest of the company, when in reality they might be the main driver of it. It helps to have separate offices and a culture of secrecy to prevent people from comparing notes.

The CEO positions himself as a controlling, micromanaging individual at the center of everything. This makes it possible for the CEO to intercept financials and other crucial numbers en route to people who might catch on.

The rest of the management staff might be filled with people too inexperienced to recognize that something is wrong. They might think the CEO is doing them a favor by giving them a golden opportunity to advance their career into an executive position at a rocket ship startup. They don’t know what they’re doing, but they think it’s okay because the CEO has taken them under his wing.

At scale it becomes difficult to do this without at least a few people being complicit, though. A fraudster usually has several close associates who can be trusted to be in on the fraud or at least look the other way for a while.

Sometimes tribal/"team sport" group dynamics keep employees inline too. Executives can foster an "us against the world" mentality that blinds workers to that which is obvious to everybody else. When in this mindset, people have the ability to ignore even the most damning evidence.

Here's an example: When Enron's CEO verbally attacked wall street analyst Richard Grubman for questioning Enron's accounting practices, Enron employees thought this was hilarious and adopted the insult as a sort of inside joke. They didn't consider Richard Grubman's position, they just took delight in 'their team' dunking on 'opposing team.'

This is massively scalable. There are examples, but I do not want to get political.

Leaving aside the specific politics, this is one of many reasons I advocate for replacing voting with sortition (picking representatives from the electoral roll, in much the same way as juries are picked).

> but I do not want to get political.

The question I keep asking myself is, if not now, then when?

See also: Theranos.

This reminds me of why traders are required to take vacation - it may be the only time their scams are unraveled.

https://www.newsday.com/business/columnists/help-wanted-carr...

When done right the vacation is sprung on them without notice. In reality they usually know when their vacation is coming so they can alert their cohorts.

The idea is everyone must take vacation (sometimes X+ consecutive days each year), not just the people you suspect of running scams.

Giving all of your employees two weeks unannounced vacation at random times is a disruptive way to run a company. It's certainly innovative but I wouldn't say it's HR "done right".

You have to take at least half you annual vacation starting tomorrow. Have fun!

Yeah. That doesn't work. Forcing the same thing in a scheduled way may be a bit of an imposition but isn't unreasonable in general.

Doing so in an unscheduled way is beneficial for similar reasons you want to test when services go down in controlled circumstances. https://en.wikipedia.org/wiki/Chaos_engineering

Large companies simply have different risks. If someone quitting randomly is a huge risk for your business you want to know about it ahead of time to mitigate it while they still work for you. 1 random week of vacation every ~3 years shouldn’t be a big deal, and discovering it was is valuable.

If you want to give me an unscheduled couple of weeks off with pay, I'm perfectly cool with that--so long as you don't hold it against me that work doesn't get done. Don't expect me to take it out of my limited planned vacation time though.I have my own plans. That would be a big FU for me.

Sure, so maybe that is a sign that trading isn’t the right industry for you?

I know firefighters often work 72 hour straight shifts. For a similar reason, I know being a firefighter isn’t the right career for me.

I suspect some jobs need to optimize days off for things other than employee happiness. For trading specifically, they can generally make up for it with above average pay.

Fair enough. If you know the deal going in--e.g. you get 3 weeks of paid vacation but we will tell you when you have to take one/two of them with no notice. Certainly there are many jobs that have to schedule people, e.g. support, although there it's mostly about having to schedule well in advance and possible having to work at popular times. I am indeed fortunate to have a lot of flexibility.

Bingo! I worked in the upper management team of an early stage startup where the CEO was lying through his teeth to investors as well as employees. There were only three people at the top level. He was a super charismatic guy and a great story teller. No one thought he was lying until it came time to raise the next round and the lead investor from seed round ran due diligence to find booked revenue was no where close to what CEO had been claiming.

> No one thought he was lying until ...

I wonder what happened after that? Could he continue working as if nothing special, just failing to raise money?

I can't imagine that first seed investor wouldn't press charges and file a lawsuit.

Agree, this being a cyber-fraud company I believe one could keep a team busy for a long time focusing on building secure systems rather than operating them to the point where no-one gets to see what's actually being stored within. The paper trail though I'm still puzzled about, he couldn't have acted alone.

Fun thought experiment: are there businesses where this structure is beneficial, or is it always a red flag?

In the past, traders were siloed and no individual trader would have access to the total positions of all the traders on the floor. Some firms still operate this way, though it's more common for trading operations to be broken up into "pods" or teams of traders and analysts.

The industry has largely moved away from this structure for a variety of reasons. One of the problems is that traders start to try and undermine each other, since the only thing that matters is your personal pnl. Another problem is that traders can unknowingly all pile into the same investments, resulting in massive risk. This is part of the reason why the Great Recession was so bad.

Damn what a good reply. You must’ve been burned/seen some shit in the past.

This all too often happens at other companies, many times inadvertently without any fraudulent intention, just by being not well-run.

And even when they end up raking in the bucks, for the shareholders it's nothing compared to what it could have been.

it sounds easier and more lucrative to simply be honest.

How would engineering know what the CEO is telling investors?

I once had a (majority-share) cofounder CEO who, when the company hit success, became extremely controlling with the books and investor relationships. There was no way for the rest of the cofounders - let alone engineering - to know what was actually going on or what the true state of health of the company was. I (and the other cofounders, and the senior engineering staff) walked away. Big life lesson.

With lazy enough investors, it wouldn't surprise me that a CEO/owner could compartmentalize enough information that the employees and investors might have totally different understandings. The CFO would be suspect, though.

> I (and the other cofounders, and the senior engineering staff) walked away

I wonder what happened after that, how did you leaving affect the company

Have you seen $GSX, a publicly traded $20B stock on Nasdaq that claims it's growing faster than early Google or Facebook and has been the subject of 5-6 short seller reports and an ongoing SEC investigation?

Seems like the main research company that exposed GSX has made a business out of exposing Chinese public companies

https://grizzlyreports.com/research/

Some interesting stuff here.

The company of course refuted the research with some vague stuff about APIs having encryption so the data would be wrong. This was back in June and the stock seems to be still going along strong... http://gsx.investorroom.com/2020-06-03-GSX-Refutes-Grizzly-R...

Muddy Waters got a report on GSX too.

PE ratio of over 500... oof

It is difficult to get a man to understand something when his salary depends upon his not understanding it.

Where was the board during this whole time? I have trouble understanding how a board allows a management team to operate in such a way that controls aren't in place (eg basic segregation of duties in finance) that would prevent or at minimum reveal this kind of behavior. The board should be seeing enough information that most of the flags you highlight should be visible to them. Not to mention, clearly the company was never audited. Regular audits should be standard practice for any company of that size. In any case, it will be interesting to see what consequences there are for board members that appear to have failed in their basic responsibilities.

I’ve been in board meetings with top tier, very well known VC board members where the CFO basically showed them the CEO was lying to them. The next two meetings the finance guy wasn’t allowed to present and then he quit. The board members never looked into it. It was like they didn’t want to know.

> Regular audits should be standard practice for any company of that size.

The company was audited twice, but the auditors tied the fraudulent bank statements to the fraudulent financial statements (woops).

> In any case, it will be interesting to see what consequences there are for board members that appear to have failed in their basic responsibilities.

Full cooperation with the SEC can get you a long way, especially if you're one of the victims of fraud.

Are you sure they were audited? I havent seen that in the material released so far, only that an auditor was engaged for due diligence, which was fairly cursory, not anywhere near an actual audit. Typically an audit would involve a direct verification of bank balances from the bank. In addition, an audit would typically directly verify customer contracts and make sure big deposits tied out to contracts and invoices. An audit would also have flagged the lack of segregation of duties as a major risk factor (though that should have been obvious to any board member). As a side note, I also wonder if Rogas was fastidious enough to ensure the GAAP financial statements all tied out with the fraudulent numbers.

I guess if an audit couldn't catch this, you have the wrong auditor. This is exactly what audits are for.

Read the DOJ filing, linked in a comment below. The auditor physically sent a person on site whose job was to watch the financial people log into the banks web interface, verify the balance, and print bank statements for the last 12 months, all in front of the auditor. The passage doesn’t make it clear why the auditor didn’t watch the ceo pull the records for the accounts receivables account

Update: filing Is here: https://www.justice.gov/usao-sdny/press-release/file/1317641...

Relevant Passage: “As part of its due diligence process, the Audit Firm had an employee (the “Auditor”) conduct a physical site visit at NS8’s offices in Las Vegas, Nevada. The Auditor was directed by a more senior Audit Firm employee to have someone from NS8 log in to the online portal for each NS8 bank account, display the current account balance, and download monthly bank statements for fiscal year 2019.”

“Based on my interview with a member of the NS8 finance department (“Finance Employee-1”), I have learned, among other things, that on or about March 11, 2020, Finance Employee-1 and ROGAS met with the Auditor in ROGAS’s office. The purpose of that meeting was for ROGAS and Finance Employee-1 each to log into the online portals for the bank accounts to which they had access (for ROGAS, the Revenue Bank Account) and download monthly account statements for the Auditor. During that meeting, Finance Employee- 1 logged into the online portal for the Expense Bank Account -- to which Finance Employee-1 had access -- and downloaded monthly account statements. Finance Employee-1 understood that ROGAS was doing the same for the Revenue Bank Account during the meeting”

You're correct, my understanding of "full audit" vs "due diligence" was off.

Yes - this is the directors’ fault. As a director you have n obligation to ensure everything is ok, and for issues of this magnitude it’s clear that the directors were bamboozled. at our firm we insist on access to the financial system (e.g. Xero) whenever we have a directorship. It’s hard to fake results, at least to this level, when we can see down to the level of individual invoices.

- where are the contracts corresponding to revenue? Yeah they are an SMB SaaS but this is financial, there will be contracts, NDAs, etc

SMB, especially the small end of SMB, does not often have contracts. It's more subscription based. That said, there were 2 versions of the software running at NS8. One was the original software that Adam Rogas and a co-founder created early on. That version was rather "opaque" and reported growing customer numbers every month. The newer version of the software was controlled by the product dev team but still reliant on the original software in some key areas. Basically, everything was obfuscated well enough to confuse everyone to the point where answers of, "it's a limitation of the original software" were taken at face value.

- if the customers are fake there is no load on the system. How does engineering not figure that out?

There were real customers and the customer growth was happening, especially in 2020. The problem is that the customer base and growth was nowhere near what Adam Rogas was cooking up on the backend.

- How does no one see an insanely low COGs when paying the cloud services bills, or the lack of allocated resources when looking in the management interfaces?

COGs and other bills were kept relatively high. It's also why the company hired 200+ people, to make the story all the more believable.

- How does no one notice a complete lack of analytics or actions being generated by all the supposed customers?

Again, real numbers were difficult to gather for excuses given repeatedly by Adam Rogas and others charged with providing those numbers. I'm not saying that others were complicit in the scam, but that they were (at least) being fed the same excuses the rest were. Investments were never made to bring visibility to the customer metrics. Was this a red flag? Yes, but then why are investors giving NS8 so much money? It's hindsight 20/20.

- Managing cash flow would be very hard. Finance is going to see all this revenue coming in and want to scale. The VCs are going to want to see money being spent on marketing activities etc. to further the growth. If there’s no corresponding revenue being spent to acquire customers but tons of revenue coming in that’s a giant red flag

Right, so plenty of money was being spent across the board. There were 2 bank accounts according to the DOJ and SEC complaints. The account for "customer revenue" was solely controlled by Adam Rogas. The other account held the investment funds that paid all the bills. Is this super shady? Yep. And it seems there was an NS8 whistleblower who kicked off the initial SEC investigation and then the FBI getting involved as well.

Obviously something terribly shady is going on here. I’m not disagreeing with you, I just don’t understand how any director level position, let alone an executive, wouldn’t be able to see serious irregularities if such a significant percentage of revenue was phony. There are just way too many knock-on effects when the overwhelming majority of your customers aren’t real, aren’t paying you, and aren’t putting any load or impact on any of your other systems (technical or otherwise). That is some bullshit clown shoes management across the entire company right there

And the CEO or others saying “oh yeah you can’t see all those customers and growth because they’re in this old legacy system that doesn’t report it” is an insane excuse to buy. Holy shit you mean to tell us that the majority of our most important revenue is coming from a legacy systems that we have zero insight into? And it’s continuing to grow? Why aren’t those people on the new system?

> “customer revenue” account controlled solely by the CEO

I cannot fathom a VP of Finance, let alone an outside accounting firm, that would be OK with this arrangement of accounts.

Edit: To be clear I’m not trying to blame the victims. This is a terrible loss to all the employees who have been pouring so much of their efforts into the company. I just am having a hard time understanding how such a thing could happen. Maybe I’ve just been blessed to work in extremely transparent organizations.

>> “customer revenue” account controlled solely by the CEO

> I cannot fathom a VP of Finance, let alone an outside accounting firm, that would be OK with this arrangement of accounts.

Right? Then again, EY audited everything and gave those fake bank statements the "thumbs up" as part of the last round of funding and due diligence on the part of the investors. Crazy.

Wasn't EY also the firm who audited Wirecard? Why is anyone taking their audits seriously?

https://markets.businessinsider.com/news/stocks/ey-chairman-...

EY were also the ones that audited and passed WoSign and StartCom SSL CA's that were fraudulently issuing bad certs and violating CAB regulations.

When I was a young and naive c-level exec (CTO), the CEO of the company was lying about the numbers to investors and everyone else, but neither me or the coo noticed as we thought it was not our concern; we were doing our jobs which was not finance. While the judge gave us a slap on the wrist only when the company suddenly turned out to have no money, he said it was definitely part of our job to at least validate the numbers. But I know enough people now who will say it is not their job and if the ceo signed off, it is enough for them. So I can see it happen. We had clients (big ones) and we were just not privy, nor interested to be fair, to the contract size. The changes were things like 800k$ product sale heightened to 1.8m etc which was not really unlikely to us or investors. We should have checked...

We can't fathom it either!

"if the customers are fake there is no load on the system. How does engineering not figure that out?

There were real customers and the customer growth was happening, especially in 2020. The problem is that the customer base and growth was nowhere near what Adam Rogas was cooking up on the backend."

This doesn't really answer the question. The article states 40-90% of customers were fictional, as a cloud architect I would have to design based on the number of customers ++ and of course I would setup monitoring and alerting with auto scaling and it would be blatantly obvious that my utilization was not going up and that would turn into an engineering investigation.

Would it leed me to the idea that most of our customers were fake? probably not. They might not even request additional capacity, but as a architect that would lead me to ask questions. For example after an announcement or company meeting where they announce the number of new customers, I would wonder wtf? How is it that we haven't added any more capacity for all these new customers?

I would see some red flags and I would like to think I would be smart enough to start looking for something new but I haven't been in such a situation thankfully.

It's difficult to read about 200 ppl being laid off and the impact on them and thier family all bc of one stupid, greedy person.

> For example after an announcement or company meeting where they announce the number of new customers

Nothing like this ever happened, AFAICT

> I would see some red flags and I would like to think I would be smart enough to start looking for something new but I haven't been in such a situation thankfully.

"Brazen fraud" is not where Occam's Razor leads in this case. "Transparency growing pains" seems much more likely. Specifically - if working for this company I would raise concerns that there aren't KPIs being regularly tracked across all functions. I'm sure it's possible that some of the newly hired senior management was working on this.

Reminds me of DC Solar, and they claimed to make physical products...

You'd think some folks working from there would wonder "Hey, does anyone KNOW anyone else working at the other factories, because we're only making X per day..."?

I was wondering the same thing. I can see 5 or 10% slipping under the radar, but 90%? What were these 200 employees even working on?

Engineering would be the most distant from customers, I guess, but even they must've noticed how few bugs were coming in.

Hard to believe it wasn't found out earlier.

People see what they expect to see. This could be accomplished by lying at every step of the way and by fabricating audit results. It lasts until it doesn't, and that's apparently what happened here.

You can fake everything. And most people don't expect this.

Wirecard opened a fake Bank Branch from a Philippines Bank in Singapore, had the EY guys walk in there and "verify" the Billion dollar balance on the computer screen.

> How does no one see an insanely low COGs when paying the cloud services bills, or the lack of allocated resources when looking in the management interfaces?

Big data and a flawed system. They sell a service that is based off of using integrations. If you stop paying for the integrations, you should stop receiving the service. That in turn hurts their level of service offerings.

To be of any value, they have to monitor a ton of transnational data. So even if you quit paying, they still monitored your data and their modules were flawed that is still showed their acceptance score if you stopped paying.

A serious question - if I may. Where do you work? Sounds like a great company.

If you cannot respond - totally fair :)

Because the larger startups are driven by people who know financial engineering... this guy got caught because the money stopped (due to layoffs).

Noone gives a shit when they're getting paid.

Nope. He got caught when it was discovered that the "customer revenue" bank account was being manipulated to look like tens of millions were in there when it was more like tens of thousands.

The other bank account had tens of millions in there thanks to the investment money.

The layoffs came once the board faced the truth of the matter and Adam Rogas suddenly resigned.

Okay, if that's the order, then yeah, someone should have said something.

My guess is that anyone who ended up "saying something" to the CEO was either quieted by lies or forced out of the business.