Zappers - State of West Virginia
Contents
1. Direkt FOS number 1 Bord NR 0 G ST ANT 1 Hk nr l 2005 03 11 11 13 Erirtco HR O0000z 1 Servit ME 1 Nr IM anri SUM 234 FLASE L SOCL 45 00 Manipulated fe EKoOWT ANT 45 00 HOMS zb5x 3 00 TOTAL Direkt POS number 1 Bord 0 GAST A amp NT 1 0005 03 11 11 13 Eritto NR 000002 HH HH HH a a a da a a a HH HH HH HH HH a a a a a a a Comparison Original amp M ated Electronic Journal Notice the reduction in gross sales amp the reduction in tax If this record is tied into inventory control adjustments in related purchases will be necessary some zappers will do this for you because you may have just sold more beer than you ordered E 100120050311 TIC Anteckningar Arkiv Redigera Format Visa Hj lp iM 1 a Ka 1 exo 1 X Be rum i mw NEUEN 1103051113000002 1 4500076700060 0111 F 1103051113000002 1 65000767 0006001H r ee Manipulated Original 1 15608 2 OG poems 110305112 0000003 1 6800076 600600 Comparison of the TIC files Manipulated amp Original Notice the in the Manipulated version in contrast with the letters H I amp P in the original version This one of the tell tale signs of manipulation in this particular program It may indicate that the system has not been correctly updated since2. This is an old Quebec Zapper It has been hard wired into the ECR The picture shows the top of the ECR removed and the yellow arrow points to the device When Zappers are added to ECRs this way it is very easy to find them People only do it this way in jurisdictions that are not looking for them C00003 jpg 1280x960x16M jpeg Contemporary Zapper Note this Swedish zapper requires a lot of manual intervention vcohm DRYCK re gt a lt LASKA STOR MJ LK STOR 12 STOL JUICE JUICE VIN COLA EN m 22 STOR SPRIT FANTA FANTA 1s TOBAK MINERAL TT PI Electronique cash register Manufactured in Paris since 1983 Popular in Italy Belgium Portugal Spain Germany Denmark Australia USA and North Africa Uses Restodata back office program Cash register is connected to a PC in the back office like the one on the following slide Back Office PC Notice the dongle grey memory stick protecting proprietary program Notice the silver memory stick this is the zapper Restodata is programmed to automatically download all information about transactions from all cash registers every morning at for example 5 00 am Next Generation Internet based Zappers Six cases in Portugal Zappers used with credit card transactions United Kingdom Portugal amp Norway I HOPs in Ohio US District Court Northern District of Ohio
3. Journal Electronic journal can be set to not function Master Reset Clears out the entire memory of the till and brings it back to a blank default program the till then determines which terminal it is by looking at others on the LAN and then prompts to import its program from one of the other terminals on the LAN Example CASIO TE 2000 See Zappers amp Phantom Ware A Global Demand for Tax Fraud Technology http papers ssrn com sol3 papers cfm abstract_id 1139826 Cash Register Good Practice Guide EU Cash Register Study Group Part of the Fiscalis Committee e Use of a refund to skim cash HMRC Re program Z Report not to record refunds e Re program X Reports not to record refunds Eliminate refunds from the Electronic Journal Thus the ECR nets refund against a sale and records only a lower net sale amount without a trace in Z Report X Report or Electronic Journal Type 2 Factory installed Phantom ware Does not require re programming Secret hidden functionality built in to ECR e Not discussed in user s manual e Not visible in menu structure Commonly revealed only in oral communications with Installer Sales representative The idea is to remove the need to re program Manufacturer looses deniability These programs have only one function Zappers There are three generations Zappers Past Zappers Present Zappers Yet to Come Zapper from the Past
4. Threshold amount 100 Tatal AN ARR AT kr 2 auto repl ce So assume we take the selection of a ticket approach 1 When we select the first item ticket number 2 1 we then get x5 Elektronisk journal Change password cS End Change Restaurant POS Nb MV aiters D 2 CAFE 2 2 ate 3 SERV 2005 03 11 eJl au 2005 03 11 aysi SER x Bill T otal Recipt time Iv All Upper to Entre 00 00 och 23 59 List of tickets paid in cash Replacementtickets Articles exclure 0 Date Time Nb ticket POS Wait Type Amount Replaced by Total removed 05 03 11 00000271 T 05 03 11 11 20 00000471 1 1 Direkt 64 00 kr 05 03 11 11 30 O0000A71 1 1 Direkt 6p 00 kr 05 03 11 11 35 ooooo ss1 1 1 Direkt 196 00 kr 05 03 11 11 44 ooo0odsz T l Direkt P6 00 kr s 05 03 11 11 46 00004771 1 Direkt 6 00 kr 05 03 11 11 48 01000172 it 1 Bord 45 00 kr 05 03 11 11 49 oooopsyi 7 1 Direkt 68 00 kr 05 03 11 11 54 ooog10 1 1 1 Direkt 68 00 kr 05 03 11 11 55 000Q1171 F l Direkt 68 00 kr 05 03 11 11 55 0001271 1 1 Direkt 130 00 kr 05 03 11 11 55 ooopisyi l Direkt 35 00 kr 05 03 11 11 56 00001471 3 1 Direkt 68 00 kr 05 03 11 11 56 009015 1 l Direkt 65 00 kr 05 03 11 11 57 OO0 0167 1 1 1 Direkt 73 00 kr 05 03 11 11 58 oopoiv7y1 1 1 Direkt 136 00 kr 05 03 11 11 59 00001871 1 Direkt 85 00 kr 05 03 11 12 04 ogoo1isy1 T 1 Direkt 65 00 kr Ne J Manual sele
5. the manipulation procedure Supplement 2 9 Ways to find a Zapper How do you find Sales suppression devices Stealth visits before audit Set up a dummy store Detailed examination of ECR printouts Concentrate on high risk businesses Audit lead from a different rigorous audit Audit lead from another jurisdiction Find and follow the corrupt installer Work collaboratively with absent owners Read the 250 Quebec cases in your spare time to learn the fact patterns and other stuff CON DWM BWN e 1 Stealth visits before audit e This is how Revenue Quebec found its first Zapper in 1997 Auditor visited a restaurant before opening an audit saved her receipts and looked for records in the TIC files of the ECR Requires some luck 2 Set up a dummy store This is what the Canadian Broadcasting Corporation did in Montreal e ECR salesman approached CBC and explained factory installed Zappers Company was subsidiary of a US ECR distribution business Salesmen actually gave interviews to CBC Connecticut has reported the similar activity in complaints by honest ECR sales people 3 Detailed examination of ECR printouts e Swedish approach There is a Swedish ECR lab in the government s training facility that has a number of corrupted ECRs for practice amp training of auditors South Carolina attorney looking for this kind of evidence in court case R
6. Western Division 3 12 cr 262 DAK filed 5 22 2012 18 people indicted 3 million Tarek Elkafrawi FBI ICE HSI Joint Terrorism Task Force Egypt Jordan Lebanon SABLE 2010 MICROS POS Internet access Two franchise fees Equipment land royalty advertising 8 net sales Manipulation of Sales payroll false SSN multiple SSN 200 illegal workers underpaid for overtime MICROS system manipulation of hours worked weekly I HOP credit 2 300 Remote access to I HOP MICROS with Team Viewer software from home computers reset clock manipulate cash transactions because tickets remained open MICROS taken off line Would you let this guy out Where s the Zapper As stated by the Magistrate Judge a sixty four count indictment filed on May 22 2012 charges Defendant in 53 counts as follows one count of money laundering in violation of 18 U S C 1956 h two counts of alien harboring in violation of 8 U S C 1324 eighteen counts of mail fraud in violation of 18 U S C 1341 twenty three counts of identity theft in violation of 18 U S C 1028 and 1028A two counts of arson in violation of 18 U S C 844 h and i and six counts of health care fraud in violation of 18 U S C 1347 Upon conviction the money laundering and mail fraud charges carry a potential statutory penalty of up to 20 years The potential penalty for conviction of each aggravated identity theft charge
7. Zappers What s Coming New Fraud amp New Enforcement INDEX Theme Market place Estimated Losses amp Three Uncovered Phantom ware Self help Factory Installed Zappers Zappers Past Zappers Present Zappers Yetto Come Is there a Zapper here Ohio Pennsylvania State Legislative Activity Long term problems amp long term solutions Theme Market place This is a Mid size business issue 1 Skimming has been an individual fraud issue not a market place issue 2 Phantom ware applications show skimming entering the market place Self help phantom ware Factory installed phantom ware 3 Zappers developed next Installers rogue developers smaller developers 4 Internet based programs Development Time Line Entering the market place 2 4 Skimming Factory installed Double Tills Phantom ware ae idiot gt proof fraud Self help Zappers system Phantom ware THE COMPETITIVE MARKET PLACE Greece 10m people 800 000 SMEs 300 000 to 350 000 ECRs and POS systems turnover of 30 000 to 40 000 systems per year 300 different machines all certified 50 importers and manufacturers Germany amp Italy EU USA Japan China non EU AND Greece has the highest fraud ratio in the EU 30 Estimated Losses amp Efforts Undertaken 1 Estimated tax losses restaurant industry only West Virginia GDP 23 4 of Quebec 99 5 million 2 Oth
8. a Guatemala El Salvador Dominican Republic and Costa Rica Bad Apples f there are privacy concerns with comprehensive technology solutions Consider adopting a limited enforcement regime based on an Oklahoma Missouri approach Further Reading An American Look at Zappers A Paper for the Physikalisch Technische Bundesanstalt Revisionssicheres System Zur Aufzeichnung Von Kassenvorg ngen Und Messinformationenthe http papers ssrn com sol3 papers cfm abstract_id 2026140 Zappers amp Phantom Ware A Global Demand for Tax Fraud Technology http papers ssrn com sol3 papers cfm abstract id 1139826 e Zappers Tax Fraud Technology and Terrorist Funding http papers ssrn com sol3 papers cfm abstract id 1095266 Thanks e Richard Ainsworth ADP Richard Ainsworth adp com Boston University vatprof bu edu Supplemental Slides e Details of a Zapped transaction from a Swedish Zapper 11 slides e 9 Ways to find a Zapper 11 slides Supplement 1 Details of a zapping from Sweden So before manipulation here is the electronic journal the sales report the sales receipt Fil Andra JORG NR 2006 10 05 15 02 41 ELECTRONIC JOURNAL UTSKRIFT 2005 03 11 00 00 2005 03 11 23 59 T MOMS 25 ITOTAL KVITTO Direkt 2005 03 11 11 13 de cde de cde dede de de de de de dede de de dede de de de de LUNCH BUFFE KONTANT MOMS 25 Electronic Jou
9. apa kvitto Unselect Double Click on the secret module It is not all that apparent what you need to do here but by double clicking in the box in the lower left entering an ID and a password you will get to the next screen the Electronic Journal which can be adjusted EE Elektronisk journal Change password t End Restaurant POS Nb Waiters D 2 CAFE 2 pose 3 SERY 1 2005 03 11 au 20050311 gt SERU E Bill Total Iv All NE Upper to 0 Fr SE POS Wait Replaced by Recipt time Entre 00 00 och 23 59 List of tickets paid in cash Articles 4 exclure 0 Date Time Nb ticket Total removed 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 05 03 11 Select the tickets to replace in the Total Sales 40 836 31 kr Total P Total 2 1 00000371 00000471 00000571 0000068671 00000771 01000172Z 00000871 00001071 oOoO00117 1 oooO012z7 1 00001371 00001471 00001571 00001671 00001771 00001871 00001971 0 00 k P H HHEHHHFHHHFHHFHHFFFFFHFHHH PRERPRP RRP REP Direkt Direkt Direkt Direkt Direkt Direkt Bord Direkt Direkt Direkt Direkt Direkt Direkt Direkt Direkt Direkt Direkt Direkt kr kr kr kr kr kr kr kr kr kr kr kr kr kr kr kr kr kr Manual selecting of replacement tickets
10. cting of repl cement tickets Total Sales Amount to remove Threshold amount 100 Total P Total 20 00 k Total Gross alidate Manipulated ElectronicJournal pro forma Here is what we have done so far is this enough manipulation Ticket 2 1 has been changed from 65 00 to 45 00 with a reduction of 20 00 on this ticket There is a running total kept in case you want to remove more Elektronisk journal gt Change password Change End Restaurant POS Nb Waiters Date B 2005 03 11 au 2005 03 11 SED x Bill T otal Recipt time Iv All mn E Upper to Entre 00 00 och 23 59 Articles 4 exclure 0 List of tickets paid in cash Replacement tickets Tickets 334 FLASKOL SOCL 45 00 kr gt 5 00 oo kris Erase Ticket Price Level Normal List of replacement tickets 334 FLASK L 5OCL Ticket with commission cde cde cde cde cde Bue de cde de cde cde dede cde cde Total Sales Threshold amount 100 mount to remove Total P Total FE Total Gross Replace auto Replace she Lunch Buffet 65 00 with beer 45 00 Notice the price reduction we could have gone lower Notice the tax reduction The Swedish VAT is at 2596 21 LUNCH E 1 65 00 1 KONTANT Original 1 85 00 MOMS 25 1 13 00 TOTAL
11. equires knowledge of ECR programs they are specific to ECR types not generic A Concentrate on high risk businesses Not f Mom or Pop runs the cash register e f publicly held enterprise Yes f multiple locations with a remote but actively engaged owner La Shish Detroit Ronan Australia Employees are paid wages under the table Unusual ratio of cash credit transactions 5 Audit lead from a different rigorous audit Zappers leave a cash hoard that is difficult to dispose of don t stop with the initial audit push to find the Zapper Audit shows that many employees are paid in cash Dudok Netherlands e Cash taken off shore US Customs Stew Leonard s Dairy CT e Cash sent to Hezbollah Homeland Security La Shish MI Normal lavish lifestyle evidence Aleef Garage UK 6 Audit lead from another jurisdiction Ontario picks up leads from Quebec New York should do the same with Quebec Frequently the devices spread in ethnic communities that have business ties to jurisdictions where this fraud is common Brazil Venezuela Quebec Austria amp Germany found similar Zappers in 600 Chinese restaurants started in Austria with a Chinese grad student in a technology school Germany followed the Austrian lead on audits 7 Find and follow the corrupt installer Revenue Quebec uses search warrants against installers simultaneously with a searc
12. er states Gea sam Tennessee Stn Toe sia remu 276m TOTAL USA 21 095b Three US Zapper Cases Stew Leonard s Dairy Norwalk CT 1994 Custom made zapper former NCR IT expert Zapper is kept in a hollowed out book in office 17m IRS income tax audit Customs uncovered LaShish restaurants Detroit MI 2007 Zapper kept at owner s residence connected to ECRs at 13 restaurants e Skim 520m 4 years sent to Hezbollah Lebanon CIA mole sister in law wife in prison Husband is fugitive from US in Lebanon Theodore R Kramer Detroit MI 2011 nstaller Journal Sales Remover program 2 strip clubs over 500 00 gross sales 5 years in prison plea bargain will talk Phantom ware There are two types Self help Factory Installed Type 1 Self help Phantom ware Modern ECRs can be re programmed to eliminate the audit trail critical records Z Reports daily periodic end of day report that records sales taxes media totals discounts voids etc e X Reports same as Z Reports except they do not reset the system after being taken Electronic Journal records all transactions blow by blow entered in the machine Programming is secret not in user s manual limit access bad employee issues Examples of Hidden Functions e Sales Data Reset Resets all sales data on the terminal to zero e Turn Off Journal Turn On
13. h of a restaurant Dudok Netherlands installers are correcting the system during an IRS audit to hide data Boutique programmers makers of specialty cash register programs Roy Quebec 8 Work collaboratively with absent owners Absentee owners can be victims of the management company Celine Dion Quebec Franchise holders McDonalds Burger King Duncan Donuts that get a royalty per sale in the store Cincinnati Ohio 2007 IRS A business that hires too many computer savvy students could be a victim 9 Read the 250 Quebec cases in your spare time to learn the fact patterns Revenue Quebec publishes summaries of all the ongoing cases on the web Goto http WWW revenu gouv ac ca eng ministere centre information communiques ev fisc 2008 janvier asp What do you do when you find them e Think beyond the audit Who installed it Who sold it Who is competing with this business locally Penalize beyond the audit Make the sale possession distribution of a sales suppression device punishable Make continuation of the business contingent on the installation of certified ECRs business licensing requirements Contact the marketplace Treat the fraud as the tip of the iceberg let the market know you are serious nitiate contact with other jurisdictions to collaborate
14. is a consecutive two year period The indictment also includes a forfeiture count pursuant to 18 U S C 982 Detention Order July 13 2012 USA v TAREK ALKAFRAWI et al Case No 3 12 CR 262 Nifty Fifty in PA amp NJ US District Court Eastern District of Pennsylvania 2 12 cr 241 MAM May 16 2012 Evasion began in 1986 FBI amp IRS CI e Philadelphia PA area amp several NJ locations 15 million skimmed 2 2m income tax Paid workers in cash cash taken to Florida retirement home amp kept in safes on premises Second set of books found Family owners and managers at each location Several owners filed SO returns with claims for refundable credits Calls from the field Zapper We have an account where the records show only receipts for certain times of the day the other times of operations are missing assume this would be turning off the machine or putting it on training mode Have you heard of a zapper that would remove certain time periods from records Thanks A Possible Zapper e There is a chain of five restaurants in the same town two high end three middle to higher end Labor ratio is 26 percent should be around 38 to 40 mostly credit cards seems high though the average is about 88 percent on preliminary analysis same POS suspect that maybe credit cards could be diverted need to dive deep to see what is there the labor is out of line based on analysis of what we usually see H
15. ow about here Another one we have the electronic data and the order numbers are missing throughout the audit at a rate of 11 percent per quarter Guest check numbers are missing at a smaller rate the order numbers are deep programmed where there are reasons for missing guest receipt numbers to be missed per software IT folks they say order numbers should always show zapper State Actions The most common question posed by State legislators goes like this We already have penalties for tax fraud why do we need more The answer is You need to be able to penalize the INSTALLER State Legislative Activity STATE BILL ACTION STATE BILL ACTION HB 5421 SB 854 FL HB 7099 Veto NY SB 2854 GA HB 415 Law OK HB 2576 Law IL HB 6155 SB 2194 IN HB 1337 UT HB 96 Law LA SB 616 Law WV SB 411 Law ME LD 1764 Law SB 768 Law MO SB 840 Notable Variances Amnesty Maine New York e Revocation of business license Oklahoma 10 years e Mandatory 3 party security Missouri for all new businesses and violators Solutions Technology German government INSIKA smart card 50 Quebec government Sales Recording Module 800 Private sector Sales Data Recorder with mobile 350 e Traditional Netherlands persuasion Norway comprehensive regulation e Split payments Ecuador Russia Turkey Argentina Brazil Peru Chile Uruguay Austria Mexico Colombi
16. rnal before manipulation 1 Item number 21 is a Lunch B 2 It cost 65 00 kroner 3 The receipt is number 2 1 F rs per familj 2005 03 11 till 2005 03 11 Unknown family 693 00 kr AVHANMTNING 1 701 01 kr 340 00 kr 1 026 00 kr 19 931 00 kr 669 00 kr 13 492 00 kr 3 144 00 kr 41 046 01 kr Out of SALES 0 00 kr Rabatt 209 70 kr Sales Report before manipulation We need this for comparison later E 1001 20050311 TIC Anteckningar Arkiv Redigera Format Visa Hj lp p x 1 Z ae D IE 1103051113400002 1 3 6500076 O0060071H A 25 1 BOOS R 1 1 x 1 1 13506 ze 05 D Oo 1 1 1 LL 110305112 0000003 1 NE Sales receipt before manipulation These are in the TIC files for tickets Notice 1 Item number 21 2 Sales price of 65 00 kroner 3 Ticket number receipt number 2 1 To manipulate the data you insert the zapper silver memory stick There is anew version of the CMDCAR DLL program on the zapper Utskrift av journal Fest a d Kwitto datum fran Mlellar 2005 03 11 H 00 00 Huzy biicder och 2005 03 11 EX 23 59 Korrigering av kvitto Kvitto Tid fran Kvitto korrigerat Korrigering artikel Melan Ba ad och 2259 Filter pa ost Konton ll anw ndar ID Bill Total t Password Melan n aoc Unselect Betalning 4 xl xi A m error 5 SPS Sk
Download Pdf Manuals
Related Search