Bank reconciliation fraud is using the monthly bank reconciliation to hide a theft rather than to find it. The person who reconciles invents outstanding checks or deposits in transit, alters the bank statement or forces the difference away with an unexplained adjustment. A reviewer finds it by rebuilding the reconciliation from statements obtained directly from the bank.
Why is the bank reconciliation a hiding place for fraud?
The bank reconciliation is a hiding place because it is the one document that compares the books with the bank, and whoever prepares it decides how any difference is explained. If that person also handles cash or payments, they can take money and then explain away the gap it leaves. The control becomes the cover.
A reconciliation exists to prove that the cash in the books matches the cash at the bank, after allowing for timing items. It is meant to catch both errors and theft. That makes it the first place a thief who understands accounting will look to tamper. A theft that shows up as a reconciling difference is a theft about to be discovered, unless the difference can be made to disappear.
The risk is greatest when one person:
- receives cash or writes checks,
- records transactions in the ledger,
- prepares the bank reconciliation, and
- receives the bank statement first.
In that setup, the reconciliation reports whatever the preparer wants it to report. A reviewer who only reads the finished reconciliation, rather than testing it, signs off on the cover story.
Small, steady thefts tend to use this route. Thefts from a cash box are often hidden in a similar way, inside the replenishment paperwork, which the post on petty cash fraud and how it is concealed describes.
Fictitious outstanding checks and deposits in transit on a fraudulent rec
Fictitious reconciling items are outstanding checks or deposits in transit that never existed. They are added to the reconciliation so that a missing amount is explained as timing. A deposit in transit for money already stolen, or an outstanding check that will never clear, makes the book and bank balances appear to agree.
Each kind of invented item absorbs the theft in a different direction.
Invented deposits in transit
A deposit in transit is money recorded in the books but not yet on the bank statement. A thief who took 3,000.00 of receipts can list a 3,000.00 deposit in transit dated the last day of the month. The reconciliation balances. The next month, the deposit never arrives, so the item has to be carried forward again, or replaced with a new fictitious item, or written off quietly.
Invented outstanding checks
An outstanding check is a payment recorded in the books but not yet cleared by the bank. Listing extra outstanding checks reduces the adjusted bank balance. That move can hide money taken from the bank directly, for example through an unrecorded transfer.
Signs of an invented item
- Deposits in transit that do not appear on the first days of the next statement.
- Outstanding checks with numbers that are out of sequence, already cleared or missing from the check register.
- Round-number reconciling items, especially ones that repeat each month.
- Items that age for months and are never investigated.
Every genuine deposit in transit should clear in the next few business days. Testing that is quick and catches most invented deposits.
Altered bank statements behind a bank reconciliation fraud
An altered bank statement is a real statement edited, or a fake one created, so that the reconciliation ties when the true statement would not. A preparer who controls the statement can remove a withdrawal, change a closing balance or add a deposit. The reconciliation then agrees with the edited statement, and the theft never appears.
Statement alteration is easier than many reviewers expect. A PDF statement can be edited with common software, and a paper statement can be retyped. The edits needed are small: change one line, adjust the running balances below it, and change the closing balance.
The tests that catch an altered statement focus on where the statement came from and whether it holds together:
- Get statements from the bank directly, through your own online banking access or by asking the bank, rather than from the preparer.
- Foot the statement: opening balance plus deposits less withdrawals must equal the closing balance, and the running balance on each line must follow.
- Compare the opening balance with the previous month's closing balance on the bank's own copy.
- Look for layout problems: fonts that do not match, misaligned columns, totals that do not add.
Footing alone will not catch a careful forgery, because a careful forger adjusts every balance. It does catch the rushed edit where one line was deleted and the closing balance was left alone. Comparing with a bank-sourced copy catches the rest.
Unexplained adjustments that close a fraudulent reconciliation
An unexplained adjustment is a line on the reconciliation, or a journal entry in the books, that makes the difference zero without a supporting document. It might be labelled "adjustment", "bank error" or "miscellaneous". In bank reconciliation fraud, this forced figure is often the stolen amount, made to look like an accounting nuisance.
Adjustments come in two places:
- On the reconciliation itself, as an "other" line that brings the two balances together.
- In the general ledger, as a journal entry that changes the book balance to match the bank. A common example is crediting cash and debiting a miscellaneous expense.
The second form is more dangerous. Once the entry is posted, next month's reconciliation starts clean. The theft is now buried in an expense account, where it looks like a cost of doing business.
To test adjustments, list every reconciling line and every journal entry to cash that is not a normal receipt, payment or bank fee. For each one, ask for the document that supports it. A bank error should have a bank correction. A miscellaneous expense should have an invoice. An adjustment with no document is the item to escalate.
Tax payments are another place where adjusting entries hide theft, because tax liabilities are complicated and few people check them. The post on payroll tax embezzlement covers withheld tax that is recorded as paid but never reaches the tax authority.
How does a reviewer re-perform a bank reconciliation to find fraud?
A reviewer re-performs a bank reconciliation by rebuilding it from scratch with data the preparer did not supply: bank statements obtained directly, the general ledger cash account and the check register. The rebuilt reconciliation is compared with the one presented. Every difference between the two is either an error or a sign of concealment.
Step list for the independent rebuild
- Get the bank statement yourself for the month under review and the following month.
- Foot the statement and confirm its opening balance matches the prior month's closing balance.
- Take the ledger cash balance at month end from the general ledger, not from the reconciliation.
- List outstanding checks from the check register and confirm each one clears on the following month's statement or is still genuinely open.
- List deposits in transit and confirm each one appears on the following month's statement within a few days.
- List bank-side items such as fees and interest that have not been booked.
- Compute the adjusted balances and compare them.
- Compare your reconciliation with the preparer's line by line, and list every difference.
An example: presented versus re-performed
The table below is an example. The amounts are illustrative.
| Line | As presented | As re-performed | Difference |
|---|---|---|---|
| Balance per bank statement | 48,210.00 | 48,210.00 | 0.00 |
| Add deposits in transit | 6,400.00 | 2,900.00 | 3,500.00 |
| Less outstanding checks | (5,120.00) | (5,120.00) | 0.00 |
| Adjusted bank balance | 49,490.00 | 45,990.00 | 3,500.00 |
| Balance per books | 49,610.00 | 49,610.00 | 0.00 |
| Less unrecorded bank fees | (120.00) | (120.00) | 0.00 |
| Adjusted book balance | 49,490.00 | 49,490.00 | 0.00 |
| Unreconciled difference | 0.00 | 3,500.00 | 3,500.00 |
The presented reconciliation balances. The rebuilt one does not, because 3,500.00 of the claimed deposits in transit never reached the bank the following month. That amount is the question for the next step.
Re-performance is one technique among several. The post on fraud detection techniques in forensic accounting sets it alongside duplicate tests, gap tests and digit analysis. When the statements arrive as PDFs, PreciseBankFlow handles the mechanical steps: it reads the statement lines, confirms each statement foots, matches lines to the ledger and lists the items that do not clear, with a report you can keep in the file.
When a clean bank reconciliation still hides theft
A clean bank reconciliation can still hide theft when the theft was recorded in the books as a legitimate payment. A check to a fake vendor, booked as an expense, clears the bank normally and leaves no reconciling difference. The reconciliation proves only that books and bank agree, not that every payment was proper.
That is the main limit of any reconciliation, honest or not. It compares two records of the same money. If both records show a payment to a fraudulent payee, they agree, and the reconciliation is correct.
Theft that a reconciliation cannot catch includes:
- Payments to fake vendors or ghost employees, recorded as expenses.
- Personal purchases booked to a real expense account.
- Duplicate payments that were both recorded.
- Unauthorized transfers that were recorded with a plausible description.
When not to rely on the rec alone
Do not treat a balanced reconciliation as evidence that no theft occurred. Pair it with tests on the payments themselves: who was paid, for what, and who approved it. A reviewer who re-performs the reconciliation and also scans the cleared payments for unfamiliar payees covers both kinds of concealment, the kind that hides inside the reconciliation and the kind that never needed to.