Pantheon 2020: Protect Your Service Company from Cybercrime
Pantheon keynote speaker Susan Frew shares tips and strategies on how to prevent—and recover—from nearly $1 million in employee business theft.
Life seemed to be smooth sailing for Susan Frew in 2012. That is, until one Saturday when a collection notice from the IRS arrived in the mail and blew out the bottom of her lifeboat.
She had met and married her husband. They had merged their collective talents to start a new HVAC and plumbing business in the Denver area called Sunshine Plumbing Heating & Air, and the company began winning multiple awards for outstanding customer service, best place to work, and more.
“We were killing it!” Frew says. “We were on top of the world.”
The company’s success opened up new opportunities for Frew to return to her role as an international professional speaker and business coach, and she was in-demand and gaining momentum. Because she needed to be away from the office more, Frew decided to hire an office manager to help run Sunshine Plumbing Heating & Air.
This person checked all of the boxes on best practices for a new hire, Frew says. She interviewed well, she was well-educated, she previously worked for a competitor, and her criminal background check came back clean.
“She was the real deal,” says Frew, who hired her, and then basically turned over the keys to the kingdom to her by sharing all of the company’s log-in credentials and allowing her to handle all of the bills. This employee even offered to handle things when she went on vacation, so no one needed to fill in for her while she was gone.
“I could dump everything on her that I didn’t want to handle, and she took it over,”
Frew says. “I was professionally in love! What a great employee, right?”
Fast forward three years to that fateful Saturday morning. When she received the IRS collection notice indicating Sunshine owed $425,000 in unpaid payroll taxes, Frew says she sat down and cried.
“What happened? This is impossible. How could this happen to us?” Frew says she asked herself. “This couldn’t happen to me. I knew how to run a business. I coached over 150 companies during the recession, including 17 different trades. I was helping up-and-coming businesses grow, and helping shrinking businesses turn themselves around.
“What the heck happened? What did we miss? And what could we have possibly done to prevent this? It all came down to lack of security and processes that allowed one employee to single-handedly bring down the whole business.”
As a business owner who became victim to employee theft, but survived to tell the tale, Frew shared with a virtual ServiceTitan Pantheon audience the key indicators to look for in employees if you suspect business theft:
Sudden change in work motivation
Abrupt lifestyle adjustment
Objections toward procedural updates
Below, Frew describes the path of destruction left by this former employee and what actions she took to help her business not only recover, but also thrive in its new path forward.
Uncovering the destruction left behind
Although it’s hard to pinpoint when the office manager “started going bad,” Frew thinks it began after Sunshine Plumbing Heating & Air hired its first service manager, giving him a higher salary than the office manager.
“She resented it. She was clearly unhappy about the decision, and she kept asking for more pay,” Frew says.
In response, Sunshine set up a pay-for-performance model for its employees and gave generous bonuses to the office manager, if she stayed on budget.
“Every month, she would be on budget, get her bonus, and off we go,” Frew says.
How did this office manager meet her bonus goals each month? Since the company’s owners relied on her to handle the mail and pay the bills, it was easy for her to cover her tracks.
First, she stopped paying certain vendors—choosing only to settle up with vendors who had a personal relationship with Frew and paying nothing to the others.
Then, she started shorting payments to the IRS for payroll taxes. If the company owed $4,000, then she paid $3,000, or if the company owed $3,000, she only paid $2,000, Frew says.
The employee also used Frew’s log-in information to order herself a company gas credit card, but then refused to give the service manager access to it when he asked for the password. Later, Frew found weekly charges for gas—as well as charges at grocery stores, nail salons, a vacation to Cancun, and even a large number of towing fees.
“Every Friday, she would fill up not one, but four cars, get a car wash, pick up some items in the gas station ... every single Friday, for three years ... and she was selling towing services on Craig’s List!” Frew exclaims.
Employee theft more common than you think
Frew ultimately fired this employee, and today the employee is charged with a cyber crime for her “illegal and unapproved use of our company credit card,” Frew says.
But, the fallout didn’t end there. Frew learned Sunshine not only owed $425,000 in back taxes to the IRS, but she personally owed another $227,000 in trust fund penalties.
And what about all of those unpaid vendors? Frew spent the next year calling each one to apologize for unpaid bills and to find out exactly how much she owed.
“We estimate we owed close to $1 million to both vendors and the IRS,” she says with a long sigh.
Frew says a quarter of businesses suffer losses of more than $1 million because of employee theft, and more than one-third of the thefts are committed by a manager.
“These types of things are more common than you think,” Frew says.
She also believes taking the proper precautions and putting the right processes in place help reduce a company’s vulnerability, allows them to catch theft much sooner, and reduces the amount of damage it causes.
“Ensuring the security and limiting the vulnerability of your business can limit your losses and increase the probability of your future success,” she says.
Road to recovery isn’t easy
Frew put Sunshine Plumbing Heating & Air on the road to recovery by writing letters to all of the company’s vendors, letting them know about the security breach and setting up a plan for repayment. Frew says the company started making roughly $30,000 a month in debt repayments.
“Some big, some small, whatever we could do to make this right,” she says. “About 95 percent of the vendors were kind, gracious, and understanding. And some said, ‘Nope, I want my money right now.’”
How did she handle those vendors? Frew simply explained they had two options: 1) Accept the payback plan and get paid incrementally, or 2) Force Sunshine to file bankruptcy, then get in line behind the IRS and wait indefinitely for a payment unlikely to come.
“Only one vendor treated us horribly throughout this mess, and once our contract with them expires at the end of the year, we will be moving on,” Frew says.
The company also had to hire “fancy, expensive” lawyers to work out a payment agreement with the IRS, which is still in progress today.
Going through a serious situation like employee theft can leave you feeling scared, frustrated, angry, and depressed. But, recovery is possible.
“Recovering from something like this is not easy,” Frew says. “But your leadership in these kinds of situations is about knowing how to accept the reality of what’s happened, taking the proper steps, and getting yourself out.”
Steps to take if you suspect employee theft
Frew admits it was lack of security, accountability controls, and processes that made her company vulnerable to employee theft. In hindsight, she recognizes some red flags that should have tipped her off sooner, such as:
Check employees’ backgrounds for civil litigation, as well as criminal actions. In this case, the former office manager’s past record included multiple civil crimes, lawsuits, and liens—none of which showed up on the criminal background check.
Create clear separation of duties, and implement checks and balances with accountability. On the few occasions when Frew questioned the former employee about a possible accounting problem, she quickly blamed an outside accounting firm for the mistake.
Passwords are like underwear—DO NOT SHARE THEM! In today’s e-commerce world, sharing your online passwords with employees is like opening the bank vault and inviting them in.
If you suspect wrongdoing by an employee or employees, you must thoroughly investigate before making any accusations.
“A false accusation can result in a lawsuit against you and negatively impact your employees’ morale and trust,” she says.
She also advises:
If it’s a large or complex issue, hire legal counsel and ask them to connect you to other experts, such as forensic accountants, cyber forensics, and other investigators, to help you identify the full scope of deceit.
Verify suspicions by investigation and determine the extent of the fraud and methods used.
If an employee steals your identity, immediately call the credit bureaus and place a freeze on your credit. This prevents anyone from opening additional accounts in your name.
Contact anyone who’s been directly or indirectly impacted by the employee theft, explain the situation, and work together on a possible resolution.
Identify the responsible employee, terminate their employment, and consider further legal action against them.
Frew says now more than ever, it’s important to understand how cyber crime can impact your home services company.
“Why now? In the first half of this year, the world practically moved to the internet and phishing attacks alone surged to 350 percent amid the Covid-19 shutdowns,” she says. “This was a cyber criminal’s dream come true!”
Where things stand today
Sunshine Plumbing Heating & Air continues to recover slowly, but surely. At the end of 2018, Frew happily reported the company came out with a negative $150,000 net profit. By the end of 2019, Sunshine made gains to end the year with a positive $70,000 net profit. As of July, the company sits 20 percent net positive in revenue and profits.
“Things are looking great,” Frew says. “We’ve moved, we’ve downsized, we’ve turned our company around, and we’re able to field all but two of our trucks. As much as I knew we’d get through this, I never want to go through this again.”
Frew hopes her story serves as inspiration for other home services companies to take a more proactive approach when it comes to implementing proper security procedures.
“It’s my life’s mission to help other business owners turn around their companies, and make sure no one ever has to go through this again,” Frew says. “Not on my watch.”
ServiceTitan is a comprehensive home and commercial services business software solution built specifically to help companies streamline their operations, boost revenue, and achieve growth. Our award-winning, cloud-based platform is trusted by more than 100,000 contractors across the country.
Ready to learn more about what ServiceTitan can do for your business? Contact our team to schedule a demo today.