
CEO of Cyber Fraud Startup NS8 Arrested by FBI, Facing Fraud Charges - prostoalex
https://www.forbes.com/sites/davidjeans/2020/09/17/ceo-of-cyber-fraud-startup-ns8-arrested-by-fbi-facing-fraud-charges/#702a4e3062ed
======
billyhoffman
Being an executive at a (substantially smaller) SaaS startup I have no idea
how having up to 90% of your revenue be fabricated could happen without others
knowing:

\- where are the contracts corresponding to revenue? Yeah they are SaaS
focused on SMB but this is a financial product, there will be contracts, NDAs,
etc

\- if the majority of the customers are fake there is such little load on the
system. How does engineering not figure that out?

\- How does no one see an insanely low COGs when paying the cloud services
bills, or the lack of allocated resources when looking in the management
interfaces?

\- Even saas Products with supposedly a no touch sales process still have
sales people and sales engineers for key accounts. What are all the sales
people doing if they’re not running trials?

\- let’s say he hid all of this by having tens of thousands of $10 a month
customers. How does your VP of sales not get totally freaked out that the
overwhelming majority of revenue is coming from no touch sales? If that’s the
case that radically changes your growth and go to market strategies. The
entire go-to- market team should be wondering what is going on? Same with
product management. Your roadmap would be completely different with a long
tail of extremely low revenue customers.

\- how does sales/client success not notice that no one is expanding? How they
aren’t talking to small customers about expansions?

\- How does no one notice a complete lack of analytics or actions being
generated by all the supposed customers?

\- product management is going to want to get feedback from all of these
customers. They’re going to be looking in analytics tools or session replay
tools like fullstory. They’re going to look at the accounts and users and do
outreach to emails asking for meetings. Aren’t they going to notice all of
those people are fake?

\- support/client success is going to have insanely high customer to support
person ratios. Where are all the support tickets for that many customers?

\- Managing cash flow would be very hard. Finance is going to see all this
revenue coming in and want to scale. The VCs are going to want to see money
being spent on marketing activities etc. to further the growth. If there’s no
corresponding revenue being spent to acquire customers but tons of revenue
coming in that’s a giant red flag

~~~
PragmaticPulp
None of it makes sense in the context of a well-run business with proper
executives in place. That’s because these frauds don’t operate like a well-run
business.

Usually, the upper management teams are extremely lean. The business is broken
up into different silos such that few people can see the big picture. Each is
led to believe they are a tiny fraction of the overall revenue, giving them
the impression that the bulk of the company’s revenue must come from another
department where they have no visibility. As a bonus, this motivates siloed
teams to feel like they need to catchup to the rest of the company, when in
reality they might be the main driver of it. It helps to have separate offices
and a culture of secrecy to prevent people from comparing notes.

The CEO positions himself as a controlling, micromanaging individual at the
center of everything. This makes it possible for the CEO to intercept
financials and other crucial numbers en route to people who might catch on.

The rest of the management staff might be filled with people too inexperienced
to recognize that something is wrong. They might think the CEO is doing them a
favor by giving them a golden opportunity to advance their career into an
executive position at a rocket ship startup. They don’t know what they’re
doing, but they think it’s okay because the CEO has taken them under his wing.

At scale it becomes difficult to do this without at least a few people being
complicit, though. A fraudster usually has several close associates who can be
trusted to be in on the fraud or at least look the other way for a while.

~~~
liability
Sometimes tribal/"team sport" group dynamics keep employees inline too.
Executives can foster an _" us against the world"_ mentality that blinds
workers to that which is obvious to everybody else. When in this mindset,
people have the ability to ignore even the most damning evidence.

Here's an example: When Enron's CEO verbally attacked wall street analyst
Richard Grubman for questioning Enron's accounting practices, Enron employees
thought this was hilarious and adopted the insult as a sort of inside joke.
They didn't consider Richard Grubman's position, they just took delight in
'their team' dunking on 'opposing team.'

~~~
rapnie
This is massively scalable. There are examples, but I do not want to get
political.

~~~
duncan_bayne
Leaving aside the specific politics, this is one of many reasons I advocate
for replacing voting with sortition (picking representatives from the
electoral roll, in much the same way as juries are picked).

------
AdmiralAsshat
I feel sorry for any CEO who actually steps down to spend more time with
his/her family. That explanation has now more or less been completely co-opted
by "Our CEO got caught in an embarrassing scandal and they need to fade from
the public eye for a bit." I now assume that anyone who gives that reason on
their way out must have done something terrible that is yet or about to come
to light.

~~~
jedberg
This recently came up when Kellyanne Conway stepped down. She said it was to
spend more time with her family, no one believed her, but all evidence points
to it really truly being the case. Her husband also stepped down from his job
and her daughter stopped tweeting about how much she hates her parents.

~~~
pfraze
That’s a bit of a unique case; they had very publicly visible family issues.

~~~
jedberg
Exactly, that's the only reason anyone believes her at all. If not for their
very public issues, I don't think anyone would have believed her.

~~~
paxys
If the issues hadn't been made pubic she wouldn't have stepped down at all.

------
tdons
An auditor was fooled while he was _in the room watching_ while the ceo
downloaded bank account statements (pages 10/11 of
[https://www.justice.gov/usao-sdny/press-
release/file/1317641...](https://www.justice.gov/usao-sdny/press-
release/file/1317641/download)):

    
    
      d. As  part  of  its  due  diligence  process,  the  Audit  Firm had an employee
         (the “Auditor”) conduct a physical site visit at NS8’s offices in Las Vegas,
         Nevada.  The Auditor was directed by a more senior Audit Firm employee to have
         someone from NS8 log in to the online portal for each NS8 bank account, display
         the current account balance, and download monthly bank statements for fiscal
         year 2019.
      
      e. Based  on  my  interview  with  a  member  of  the  NS8 finance department
         (“Finance Employee-1”), I have learned, among other things, that on or about
         March 11, 2020, Finance Employee-1 and ROGAS met with the Auditor in ROGAS’s
         office.  The purpose of that meeting was for ROGAS and Finance Employee-1 each
         to log into the online portals for the bank accounts to which they had access
         (for ROGAS, the Revenue Bank Account) and download monthly account statements
         for the Auditor.  During that meeting, Finance Employee-1 logged into the online
         portal for the Expense Bank Account -- to which  Finance Employee-1  had  access
         -- and  downloaded  monthly  account statements.  Finance Employee-1 understood
         that ROGAS was doing the same for the Revenue Bank Account during the meeting.
      
      f. Late in the evening on or about March 11, 2020, the Auditor  emailed  another
         employee  as  follows:    “Attached  please  find the bank statements and
         screenshots that I observed [Finance Employee-1] and Adam [ROGAS] download this
         afternoon.”  Attached to  that  email,  among  other things,  were  the
         Fraudulent  Bank  Statements for the Revenue Bank Account for the period from
         January 2019 through February 2020.

~~~
PeterisP
The whole concept of "have someone from NS8 log in to the online portal for
each NS8 bank account, display the current account balance, and download
monthly bank statements for fiscal year 2019." seems kind of weird and even
ridiculous.

In the audits I've seen, the standard procedure to get the same information
would require the company to authorise the auditors so that they could get a
written confirmation of the funds directly from the bank or whoever holds the
assets or debt. You would not trust the account statements that the company
gives you, you would get the same (hopefully) account statements yourself.
Accepting that watching a company employee log in some site is equivalent to
getting an official confirmation from that outside third party is ....
interesting. The whole point of an audit is to verify if everything that the
company shows you is actually true instead of looking at what they show you
and believing it.

------
jedberg
> It seems ironic that the co-founder of a company designed to prevent online
> fraud would engage in fraudulent activity himself

I don't find that ironic at all. Having worked in the security space for a
long time, it seems like the best people in the business are the ones who
would be great at committing the crimes if not for their own morality.

Someone with a weak sense of morals could easily turn to evil.

~~~
heartbeats
Well, it _is_ a cyber fraud startup. They didn't lie about that.

~~~
jessaustin
Reminiscent of Jesse's advice to Walt about a " _criminal_ lawyer".

~~~
dane-pgp
Also reminiscent of the aptly named company "Fraud Guarantee":

[https://www.law360.com/articles/1311477/giuliani-allies-
char...](https://www.law360.com/articles/1311477/giuliani-allies-charged-over-
fraud-guarantee-co-scam)

------
rococode
Have VCs started skimping on DD because problems come up so rarely? Lightspeed
(who led the last round for these guys) isn't a no-name firm, they invested in
Snap, GrubHub, Telegram, etc. Surely they have the experience to find out
gigantic major problems like this? This feels like something that should've
come up in diligence before they sent them 120 million bucks... There are so
many places it could've shown up or at least been hidden in a way that
should've raised some flags.

~~~
elliekelly
What’s absolutely stunning to me is the (former) CEO quote in the article says
the company was under SEC investigation for fraud as early as November of last
year. And given that the DOJ complaint alleges the fraud occurred between
January 2019-February 2020 I would be inclined to believe it. (Fraud doesn’t
tend to just stop of it’s own accord.)

So was the investigation disclosed to Lightspeed and they decided to invest
anyway? Who on earth would invest with someone currently under investigation
for a scheme to defraud investors? And if it wasn’t disclosed, why not? Did
that not come up at all during due diligence?

~~~
yesbabyyes
In this case the due diligence, while quite due, perhaps wasn't very diligent.

------
legerdemain
Interesting. They reached out to me on TripleByte last year: remote position,
rather high cash comp for a startup, and no coding or whiteboarding as part of
the onsite!

~~~
whycombagator
They were on SO (Stack Overflow) jobs too, one of the postings was for up to
$250k remote IIRC. It was for a principal engineer position with experience in
java & k8s. Their lower engineering titles on SO jobs were decent salaries too
(mid-late 100s I think).

------
pstoica
Ex-employee here. Adam Rogas is a pathological liar and sociopath who dragged
this out for years. I don't know how multiple audits failed to raise red flags
over multiple $999,999.99 fake Stripe payouts. He literally inserted millions
every few lines that didn't match up with the data around it. They never asked
anyone else to produce the same report. Everyone involved should never be
responsible for this amount of money again (looking at you, Lightspeed).

If your CEO is actively siloing all financial and customer information, your
entire company needs to speak up and get on the same page. Don't let this
happen to you.

~~~
wakeywakeywakey
Why did you choose not to blow the whistle?

~~~
pstoica
I didn't have all the information that's coming out now. People tried. Read
the article. The last investment was finalized days after someone raised
concerns after realizing we didn't contact 70% of our customers.

~~~
wakeywakeywakey
The details of your post go beyond those mentioned in the article. Could you
provide additional links?

~~~
pstoica
I was someone at the bottom of the totem pole who tried to do my job and ask
what questions I could. I certainly noticed a lack of analytics or basic
traffic/revenue/customer data. Retroactively, it was obvious that this was
essentially a fake job, but I couldn't piece this together and there wasn't
enough company-wide transparency.

The fake financial statements were publicly released:
[https://www.justice.gov/usao-sdny/press-
release/file/1317641...](https://www.justice.gov/usao-sdny/press-
release/file/1317641/download)

~~~
edm0nd
How much were you being paid a year to do basically nothing?

~~~
pstoica
Decent salary, but that's not the point. I'm distraught to realize I spent 5
months on nothing, and it's not something I'm proud to have or explain on my
CV. It's cruel how much money these people throw away, but we were misled into
thinking it was real. I wouldn't have taken this position to support such a
scumbag.

~~~
CatShitTodd
What is cruel is I am having to file bankruptcy because of this.

~~~
NationalPark
Were you an investor?

~~~
CatShitTodd
No, not an investor. Without giving a way too much, we are a company in the
technology space. They paid us a fee per user. They paid us fees based on
these fake numbers of users that they submitted to their investors. Which
means they essentially over paid us what is a lot of money for our small
company. We made business decisions around that money in the past and for the
future. Now it looks like that not only will we get no more money, but they
also want like 90% of what they paid us back.

------
donor20
This is a bit of an interesting and somewhat unusual situation.

In most cases, your finance team (internally) will be the one to pick up on
the fact that stuff doesn't make sense.

They won't be able to tie the invoices to subsequent payment to get an
accounts receivable schedule to show who still owes what.

They won't be able to get the stripe reports / merchant clearing disbursement
reports to agree to the GL clearing accounts.

It's also rare for the CEO to have the only access to bank statements. Fraud
risks are often higher in finance team, as they are the ones who catch
problems elsewhere, but can be hard to catch problems with them.

This make me wonder how experienced the startups accounting team was.

------
dboreham
Hmm. The bank statements seen by the finance dept. came from the CEO??? How do
the "finance dept" not know that's an indication of fraud??

~~~
dannyw
The more pressing question is how they passed an audit by EY?

~~~
zrobotics
Considering wirecard, I'm thinking that an Ernst-Young audit isn't all that
hard to pass. My question is, at what point does engaging EY become a negative
signal?

------
rmason
If you're a VC firm shouldn't the amount of due diligence you do increase with
the amount of money you're investing? Or was their investigating capacity so
poor that it's a miracle they weren't cheated before?

Or are there other startups they've invested in that just haven't been found
out yet? If I was one of their LP's I'd be asking some hard questions.

~~~
heartbeats
No, it should decrease. If you're a gazillion dollars deep, your best
incentive is to cover up the fraud and try to dump it on someone else.

------
throwawayYeah
TNot surprising. he co-lead on this deal was the company I work for
(insurance). This doesn t surprised me as our VC arm sometime is ego driven.
Being a strategic VC they have to follow the gut feeling of board member with
limited due diligence. We often worry with teamates about the VC arm
investment (Serie B into Iot backed in blockchain jewelery kind of deal). The
team also like to take famous SV investor content and republish it internally
as own. this bit us a few time when a C suit tweet a congratulating message on
great content from our firm like 'software is eating the world'. The irony
here is that we are an insurance company, we should know how to prevent
fraud...

------
neallindsay
Ah–it was supposed to be an anti-fraud startup, not a fraud startup.

~~~
redisman
Common mistake

------
threetimesy
Same thing the former CEO of HeadSpin has reportedly done.

------
dyeje
Huh, I interviewed with these folks a few years ago. The interview process was
quite odd, guess I dodged a bullet.

~~~
bredren
How was it odd?

~~~
dyeje
Phone screen was super short, like 5 minutes. Followed by a vague exercise to
create a tracking service without a database (wat?). Then there was like 2
weeks of back and forth emails for scheduling for a review until they said
they needed someone with "stronger programming skills".

------
peter_d_sherman
Cursorily examining this company's web page:

[https://www.ns8.com/en-us](https://www.ns8.com/en-us)

It seems to me like this company's base value proposition, that is, for any
company's monetary transactions with customers, give that transaction a risk
assessment score based on whatever data about the customer is available.

That, in its simplest, most elemenatary, most basic form, is a good value
proposition.

Companies would find value in software which could deliver that proposition (a
related idea that comes to mind is if PayPal decoupled their fraud prevention
software, and sold that software to businesses separately, then that software
would deliver an equivalent value).

So the base value proposition of this company (assuming their software
actually works) -- is a valid one.

What seems to have done this company in, however, (if the article is to be
believed) is accounting fraud, which may have been preceeded by lack of
customers, lack of revenue or expected revenue.

It's always an interesting question to me (correlation vs. causation-wise) if
lack of sales triggers accounting fraud, or if accounting fraud just sort of
happens on its own...

You know, here's an idea for the FBI or other related investigative agencies
-- you could, based on previous cases, create a list of "risk factors", each
of which would count towards an overall "risk score" \-- of something being
seriously wrong at a company.

Such factors would include, but not be limited to: How much debt a company has
to investors, how much revenue is it making relative to that debt, what is its
growth rate, what is the age of the CEO, what industry is it in, etc., etc.

Grab all of that data, from all companies, run it through a machine learning
algorithm, get a "risk score" for each and every company, then if you have
nothing better to do (free time between other investigations), start
investigating the companies with the highest "risk scores". <g>

You know, you might call it "Cyber Fraud Detection Software" \-- for large
companies... <g>

Then if that works well in the U.S. -- give the software (for free!) to all
other countries!

Also, the same set of ideas and Machine Learning -- could be used to track
wasteful government spending (foreign and domestic), or wasteful spending of
so-called charitable organizations...

The possibilities are truly endless!

------
tehwebguy
Now do WeWork

------
fluffernutter
I had an FBI agent tell me they were at capacity for investigating new fraud
and that, unless someone was going to die, they couldn't take on new cases.
This was 2 years ago.

------
bfuclusion
If anybody wonders what 'irony' means, this is it.

------
Andrew_nenakhov
To catch a criminal, one must think like a criminal.

------
sbpayne
Instead of fitting the product to the market, he tried fitting the market to
the product

------
alphachloride
If you can't beat 'em, ...

------
garysahota93
This irony is what exactly what I needed on a Friday.

------
codegeek
Innocent before proven Guilty but I have to say seeing all these CEOs being
charged with Fraud is why there has been so much noise against Capitalism as a
whole and CEOs get a bad rep by default. There are so many of us (working our
butts off in the background without public stunts/investors etc) and then
these idiots spoil it. Being a small bootstrapped CEO myself, I am always
concerned about being as honest as possible with our customers and then you
have guys that are doing crazy shit. Funny thing is they mostly get away with
it too. Sad world.

~~~
dannyw
The number of CEOs charged for fraud seems pretty small to me.

~~~
fuzzfactor
The smaller number could be a stronger indicator that many more are getting
away with it.

