Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
CEO of Cyber Fraud Startup NS8 Arrested by FBI, Facing Fraud Charges (forbes.com/sites/davidjeans)
266 points by lxm on Sept 18, 2020 | hide | past | favorite | 157 comments


Being an executive at a (substantially smaller) SaaS startup I have no idea how having up to 90% of your revenue be fabricated could happen without others knowing:

- where are the contracts corresponding to revenue? Yeah they are SaaS focused on SMB but this is a financial product, there will be contracts, NDAs, etc

- if the majority of the customers are fake there is such little load on the system. How does engineering not figure that out?

- How does no one see an insanely low COGs when paying the cloud services bills, or the lack of allocated resources when looking in the management interfaces?

- Even saas Products with supposedly a no touch sales process still have sales people and sales engineers for key accounts. What are all the sales people doing if they’re not running trials?

- let’s say he hid all of this by having tens of thousands of $10 a month customers. How does your VP of sales not get totally freaked out that the overwhelming majority of revenue is coming from no touch sales? If that’s the case that radically changes your growth and go to market strategies. The entire go-to- market team should be wondering what is going on? Same with product management. Your roadmap would be completely different with a long tail of extremely low revenue customers.

- how does sales/client success not notice that no one is expanding? How they aren’t talking to small customers about expansions?

- How does no one notice a complete lack of analytics or actions being generated by all the supposed customers?

- product management is going to want to get feedback from all of these customers. They’re going to be looking in analytics tools or session replay tools like fullstory. They’re going to look at the accounts and users and do outreach to emails asking for meetings. Aren’t they going to notice all of those people are fake?

- support/client success is going to have insanely high customer to support person ratios. Where are all the support tickets for that many customers?

- Managing cash flow would be very hard. Finance is going to see all this revenue coming in and want to scale. The VCs are going to want to see money being spent on marketing activities etc. to further the growth. If there’s no corresponding revenue being spent to acquire customers but tons of revenue coming in that’s a giant red flag


None of it makes sense in the context of a well-run business with proper executives in place. That’s because these frauds don’t operate like a well-run business.

Usually, the upper management teams are extremely lean. The business is broken up into different silos such that few people can see the big picture. Each is led to believe they are a tiny fraction of the overall revenue, giving them the impression that the bulk of the company’s revenue must come from another department where they have no visibility. As a bonus, this motivates siloed teams to feel like they need to catchup to the rest of the company, when in reality they might be the main driver of it. It helps to have separate offices and a culture of secrecy to prevent people from comparing notes.

The CEO positions himself as a controlling, micromanaging individual at the center of everything. This makes it possible for the CEO to intercept financials and other crucial numbers en route to people who might catch on.

The rest of the management staff might be filled with people too inexperienced to recognize that something is wrong. They might think the CEO is doing them a favor by giving them a golden opportunity to advance their career into an executive position at a rocket ship startup. They don’t know what they’re doing, but they think it’s okay because the CEO has taken them under his wing.

At scale it becomes difficult to do this without at least a few people being complicit, though. A fraudster usually has several close associates who can be trusted to be in on the fraud or at least look the other way for a while.


Sometimes tribal/"team sport" group dynamics keep employees inline too. Executives can foster an "us against the world" mentality that blinds workers to that which is obvious to everybody else. When in this mindset, people have the ability to ignore even the most damning evidence.

Here's an example: When Enron's CEO verbally attacked wall street analyst Richard Grubman for questioning Enron's accounting practices, Enron employees thought this was hilarious and adopted the insult as a sort of inside joke. They didn't consider Richard Grubman's position, they just took delight in 'their team' dunking on 'opposing team.'


This is massively scalable. There are examples, but I do not want to get political.


Leaving aside the specific politics, this is one of many reasons I advocate for replacing voting with sortition (picking representatives from the electoral roll, in much the same way as juries are picked).


> but I do not want to get political.

The question I keep asking myself is, if not now, then when?


See also: Theranos.


This reminds me of why traders are required to take vacation - it may be the only time their scams are unraveled.

https://www.newsday.com/business/columnists/help-wanted-carr...


When done right the vacation is sprung on them without notice. In reality they usually know when their vacation is coming so they can alert their cohorts.


The idea is everyone must take vacation (sometimes X+ consecutive days each year), not just the people you suspect of running scams.

Giving all of your employees two weeks unannounced vacation at random times is a disruptive way to run a company. It's certainly innovative but I wouldn't say it's HR "done right".


You have to take at least half you annual vacation starting tomorrow. Have fun!

Yeah. That doesn't work. Forcing the same thing in a scheduled way may be a bit of an imposition but isn't unreasonable in general.


Doing so in an unscheduled way is beneficial for similar reasons you want to test when services go down in controlled circumstances. https://en.wikipedia.org/wiki/Chaos_engineering

Large companies simply have different risks. If someone quitting randomly is a huge risk for your business you want to know about it ahead of time to mitigate it while they still work for you. 1 random week of vacation every ~3 years shouldn’t be a big deal, and discovering it was is valuable.


If you want to give me an unscheduled couple of weeks off with pay, I'm perfectly cool with that--so long as you don't hold it against me that work doesn't get done. Don't expect me to take it out of my limited planned vacation time though.I have my own plans. That would be a big FU for me.


Sure, so maybe that is a sign that trading isn’t the right industry for you?

I know firefighters often work 72 hour straight shifts. For a similar reason, I know being a firefighter isn’t the right career for me.

I suspect some jobs need to optimize days off for things other than employee happiness. For trading specifically, they can generally make up for it with above average pay.


Fair enough. If you know the deal going in--e.g. you get 3 weeks of paid vacation but we will tell you when you have to take one/two of them with no notice. Certainly there are many jobs that have to schedule people, e.g. support, although there it's mostly about having to schedule well in advance and possible having to work at popular times. I am indeed fortunate to have a lot of flexibility.


Bingo! I worked in the upper management team of an early stage startup where the CEO was lying through his teeth to investors as well as employees. There were only three people at the top level. He was a super charismatic guy and a great story teller. No one thought he was lying until it came time to raise the next round and the lead investor from seed round ran due diligence to find booked revenue was no where close to what CEO had been claiming.


> No one thought he was lying until ...

I wonder what happened after that? Could he continue working as if nothing special, just failing to raise money?


I can't imagine that first seed investor wouldn't press charges and file a lawsuit.


Agree, this being a cyber-fraud company I believe one could keep a team busy for a long time focusing on building secure systems rather than operating them to the point where no-one gets to see what's actually being stored within. The paper trail though I'm still puzzled about, he couldn't have acted alone.


Fun thought experiment: are there businesses where this structure is beneficial, or is it always a red flag?


In the past, traders were siloed and no individual trader would have access to the total positions of all the traders on the floor. Some firms still operate this way, though it's more common for trading operations to be broken up into "pods" or teams of traders and analysts.

The industry has largely moved away from this structure for a variety of reasons. One of the problems is that traders start to try and undermine each other, since the only thing that matters is your personal pnl. Another problem is that traders can unknowingly all pile into the same investments, resulting in massive risk. This is part of the reason why the Great Recession was so bad.


Damn what a good reply. You must’ve been burned/seen some shit in the past.


This all too often happens at other companies, many times inadvertently without any fraudulent intention, just by being not well-run.

And even when they end up raking in the bucks, for the shareholders it's nothing compared to what it could have been.


it sounds easier and more lucrative to simply be honest.


How would engineering know what the CEO is telling investors?

I once had a (majority-share) cofounder CEO who, when the company hit success, became extremely controlling with the books and investor relationships. There was no way for the rest of the cofounders - let alone engineering - to know what was actually going on or what the true state of health of the company was. I (and the other cofounders, and the senior engineering staff) walked away. Big life lesson.

With lazy enough investors, it wouldn't surprise me that a CEO/owner could compartmentalize enough information that the employees and investors might have totally different understandings. The CFO would be suspect, though.


> I (and the other cofounders, and the senior engineering staff) walked away

I wonder what happened after that, how did you leaving affect the company


Have you seen $GSX, a publicly traded $20B stock on Nasdaq that claims it's growing faster than early Google or Facebook and has been the subject of 5-6 short seller reports and an ongoing SEC investigation?


Seems like the main research company that exposed GSX has made a business out of exposing Chinese public companies

https://grizzlyreports.com/research/

Some interesting stuff here.

The company of course refuted the research with some vague stuff about APIs having encryption so the data would be wrong. This was back in June and the stock seems to be still going along strong... http://gsx.investorroom.com/2020-06-03-GSX-Refutes-Grizzly-R...


Muddy Waters got a report on GSX too.


PE ratio of over 500... oof


It is difficult to get a man to understand something when his salary depends upon his not understanding it.


Where was the board during this whole time? I have trouble understanding how a board allows a management team to operate in such a way that controls aren't in place (eg basic segregation of duties in finance) that would prevent or at minimum reveal this kind of behavior. The board should be seeing enough information that most of the flags you highlight should be visible to them. Not to mention, clearly the company was never audited. Regular audits should be standard practice for any company of that size. In any case, it will be interesting to see what consequences there are for board members that appear to have failed in their basic responsibilities.


I’ve been in board meetings with top tier, very well known VC board members where the CFO basically showed them the CEO was lying to them. The next two meetings the finance guy wasn’t allowed to present and then he quit. The board members never looked into it. It was like they didn’t want to know.


> Regular audits should be standard practice for any company of that size.

The company was audited twice, but the auditors tied the fraudulent bank statements to the fraudulent financial statements (woops).

> In any case, it will be interesting to see what consequences there are for board members that appear to have failed in their basic responsibilities.

Full cooperation with the SEC can get you a long way, especially if you're one of the victims of fraud.


Are you sure they were audited? I havent seen that in the material released so far, only that an auditor was engaged for due diligence, which was fairly cursory, not anywhere near an actual audit. Typically an audit would involve a direct verification of bank balances from the bank. In addition, an audit would typically directly verify customer contracts and make sure big deposits tied out to contracts and invoices. An audit would also have flagged the lack of segregation of duties as a major risk factor (though that should have been obvious to any board member). As a side note, I also wonder if Rogas was fastidious enough to ensure the GAAP financial statements all tied out with the fraudulent numbers.

I guess if an audit couldn't catch this, you have the wrong auditor. This is exactly what audits are for.


Read the DOJ filing, linked in a comment below. The auditor physically sent a person on site whose job was to watch the financial people log into the banks web interface, verify the balance, and print bank statements for the last 12 months, all in front of the auditor. The passage doesn’t make it clear why the auditor didn’t watch the ceo pull the records for the accounts receivables account

Update: filing Is here: https://www.justice.gov/usao-sdny/press-release/file/1317641...

Relevant Passage: “As part of its due diligence process, the Audit Firm had an employee (the “Auditor”) conduct a physical site visit at NS8’s offices in Las Vegas, Nevada. The Auditor was directed by a more senior Audit Firm employee to have someone from NS8 log in to the online portal for each NS8 bank account, display the current account balance, and download monthly bank statements for fiscal year 2019.”

“Based on my interview with a member of the NS8 finance department (“Finance Employee-1”), I have learned, among other things, that on or about March 11, 2020, Finance Employee-1 and ROGAS met with the Auditor in ROGAS’s office. The purpose of that meeting was for ROGAS and Finance Employee-1 each to log into the online portals for the bank accounts to which they had access (for ROGAS, the Revenue Bank Account) and download monthly account statements for the Auditor. During that meeting, Finance Employee- 1 logged into the online portal for the Expense Bank Account -- to which Finance Employee-1 had access -- and downloaded monthly account statements. Finance Employee-1 understood that ROGAS was doing the same for the Revenue Bank Account during the meeting”


You're correct, my understanding of "full audit" vs "due diligence" was off.


Yes - this is the directors’ fault. As a director you have n obligation to ensure everything is ok, and for issues of this magnitude it’s clear that the directors were bamboozled. at our firm we insist on access to the financial system (e.g. Xero) whenever we have a directorship. It’s hard to fake results, at least to this level, when we can see down to the level of individual invoices.


- where are the contracts corresponding to revenue? Yeah they are an SMB SaaS but this is financial, there will be contracts, NDAs, etc

SMB, especially the small end of SMB, does not often have contracts. It's more subscription based. That said, there were 2 versions of the software running at NS8. One was the original software that Adam Rogas and a co-founder created early on. That version was rather "opaque" and reported growing customer numbers every month. The newer version of the software was controlled by the product dev team but still reliant on the original software in some key areas. Basically, everything was obfuscated well enough to confuse everyone to the point where answers of, "it's a limitation of the original software" were taken at face value.

- if the customers are fake there is no load on the system. How does engineering not figure that out?

There were real customers and the customer growth was happening, especially in 2020. The problem is that the customer base and growth was nowhere near what Adam Rogas was cooking up on the backend.

- How does no one see an insanely low COGs when paying the cloud services bills, or the lack of allocated resources when looking in the management interfaces?

COGs and other bills were kept relatively high. It's also why the company hired 200+ people, to make the story all the more believable.

- How does no one notice a complete lack of analytics or actions being generated by all the supposed customers?

Again, real numbers were difficult to gather for excuses given repeatedly by Adam Rogas and others charged with providing those numbers. I'm not saying that others were complicit in the scam, but that they were (at least) being fed the same excuses the rest were. Investments were never made to bring visibility to the customer metrics. Was this a red flag? Yes, but then why are investors giving NS8 so much money? It's hindsight 20/20.

- Managing cash flow would be very hard. Finance is going to see all this revenue coming in and want to scale. The VCs are going to want to see money being spent on marketing activities etc. to further the growth. If there’s no corresponding revenue being spent to acquire customers but tons of revenue coming in that’s a giant red flag

Right, so plenty of money was being spent across the board. There were 2 bank accounts according to the DOJ and SEC complaints. The account for "customer revenue" was solely controlled by Adam Rogas. The other account held the investment funds that paid all the bills. Is this super shady? Yep. And it seems there was an NS8 whistleblower who kicked off the initial SEC investigation and then the FBI getting involved as well.


Obviously something terribly shady is going on here. I’m not disagreeing with you, I just don’t understand how any director level position, let alone an executive, wouldn’t be able to see serious irregularities if such a significant percentage of revenue was phony. There are just way too many knock-on effects when the overwhelming majority of your customers aren’t real, aren’t paying you, and aren’t putting any load or impact on any of your other systems (technical or otherwise). That is some bullshit clown shoes management across the entire company right there

And the CEO or others saying “oh yeah you can’t see all those customers and growth because they’re in this old legacy system that doesn’t report it” is an insane excuse to buy. Holy shit you mean to tell us that the majority of our most important revenue is coming from a legacy systems that we have zero insight into? And it’s continuing to grow? Why aren’t those people on the new system?

> “customer revenue” account controlled solely by the CEO

I cannot fathom a VP of Finance, let alone an outside accounting firm, that would be OK with this arrangement of accounts.

Edit: To be clear I’m not trying to blame the victims. This is a terrible loss to all the employees who have been pouring so much of their efforts into the company. I just am having a hard time understanding how such a thing could happen. Maybe I’ve just been blessed to work in extremely transparent organizations.


>> “customer revenue” account controlled solely by the CEO

> I cannot fathom a VP of Finance, let alone an outside accounting firm, that would be OK with this arrangement of accounts.

Right? Then again, EY audited everything and gave those fake bank statements the "thumbs up" as part of the last round of funding and due diligence on the part of the investors. Crazy.


Wasn't EY also the firm who audited Wirecard? Why is anyone taking their audits seriously?

https://markets.businessinsider.com/news/stocks/ey-chairman-...


EY were also the ones that audited and passed WoSign and StartCom SSL CA's that were fraudulently issuing bad certs and violating CAB regulations.


When I was a young and naive c-level exec (CTO), the CEO of the company was lying about the numbers to investors and everyone else, but neither me or the coo noticed as we thought it was not our concern; we were doing our jobs which was not finance. While the judge gave us a slap on the wrist only when the company suddenly turned out to have no money, he said it was definitely part of our job to at least validate the numbers. But I know enough people now who will say it is not their job and if the ceo signed off, it is enough for them. So I can see it happen. We had clients (big ones) and we were just not privy, nor interested to be fair, to the contract size. The changes were things like 800k$ product sale heightened to 1.8m etc which was not really unlikely to us or investors. We should have checked...


We can't fathom it either!


"if the customers are fake there is no load on the system. How does engineering not figure that out?

There were real customers and the customer growth was happening, especially in 2020. The problem is that the customer base and growth was nowhere near what Adam Rogas was cooking up on the backend."

This doesn't really answer the question. The article states 40-90% of customers were fictional, as a cloud architect I would have to design based on the number of customers ++ and of course I would setup monitoring and alerting with auto scaling and it would be blatantly obvious that my utilization was not going up and that would turn into an engineering investigation.

Would it leed me to the idea that most of our customers were fake? probably not. They might not even request additional capacity, but as a architect that would lead me to ask questions. For example after an announcement or company meeting where they announce the number of new customers, I would wonder wtf? How is it that we haven't added any more capacity for all these new customers?

I would see some red flags and I would like to think I would be smart enough to start looking for something new but I haven't been in such a situation thankfully.

It's difficult to read about 200 ppl being laid off and the impact on them and thier family all bc of one stupid, greedy person.


> For example after an announcement or company meeting where they announce the number of new customers

Nothing like this ever happened, AFAICT

> I would see some red flags and I would like to think I would be smart enough to start looking for something new but I haven't been in such a situation thankfully.

"Brazen fraud" is not where Occam's Razor leads in this case. "Transparency growing pains" seems much more likely. Specifically - if working for this company I would raise concerns that there aren't KPIs being regularly tracked across all functions. I'm sure it's possible that some of the newly hired senior management was working on this.


Reminds me of DC Solar, and they claimed to make physical products...

You'd think some folks working from there would wonder "Hey, does anyone KNOW anyone else working at the other factories, because we're only making X per day..."?


I was wondering the same thing. I can see 5 or 10% slipping under the radar, but 90%? What were these 200 employees even working on?

Engineering would be the most distant from customers, I guess, but even they must've noticed how few bugs were coming in.

Hard to believe it wasn't found out earlier.


People see what they expect to see. This could be accomplished by lying at every step of the way and by fabricating audit results. It lasts until it doesn't, and that's apparently what happened here.


You can fake everything. And most people don't expect this.

Wirecard opened a fake Bank Branch from a Philippines Bank in Singapore, had the EY guys walk in there and "verify" the Billion dollar balance on the computer screen.


> How does no one see an insanely low COGs when paying the cloud services bills, or the lack of allocated resources when looking in the management interfaces?

Big data and a flawed system. They sell a service that is based off of using integrations. If you stop paying for the integrations, you should stop receiving the service. That in turn hurts their level of service offerings.

To be of any value, they have to monitor a ton of transnational data. So even if you quit paying, they still monitored your data and their modules were flawed that is still showed their acceptance score if you stopped paying.


A serious question - if I may. Where do you work? Sounds like a great company.

If you cannot respond - totally fair :)


Because the larger startups are driven by people who know financial engineering... this guy got caught because the money stopped (due to layoffs).

Noone gives a shit when they're getting paid.


Nope. He got caught when it was discovered that the "customer revenue" bank account was being manipulated to look like tens of millions were in there when it was more like tens of thousands.

The other bank account had tens of millions in there thanks to the investment money.

The layoffs came once the board faced the truth of the matter and Adam Rogas suddenly resigned.


Okay, if that's the order, then yeah, someone should have said something.


My guess is that anyone who ended up "saying something" to the CEO was either quieted by lies or forced out of the business.


I feel sorry for any CEO who actually steps down to spend more time with his/her family. That explanation has now more or less been completely co-opted by "Our CEO got caught in an embarrassing scandal and they need to fade from the public eye for a bit." I now assume that anyone who gives that reason on their way out must have done something terrible that is yet or about to come to light.


It’s like Thiel’s point about how monopolies always talk about the open market and small fish talk about being a monopoly. In this case, if you’re actually stepping down to spend time with family, you say “I’m looking for my next challenge.”


Our company recently had two executives leave to "pursue other opportunities". I saw an announcement from another company about one of them, but not the other one. I wonder if they are "spending more time with their family"


This recently came up when Kellyanne Conway stepped down. She said it was to spend more time with her family, no one believed her, but all evidence points to it really truly being the case. Her husband also stepped down from his job and her daughter stopped tweeting about how much she hates her parents.


That’s a bit of a unique case; they had very publicly visible family issues.


Exactly, that's the only reason anyone believes her at all. If not for their very public issues, I don't think anyone would have believed her.


If the issues hadn't been made pubic she wouldn't have stepped down at all.


I am not sure she ever liked working for trump. It is weird that she chose to anyway.


A lot of CEOs step down with no drama! I think most people only think "scandal" when there's already a related scandal... I can't think of any CEOs/execs who have stepped down with suspicion without any other indicators of a scandal.


The reason that euphemism flies is because of the truth behind it: people regularly make life changes to prioritize family life. The other 99.9% of people who cite this reason for change will drown out the minority that use it as a euphemism for getting caught doing bad things.


"I now assume that anyone who gives that reason on their way out must have done something terrible that is yet or about to come to light."

Maybe you should think about that a little bit more if you really feel sorry.


Hmm, what do you have when you've got a fraudulent executive buried up to his neck in sand?

And everyone who should do something about it having their heads buried?

A. Misplaced sand.


LOL, if I ever make it at that level, my explanation for wanting to spend more time with my family will be "wanting to spend time with hookers"


When you've invested that much into something you're not very likely to suddenly decide to make that sort of strategic blunder for giggles.


You must really not know me (or a lot of people).


The people who would say something like that are also unlikely to not say something long enough to get to such a position.


Most of the value hookers bring to the table is not having to spend time with them to get what you want.

Your comment makes little to no sense.


An auditor was fooled while he was in the room watching while the ceo downloaded bank account statements (pages 10/11 of https://www.justice.gov/usao-sdny/press-release/file/1317641...):

  d. As  part  of  its  due  diligence  process,  the  Audit  Firm had an employee
     (the “Auditor”) conduct a physical site visit at NS8’s offices in Las Vegas,
     Nevada.  The Auditor was directed by a more senior Audit Firm employee to have
     someone from NS8 log in to the online portal for each NS8 bank account, display
     the current account balance, and download monthly bank statements for fiscal
     year 2019.
  
  e. Based  on  my  interview  with  a  member  of  the  NS8 finance department
     (“Finance Employee-1”), I have learned, among other things, that on or about
     March 11, 2020, Finance Employee-1 and ROGAS met with the Auditor in ROGAS’s
     office.  The purpose of that meeting was for ROGAS and Finance Employee-1 each
     to log into the online portals for the bank accounts to which they had access
     (for ROGAS, the Revenue Bank Account) and download monthly account statements
     for the Auditor.  During that meeting, Finance Employee-1 logged into the online
     portal for the Expense Bank Account -- to which  Finance Employee-1  had  access
     -- and  downloaded  monthly  account statements.  Finance Employee-1 understood
     that ROGAS was doing the same for the Revenue Bank Account during the meeting.
  
  f. Late in the evening on or about March 11, 2020, the Auditor  emailed  another
     employee  as  follows:    “Attached  please  find the bank statements and
     screenshots that I observed [Finance Employee-1] and Adam [ROGAS] download this
     afternoon.”  Attached to  that  email,  among  other things,  were  the
     Fraudulent  Bank  Statements for the Revenue Bank Account for the period from
     January 2019 through February 2020.


The whole concept of "have someone from NS8 log in to the online portal for each NS8 bank account, display the current account balance, and download monthly bank statements for fiscal year 2019." seems kind of weird and even ridiculous.

In the audits I've seen, the standard procedure to get the same information would require the company to authorise the auditors so that they could get a written confirmation of the funds directly from the bank or whoever holds the assets or debt. You would not trust the account statements that the company gives you, you would get the same (hopefully) account statements yourself. Accepting that watching a company employee log in some site is equivalent to getting an official confirmation from that outside third party is .... interesting. The whole point of an audit is to verify if everything that the company shows you is actually true instead of looking at what they show you and believing it.


Thanks for the link - interesting reading. It looks like he modified the PDFs from the bank which is pretty sneaky, since most people assume PDFs are inviolable (this topic has come up on HN before). In my experience, auto-generated PDFs from reporting systems are fairly easy to manipulate (for the record, I have only done so for automated data extraction, not to change the document!).


Sounds like they might have used the CEOs computer and perhaps he has a modified PDF report ready, downloaded the actual report but provided the altered version.

Agree with the other comments, the auditor should get the reports independently or use their own laptop to login/get the report.


> It seems ironic that the co-founder of a company designed to prevent online fraud would engage in fraudulent activity himself

I don't find that ironic at all. Having worked in the security space for a long time, it seems like the best people in the business are the ones who would be great at committing the crimes if not for their own morality.

Someone with a weak sense of morals could easily turn to evil.


One of Terry Pratchett's Discworld novels features a thief being deliberately put in charge of the Royal Mint.

https://en.wikipedia.org/wiki/Making_Money


A few years ago, it was discovered that the head of the Royal Coin Cabinet of Sweden, a museum with one of the world's largest coin collections worth almost $3 billion USD, had been stealing and selling historical coins worth a fortune. Kind of the opposite, really.

There's a three part documentary series here (Swedish): https://www.svtplay.se/guldfeber-stolderna-pa-kungliga-myntk...


Frank Abagnale has worked for the FBI for 40 years now. He still has an Ego, but he has turned down several offers of pardons for his past crimes and is now very much on the light side of the force.

https://youtu.be/vsMydMDi3rI


"Having worked in the security space for a long time, it seems like the best people in the business are the ones who would be great at committing the crimes if not for their own morality." Well and truth be told none would know so maybe they are doing it ?


Agreed.

It reminds me of all those bogus security/antivirus apps on the Google Play store that harvest more user data than any virus ever could.


Well, it is a cyber fraud startup. They didn't lie about that.


Reminiscent of Jesse's advice to Walt about a "criminal lawyer".


Also reminiscent of the aptly named company "Fraud Guarantee":

https://www.law360.com/articles/1311477/giuliani-allies-char...


Yeah I first read the article wondering if cyber fraud was their business model.


Have VCs started skimping on DD because problems come up so rarely? Lightspeed (who led the last round for these guys) isn't a no-name firm, they invested in Snap, GrubHub, Telegram, etc. Surely they have the experience to find out gigantic major problems like this? This feels like something that should've come up in diligence before they sent them 120 million bucks... There are so many places it could've shown up or at least been hidden in a way that should've raised some flags.


What’s absolutely stunning to me is the (former) CEO quote in the article says the company was under SEC investigation for fraud as early as November of last year. And given that the DOJ complaint alleges the fraud occurred between January 2019-February 2020 I would be inclined to believe it. (Fraud doesn’t tend to just stop of it’s own accord.)

So was the investigation disclosed to Lightspeed and they decided to invest anyway? Who on earth would invest with someone currently under investigation for a scheme to defraud investors? And if it wasn’t disclosed, why not? Did that not come up at all during due diligence?


In this case the due diligence, while quite due, perhaps wasn't very diligent.


Based on other comments, NS8 was audited by Ernst-Young and passed. So they had an expert do an audit and find no issues.


>Ernst-Young

Wirecard's long-time auditor!


This is because who pays for Due Diligence... if you are paying you can influence it. I'd love for there to be a firm that did a 50/50 escrow for DD.


The VC firm pays for their own DD. Certainly if they are leading the round.

Initial meeting-> NDA -> some due diligence -> letter of intent/term sheet (depending on the transaction) -> 30-45 days of very deep due diligence.


I’ve heard this as a rumor, yes.


Interesting. They reached out to me on TripleByte last year: remote position, rather high cash comp for a startup, and no coding or whiteboarding as part of the onsite!


They were on SO (Stack Overflow) jobs too, one of the postings was for up to $250k remote IIRC. It was for a principal engineer position with experience in java & k8s. Their lower engineering titles on SO jobs were decent salaries too (mid-late 100s I think).


Yeah I saw them super active on triplebyte and angel.co a-list. I got pretty far into the interview; lucky I dodged a huge bullet!


Ex-employee here. Adam Rogas is a pathological liar and sociopath who dragged this out for years. I don't know how multiple audits failed to raise red flags over multiple $999,999.99 fake Stripe payouts. He literally inserted millions every few lines that didn't match up with the data around it. They never asked anyone else to produce the same report. Everyone involved should never be responsible for this amount of money again (looking at you, Lightspeed).

If your CEO is actively siloing all financial and customer information, your entire company needs to speak up and get on the same page. Don't let this happen to you.


Anyway folx, don't invest in a "hot startup" you've never heard of.


Do you know when the company/Rogas first came under investigation?


The SEC tried investigating since December 2019, possibly earlier. Again, public information.


Why did you choose not to blow the whistle?


I didn't have all the information that's coming out now. People tried. Read the article. The last investment was finalized days after someone raised concerns after realizing we didn't contact 70% of our customers.


The details of your post go beyond those mentioned in the article. Could you provide additional links?


I was someone at the bottom of the totem pole who tried to do my job and ask what questions I could. I certainly noticed a lack of analytics or basic traffic/revenue/customer data. Retroactively, it was obvious that this was essentially a fake job, but I couldn't piece this together and there wasn't enough company-wide transparency.

The fake financial statements were publicly released: https://www.justice.gov/usao-sdny/press-release/file/1317641...


How much were you being paid a year to do basically nothing?


Decent salary, but that's not the point. I'm distraught to realize I spent 5 months on nothing, and it's not something I'm proud to have or explain on my CV. It's cruel how much money these people throw away, but we were misled into thinking it was real. I wouldn't have taken this position to support such a scumbag.


What is cruel is I am having to file bankruptcy because of this.


That is super tough and stressing, sorry!

FWIW, I would wait on returning any money (or saying anything at all, really) + talk to a lawyer with experience in bankruptcy (their's + yours).

My guess is you can keep all/most of the $. They were fraudulent to you + the company is now evaporating. Sounds like you still need to pivot, but at least you can do so with $ in the bank and no black marks.


Not sure if you're being serious, but if you were an early investor, isn't it on you to make sure the business is legit? Anyone can be misled by a fraudster, but some responsibility lies with the VCs and angel investors throwing money at these companies and enabling this sort of thing to happen.


No, not an investor. Without giving a way too much, we are a company in the technology space. They paid us a fee per user. They paid us fees based on these fake numbers of users that they submitted to their investors. Which means they essentially over paid us what is a lot of money for our small company. We made business decisions around that money in the past and for the future. Now it looks like that not only will we get no more money, but they also want like 90% of what they paid us back.


Sorry to hear that. I dont know what the contract says, but I would be inclined to lawyer up and tell them to get stuffed RE the repayments.


Were you an investor?


No, not an investor. Without giving a way too much, we are a company in the technology space. They paid us a fee per user. They paid us fees based on these fake numbers of users that they submitted to their investors. Which means they essentially over paid us what is a lot of money for our small company. We made business decisions around that money in the past and for the future. Now it looks like that not only will we get no more money, but they also want like 90% of what they paid us back.


Man/Gal, that sucks! Keep your head up <3


Why would you? Even if you've got all your ducks in a row you've made yourself a target for media attention and lawsuits.


Why not? Anonymously demanding moral action from others makes me righteous and costs me nothing. =)


And how was the quality of product? Was it something breathtaking that it attracted $157.9M in funding?


Hell no, a $400 million valuation made no sense, but he kept feeding us these lies.


This is a bit of an interesting and somewhat unusual situation.

In most cases, your finance team (internally) will be the one to pick up on the fact that stuff doesn't make sense.

They won't be able to tie the invoices to subsequent payment to get an accounts receivable schedule to show who still owes what.

They won't be able to get the stripe reports / merchant clearing disbursement reports to agree to the GL clearing accounts.

It's also rare for the CEO to have the only access to bank statements. Fraud risks are often higher in finance team, as they are the ones who catch problems elsewhere, but can be hard to catch problems with them.

This make me wonder how experienced the startups accounting team was.


Hmm. The bank statements seen by the finance dept. came from the CEO??? How do the "finance dept" not know that's an indication of fraud??


The more pressing question is how they passed an audit by EY?


Considering wirecard, I'm thinking that an Ernst-Young audit isn't all that hard to pass. My question is, at what point does engaging EY become a negative signal?


If you're a VC firm shouldn't the amount of due diligence you do increase with the amount of money you're investing? Or was their investigating capacity so poor that it's a miracle they weren't cheated before?

Or are there other startups they've invested in that just haven't been found out yet? If I was one of their LP's I'd be asking some hard questions.


No, it should decrease. If you're a gazillion dollars deep, your best incentive is to cover up the fraud and try to dump it on someone else.


Same thing the former CEO of HeadSpin has reportedly done.


TNot surprising. he co-lead on this deal was the company I work for (insurance). This doesn t surprised me as our VC arm sometime is ego driven. Being a strategic VC they have to follow the gut feeling of board member with limited due diligence. We often worry with teamates about the VC arm investment (Serie B into Iot backed in blockchain jewelery kind of deal). The team also like to take famous SV investor content and republish it internally as own. this bit us a few time when a C suit tweet a congratulating message on great content from our firm like 'software is eating the world'. The irony here is that we are an insurance company, we should know how to prevent fraud...


Ah–it was supposed to be an anti-fraud startup, not a fraud startup.


Common mistake


Huh, I interviewed with these folks a few years ago. The interview process was quite odd, guess I dodged a bullet.


How was it odd?


Phone screen was super short, like 5 minutes. Followed by a vague exercise to create a tracking service without a database (wat?). Then there was like 2 weeks of back and forth emails for scheduling for a review until they said they needed someone with "stronger programming skills".


Cursorily examining this company's web page:

https://www.ns8.com/en-us

It seems to me like this company's base value proposition, that is, for any company's monetary transactions with customers, give that transaction a risk assessment score based on whatever data about the customer is available.

That, in its simplest, most elemenatary, most basic form, is a good value proposition.

Companies would find value in software which could deliver that proposition (a related idea that comes to mind is if PayPal decoupled their fraud prevention software, and sold that software to businesses separately, then that software would deliver an equivalent value).

So the base value proposition of this company (assuming their software actually works) -- is a valid one.

What seems to have done this company in, however, (if the article is to be believed) is accounting fraud, which may have been preceeded by lack of customers, lack of revenue or expected revenue.

It's always an interesting question to me (correlation vs. causation-wise) if lack of sales triggers accounting fraud, or if accounting fraud just sort of happens on its own...

You know, here's an idea for the FBI or other related investigative agencies -- you could, based on previous cases, create a list of "risk factors", each of which would count towards an overall "risk score" -- of something being seriously wrong at a company.

Such factors would include, but not be limited to: How much debt a company has to investors, how much revenue is it making relative to that debt, what is its growth rate, what is the age of the CEO, what industry is it in, etc., etc.

Grab all of that data, from all companies, run it through a machine learning algorithm, get a "risk score" for each and every company, then if you have nothing better to do (free time between other investigations), start investigating the companies with the highest "risk scores". <g>

You know, you might call it "Cyber Fraud Detection Software" -- for large companies... <g>

Then if that works well in the U.S. -- give the software (for free!) to all other countries!

Also, the same set of ideas and Machine Learning -- could be used to track wasteful government spending (foreign and domestic), or wasteful spending of so-called charitable organizations...

The possibilities are truly endless!


Now do WeWork


I had an FBI agent tell me they were at capacity for investigating new fraud and that, unless someone was going to die, they couldn't take on new cases. This was 2 years ago.


If anybody wonders what 'irony' means, this is it.


To catch a criminal, one must think like a criminal.


Instead of fitting the product to the market, he tried fitting the market to the product


If you can't beat 'em, ...


This irony is what exactly what I needed on a Friday.


Innocent before proven Guilty but I have to say seeing all these CEOs being charged with Fraud is why there has been so much noise against Capitalism as a whole and CEOs get a bad rep by default. There are so many of us (working our butts off in the background without public stunts/investors etc) and then these idiots spoil it. Being a small bootstrapped CEO myself, I am always concerned about being as honest as possible with our customers and then you have guys that are doing crazy shit. Funny thing is they mostly get away with it too. Sad world.


The number of CEOs charged for fraud seems pretty small to me.


The smaller number could be a stronger indicator that many more are getting away with it.


[flagged]


> And besides, who didn’t flex a slide or two to show future numbers how they hoped it will look instead of honest truth. If thats the case then DOJ has to come and knock at door of every Hacker News user, or any IT person in that matter.

Unethical people commonly state their belief that everybody else does as they do. This is self-delusion meant to assuage feelings of guilt.

Hence the proverb (which I understand to exist in numerous languages): A thief thinks every man steals.


This is simply not the case. Adam lied to everyone's face for years. Read the documents and financial statements if you think this is just a little "flex" every couple of slides.


it doesn't surprise me. i worked with him over 20 years ago when he ran hiphopsite.com, he was a shifty guy then.


I don't think every startup CEO is falsifying bank statements to show millions more in income to their own finance department and investors than they actually have.


We simply don't know that. That's what DOJ accuses him of - now we need to wait to hear his side of the story (and his lawyers), unless of course you believe in USA everyone is guilty without being proven of committing said crime?


A court has an obligation to do that, a random person on the internet has no such obligation.

Eventually it will be decided by a handful of random people’s opinions based on the evidence put forth. For


Something of a nitpick, but you can believe one person is guilty pre-trial without thinking everyone is - there simply needs to be enough evidence to pass your own burden of proof (there's no obligation on a person, outside of a jury, to uphold the 'beyond reasonable doubt' standard), or that you believe there is no room for reasonable doubt even at this stage.

A person unconnected to the case commenting online has far less of an impact than a court with the power to impose criminal sanctions, so using a lower standard of proof isn't particularly harmful.


> its so easy to proof he deceived investors because well he doesn’t have any numbers to show

There is a huge difference between saying "we're killing it" while you're hustling, highlighting bookings because your revenues suck, sending invoices early to bring up revenue, on one hand, and forging bank statements. The former move from almost expected to borderline behaviour. The last is simply fraud.


Most people would call that "lying", "unethical", and probably "stupid."


Citation(s) needed


Take your libertarian dreams to international waters. Regulation exists to create opportunity, not destroy it. Unless you have facts to back up your claims, don't spread misinformation.


Their position isn't Libertarian.

I'm a Rand quoting free market extremist, and I'm A-OK with this guy going to jail for fraud. Fraud is, after all, morally equivalent to physical coercion.

On a related note, most people who heap scorn on Rand seem to have missed the fact that many (most?) of the major villains in Atlas Shrugged are corrupt businessmen.

Hang 'em high.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: