Corporate
Spotting shell-company laundering
Layered invoices to entities with no website, no employees, and a shared registered agent are the most common red flag.
Public Education
Learn the patterns. Prevent the next case.
The clearest defense against fraud is a public that knows what it looks like. These primers are distilled from the last four years of Doaf casework.
Field guides
Crypto
Auditor capture in crypto
Look for attestations that confirm reserves without confirming liabilities. Reputable firms always disclose both sides.
Government
Procurement steering
Recurring sole-source awards to a single vendor — especially below the public-bid threshold — should trigger review.
Banking
Synthetic identities
Fragments of real PII stitched onto fabricated profiles. New SSNs with thick credit files within 18 months are suspicious.
Healthcare
Phantom billing in healthcare
Sustained CPT-code upgrades after a billing-vendor switch are the single highest-yield audit signal.
Corporate
Disclosure inflation
Backlog figures that grow faster than headcount, hiring, or warehouse space rarely survive an honest audit.
Red-flag checklist
If you see three or more of these, file a report.
- ▸ Round-number invoices between related parties
- ▸ Vendors with no verifiable physical address
- ▸ Sudden change of auditor mid-fiscal year
- ▸ Unexplained offshore subsidiaries
- ▸ Backdated contracts or amendments
- ▸ Pressure to bypass internal controls
- ▸ Discrepancies between bank and ledger balances
- ▸ Personal expenses routed through corporate accounts
Quick check
1. An auditor signs off on a crypto exchange's 'proof of reserves' but does not examine liabilities. What does this tell you?
2. A city procurement office awards 9 of its last 11 contracts to the same vendor, each just below the public-bid threshold. This is:
3. A whistleblower at a bank notices wire instructions being stripped of originator country. They should: