Scanguards Financial Fraud

The financial fraud at Scanguards is both a specific embezzlement scheme and the first visible trace of a larger theft. John Reardon manipulated the recorded value of company assets so he could dispose of them without the required oversight, then keep the difference between their scrap value and their true resale value. Delilah Sheridan’s forensic audit uncovered the method, but the effort to obstruct her investigation—and the encrypted transactions later found in the company’s system—made clear that the apparent scale of John’s theft did not explain everything.

Detection and the Audit

The investigation began when routine statistical reviews at Scanguards’ headquarters identified abnormal ratios between fixed assets and depreciation in the San Francisco branch. Rather than rely on an auditor familiar with the local staff, the company assigned an outside specialist with no prior connections there. Rotating auditors was understood as a safeguard: too much familiarity with the people being examined could compromise the independence of the review.

Delilah Sheridan specialized in forensic accounting rather than routine financial audits. She initially expected to find either incompetence or fraud, but the irregularities appeared methodical and seemed to have continued for nearly a year. One detail troubled her independently of the accounting ratios: records for the current and previous year had already been placed in storage, although companies generally retained documents for longer before archiving them. The early removal of those records made the paper trail harder to inspect and sharpened her suspicion that the accounting anomalies were deliberate.

The distinction between computer entries and original documents became central to her method. The electronic system showed who had entered a transaction, but not reliably who had initiated and approved it. Employees sometimes shared passwords despite company rules, so a user name attached to an entry could not by itself establish who had actually authorized the transaction. Delilah therefore sought original records to reconstruct the approval chain, not merely to identify the account under which a transaction appeared. Her report, once supported by those documents, could establish responsibility more securely than the system’s displayed credentials.

John Reardon's Asset Scheme

John eventually described the basic fraud as beginning with accounting entries that reduced equipment to scrap value. The practice exploited his authority to write off older assets worth less than $2,500 without obtaining an additional signoff from headquarters. By accelerating depreciation, he pushed assets below that threshold and used the resulting lower book value to bypass internal controls.

The write-off was only the first step. John transferred the assets to someone outside the company, who could sell them for their actual value. The company received the recorded scrap value, while John kept the difference. The scheme converted an ordinary accounting procedure—depreciation over an asset’s useful life—into a way to conceal value leaving the company. Its apparent simplicity depended on the gap between what the books said an item was worth and what a buyer would pay for it.

John’s explanation also supplied a personal pressure behind the theft. He said the scheme had helped after he and Karen bought a new house and the mortgage interest rate rose enough to make the payments difficult. He recognized that this did not justify stealing. The disclosed pressure helps explain his account of why he began, but it does not account for the subsequent threats or the broader activity surrounding the company’s records. He described his own taking as a comparatively small sum; the amount was not established as a final, audited total.

Obstruction and Escalating Risk

As the audit advanced, John understood that the original transaction documents could expose him. When Delilah asked whether the boxes had arrived from storage, he confirmed that they were at the loading dock and said he would have them brought up. He knew that once she reviewed the paperwork, she could identify him as the person defrauding the company. Her continued requests for supporting records thus marked a narrowing path from suspicious ratios to evidence tying transactions to an individual.

John had also hired his brother-in-law, Billy, to attack Delilah. Billy acknowledged that he had been paid, and the fact that the same attacker had gone after her twice made the violence difficult to dismiss as coincidence. John’s account to Billy presented his own bookkeeping fraud as the reason for wanting the auditor removed, although Billy considered that explanation insufficient grounds for an attack. John did not want Karen to learn what he had done, adding a private effort at concealment to the pressure around the audit.

The threat John faced came from someone else as well. After he began manipulating the books, an unidentified man contacted and blackmailed him, demanding access to Scanguards’ books in exchange for silence. John said he had never seen the man, did not know his name, and had spoken to him only by telephone. He kept asking no questions, believing that knowing less would be safer. The blackmailer then ordered him to get rid of Delilah and threatened to get rid of John if he failed. John suspected the unseen man was pursuing a much larger fraud and wanted access to the company’s systems through John’s login and password.

From Asset Write-Offs to Encrypted Transactions

Delilah’s findings made the difference between John’s method and the wider danger increasingly important. She estimated that accelerated depreciation and the resale of small assets might account for tens of thousands of dollars, perhaps even fifty or a hundred thousand, but treated such figures as possibilities rather than a confirmed loss. That level of theft, by itself, did not readily explain why someone would commission a potentially fatal attack or silence John before he could be questioned.

The company’s cash controls offered another point of comparison. Delilah had read the procedure manual and knew that cash transfers required two approvals, preventing John from moving money alone through that channel. The asset scheme, by contrast, exploited a low-value disposal threshold at which he could act without another headquarters signoff. The contrast showed how the design of internal controls shaped the form the fraud took: the easier route was not necessarily direct access to cash, but the deliberate reclassification and disposal of physical assets.

A further clue emerged when Amaury found encrypted data that John had uploaded to headquarters and asked Thomas, Scanguards’ information-technology specialist, to examine it. Later, transaction screens showed Thomas logged in and authorizing John Reardon’s encrypted transactions, with approval notices appearing across the display. Those screens established that the encrypted activity was still moving through company systems, but did not, on their own, explain who controlled it or what the transactions contained. They extended the investigation beyond the asset write-offs without resolving the identity or full purpose of the larger operation.

Significance of the Fraud

The fraud’s investigative force comes from the difference between visible evidence and actual responsibility. A ledger can show a value, an electronic record can display a user account, and a disposal form can bear an approval; none necessarily identifies who initiated or authorized the underlying action when employees share passwords or when transactions have been encrypted. Delilah’s insistence on originals and supporting documentation responds directly to that uncertainty, turning audit work into a reconstruction of agency as well as of money.

John’s scheme is therefore both a completed method of personal embezzlement and a misleadingly small explanation for the violence around the audit. His asset write-offs provide a concrete fraud that can be traced through thresholds, transfers, and resale values. The blackmail, the demand for system access, and the encrypted transactions point beyond it, while leaving the larger theft unresolved at this stage. The distinction keeps the investigation from mistaking the first person caught in the books for the only person exploiting them.